3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a

Analysis

max time kernel
203s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 19:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe
Size

1.1MB
MD5

89407a4c6371f031a3f2196655270997
SHA1

1af7e99baa61ffaebef1891ea4d267ef599fe8d9
SHA256

3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a
SHA512

e7b05bdfb2c62d3526a55f9a2b5bb30e3fae3a997c47af29db34befedf9dbe9ffa98774dd8b22e6289a767b0d4fd243f07f7f49b768d806c1c6bbf7bcd171200
SSDEEP

24576:i5V/MMqXZNrYcwr0hDLYzyFo4GxXjgX5X85cqzGMQXj2qBIS/+2:gVDiZBP42Yzlm5s5VGMSj2qBv

Score

9^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
behavioral2/memory/1620-150-0x0000000073180000-0x0000000073189000-memory.dmp	acprotect
C:\Users\Admin\AppData\Local\Temp\nsz85DB.tmp\SelfDel.dll	acprotect

Drops file in Drivers directory 2 IoCs

Processes:

3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe

description	ioc	process
File created	C:\Windows\System32\drivers\crfilterdrv.sys	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe
File opened for modification	C:\Windows\System32\drivers\crfilterdrv.sys	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe

Executes dropped EXE 3 IoCs

Processes:

nfregdrv.exeCashReminder.exeCashReminder.exe

pid process

3124 nfregdrv.exe
4744 CashReminder.exe
3528 CashReminder.exe

pid	process
3124	nfregdrv.exe
4744	CashReminder.exe
3528	CashReminder.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1620-150-0x0000000073180000-0x0000000073189000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\nsz85DB.tmp\SelfDel.dll	upx

Loads dropped DLL 20 IoCs

Processes:

3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exenfregdrv.exeCashReminder.exeCashReminder.exe

pid	process
1620	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe
3124	nfregdrv.exe
1620	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe
1620	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe
4744	CashReminder.exe
1620	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe
4744	CashReminder.exe
4744	CashReminder.exe
4744	CashReminder.exe
4744	CashReminder.exe
4744	CashReminder.exe
4744	CashReminder.exe
4744	CashReminder.exe
3528	CashReminder.exe
3528	CashReminder.exe
3528	CashReminder.exe
3528	CashReminder.exe
3528	CashReminder.exe
3528	CashReminder.exe
3528	CashReminder.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 4 IoCs

Processes:

CashReminder.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	CashReminder.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	CashReminder.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	CashReminder.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	CashReminder.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe

description	pid	process	target process
PID 1620 set thread context of 4404	1620	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe	explorer.exe

Drops file in Program Files directory 9 IoCs

Processes:

3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe

description	ioc	process
File created	C:\Program Files (x86)\CashReminder\CashReminder.exe	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe
File created	C:\Program Files (x86)\CashReminder\ssleay32.dll	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe
File created	C:\Program Files (x86)\CashReminder\libeay32.dll	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe
File opened for modification	C:\Program Files (x86)\CashReminder\crfilterdrv.sys	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe
File created	C:\Program Files (x86)\CashReminder\nfapi.dll	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe
File created	C:\Program Files (x86)\CashReminder\ProtocolFilters.dll	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe
File created	C:\Program Files (x86)\CashReminder\crfilterdrv.sys	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe
File created	C:\Program Files (x86)\CashReminder\nfregdrv.exe	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe
File created	C:\Program Files (x86)\CashReminder\uninstall.exe	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 8 IoCs

Processes:

CashReminder.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	CashReminder.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	CashReminder.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	CashReminder.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	CashReminder.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	CashReminder.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	CashReminder.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	CashReminder.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	CashReminder.exe

Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

644
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe

pid process

1620 3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe

pid	process
644

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exeCashReminder.execmd.exenet.exe

description	pid	process	target process
PID 1620 wrote to memory of 3124	1620	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe	nfregdrv.exe
PID 1620 wrote to memory of 3124	1620	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe	nfregdrv.exe
PID 1620 wrote to memory of 3124	1620	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe	nfregdrv.exe
PID 1620 wrote to memory of 4744	1620	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe	CashReminder.exe
PID 1620 wrote to memory of 4744	1620	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe	CashReminder.exe
PID 1620 wrote to memory of 4744	1620	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe	CashReminder.exe
PID 1620 wrote to memory of 4404	1620	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe	explorer.exe
PID 1620 wrote to memory of 4404	1620	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe	explorer.exe
PID 1620 wrote to memory of 4404	1620	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe	explorer.exe
PID 1620 wrote to memory of 4404	1620	3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe	explorer.exe
PID 4744 wrote to memory of 4756	4744	CashReminder.exe	cmd.exe
PID 4744 wrote to memory of 4756	4744	CashReminder.exe	cmd.exe
PID 4744 wrote to memory of 4756	4744	CashReminder.exe	cmd.exe
PID 4756 wrote to memory of 2156	4756	cmd.exe	net.exe
PID 4756 wrote to memory of 2156	4756	cmd.exe	net.exe
PID 4756 wrote to memory of 2156	4756	cmd.exe	net.exe
PID 2156 wrote to memory of 1264	2156	net.exe	net1.exe
PID 2156 wrote to memory of 1264	2156	net.exe	net1.exe
PID 2156 wrote to memory of 1264	2156	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe
"C:\Users\Admin\AppData\Local\Temp\3afdbb55108d1c254149483a9f5205c500df189f52248dab0bbe6a4159888f0a.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1620

C:\Program Files (x86)\CashReminder\nfregdrv.exe
nfregdrv.exe C:\Windows\system32\drivers\crfilterdrv.sys
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3124

C:\Program Files (x86)\CashReminder\CashReminder.exe
"C:\Program Files (x86)\CashReminder\CashReminder.exe" /install /SILENT
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4744

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net start CashReminder
3⤵
- Suspicious use of WriteProcessMemory
PID:4756

C:\Windows\SysWOW64\net.exe
net start CashReminder
4⤵
- Suspicious use of WriteProcessMemory
PID:2156

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start CashReminder
5⤵
PID:1264

C:\Windows\SysWOW64\explorer.exe
C:\Windows\system32\explorer.exe
2⤵
PID:4404

C:\Program Files (x86)\CashReminder\CashReminder.exe
"C:\Program Files (x86)\CashReminder\CashReminder.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\CashReminder\CashReminder.exe
Filesize
434KB

MD5
0b3fde0415877f15acdee788759064b7

SHA1
3a8e8c49baca64aae0802ec3da91a4ffd2affb0f

SHA256
64d88f8a5b85cb0d5c8de6ccde5724e71baeb3e46c302d1882a0fb512998ac9c

SHA512
55b1678ee75ec5e2317ced249ff842361564a1d5bb8de1a10eed3d33984a79cf881bfa7767a824625c390f4a9f433afd6c201f71a3e5a74afea2b76bf5a1eaa3

Download Submit
C:\Program Files (x86)\CashReminder\CashReminder.exe
Filesize
434KB

MD5
0b3fde0415877f15acdee788759064b7

SHA1
3a8e8c49baca64aae0802ec3da91a4ffd2affb0f

SHA256
64d88f8a5b85cb0d5c8de6ccde5724e71baeb3e46c302d1882a0fb512998ac9c

SHA512
55b1678ee75ec5e2317ced249ff842361564a1d5bb8de1a10eed3d33984a79cf881bfa7767a824625c390f4a9f433afd6c201f71a3e5a74afea2b76bf5a1eaa3

Download Submit
C:\Program Files (x86)\CashReminder\CashReminder.exe
Filesize
434KB

MD5
0b3fde0415877f15acdee788759064b7

SHA1
3a8e8c49baca64aae0802ec3da91a4ffd2affb0f

SHA256
64d88f8a5b85cb0d5c8de6ccde5724e71baeb3e46c302d1882a0fb512998ac9c

SHA512
55b1678ee75ec5e2317ced249ff842361564a1d5bb8de1a10eed3d33984a79cf881bfa7767a824625c390f4a9f433afd6c201f71a3e5a74afea2b76bf5a1eaa3

