Analysis
-
max time kernel
68s -
max time network
97s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:45
Static task
static1
Behavioral task
behavioral1
Sample
3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe
Resource
win7-20220812-en
General
-
Target
3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe
-
Size
1.1MB
-
MD5
89407a4c6371f031a3f2196655270997
-
SHA1
1af7e99baa61ffaebef1891ea4d267ef599fe8d9
-
SHA256
3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a
-
SHA512
e7b05bdfb2c62d3526a55f9a2b5bb30e3fae3a997c47af29db34befedf9dbe9ffa98774dd8b22e6289a767b0d4fd243f07f7f49b768d806c1c6bbf7bcd171200
-
SSDEEP
24576:i5V/MMqXZNrYcwr0hDLYzyFo4GxXjgX5X85cqzGMQXj2qBIS/+2:gVDiZBP42Yzlm5s5VGMSj2qBv
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\nsj802B.tmp\SelfDel.dll acprotect behavioral1/memory/2016-83-0x0000000074F90000-0x0000000074F99000-memory.dmp acprotect -
Drops file in Drivers directory 1 IoCs
Processes:
3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exedescription ioc process File created C:\Windows\System32\drivers\crfilterdrv.sys 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe -
Executes dropped EXE 3 IoCs
Processes:
nfregdrv.exeCashReminder.exeCashReminder.exepid process 952 nfregdrv.exe 1688 CashReminder.exe 636 CashReminder.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\nsj802B.tmp\SelfDel.dll upx behavioral1/memory/2016-83-0x0000000074F90000-0x0000000074F99000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
explorer.exepid process 468 explorer.exe -
Loads dropped DLL 16 IoCs
Processes:
3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exenfregdrv.exeCashReminder.exeCashReminder.exepid process 2016 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe 2016 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe 2016 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe 952 nfregdrv.exe 2016 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe 2016 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe 2016 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe 1688 CashReminder.exe 1688 CashReminder.exe 1688 CashReminder.exe 2016 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe 1688 CashReminder.exe 636 CashReminder.exe 636 CashReminder.exe 636 CashReminder.exe 636 CashReminder.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 1 IoCs
Processes:
CashReminder.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat CashReminder.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exedescription pid process target process PID 2016 set thread context of 468 2016 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe explorer.exe -
Drops file in Program Files directory 9 IoCs
Processes:
3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exedescription ioc process File created C:\Program Files (x86)\CashReminder\nfregdrv.exe 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe File created C:\Program Files (x86)\CashReminder\libeay32.dll 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe File created C:\Program Files (x86)\CashReminder\nfapi.dll 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe File created C:\Program Files (x86)\CashReminder\ssleay32.dll 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe File created C:\Program Files (x86)\CashReminder\ProtocolFilters.dll 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe File created C:\Program Files (x86)\CashReminder\crfilterdrv.sys 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe File created C:\Program Files (x86)\CashReminder\uninstall.exe 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe File opened for modification C:\Program Files (x86)\CashReminder\crfilterdrv.sys 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe File created C:\Program Files (x86)\CashReminder\CashReminder.exe 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 24 IoCs
