6109e72c382692c62e32882b58056f0b57539536d18e82467aebaab230fe2516

Analysis

max time kernel
363s
max time network
369s
platform
windows7_x64
resource
win7-20220812-es
resource tags

arch:x64arch:x86image:win7-20220812-eslocale:es-esos:windows7-x64systemwindows
submitted
30/10/2022, 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

loaris-setup.exe
Size

1.1MB
MD5

3557cbd1876ca6e2665c5b5282e1a871
SHA1

9ea8435f4be459f3dc2eb5908ac8e54936f5298b
SHA256

6109e72c382692c62e32882b58056f0b57539536d18e82467aebaab230fe2516
SHA512

c2d74a0803f622b490f366072e8479adcb0b284a67b8be5c67c91cce2544033e3c82d535a8e1e99817a53ef71783d429749190b2852fe7c1109e06ddf39c4cb2
SSDEEP

24576:QEKqgMrl/srreblmDFEYRNCnLlL/W2DNct:GSl/srKluEoQpL/WYNct

Score

8^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
1276	O68BQ690.exe
1700	O68BQ690.tmp
1172	ltr.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B884539-D34B-4F5B-B008-3A6F3B213E5C}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B884539-D34B-4F5B-B008-3A6F3B213E5C}\InprocServer32\ = "C:\\PROGRA~1\\LOARIS~1\\shellext.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B884539-D34B-4F5B-B008-3A6F3B213E5C}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1260-55-0x0000000000400000-0x0000000000824000-memory.dmp	upx
behavioral1/memory/1260-67-0x0000000000400000-0x0000000000824000-memory.dmp	upx
behavioral1/memory/1260-92-0x0000000000400000-0x0000000000824000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\Geo\Nation	ltr.exe

Loads dropped DLL 19 IoCs

pid	Process
1260	loaris-setup.exe
1276	O68BQ690.exe
1700	O68BQ690.tmp
1700	O68BQ690.tmp
1700	O68BQ690.tmp
1496	regsvr32.exe
1700	O68BQ690.tmp
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1172	ltr.exe
1172	ltr.exe
1172	ltr.exe
1172	ltr.exe
1172	ltr.exe
1228	Process not Found
1172	ltr.exe
1172	ltr.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	ltr.exe
File opened (read-only)	\??\e:	ltr.exe
File opened (read-only)	\??\f:	ltr.exe
File opened (read-only)	\??\i:	ltr.exe
File opened (read-only)	\??\k:	ltr.exe
File opened (read-only)	\??\l:	ltr.exe
File opened (read-only)	\??\m:	ltr.exe
File opened (read-only)	\??\h:	ltr.exe
File opened (read-only)	\??\j:	ltr.exe
File opened (read-only)	\??\n:	ltr.exe
File opened (read-only)	\??\r:	ltr.exe
File opened (read-only)	\??\t:	ltr.exe
File opened (read-only)	\??\v:	ltr.exe
File opened (read-only)	\??\b:	ltr.exe
File opened (read-only)	\??\p:	ltr.exe
File opened (read-only)	\??\u:	ltr.exe
File opened (read-only)	\??\x:	ltr.exe
File opened (read-only)	\??\y:	ltr.exe
File opened (read-only)	\??\g:	ltr.exe
File opened (read-only)	\??\o:	ltr.exe
File opened (read-only)	\??\q:	ltr.exe
File opened (read-only)	\??\s:	ltr.exe
File opened (read-only)	\??\w:	ltr.exe
File opened (read-only)	\??\z:	ltr.exe