Download Submit
C:\Program Files (x86)\CashReminder\LIBEAY32.dll
Filesize
1.2MB

MD5
bec584303ce252396a3731ce5bdcf03a

SHA1
652df7bec1cc6cdee7407872ed263845592fff33

SHA256
9b4d3c88cbe1fac6d79c93e4ccd46f76d237c8db7b0d4843d001a22e7d590ec0

SHA512
c2fbca4c4ad810ddfe7778004bfd86203191a890fdd623b4f268e139068b1348174dbbe00b5234927d5a0887ca4de9c256ae6f45e1282746abfc9c60355bf605

Download Submit
C:\Program Files (x86)\CashReminder\ProtocolFilters.dll
Filesize
332KB

MD5
9c9694225679c7c577d72ea1537544cc

SHA1
8342872c5ef4d8c265eace1903a5ca2c7a38905c

SHA256
615f0ab9ecdef7834a6943623752cae5814b06d2f4894e9da074a7e3b68ea86e

SHA512
0c0558484cbbd12d5401b3a58b4ebf494d4740f4764491acc0e30a35c9a202c89e9ab7590675b5c729cd200025af2658dd723335f049cbaf44cdfb068312a74a

Download Submit
C:\Program Files (x86)\CashReminder\ProtocolFilters.dll
Filesize
332KB

MD5
9c9694225679c7c577d72ea1537544cc

SHA1
8342872c5ef4d8c265eace1903a5ca2c7a38905c

SHA256
615f0ab9ecdef7834a6943623752cae5814b06d2f4894e9da074a7e3b68ea86e

SHA512
0c0558484cbbd12d5401b3a58b4ebf494d4740f4764491acc0e30a35c9a202c89e9ab7590675b5c729cd200025af2658dd723335f049cbaf44cdfb068312a74a

Download Submit
C:\Program Files (x86)\CashReminder\ProtocolFilters.dll
Filesize
332KB

MD5
9c9694225679c7c577d72ea1537544cc

SHA1
8342872c5ef4d8c265eace1903a5ca2c7a38905c

SHA256
615f0ab9ecdef7834a6943623752cae5814b06d2f4894e9da074a7e3b68ea86e

SHA512
0c0558484cbbd12d5401b3a58b4ebf494d4740f4764491acc0e30a35c9a202c89e9ab7590675b5c729cd200025af2658dd723335f049cbaf44cdfb068312a74a

Download Submit
C:\Program Files (x86)\CashReminder\ProtocolFilters.dll
Filesize
332KB

MD5
9c9694225679c7c577d72ea1537544cc

SHA1
8342872c5ef4d8c265eace1903a5ca2c7a38905c

SHA256
615f0ab9ecdef7834a6943623752cae5814b06d2f4894e9da074a7e3b68ea86e

SHA512
0c0558484cbbd12d5401b3a58b4ebf494d4740f4764491acc0e30a35c9a202c89e9ab7590675b5c729cd200025af2658dd723335f049cbaf44cdfb068312a74a

Download Submit
C:\Program Files (x86)\CashReminder\ProtocolFilters.dll
Filesize
332KB

MD5
9c9694225679c7c577d72ea1537544cc

SHA1
8342872c5ef4d8c265eace1903a5ca2c7a38905c

SHA256
615f0ab9ecdef7834a6943623752cae5814b06d2f4894e9da074a7e3b68ea86e

SHA512
0c0558484cbbd12d5401b3a58b4ebf494d4740f4764491acc0e30a35c9a202c89e9ab7590675b5c729cd200025af2658dd723335f049cbaf44cdfb068312a74a

Download Submit
C:\Program Files (x86)\CashReminder\SSLEAY32.dll
Filesize
344KB

MD5
da6f5524c9e5b5804dc5117022d08331

SHA1
31054708152012d0c37013ca4945097958169079

SHA256
5083b5da5edcf022c593ce40c2e8bfa90913b4e556401b4908fa29efd3cce5b8

SHA512
1e42b143d40bf5726d5ba632112c97342dbb0cc282ffcd2a05da1f389d6899b8ad3513d4cd099ad71039086dae1ace995b85047afc24b7c80e51ee5dea246dad