Processes:
CashReminder.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 CashReminder.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" CashReminder.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" CashReminder.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 CashReminder.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CFF4FA3D-9664-4E20-8EFD-5AB38AA6AFE6}\WpadDecisionTime = c0c41fc85701d901 CashReminder.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections CashReminder.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings CashReminder.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" CashReminder.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad CashReminder.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0083000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 CashReminder.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CFF4FA3D-9664-4E20-8EFD-5AB38AA6AFE6}\WpadNetworkName = "Network 3" CashReminder.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-00-62-20-4b-7d\WpadDecisionTime = c0c41fc85701d901 CashReminder.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ CashReminder.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix CashReminder.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" CashReminder.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CFF4FA3D-9664-4E20-8EFD-5AB38AA6AFE6}\WpadDecisionReason = "1" CashReminder.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-00-62-20-4b-7d CashReminder.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CFF4FA3D-9664-4E20-8EFD-5AB38AA6AFE6}\f2-00-62-20-4b-7d CashReminder.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-00-62-20-4b-7d\WpadDecision = "0" CashReminder.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" CashReminder.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CFF4FA3D-9664-4E20-8EFD-5AB38AA6AFE6} CashReminder.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CFF4FA3D-9664-4E20-8EFD-5AB38AA6AFE6}\WpadDecision = "0" CashReminder.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-00-62-20-4b-7d\WpadDecisionReason = "1" CashReminder.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings CashReminder.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 460 -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exepid process 2016 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exeCashReminder.execmd.exenet.exedescription pid process target process PID 2016 wrote to memory of 952 2016 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe nfregdrv.exe PID 2016 wrote to memory of 952 2016 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe nfregdrv.exe PID 2016 wrote to memory of 952 2016 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe nfregdrv.exe PID 2016 wrote to memory of 952 2016 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe nfregdrv.exe PID 2016 wrote to memory of 1688 2016 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe CashReminder.exe PID 2016 wrote to memory of 1688 2016 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe CashReminder.exe PID 2016 wrote to memory of 1688 2016 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe CashReminder.exe PID 2016 wrote to memory of 1688 2016 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe CashReminder.exe PID 2016 wrote to memory of 468 2016 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe explorer.exe