Drops file in Program Files directory 36 IoCs

description	ioc	Process
File created	C:\Program Files\Loaris Trojan Remover\is-JNUN2.tmp	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\Lang\is-4IOBL.tmp	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\Lang\is-G10OU.tmp	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\Lang\is-L1EAV.tmp	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\Lang\is-5JTQR.tmp	O68BQ690.tmp
File opened for modification	C:\Program Files\Loaris Trojan Remover\shellext.dll	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\Lang\is-KD36R.tmp	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\Lang\is-T8V4F.tmp	O68BQ690.tmp
File opened for modification	C:\Program Files\Loaris Trojan Remover\ssleay32.dll	O68BQ690.tmp
File opened for modification	C:\Program Files\Loaris Trojan Remover\7z.dll	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\Lang\is-MA6V6.tmp	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\Lang\is-MVGRD.tmp	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\is-TNSG8.tmp	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\unins000.msg	O68BQ690.tmp
File opened for modification	C:\Program Files\Loaris Trojan Remover\ltr.exe	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\unins000.dat	O68BQ690.tmp
File opened for modification	C:\Program Files\Loaris Trojan Remover\libmem.dll	O68BQ690.tmp
File opened for modification	C:\Program Files\Loaris Trojan Remover\offreg.dll	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\Lang\is-V2O8M.tmp	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\Lang\is-0C2UI.tmp	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\Lang\is-VQHQA.tmp	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\is-TPSJV.tmp	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\Lang\is-MOVT6.tmp	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\Lang\is-BDRDN.tmp	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\Lang\is-TVDUF.tmp	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\is-FAD9N.tmp	O68BQ690.tmp
File opened for modification	C:\Program Files\Loaris Trojan Remover\unins000.dat	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\is-OEPCO.tmp	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\is-75H6E.tmp	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\Lang\is-V6ARD.tmp	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\is-12CO5.tmp	O68BQ690.tmp
File opened for modification	C:\Program Files\Loaris Trojan Remover\trojanremover.chm	O68BQ690.tmp
File opened for modification	C:\Program Files\Loaris Trojan Remover\libeay32.dll	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\is-S37UV.tmp	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\Lang\is-QEM1E.tmp	O68BQ690.tmp
File created	C:\Program Files\Loaris Trojan Remover\is-P9R3T.tmp	O68BQ690.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	loaris-setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	loaris-setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ltr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ltr.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
696	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 56 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\avangate.com\Total = "41"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	ltr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\secure.avangate.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\avangate.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\avangate.com\Total = "136"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\avangate.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\secure.avangate.com\ = "159"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30a66bb0aaecd801	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c00000000020000000000106600000001000020000000886aea6e1e61861d0abf63682271b1493f649fbdbdc1ddc1505291efcc31b356000000000e8000000002000020000000e3b078d7fecb6dd4a305b5433eeaec4939f33aaf528a8fba099fdcfe44ce2c33900000004c0036b01e5ade0f60b0eaa83fdcfbd86172c481a8c7b879832f0c88ef90ebbf0d06b09d39a3daa11b03e064816ff5868f2580e69314e8fafea4d77b68316dc48232540907e06324197a4519f198a35984055f5a0c8a99dee27dab8e7896776fd68bea2c319e4142903ca6a1014781db5c464df3d06816d6a628ea2a4d47ddd0edefaad5bdc338aa67ff8d609cab7bd240000000e097ab629eb99d08d9d2b49423d2eb0db609fcf6aec9dc791b1bff012dc846689fa438b7a6a38fcdb0f6fdde512adf18ccbe4dcab5f97af8f81cc354fec94a2c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\es-ES = "es-ES.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373931988"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\avangate.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\secure.avangate.com	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c000000000200000000001066000000010000200000003237950729020fab6ecb5b060fc6c08a82a53e46cca9e878f12dd023642a8776000000000e80000000020000200000005fdb191d04ecc728d2d3c0b9bf0e3991683f7a1f3526741ef6cc89e8271be574200000002c3f11f62139735187f07eca987c08e6fcf0eb7bc136afff793f32d4cf326db6400000004fb9d58b6c7a66f80dd7778d7f28848337cd242013f9c5ddf1eeac292250d339748488dacbf78a4c7406bca766b1eb6dbc64a079eb29e3e0639da4308b08fbf5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\secure.avangate.com\ = "136"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\secure.avangate.com\ = "41"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\avangate.com\Total = "159"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1A2E7B1-589D-11ED-9243-66C13449FA90} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "41"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "136"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "159"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-18_tmp_tlh	ltr.exe
Key created	\REGISTRY\USER\S-1-5-19_tmp_tlh	ltr.exe
Key created	\REGISTRY\USER\S-1-5-20_tmp_tlh	ltr.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\shellext.Loaris Trojan Remover	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\shellext.Loaris Trojan Remover\ = "Loaris Trojan Remover"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\shellext.Loaris Trojan Remover\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B884539-D34B-4F5B-B008-3A6F3B213E5C}\ProgID\ = "shellext.Loaris Trojan Remover"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B884539-D34B-4F5B-B008-3A6F3B213E5C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B884539-D34B-4F5B-B008-3A6F3B213E5C}\ = "Loaris Trojan Remover"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B884539-D34B-4F5B-B008-3A6F3B213E5C}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B884539-D34B-4F5B-B008-3A6F3B213E5C}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\ShellEx\ContextMenuHandlers\Loaris Trojan Remover	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\44F9F8A6CA62F7E1882AC8326552BE79	ltr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\F3719E42DDC32453857FEF615228A497	ltr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\F3719E42DDC32453857FEF615228A497\ = "jj0aj"	ltr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B884539-D34B-4F5B-B008-3A6F3B213E5C}\InprocServer32\ = "C:\\PROGRA~1\\LOARIS~1\\shellext.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\Loaris Trojan Remover\ = "{4B884539-D34B-4F5B-B008-3A6F3B213E5C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\Loaris Trojan Remover	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B884539-D34B-4F5B-B008-3A6F3B213E5C}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Loaris Trojan Remover\ = "{4B884539-D34B-4F5B-B008-3A6F3B213E5C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\ShellEx\ContextMenuHandlers\Loaris Trojan Remover	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Loaris Trojan Remover\ = "{4B884539-D34B-4F5B-B008-3A6F3B213E5C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\shellext.Loaris Trojan Remover\Clsid\ = "{4B884539-D34B-4F5B-B008-3A6F3B213E5C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\ShellEx\ContextMenuHandlers\Loaris Trojan Remover	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Loaris Trojan Remover\ = "{4B884539-D34B-4F5B-B008-3A6F3B213E5C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\44F9F8A6CA62F7E1882AC8326552BE79\ = "PPA-P"	ltr.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	ltr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	ltr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	ltr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	ltr.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1700	O68BQ690.tmp
1700	O68BQ690.tmp
1172	ltr.exe
1172	ltr.exe
1172	ltr.exe
1172	ltr.exe
1172	ltr.exe
1172	ltr.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	696	taskkill.exe
Token: SeDebugPrivilege	1172	ltr.exe
Token: SeDebugPrivilege	1172	ltr.exe
Token: SeBackupPrivilege	1172	ltr.exe
Token: SeRestorePrivilege	1172	ltr.exe
Token: 33	648	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	648	AUDIODG.EXE
Token: 33	648	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	648	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1260	loaris-setup.exe
1700	O68BQ690.tmp
1172	ltr.exe
1172	ltr.exe
1480	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1260	loaris-setup.exe
1172	ltr.exe
1172	ltr.exe
1172	ltr.exe
1480	iexplore.exe
1480	iexplore.exe
1396	IEXPLORE.EXE
1396	IEXPLORE.EXE
1396	IEXPLORE.EXE
1396	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 1276	1260	loaris-setup.exe	27
PID 1260 wrote to memory of 1276	1260	loaris-setup.exe	27
PID 1260 wrote to memory of 1276	1260	loaris-setup.exe	27
PID 1260 wrote to memory of 1276	1260	loaris-setup.exe	27
PID 1260 wrote to memory of 1276	1260	loaris-setup.exe	27
PID 1260 wrote to memory of 1276	1260	loaris-setup.exe	27
PID 1260 wrote to memory of 1276	1260	loaris-setup.exe	27
PID 1276 wrote to memory of 1700	1276	O68BQ690.exe	28
PID 1276 wrote to memory of 1700	1276	O68BQ690.exe	28
PID 1276 wrote to memory of 1700	1276	O68BQ690.exe	28
PID 1276 wrote to memory of 1700	1276	O68BQ690.exe	28
PID 1276 wrote to memory of 1700	1276	O68BQ690.exe	28
PID 1276 wrote to memory of 1700	1276	O68BQ690.exe	28
PID 1276 wrote to memory of 1700	1276	O68BQ690.exe	28
PID 1700 wrote to memory of 696	1700	O68BQ690.tmp	29
PID 1700 wrote to memory of 696	1700	O68BQ690.tmp	29
PID 1700 wrote to memory of 696	1700	O68BQ690.tmp	29
PID 1700 wrote to memory of 696	1700	O68BQ690.tmp	29
PID 1700 wrote to memory of 1496	1700	O68BQ690.tmp	32
PID 1700 wrote to memory of 1496	1700	O68BQ690.tmp	32
PID 1700 wrote to memory of 1496	1700	O68BQ690.tmp	32
PID 1700 wrote to memory of 1496	1700	O68BQ690.tmp	32
PID 1700 wrote to memory of 1496	1700	O68BQ690.tmp	32
PID 1700 wrote to memory of 1496	1700	O68BQ690.tmp	32
PID 1700 wrote to memory of 1496	1700	O68BQ690.tmp	32
PID 1260 wrote to memory of 1172	1260	loaris-setup.exe	34
PID 1260 wrote to memory of 1172	1260	loaris-setup.exe	34
PID 1260 wrote to memory of 1172	1260	loaris-setup.exe	34
PID 1260 wrote to memory of 1172	1260	loaris-setup.exe	34
PID 1480 wrote to memory of 1396	1480	iexplore.exe	38
PID 1480 wrote to memory of 1396	1480	iexplore.exe	38
PID 1480 wrote to memory of 1396	1480	iexplore.exe	38
PID 1480 wrote to memory of 1396	1480	iexplore.exe	38

C:\Users\Admin\AppData\Local\Temp\loaris-setup.exe
"C:\Users\Admin\AppData\Local\Temp\loaris-setup.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Temp\O68BQ690.exe
  C:\Users\Admin\AppData\Local\Temp\O68BQ690.exe /SAVEINF="C:\Users\Admin\AppData\Local\Temp\2Ie8R1T1.I4n" /verysilent
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Users\Admin\AppData\Local\Temp\is-15F61.tmp\O68BQ690.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-15F61.tmp\O68BQ690.tmp" /SL5="$1016A,93976550,356352,C:\Users\Admin\AppData\Local\Temp\O68BQ690.exe" /SAVEINF="C:\Users\Admin\AppData\Local\Temp\2Ie8R1T1.I4n" /verysilent
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1700
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im ltr.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:696
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Loaris Trojan Remover\shellext.dll"
      4⤵
      Registers COM server for autorun
      Loads dropped DLL
      Modifies registry class
      PID:1496
- C:\Program Files\Loaris Trojan Remover\ltr.exe
  "C:\Program Files\Loaris Trojan Remover\ltr.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  - Enumerates connected drives
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1172

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x468
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:648

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://secure.avangate.com/order/checkout.php?PRODS=4718603&QTY=1&BACK_REF=https%3A%2F%2Floaris.com%2Fthanks%2F&CART=1&CARD=2&CLEAN_CART=1
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1480 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Loaris Trojan Remover\7z.dll

Filesize
1.5MB

MD5
39cbc5a8d95482360d24b372e2af6e0b

SHA1
efd6271a32f35a5e97b0592a88ef701d8033fe41

SHA256
90958537ea7f8afd8369d4902145277c61d23ad411feea71168c0b3e2b96d2a8

SHA512
682efb6f932e4aab6ce81c1461d7345ffb7fca0788d07418356e2ceb7bbc92307b4b9165547ca42223a68cfb366152187ef161d305735a15f6fd6842c5b1af53

Download Submit
C:\Program Files\Loaris Trojan Remover\lang\arabic.lng

Filesize
36KB

MD5
496a50e36b9069052279157251167f0c

SHA1
d17d5b4471702cf98104c202957da788b7cd7d51

SHA256
ec71316fcd683e9d9525e933e026678f072a7ed933af58cd6e06e58ce96b165b

SHA512
dbac2612db78e4637351e0a0e315401aa2af7b8a15bf5d506356ec75ddc66a5b25bf775c9e82e3e64b9a32f42ce99c3778feb80297166429baede40ce7db20b7

Download Submit
C:\Program Files\Loaris Trojan Remover\lang\chinese (Simplified).lng

Filesize
22KB

MD5
78fb791e6bd25dbfa0b41b6307268293

SHA1
1d8895f6fe938f084c52700afd4886f87dd93dcc

SHA256
3e45f72bcdd83d040750e0258dd7cf5a01bce88667fdb80d9f7e3db4e2aed91a

SHA512
5476ef0a4958c115de9973e77a5ee2d371e35e365e8e98d7189b44d78e35dd4283737bcfce97f4895d4e1f7cce01b034fc60ef7b68f7825b71e003dec2db1076

Download Submit
C:\Program Files\Loaris Trojan Remover\lang\chinese (Traditional).lng

Filesize
22KB

MD5
dd755516035b893836e0f19681ffd2b7

SHA1
ceb9b1b94123f8ea03030d44593dd816fd4b37ff

SHA256
522c9e1f2c14816f47246264dd6f24df2e9e53119cbc2e6be8fdaffc5a369fa4

SHA512
58f8e4e7ea59f2aa2462588fdb7278295b340edd06a9d3d1b582262d179b2e8ef877648f191277ca18d960c2ed10fec8e8f8b38cdd1e52cc23bcb72434500a6d

Download Submit
C:\Program Files\Loaris Trojan Remover\lang\dutch.lng

Filesize
26KB

MD5
bbf577ac0b0c0dbb4af6c44af182b1a9

SHA1
b07cbffa16ff3cdabc822f27bab91d05398948fe

SHA256
272c33f7fc1933b6fe8cc9df61ca05b46ff61db5642180f4b0426170baa4d2b5

SHA512
647d9f2b65aa2fb2c786bd44ccc96ec14036bb8a8c2df91c1a92547bf42190f595fddf9e680d9ee8fea0d1f70b2d277706e6a9e5bcf39f7bef65e24e3eba3d81

Download Submit
C:\Program Files\Loaris Trojan Remover\lang\english.lng

Filesize
24KB

MD5
2443df6c0554e62e7dae584a56229316

SHA1
c110c4451f9fc20c34f207a444865d01ba93766a

SHA256
334b7f1af358d1914daf3546c0a8f5064f4d0a07ee58eab8f9b9b24c4de8e996

SHA512
8eef8c4b1fdbdb0108511437b74abf7e8888f794efe009e2d4b635c3da800dbd217766208db843934ba44cae250e4bd3a1c5a956485bf51f0c160a4d246bc75a

Download Submit
C:\Program Files\Loaris Trojan Remover\lang\german.lng

Filesize
26KB

MD5
247d5572a74b58e22084e1c0fdea9740

SHA1
8779e4b2ed9f30542c243e07a175a0753b362e61

SHA256
2d29e295f1fc71e8c888b1ee79595347f7c5913b59f0cd08b480adfa445e243c

SHA512
b5c0c047fc9f0c218a12d202728bbb947f22a3be8c0afa0c35ba1bf2f27799aa0a9f445e9e565e59589f4ce894a0c4a0ac96fa8747fa134d06bd3ef8546ca908

Download Submit
C:\Program Files\Loaris Trojan Remover\lang\hungarian.lng

Filesize
27KB

MD5
a6a9b2f97d2536dc94bbde44cb1a5cc1

SHA1
1967e71334c8f149deb13ff09138019b9e4805b1

SHA256
2cfafaaad1d47de158d8cb4d594ecaacf036bc189acbc83f563679ccae03dc24

SHA512
4452351255b99695a958381c682b992c02806c441ed3ee1ae0e654df137c348ddec336f7403a2002c1fe9a6ed594f0aba7412a4acce4e1ab5052e5de61512a1f

Download Submit
C:\Program Files\Loaris Trojan Remover\lang\indonesian.lng

Filesize
25KB

MD5
8135a48da3350ede8b0981fbf46559d8

SHA1
ce6a3cdb1fc98cbe41fd4816ca8c08a4e718bd65

SHA256
666c8f321f298d418312bd54332930b3e072b50dd1d72edf62f37e6a6f30ffb2

SHA512
8361688d9a68af79ebad5fbab79afeee2cad5583aa5ca87db5c3c50c5b2b5c4d10da3da21172e4e7b2ead7221a6df5dac0de65392b808a885da900e07943d086

Download Submit
C:\Program Files\Loaris Trojan Remover\lang\italian.lng

Filesize
25KB

MD5
b38c183f889ca5c28960b30dbe0f42d7

SHA1
f28de53270cd7eb3129a8f6e0b64a11ba563f267

SHA256
df65ae2e80180c9952538500666e85834574b94d0271f8a2280ce1181451ddce

SHA512
5a6a0eaab9cf749e4c26fdfffc1d45810ea138f6a9d06b3a98d6f47b037c5fb94e4e6b95fdfa9b0e8358e9115331856e4fb4361be05cbe2d77345cd11c7eeffa

Download Submit
C:\Program Files\Loaris Trojan Remover\lang\persian.lng

Filesize
36KB

MD5
4712d74f1644aea72be1a07dcc9cc5e5

SHA1
8a1c90d7e82dc4665cd9280d549889505c9c8cc3

SHA256
947d73cba2d6be96b40353f5d5a2a8ff4ad12f905be26dbf24efec030e4426aa

SHA512
0dfb8d141a3c197b8b060cf2d391012ab627021007b23df7f8a56d3acbdaf645ce02a607d190f902eb0cccd7e44b009a0387ab34145cb799e28a7bfe5e7b0006

Download Submit
C:\Program Files\Loaris Trojan Remover\lang\polish.lng

Filesize
26KB

MD5
81c6f5d706b70c44274580e3b6acd386

SHA1
d6b93bf41b37d8926bf7a50683d375e4d67702bd

SHA256
776ba60ea7d6e23bf6e49a8853cbfa2f945f4343290d6641f7f8427e7325e096

SHA512
6bb36dc0446186db3842bb11e38a34aa931b74916fee6ce89507a7acecf67db87653da1b4910c25084059de9029f846e7a13321cecd37289748087db832c43b7