PID 2016 wrote to memory of 468 2016 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe explorer.exe PID 2016 wrote to memory of 468 2016 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe explorer.exe PID 2016 wrote to memory of 468 2016 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe explorer.exe PID 2016 wrote to memory of 468 2016 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe explorer.exe PID 1688 wrote to memory of 1160 1688 CashReminder.exe cmd.exe PID 1688 wrote to memory of 1160 1688 CashReminder.exe cmd.exe PID 1688 wrote to memory of 1160 1688 CashReminder.exe cmd.exe PID 1688 wrote to memory of 1160 1688 CashReminder.exe cmd.exe PID 1160 wrote to memory of 1796 1160 cmd.exe net.exe PID 1160 wrote to memory of 1796 1160 cmd.exe net.exe PID 1160 wrote to memory of 1796 1160 cmd.exe net.exe PID 1160 wrote to memory of 1796 1160 cmd.exe net.exe PID 1796 wrote to memory of 1120 1796 net.exe net1.exe PID 1796 wrote to memory of 1120 1796 net.exe net1.exe PID 1796 wrote to memory of 1120 1796 net.exe net1.exe PID 1796 wrote to memory of 1120 1796 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe"C:\Users\Admin\AppData\Local\Temp\3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Program Files (x86)\CashReminder\nfregdrv.exenfregdrv.exe C:\Windows\system32\drivers\crfilterdrv.sys2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Program Files (x86)\CashReminder\CashReminder.exe"C:\Program Files (x86)\CashReminder\CashReminder.exe" /install /SILENT2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\cmd.execmd.exe /c net start CashReminder3⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\net.exenet start CashReminder4⤵
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start CashReminder5⤵PID:1120
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\system32\explorer.exe2⤵
- Deletes itself
PID:468
-
C:\Program Files (x86)\CashReminder\CashReminder.exe"C:\Program Files (x86)\CashReminder\CashReminder.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:636
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\CashReminder\CashReminder.exeFilesize
434KB
MD50b3fde0415877f15acdee788759064b7
SHA13a8e8c49baca64aae0802ec3da91a4ffd2affb0f
SHA25664d88f8a5b85cb0d5c8de6ccde5724e71baeb3e46c302d1882a0fb512998ac9c
SHA51255b1678ee75ec5e2317ced249ff842361564a1d5bb8de1a10eed3d33984a79cf881bfa7767a824625c390f4a9f433afd6c201f71a3e5a74afea2b76bf5a1eaa3
-
C:\Program Files (x86)\CashReminder\CashReminder.exeFilesize
434KB
MD50b3fde0415877f15acdee788759064b7
SHA13a8e8c49baca64aae0802ec3da91a4ffd2affb0f
SHA25664d88f8a5b85cb0d5c8de6ccde5724e71baeb3e46c302d1882a0fb512998ac9c
SHA51255b1678ee75ec5e2317ced249ff842361564a1d5bb8de1a10eed3d33984a79cf881bfa7767a824625c390f4a9f433afd6c201f71a3e5a74afea2b76bf5a1eaa3
-
C:\Program Files (x86)\CashReminder\LIBEAY32.dllFilesize
1.2MB
MD5bec584303ce252396a3731ce5bdcf03a
SHA1652df7bec1cc6cdee7407872ed263845592fff33
SHA2569b4d3c88cbe1fac6d79c93e4ccd46f76d237c8db7b0d4843d001a22e7d590ec0
SHA512c2fbca4c4ad810ddfe7778004bfd86203191a890fdd623b4f268e139068b1348174dbbe00b5234927d5a0887ca4de9c256ae6f45e1282746abfc9c60355bf605
-
C:\Program Files (x86)\CashReminder\ProtocolFilters.dllFilesize
332KB
MD59c9694225679c7c577d72ea1537544cc
SHA18342872c5ef4d8c265eace1903a5ca2c7a38905c
SHA256615f0ab9ecdef7834a6943623752cae5814b06d2f4894e9da074a7e3b68ea86e
SHA5120c0558484cbbd12d5401b3a58b4ebf494d4740f4764491acc0e30a35c9a202c89e9ab7590675b5c729cd200025af2658dd723335f049cbaf44cdfb068312a74a
-
C:\Program Files (x86)\CashReminder\SSLEAY32.dllFilesize
344KB
MD5da6f5524c9e5b5804dc5117022d08331
SHA131054708152012d0c37013ca4945097958169079