Download Submit
C:\Program Files\Loaris Trojan Remover\lang\portuguese (brazilian).lng

Filesize
27KB

MD5
28d9722892f54cb2400ad8c6c1808e2f

SHA1
58dbc66978ba3056791d94ceb2ee39ad2b5d4f92

SHA256
375639c7763f3cb75d8c62341814d56a183cff7c5894b42a89f344ed69b97f62

SHA512
e751bc43880da90390554162777c76ae0d945977faeef79c14bb02ca114f8dc108a61789763066a7fed82f112df46237f8b6ce191e5832b9abcda55295dc10c2

Download Submit
C:\Program Files\Loaris Trojan Remover\lang\russian.lng

Filesize
39KB

MD5
1bd5932364eba12621a6dd6b0403f4df

SHA1
92a08db0a11b824345dd8ba5cb157dc00a8c6c87

SHA256
b1519bc19022b8e2681668f83b2e930c4f15817565ded6d96e97b76bfa97ba78

SHA512
1712cf5bd74e98c4b089849b0c034e833861d289228862ba91f9a58064a1a6d4f6cac2b48a3444213c1b1c74ea2f3cf5759ccf5731a49471084f3b80accbb8f6

Download Submit
C:\Program Files\Loaris Trojan Remover\lang\thai.lng

Filesize
50KB

MD5
a778425f0bad4a069c4e19907211fa60

SHA1
2c03d727127050d70ba9f72c2c30afa2f273f653

SHA256
12744e1bffddaca2446f8fe62c1fea09a9f08fe45e5717451303523a1d38a9d4

SHA512
b37f387997b307b2e6607c69cc2d6ac2873045ba93f40c2e3f59fdff49276c3dfbacfb24a8077ee63bc3b24535c2421f759648d5b6d30b22ea9043fceeafc766

Download Submit
C:\Program Files\Loaris Trojan Remover\lang\turkish.lng

Filesize
28KB

MD5
8839028d0f2e2e84b17b5f7a9a2fa576

SHA1
fa404f47b63ef0b9fe3bb3b5b5fbab6218a7de94

SHA256
aaefb38c245782aee418eb409d4953456b81e221762b3c396ae0ef13a036781e

SHA512
ae3f38e77643b74a2c2aba008c6b9e3055afc7f11a46eb53ad9c500b6e506732b2be0f118d061e7cb5b7c4112f391af9aaa10979444810f5ade9e043c8d9b61c

Download Submit
C:\Program Files\Loaris Trojan Remover\lang\ukrainian.lng

Filesize
38KB

MD5
6bde4b2a3c841fa5ddda47f717c9eceb

SHA1
77ab38a3a7d3b618d7c313afbbae5fd0434a08de

SHA256
c5338b17676504f331814c2f0f1610e54a818ee58d39e7c6775f0e1d176a91ff

SHA512
1d3a5ca4b87399ca496e3a9a264cbe19b4eb7dacbdbad7f96fc6de7ef8272f75e2e6ae70048512f387ccd49765c04984981957a4351480bdb3452155e369b5f6

Download Submit
C:\Program Files\Loaris Trojan Remover\libeay32.dll

Filesize
2.2MB

MD5
a1e976686bb8e633a680c728aeb8b29f

SHA1
fce1b2cccf5d8e6bc7d523adbc706781646d73fb

SHA256
267572917b1f890cd228479463b30d1b9df2c2517968807687de670fb3a4a4c3

SHA512
a270d8a0cc450e7e32bca87f6dd9d65cea5cc45822e99731971f0a2a835f5ee969e1b13586be70dee14959d008b477b0a3c10b0ef7a6e6abf971db827924992f

Download Submit
C:\Program Files\Loaris Trojan Remover\libmem.dll

Filesize
255KB

MD5
9d18928d7d60d4648857f520ecad1c7a

SHA1
0df7859d924f62b0e8d36d73745efd399c4b680b

SHA256
d61f8575217e190c6ce6e8412ca5b1b62e0522d39efdb2dad6ee710ec1c1749f

SHA512
127fd6a9513f8ab74691732c97be703af300d9874bdddd7f88d94afedd4d43c3ed67819938684c9786145ebc8f2cee655fb9edb96e5a7e8e5aded0308b3d21b0

Download Submit
C:\Program Files\Loaris Trojan Remover\ltr.exe

Filesize
18.2MB

MD5
fcc4d5d1994f9cc9e001e75676b47c8b

SHA1
99618969fa3cbccfa6d2c50dc10e148265f7d248

SHA256
226047e711b58baea775fe0f9d69c48f40c698fe656ec0f226dd0924e742bf11

SHA512
d3a955e4b78877f1b3ba11fc3827142e37ecc4fe04d5049bd5dd67903f7bb4cb723ba75079b2b535c0a80e7ab4938a194c6969d2d4fdae06bc148c18a494f933

Download Submit
C:\Program Files\Loaris Trojan Remover\ltr.exe

Filesize
18.2MB

MD5
fcc4d5d1994f9cc9e001e75676b47c8b

SHA1
99618969fa3cbccfa6d2c50dc10e148265f7d248

SHA256
226047e711b58baea775fe0f9d69c48f40c698fe656ec0f226dd0924e742bf11

SHA512
d3a955e4b78877f1b3ba11fc3827142e37ecc4fe04d5049bd5dd67903f7bb4cb723ba75079b2b535c0a80e7ab4938a194c6969d2d4fdae06bc148c18a494f933

Download Submit
C:\Program Files\Loaris Trojan Remover\offreg.dll

Filesize
74KB

MD5
1eab65173f446a3e116556ce53c7717d

SHA1
3781bf5a8407d7adae6bda741322c13e4e124588

SHA256
54ce76e23156bdb9873014f9da22c023339ee3f1e5a3b7d70c1a9e1016865a50

SHA512
c98f92ac82ab90dd4121860a967a986d07ef848f8d9aa3a5c107857aa78bdb2c82fd62b4731e18dffd6b1267d0e9ddaa940273611158f28fb9aeca74d8b1c415

Download Submit
C:\Program Files\Loaris Trojan Remover\shellext.dll

Filesize
1.9MB

MD5
87297a02728a7b4fe84c0522224137ef

SHA1
cf7676ec53b3a0b6008542b7efe007a30c4e1776

SHA256
ee78762c4c34245d57e088d955624c0819c6715717adbf965a96f095a4fb2c85

SHA512
84c3f1c21c8fc77693b03833d53eaa1a358f81fe91b88f32bc13961ac688b54ff95758ab09d0a23b338bed85bee35620943b4a271db142e565dd1e3d9f02b9ad

Download Submit
C:\ProgramData\Loaris\Trojan Remover\database\nfd.c

Filesize
36KB

MD5
cd73adaab4d1d62155fb270c6c6fde6e

SHA1
10045d02e3f62fd681f03bba4dee0477b979f9da

SHA256
05dd6b217577dac20f3df62bc1b830f54fbf0c8e35abccb87b2ed0dd9b59ce2a

SHA512
2a1616ede352fbc5dcf416546e112fe69136b89976ccbeb4312a2d7e69ea2d42dcd850c892d6ae4f3009e035c44a5458577238224a337545655416c2d7da73e8

Download Submit
C:\ProgramData\Loaris\Trojan Remover\database\nfs.c

Filesize
1.9MB

MD5
adb0a4b5c31ee2bbd0e5549f2bbaf246

SHA1
7553c903b904757c9c3927ebaef6411ee9e83bd5

SHA256
df46527f40502e56a00ea76aba7d7601dc5d9e9c9dc9c43517a45eb6900355e0

SHA512
7dc2d18f94bb0c0ae03687470939843426b29d84f78ff878e4f0b8a63bb4190195d6f770ea280ba3f6340729f880763af41616bcd662c73a838bc9dcb9d8746c

Download Submit
C:\ProgramData\Loaris\Trojan Remover\database\upd001.c

Filesize
613KB

MD5
926e0c9105f99738e6ec2a89c7153891

SHA1
caa333a0f317a7fe791141aedced58e34fa07990

SHA256
e38428caea9689c9944f61359a2e2be42c07d3284579dc38dede7ac721ec6a60

SHA512
1062154e8ca7651d9845979fca33d1980347af82bb7a6ad43cd996172061d9f477df244bb5413cf37f80efc039499e8c662b28d3268c39c965568d8fa30a5ee2

Download Submit
C:\ProgramData\Loaris\Trojan Remover\database\upd002.c

Filesize
14KB

MD5
47cea900c7cfa2b841cc3a667a639c0c

SHA1
8be6e4ce2ce963b785b5583253f86a9bd848164d

SHA256
241359241b322bd2d9ad6a5546b478789f116966c377473e433811e35016e082

SHA512
d4181e6b60f5fe5db836102e11a5df104d62402d66fad723e02da2977c5168ae60b47af7ef18a8fba3f4544ea757dcab288ab6539e68a94953d49fddbfa16ad5

Download Submit
C:\ProgramData\Loaris\Trojan Remover\database\upd003.c

Filesize
18KB

MD5
c76dda34470338bcb4aa1c2052e03287

SHA1
d8b7f1043ce67fab933e21b265e0b16be72db9c8

SHA256
db87cd11ddabcaabf335cc11647620e5b59298034fec0c7efd01a4fb55a6044c

SHA512
827dbfbab743c7e365f57f49ec4715018b04c231b90ad948d712427c51bb654c43ee04beb10264457ed1dc348ef7bb85a77c5b018c79be8d3c5265753950008b

Download Submit
C:\ProgramData\Loaris\Trojan Remover\database\upd006.c

Filesize
49KB

MD5
a2de49c9cce08dce233d168d6e8b00ad

SHA1
7ded3186212e7446e0cf94cdedcb562ba68fd6d1

SHA256
c6c31b302ec62d221b6237df3ddfd0654cb939fd1c6c0b8c1400197cf189484a

SHA512
e1fea14bd2715cd8d1747da1870939de8bae7f995850460195b52c3687391244c5bfa63dbb40c3594d86fe946acf5c93d01c108dcb88a944528945c3a471a161

Download Submit
C:\ProgramData\Loaris\Trojan Remover\database\upd007.c

Filesize
23KB

MD5
963dac9666d97be797ceea7e1d59e1d1

SHA1
3697e535a132d8d8df380131b3203d618f90cc90

SHA256
4b32ec845358bca987544317c33ee6b51d1e86d62681947f0707422db7f15c62

SHA512
b44c4a1267a87b280176087eb6670a42c2eda7d66f6cffcfe4ea4115cda15106f6e95ad695fcb6bbdb946f49c8f1308ec5593f4da333b81a575bbdc0713ba460

Download Submit
C:\ProgramData\Loaris\Trojan Remover\database\upd008.c

Filesize
917KB

MD5
4934d1745147cf36feee69e26aa076c1

SHA1
0e9ba29f066a092994984bd7e1e3bf1b023fd976

SHA256
0157dcb350eb8c04822a28b20a0a1eb96a591830efb22ae294dcb9a1437eb447

SHA512
0e89f7786de76b3d816550fcc4615bd5774c3b43eac545169ff9dc308777073fb7dca80f7627f765ffe24a5a810ab783ca7ace9438d5dbd0fdf693a99a940a47

Download Submit
C:\ProgramData\Loaris\Trojan Remover\database\upd009.c

Filesize
106KB

MD5
b7dac0b7e27db7b01db9a6136b0760f6

SHA1
e02c62fea17dcbea2c618107605e7f13b758e780

SHA256
ee0fa6150b98e96d1640a08b25bcc7e7c29800d3d05e8798671367aae474b658

SHA512
a17ac5c77c91fc79b9ec8a67a2f4cf4c7205121fd1f043fd1ed357f9876f346262c013f80aea5eb56f08a74abf655fdc2b3b5e45cc1d8a0a87eba8722331ae4b

Download Submit
C:\ProgramData\Loaris\Trojan Remover\database\upd00A.c

Filesize
405KB

MD5
c03c64d1047700efaa3a6a5abd7f1c97

SHA1
b4c0729077a0a219af17a2a63c1e32d42769c8f4

SHA256
829ab23d119ed119ca311913d59e67ee533593895a11cf6a197b21850bd88a93

SHA512
4821d9d5d3b61acd88ef14119b91b50b4a658451dc57b5cf7595e7c1b8ac606d0a1d02a89f7e7d7b976312f1b4337994ee660435b589a70bcc46f11d6b507c08

Download Submit
C:\ProgramData\Loaris\Trojan Remover\database\upd00D.c

Filesize
103KB

MD5
9554098efc9f159b45017202db70aa89

SHA1
83157550e4acc97932fb346c8d22216703b36c75

SHA256
cb748b0b72997cbcd4e9bc75177fbb90c70d389560c218baa426c3817659948c

SHA512
550464caddf7f55586ef2bed24eb02b68b71862ec1356a486690944c31f63af285b95c2fb03ed214ee305146986e0b53400f17cea63a81aaeb30fc9d22f5e1b4

Download Submit
C:\ProgramData\Loaris\Trojan Remover\database\upd00E.c

Filesize
47KB

MD5
3cc189addea5a20f82fc4806056d1a5c

SHA1
d2b080b69439993a1f144d20bab8c9e32b2b142c

SHA256
78d3f75fad41050bda660b6cbf21233b318341bd7cdd024aba8783fb5836d1e5

SHA512
25d37dc1d422371e1b41bfb26b8af04c61c36a7c1b318a3a6c7360bb5fbb6a0e16eec30973313b90f16ddeb070d88819b146ce8aa67552ab19b7b60cf222d607

Download Submit
C:\ProgramData\Loaris\Trojan Remover\database\upd00F.c

Filesize
28KB

MD5
fea296ea3a80f4b6033aa69597d43a40

SHA1
ee5981c2c31d6a6721ede7cddb9315f137a3605c

SHA256
aa84567a5fdbce5969a006fa0e8a4e24e97e179f07df40b543f9f3ead93d1578

SHA512
f2f50e3c9fb40962ad19b506263dd8b7a7e447cb8b3446ee46cb23f9f95fc4ace77c11935035d444d8350062a814f43b945c5b5b9349ae30116cfa1c0f9f3618