SHA2565083b5da5edcf022c593ce40c2e8bfa90913b4e556401b4908fa29efd3cce5b8
SHA5121e42b143d40bf5726d5ba632112c97342dbb0cc282ffcd2a05da1f389d6899b8ad3513d4cd099ad71039086dae1ace995b85047afc24b7c80e51ee5dea246dad
-
C:\Program Files (x86)\CashReminder\nfapi.dllFilesize
116KB
MD5d8305b5c2810e2e135f87bb32d62810e
SHA1e78991c4d920b61f068c27071253ab5e825572bc
SHA256a035dde03f95ad199a74e141089ea94d24abb42f56a9cc14c86c76c6ce6932ec
SHA512c01145ec54a3e2010d777625b65660f4d88a6488de171a97fdfe29b7da15c45aaa88b49a54046d42d199d5685560670ef2ccc6df3c915fda77a02796069123ab
-
C:\Program Files (x86)\CashReminder\nfregdrv.exeFilesize
48KB
MD501b5780505301ada6dc102fb77b2298c
SHA1328c3931a54af2d7adb88ba4c4c18ce1af8d5a72
SHA256aad2d85472448abe8250cf3180c3d0373540f46e8a8e76d8ef2f78db62be0812
SHA512bc5bd91c46f452a76ae0595287622256e8c79e90158171bedf6b68d4439dfefceb06948bd49deb0aeb1344ce89a312bb87b01e2daf3880729fff642951c33947
-
\Program Files (x86)\CashReminder\CashReminder.exeFilesize
434KB
MD50b3fde0415877f15acdee788759064b7
SHA13a8e8c49baca64aae0802ec3da91a4ffd2affb0f
SHA25664d88f8a5b85cb0d5c8de6ccde5724e71baeb3e46c302d1882a0fb512998ac9c
SHA51255b1678ee75ec5e2317ced249ff842361564a1d5bb8de1a10eed3d33984a79cf881bfa7767a824625c390f4a9f433afd6c201f71a3e5a74afea2b76bf5a1eaa3
-
\Program Files (x86)\CashReminder\CashReminder.exeFilesize
434KB
MD50b3fde0415877f15acdee788759064b7
SHA13a8e8c49baca64aae0802ec3da91a4ffd2affb0f
SHA25664d88f8a5b85cb0d5c8de6ccde5724e71baeb3e46c302d1882a0fb512998ac9c
SHA51255b1678ee75ec5e2317ced249ff842361564a1d5bb8de1a10eed3d33984a79cf881bfa7767a824625c390f4a9f433afd6c201f71a3e5a74afea2b76bf5a1eaa3
-
\Program Files (x86)\CashReminder\ProtocolFilters.dllFilesize
332KB
MD59c9694225679c7c577d72ea1537544cc
SHA18342872c5ef4d8c265eace1903a5ca2c7a38905c
SHA256615f0ab9ecdef7834a6943623752cae5814b06d2f4894e9da074a7e3b68ea86e
SHA5120c0558484cbbd12d5401b3a58b4ebf494d4740f4764491acc0e30a35c9a202c89e9ab7590675b5c729cd200025af2658dd723335f049cbaf44cdfb068312a74a
-
\Program Files (x86)\CashReminder\ProtocolFilters.dllFilesize
332KB
MD59c9694225679c7c577d72ea1537544cc
SHA18342872c5ef4d8c265eace1903a5ca2c7a38905c
SHA256615f0ab9ecdef7834a6943623752cae5814b06d2f4894e9da074a7e3b68ea86e
SHA5120c0558484cbbd12d5401b3a58b4ebf494d4740f4764491acc0e30a35c9a202c89e9ab7590675b5c729cd200025af2658dd723335f049cbaf44cdfb068312a74a
-
\Program Files (x86)\CashReminder\libeay32.dllFilesize
1.2MB
MD5bec584303ce252396a3731ce5bdcf03a
SHA1652df7bec1cc6cdee7407872ed263845592fff33
SHA2569b4d3c88cbe1fac6d79c93e4ccd46f76d237c8db7b0d4843d001a22e7d590ec0
SHA512c2fbca4c4ad810ddfe7778004bfd86203191a890fdd623b4f268e139068b1348174dbbe00b5234927d5a0887ca4de9c256ae6f45e1282746abfc9c60355bf605
-
\Program Files (x86)\CashReminder\libeay32.dllFilesize
1.2MB
MD5bec584303ce252396a3731ce5bdcf03a
SHA1652df7bec1cc6cdee7407872ed263845592fff33
SHA2569b4d3c88cbe1fac6d79c93e4ccd46f76d237c8db7b0d4843d001a22e7d590ec0
SHA512c2fbca4c4ad810ddfe7778004bfd86203191a890fdd623b4f268e139068b1348174dbbe00b5234927d5a0887ca4de9c256ae6f45e1282746abfc9c60355bf605
-
\Program Files (x86)\CashReminder\nfapi.dllFilesize
116KB
MD5d8305b5c2810e2e135f87bb32d62810e
SHA1e78991c4d920b61f068c27071253ab5e825572bc
SHA256a035dde03f95ad199a74e141089ea94d24abb42f56a9cc14c86c76c6ce6932ec
SHA512c01145ec54a3e2010d777625b65660f4d88a6488de171a97fdfe29b7da15c45aaa88b49a54046d42d199d5685560670ef2ccc6df3c915fda77a02796069123ab
-
\Program Files (x86)\CashReminder\nfapi.dllFilesize
116KB
MD5d8305b5c2810e2e135f87bb32d62810e
SHA1e78991c4d920b61f068c27071253ab5e825572bc
SHA256a035dde03f95ad199a74e141089ea94d24abb42f56a9cc14c86c76c6ce6932ec
SHA512c01145ec54a3e2010d777625b65660f4d88a6488de171a97fdfe29b7da15c45aaa88b49a54046d42d199d5685560670ef2ccc6df3c915fda77a02796069123ab