Download Submit
C:\ProgramData\Loaris\Trojan Remover\database\upd010.c

Filesize
3KB

MD5
de2f6ac3acde495b21fcb1cfc836c13e

SHA1
116ff988ba3df8869df287f5bbe665a17e28cab3

SHA256
ddbbad04a714c3b7e327bd944bd8986f30e42eff35d727f7b01a0c98645493e0

SHA512
fd5c5dc46ee47d46e607c314ee27953937c93de430a0eaeef9a79a93ca85d0ae4d88f6fdb4e809732b559d8a76d196fbbe004ea47d4a998279d74e2cae2d325d

Download Submit
C:\ProgramData\Loaris\Trojan Remover\database\upd011.c

Filesize
75KB

MD5
9308e80895454ebb13db4924640cc1bc

SHA1
e4efb7a0403ba42e42358de4896a36cd02972d46

SHA256
269c0a483fd6b38c627d5975f31a042e5dff88a4ba2c4c219f9db3a1446c4325

SHA512
4f9f376b34b55484231873f9c22b6af3efaab192f1f79a04cd75f23a6d27d2703053deab98a0c63148ea9682b28558ab9cd2dfaa52b887254e13f70ea88d1d14

Download Submit
C:\ProgramData\Loaris\Trojan Remover\database\upd013.c

Filesize
151KB

MD5
ca72061d9c36b655f6099219d88e25d3

SHA1
c0f99702594256de5e4f9f265d2f259d18d210a8

SHA256
cb632cb470818500e9e9f743fdcb85d6629c5c6722b839823587a234f86d0325

SHA512
e07b2e61dcd94738d5d4a88b7f3164fd10c0ab325c48749d881410feb5e7421eff410f2b8cba9d97d40fb9633360703fe42566014a0f7becbabb685d22df07ac

Download Submit
C:\ProgramData\Loaris\Trojan Remover\database\upd101.c

Filesize
7.4MB

MD5
73aaabe0363e57c915a213b24e73fc5a

SHA1
ddfeaffac7632d9103a6b27783d1cc9369664af8

SHA256
3e68aa3b9a56b46959108bb24b2b6c2ceaed407a4aa7d143d21562dfc17027b8

SHA512
89bb1569de4ce7c8b29b98ac963d45e852f378c3767f877ce0f4549d8d7ee7db0091de924a7e353f051b6d316222efadb66e2e25c714804825e803c8d4e84e01

Download Submit
C:\ProgramData\Loaris\Trojan Remover\database\upd102.c

Filesize
20.5MB

MD5
cdf2b4285968c9617131e6f8844ed776

SHA1
8ec61a7119fb7dbf4c23a5672387bf8e7115dd88

SHA256
40da10254073539dc7355884297c1d373df96632ba8885ec23499abe092b305b

SHA512
ecc154b5b0530599c2ff6f362bcb0ac9bc072fc1531dc66823c8ee73a6667a80bb40b63bd6ff3b43352f174fd19a7dc4df364a54006ceedec771afad3877852a

Download Submit
C:\ProgramData\Loaris\Trojan Remover\database\upd104.c

Filesize
825KB

MD5
174b57867446877a04af6fe07d6c665c

SHA1
4b3331d1de1c81b27634ce357011cda3157e4014

SHA256
96b7043d090de9eb0333a12fc500e6e39852ca20cfde54ec5bb352e2f92d9b6b

SHA512
20ead592d0c6c5509fdb45dfad3fbee0c57bc5161f8eff7158323542b704892d4a3c8dfeeff9479028afe8088db3b87134141c25bd2331be109a6e12b9277451

Download Submit
C:\ProgramData\Loaris\Trojan Remover\database\upd10F.c

Filesize
40.7MB

MD5
9796097368acd59f5e081f4dcb17d19b

SHA1
85123da359cacb2bbd2c03a7540228977a0f7a22

SHA256
673f8b2429472ba3635583cb2b50dd322749a43ee56efd2267d51b787c91ff36

SHA512
3167c6997882354265208b47faac3c3d33485d6b333ae8a2e841c61054112d510deee534cfef0047d8f85188934d72198efb41aaa8e6dd5678d488d31254c031

Download Submit
C:\Users\Admin\AppData\Local\Temp\2Ie8R1T1.I4n

Filesize
126B

MD5
49c868b6c1c75819e01e480d6ac9b37d

SHA1
010378937f6f18e2854ef1c095ec278803ca4933

SHA256
2156f747bd8266beec3ded3fe4cbada6717f14ca77ff5460ddd3fbb6626cd9a4

SHA512
ed98b6a430ded2c8475d808d2f33bd83c496f804939cb273483fcc9c80e877792119d6fb6506e426864e95103eb8fb43a6404080cd59dc12cc20edb3ec504362

Download Submit
C:\Users\Admin\AppData\Local\Temp\O68BQ690.exe

Filesize
90.1MB

MD5
251491ae464821ce4e107fcfaff42f34

SHA1
a971ce1f6216d60583574979b0362088013f60c0

SHA256
0dbe22b6c713f882f2e5f007c9050569272e138f8683de0812c38b7e5306464d

SHA512
f36725a3d99b226bc57ee269e0a9662ea766063bb2d64d35d9c49ca8bc7be1e514815d327dd3b5bc67a8940430f0cbf8101333fe57591ea7eb74708e218932f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\O68BQ690.exe

Filesize
90.1MB

MD5
251491ae464821ce4e107fcfaff42f34

SHA1
a971ce1f6216d60583574979b0362088013f60c0

SHA256
0dbe22b6c713f882f2e5f007c9050569272e138f8683de0812c38b7e5306464d

SHA512
f36725a3d99b226bc57ee269e0a9662ea766063bb2d64d35d9c49ca8bc7be1e514815d327dd3b5bc67a8940430f0cbf8101333fe57591ea7eb74708e218932f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-15F61.tmp\O68BQ690.tmp

Filesize
1.4MB

MD5
0642e7b236a54ecda49acaf2581ffe9e

SHA1
41bc1e92cfcd348f94f12f20183a8dca0d09afe3

SHA256
78a285b19ed01a7e9a20de0de401cacb14b94cdb09723f7760027bde559537ef

SHA512
0748be7abd2c6231347907551fcf3a7218e6f4416111d6ac24d942af7374834c3961f806123034c688eb2301dbafd02c553f3f69c6b87b38ed85ae207dabd24c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-15F61.tmp\O68BQ690.tmp

Filesize
1.4MB

MD5
0642e7b236a54ecda49acaf2581ffe9e

SHA1
41bc1e92cfcd348f94f12f20183a8dca0d09afe3

SHA256
78a285b19ed01a7e9a20de0de401cacb14b94cdb09723f7760027bde559537ef

SHA512
0748be7abd2c6231347907551fcf3a7218e6f4416111d6ac24d942af7374834c3961f806123034c688eb2301dbafd02c553f3f69c6b87b38ed85ae207dabd24c

Download Submit
\Program Files\Loaris Trojan Remover\7z.dll

Filesize
1.5MB

MD5
39cbc5a8d95482360d24b372e2af6e0b

SHA1
efd6271a32f35a5e97b0592a88ef701d8033fe41

SHA256
90958537ea7f8afd8369d4902145277c61d23ad411feea71168c0b3e2b96d2a8

SHA512
682efb6f932e4aab6ce81c1461d7345ffb7fca0788d07418356e2ceb7bbc92307b4b9165547ca42223a68cfb366152187ef161d305735a15f6fd6842c5b1af53

Download Submit
\Program Files\Loaris Trojan Remover\libeay32.dll

Filesize
2.2MB

MD5
a1e976686bb8e633a680c728aeb8b29f

SHA1
fce1b2cccf5d8e6bc7d523adbc706781646d73fb

SHA256
267572917b1f890cd228479463b30d1b9df2c2517968807687de670fb3a4a4c3

SHA512
a270d8a0cc450e7e32bca87f6dd9d65cea5cc45822e99731971f0a2a835f5ee969e1b13586be70dee14959d008b477b0a3c10b0ef7a6e6abf971db827924992f

Download Submit
\Program Files\Loaris Trojan Remover\libmem.dll

Filesize
255KB

MD5
9d18928d7d60d4648857f520ecad1c7a

SHA1
0df7859d924f62b0e8d36d73745efd399c4b680b

SHA256
d61f8575217e190c6ce6e8412ca5b1b62e0522d39efdb2dad6ee710ec1c1749f

SHA512
127fd6a9513f8ab74691732c97be703af300d9874bdddd7f88d94afedd4d43c3ed67819938684c9786145ebc8f2cee655fb9edb96e5a7e8e5aded0308b3d21b0

Download Submit
\Program Files\Loaris Trojan Remover\ltr.exe

Filesize
18.2MB

MD5
fcc4d5d1994f9cc9e001e75676b47c8b

SHA1
99618969fa3cbccfa6d2c50dc10e148265f7d248

SHA256
226047e711b58baea775fe0f9d69c48f40c698fe656ec0f226dd0924e742bf11

SHA512
d3a955e4b78877f1b3ba11fc3827142e37ecc4fe04d5049bd5dd67903f7bb4cb723ba75079b2b535c0a80e7ab4938a194c6969d2d4fdae06bc148c18a494f933

Download Submit
\Program Files\Loaris Trojan Remover\ltr.exe

Filesize
18.2MB

MD5
fcc4d5d1994f9cc9e001e75676b47c8b

SHA1
99618969fa3cbccfa6d2c50dc10e148265f7d248

SHA256
226047e711b58baea775fe0f9d69c48f40c698fe656ec0f226dd0924e742bf11

SHA512
d3a955e4b78877f1b3ba11fc3827142e37ecc4fe04d5049bd5dd67903f7bb4cb723ba75079b2b535c0a80e7ab4938a194c6969d2d4fdae06bc148c18a494f933

Download Submit
\Program Files\Loaris Trojan Remover\ltr.exe

Filesize
18.2MB

MD5
fcc4d5d1994f9cc9e001e75676b47c8b

SHA1
99618969fa3cbccfa6d2c50dc10e148265f7d248

SHA256
226047e711b58baea775fe0f9d69c48f40c698fe656ec0f226dd0924e742bf11

SHA512
d3a955e4b78877f1b3ba11fc3827142e37ecc4fe04d5049bd5dd67903f7bb4cb723ba75079b2b535c0a80e7ab4938a194c6969d2d4fdae06bc148c18a494f933

Download Submit
\Program Files\Loaris Trojan Remover\ltr.exe

Filesize
18.2MB

MD5
fcc4d5d1994f9cc9e001e75676b47c8b

SHA1
99618969fa3cbccfa6d2c50dc10e148265f7d248

SHA256
226047e711b58baea775fe0f9d69c48f40c698fe656ec0f226dd0924e742bf11

SHA512
d3a955e4b78877f1b3ba11fc3827142e37ecc4fe04d5049bd5dd67903f7bb4cb723ba75079b2b535c0a80e7ab4938a194c6969d2d4fdae06bc148c18a494f933

Download Submit
\Program Files\Loaris Trojan Remover\ltr.exe

Filesize
18.2MB

MD5
fcc4d5d1994f9cc9e001e75676b47c8b

SHA1
99618969fa3cbccfa6d2c50dc10e148265f7d248

SHA256
226047e711b58baea775fe0f9d69c48f40c698fe656ec0f226dd0924e742bf11

SHA512
d3a955e4b78877f1b3ba11fc3827142e37ecc4fe04d5049bd5dd67903f7bb4cb723ba75079b2b535c0a80e7ab4938a194c6969d2d4fdae06bc148c18a494f933

Download Submit
\Program Files\Loaris Trojan Remover\ltr.exe

Filesize
18.2MB

MD5
fcc4d5d1994f9cc9e001e75676b47c8b

SHA1
99618969fa3cbccfa6d2c50dc10e148265f7d248

SHA256
226047e711b58baea775fe0f9d69c48f40c698fe656ec0f226dd0924e742bf11

SHA512
d3a955e4b78877f1b3ba11fc3827142e37ecc4fe04d5049bd5dd67903f7bb4cb723ba75079b2b535c0a80e7ab4938a194c6969d2d4fdae06bc148c18a494f933

Download Submit
\Program Files\Loaris Trojan Remover\offreg.dll

Filesize
74KB

MD5
1eab65173f446a3e116556ce53c7717d

SHA1
3781bf5a8407d7adae6bda741322c13e4e124588

SHA256
54ce76e23156bdb9873014f9da22c023339ee3f1e5a3b7d70c1a9e1016865a50

SHA512
c98f92ac82ab90dd4121860a967a986d07ef848f8d9aa3a5c107857aa78bdb2c82fd62b4731e18dffd6b1267d0e9ddaa940273611158f28fb9aeca74d8b1c415

Download Submit
\Program Files\Loaris Trojan Remover\shellext.dll

Filesize
1.9MB

MD5
87297a02728a7b4fe84c0522224137ef

SHA1
cf7676ec53b3a0b6008542b7efe007a30c4e1776

SHA256
ee78762c4c34245d57e088d955624c0819c6715717adbf965a96f095a4fb2c85

SHA512
84c3f1c21c8fc77693b03833d53eaa1a358f81fe91b88f32bc13961ac688b54ff95758ab09d0a23b338bed85bee35620943b4a271db142e565dd1e3d9f02b9ad

Download Submit
\Users\Admin\AppData\Local\Temp\O68BQ690.exe

Filesize
90.1MB

MD5
251491ae464821ce4e107fcfaff42f34

SHA1
a971ce1f6216d60583574979b0362088013f60c0

SHA256
0dbe22b6c713f882f2e5f007c9050569272e138f8683de0812c38b7e5306464d

SHA512
f36725a3d99b226bc57ee269e0a9662ea766063bb2d64d35d9c49ca8bc7be1e514815d327dd3b5bc67a8940430f0cbf8101333fe57591ea7eb74708e218932f3

Download Submit
\Users\Admin\AppData\Local\Temp\is-15F61.tmp\O68BQ690.tmp

Filesize
1.4MB

MD5
0642e7b236a54ecda49acaf2581ffe9e

SHA1
41bc1e92cfcd348f94f12f20183a8dca0d09afe3

SHA256
78a285b19ed01a7e9a20de0de401cacb14b94cdb09723f7760027bde559537ef

SHA512
0748be7abd2c6231347907551fcf3a7218e6f4416111d6ac24d942af7374834c3961f806123034c688eb2301dbafd02c553f3f69c6b87b38ed85ae207dabd24c

Download Submit
\Users\Admin\AppData\Local\Temp\is-IH2J8.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-IH2J8.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/1172-193-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/1172-157-0x0000000004FB0000-0x0000000004FC7000-memory.dmp