-
\Program Files (x86)\CashReminder\nfapi.dllFilesize
116KB
MD5d8305b5c2810e2e135f87bb32d62810e
SHA1e78991c4d920b61f068c27071253ab5e825572bc
SHA256a035dde03f95ad199a74e141089ea94d24abb42f56a9cc14c86c76c6ce6932ec
SHA512c01145ec54a3e2010d777625b65660f4d88a6488de171a97fdfe29b7da15c45aaa88b49a54046d42d199d5685560670ef2ccc6df3c915fda77a02796069123ab
-
\Program Files (x86)\CashReminder\nfregdrv.exeFilesize
48KB
MD501b5780505301ada6dc102fb77b2298c
SHA1328c3931a54af2d7adb88ba4c4c18ce1af8d5a72
SHA256aad2d85472448abe8250cf3180c3d0373540f46e8a8e76d8ef2f78db62be0812
SHA512bc5bd91c46f452a76ae0595287622256e8c79e90158171bedf6b68d4439dfefceb06948bd49deb0aeb1344ce89a312bb87b01e2daf3880729fff642951c33947
-
\Program Files (x86)\CashReminder\nfregdrv.exeFilesize
48KB
MD501b5780505301ada6dc102fb77b2298c
SHA1328c3931a54af2d7adb88ba4c4c18ce1af8d5a72
SHA256aad2d85472448abe8250cf3180c3d0373540f46e8a8e76d8ef2f78db62be0812
SHA512bc5bd91c46f452a76ae0595287622256e8c79e90158171bedf6b68d4439dfefceb06948bd49deb0aeb1344ce89a312bb87b01e2daf3880729fff642951c33947
-
\Program Files (x86)\CashReminder\ssleay32.dllFilesize
344KB
MD5da6f5524c9e5b5804dc5117022d08331
SHA131054708152012d0c37013ca4945097958169079
SHA2565083b5da5edcf022c593ce40c2e8bfa90913b4e556401b4908fa29efd3cce5b8
SHA5121e42b143d40bf5726d5ba632112c97342dbb0cc282ffcd2a05da1f389d6899b8ad3513d4cd099ad71039086dae1ace995b85047afc24b7c80e51ee5dea246dad
-
\Program Files (x86)\CashReminder\ssleay32.dllFilesize
344KB
MD5da6f5524c9e5b5804dc5117022d08331
SHA131054708152012d0c37013ca4945097958169079
SHA2565083b5da5edcf022c593ce40c2e8bfa90913b4e556401b4908fa29efd3cce5b8
SHA5121e42b143d40bf5726d5ba632112c97342dbb0cc282ffcd2a05da1f389d6899b8ad3513d4cd099ad71039086dae1ace995b85047afc24b7c80e51ee5dea246dad
-
\Users\Admin\AppData\Local\Temp\nsj802B.tmp\SelfDel.dllFilesize
5KB
MD5e5786e8703d651bc8bd4bfecf46d3844
SHA1fee5aa4b325deecbf69ccb6eadd89bd5ae59723f
SHA256d115bce0a787b4f895e700efe943695c8f1087782807d91d831f6015b0f98774
SHA512d14ad43a01db19428cd8ccd2fe101750860933409b5be2eb85a3e400efcd37b1b6425ce84e87a7fe46ecabc7b91c4b450259e624c178b86e194ba7da97957ba3
-
\Users\Admin\AppData\Local\Temp\nsj802B.tmp\SimpleSC.dllFilesize
61KB
MD5d63975ce28f801f236c4aca5af726961
SHA13d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9
SHA256e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
SHA5128357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810
-
\Users\Admin\AppData\Local\Temp\nsj802B.tmp\System.dllFilesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
memory/468-84-0x0000000000780EFA-mapping.dmp
-
memory/468-86-0x0000000075301000-0x0000000075303000-memory.dmpFilesize
8KB
-
memory/636-99-0x0000000000680000-0x00000000007B8000-memory.dmpFilesize
1.2MB
-
memory/636-96-0x0000000000330000-0x0000000000387000-memory.dmpFilesize
348KB
-
memory/952-59-0x0000000000000000-mapping.dmp
-
memory/1120-89-0x0000000000000000-mapping.dmp
-
memory/1160-87-0x0000000000000000-mapping.dmp
-
memory/1688-81-0x00000000006B0000-0x00000000007E8000-memory.dmpFilesize
1.2MB
-
memory/1688-72-0x0000000000220000-0x0000000000275000-memory.dmpFilesize
340KB
-
memory/1688-67-0x0000000000000000-mapping.dmp
-
memory/1688-76-0x0000000000280000-0x00000000002D7000-memory.dmpFilesize
348KB
-
memory/1796-88-0x0000000000000000-mapping.dmp
-
memory/2016-56-0x0000000074E41000-0x0000000074E43000-memory.dmpFilesize
8KB
-
memory/2016-54-0x0000000076711000-0x0000000076713000-memory.dmpFilesize
8KB
-
memory/2016-64-0x0000000001E20000-0x0000000001E33000-memory.dmpFilesize
76KB
-
memory/2016-83-0x0000000074F90000-0x0000000074F99000-memory.dmpFilesize
36KB