Filesize
92KB

Download
memory/1172-619-0x0000000010BE0000-0x0000000010DF6000-memory.dmp

Filesize
2.1MB

Download
memory/1172-166-0x0000000004FB0000-0x0000000004FB7000-memory.dmp

Filesize
28KB

Download
memory/1172-167-0x0000000004FB0000-0x0000000004FB7000-memory.dmp

Filesize
28KB

Download
memory/1172-120-0x0000000005650000-0x0000000005866000-memory.dmp

Filesize
2.1MB

Download
memory/1172-168-0x0000000004FB0000-0x0000000004FB7000-memory.dmp

Filesize
28KB

Download
memory/1172-169-0x0000000004FB0000-0x0000000004FC7000-memory.dmp

Filesize
92KB

Download
memory/1172-170-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Filesize
84KB

Download
memory/1172-172-0x0000000004FB0000-0x0000000004FC9000-memory.dmp

Filesize
100KB

Download
memory/1172-173-0x0000000004FB0000-0x0000000004FC9000-memory.dmp

Filesize
100KB

Download
memory/1172-174-0x0000000004FB0000-0x0000000004FCB000-memory.dmp

Filesize
108KB

Download
memory/1172-176-0x0000000004FB0000-0x0000000004FBB000-memory.dmp

Filesize
44KB

Download
memory/1172-177-0x0000000004FB0000-0x0000000004FBB000-memory.dmp

Filesize
44KB

Download
memory/1172-178-0x0000000004FB0000-0x0000000004FB9000-memory.dmp

Filesize
36KB

Download
memory/1172-141-0x0000000004FB0000-0x0000000004FEE000-memory.dmp

Filesize
248KB

Download
memory/1172-140-0x0000000004FB0000-0x0000000004FEE000-memory.dmp

Filesize
248KB

Download
memory/1172-142-0x0000000004FB0000-0x0000000005007000-memory.dmp

Filesize
348KB

Download
memory/1172-143-0x0000000004FB0000-0x0000000005007000-memory.dmp

Filesize
348KB

Download
memory/1172-144-0x0000000004FB0000-0x0000000004FBA000-memory.dmp

Filesize
40KB

Download
memory/1172-145-0x0000000004FB0000-0x0000000004FBA000-memory.dmp

Filesize
40KB

Download
memory/1172-146-0x0000000004FB0000-0x000000000502B000-memory.dmp

Filesize
492KB

Download
memory/1172-147-0x0000000004FB0000-0x000000000502B000-memory.dmp

Filesize
492KB

Download
memory/1172-149-0x0000000004FB0000-0x0000000005006000-memory.dmp

Filesize
344KB

Download
memory/1172-148-0x0000000004FB0000-0x0000000005006000-memory.dmp

Filesize
344KB

Download
memory/1172-150-0x0000000004FB0000-0x0000000004FDF000-memory.dmp

Filesize
188KB

Download
memory/1172-152-0x0000000004FB0000-0x0000000005039000-memory.dmp

Filesize
548KB

Download
memory/1172-151-0x0000000004FB0000-0x0000000004FDF000-memory.dmp

Filesize
188KB

Download
memory/1172-153-0x0000000004FB0000-0x0000000005039000-memory.dmp

Filesize
548KB

Download
memory/1172-155-0x0000000004FB0000-0x0000000004FC2000-memory.dmp

Filesize
72KB

Download
memory/1172-154-0x0000000004FB0000-0x0000000004FC2000-memory.dmp

Filesize
72KB

Download
memory/1172-156-0x0000000004FB0000-0x0000000004FB7000-memory.dmp

Filesize
28KB

Download
memory/1172-160-0x0000000004FB0000-0x0000000004FCE000-memory.dmp

Filesize
120KB

Download
memory/1172-161-0x0000000004FB0000-0x0000000004FF7000-memory.dmp

Filesize
284KB

Download
memory/1172-159-0x0000000004FB0000-0x0000000004FCE000-memory.dmp

Filesize
120KB

Download
memory/1172-158-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Filesize
84KB

Download
memory/1172-179-0x0000000004FB0000-0x0000000004FB9000-memory.dmp

Filesize
36KB

Download
memory/1172-162-0x0000000004FB0000-0x0000000004FBB000-memory.dmp

Filesize
44KB

Download
memory/1172-165-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Filesize
84KB

Download
memory/1172-164-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Filesize
84KB

Download
memory/1172-163-0x0000000004FB0000-0x0000000004FBB000-memory.dmp

Filesize
44KB

Download
memory/1172-171-0x0000000004FB0000-0x0000000004FF7000-memory.dmp

Filesize
284KB

Download
memory/1172-175-0x0000000004FB0000-0x0000000004FCB000-memory.dmp

Filesize
108KB

Download
memory/1172-180-0x0000000004FB0000-0x000000000502B000-memory.dmp

Filesize
492KB

Download
memory/1172-181-0x0000000004FB0000-0x000000000502B000-memory.dmp

Filesize
492KB

Download
memory/1172-185-0x0000000004FB0000-0x0000000004FCE000-memory.dmp

Filesize
120KB

Download
memory/1172-190-0x0000000004FB0000-0x0000000004FB8000-memory.dmp

Filesize
32KB

Download
memory/1172-192-0x0000000004FB0000-0x0000000004FFC000-memory.dmp

Filesize
304KB

Download
memory/1172-197-0x0000000004FB0000-0x0000000004FB4000-memory.dmp

Filesize
16KB

Download
memory/1172-196-0x0000000004FB0000-0x0000000004FB4000-memory.dmp

Filesize
16KB

Download
memory/1172-195-0x0000000004FB0000-0x0000000004FB4000-memory.dmp

Filesize
16KB

Download
memory/1172-194-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/1172-182-0x0000000004FB0000-0x0000000004FF8000-memory.dmp

Filesize
288KB

Download
memory/1172-191-0x0000000004FB0000-0x0000000004FFC000-memory.dmp

Filesize
304KB

Download
memory/1172-189-0x0000000004FB0000-0x0000000004FB8000-memory.dmp

Filesize
32KB

Download
memory/1172-188-0x0000000004FB0000-0x0000000004FBA000-memory.dmp

Filesize
40KB

Download
memory/1172-187-0x0000000004FB0000-0x0000000004FBA000-memory.dmp

Filesize
40KB

Download
memory/1172-186-0x0000000004FB0000-0x0000000004FCE000-memory.dmp

Filesize
120KB

Download
memory/1172-184-0x0000000004FB0000-0x0000000004FC1000-memory.dmp

Filesize
68KB

Download
memory/1172-183-0x0000000004FB0000-0x0000000004FC1000-memory.dmp

Filesize
68KB

Download
memory/1260-54-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download
memory/1260-67-0x0000000000400000-0x0000000000824000-memory.dmp

Filesize
4.1MB

Download
memory/1260-55-0x0000000000400000-0x0000000000824000-memory.dmp

Filesize
4.1MB

Download
memory/1260-56-0x0000000074A41000-0x0000000074A43000-memory.dmp

Filesize
8KB

Download
memory/1260-92-0x0000000000400000-0x0000000000824000-memory.dmp

Filesize
4.1MB

Download
memory/1276-61-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1276-69-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1276-87-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1276-73-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1496-81-0x0000000001F60000-0x000000000215A000-memory.dmp

Filesize
2.0MB

Download
memory/1496-78-0x000007FEFBE01000-0x000007FEFBE03000-memory.dmp

Filesize
8KB

Download