Download Submit
C:\Program Files (x86)\CashReminder\libeay32.dll
Filesize
1.2MB

MD5
bec584303ce252396a3731ce5bdcf03a

SHA1
652df7bec1cc6cdee7407872ed263845592fff33

SHA256
9b4d3c88cbe1fac6d79c93e4ccd46f76d237c8db7b0d4843d001a22e7d590ec0

SHA512
c2fbca4c4ad810ddfe7778004bfd86203191a890fdd623b4f268e139068b1348174dbbe00b5234927d5a0887ca4de9c256ae6f45e1282746abfc9c60355bf605

Download Submit
C:\Program Files (x86)\CashReminder\libeay32.dll
Filesize
1.2MB

MD5
bec584303ce252396a3731ce5bdcf03a

SHA1
652df7bec1cc6cdee7407872ed263845592fff33

SHA256
9b4d3c88cbe1fac6d79c93e4ccd46f76d237c8db7b0d4843d001a22e7d590ec0

SHA512
c2fbca4c4ad810ddfe7778004bfd86203191a890fdd623b4f268e139068b1348174dbbe00b5234927d5a0887ca4de9c256ae6f45e1282746abfc9c60355bf605

Download Submit
C:\Program Files (x86)\CashReminder\libeay32.dll
Filesize
1.2MB

MD5
bec584303ce252396a3731ce5bdcf03a

SHA1
652df7bec1cc6cdee7407872ed263845592fff33

SHA256
9b4d3c88cbe1fac6d79c93e4ccd46f76d237c8db7b0d4843d001a22e7d590ec0

SHA512
c2fbca4c4ad810ddfe7778004bfd86203191a890fdd623b4f268e139068b1348174dbbe00b5234927d5a0887ca4de9c256ae6f45e1282746abfc9c60355bf605

Download Submit
C:\Program Files (x86)\CashReminder\libeay32.dll
Filesize
1.2MB

MD5
bec584303ce252396a3731ce5bdcf03a

SHA1
652df7bec1cc6cdee7407872ed263845592fff33

SHA256
9b4d3c88cbe1fac6d79c93e4ccd46f76d237c8db7b0d4843d001a22e7d590ec0

SHA512
c2fbca4c4ad810ddfe7778004bfd86203191a890fdd623b4f268e139068b1348174dbbe00b5234927d5a0887ca4de9c256ae6f45e1282746abfc9c60355bf605

Download Submit
C:\Program Files (x86)\CashReminder\libeay32.dll
Filesize
1.2MB

MD5
bec584303ce252396a3731ce5bdcf03a

SHA1
652df7bec1cc6cdee7407872ed263845592fff33

SHA256
9b4d3c88cbe1fac6d79c93e4ccd46f76d237c8db7b0d4843d001a22e7d590ec0

SHA512
c2fbca4c4ad810ddfe7778004bfd86203191a890fdd623b4f268e139068b1348174dbbe00b5234927d5a0887ca4de9c256ae6f45e1282746abfc9c60355bf605

Download Submit
C:\Program Files (x86)\CashReminder\nfapi.dll
Filesize
116KB

MD5
d8305b5c2810e2e135f87bb32d62810e

SHA1
e78991c4d920b61f068c27071253ab5e825572bc

SHA256
a035dde03f95ad199a74e141089ea94d24abb42f56a9cc14c86c76c6ce6932ec

SHA512
c01145ec54a3e2010d777625b65660f4d88a6488de171a97fdfe29b7da15c45aaa88b49a54046d42d199d5685560670ef2ccc6df3c915fda77a02796069123ab

Download Submit
C:\Program Files (x86)\CashReminder\nfapi.dll
Filesize
116KB

MD5
d8305b5c2810e2e135f87bb32d62810e

SHA1
e78991c4d920b61f068c27071253ab5e825572bc

SHA256
a035dde03f95ad199a74e141089ea94d24abb42f56a9cc14c86c76c6ce6932ec

SHA512
c01145ec54a3e2010d777625b65660f4d88a6488de171a97fdfe29b7da15c45aaa88b49a54046d42d199d5685560670ef2ccc6df3c915fda77a02796069123ab

Download Submit
C:\Program Files (x86)\CashReminder\nfapi.dll
Filesize
116KB

MD5
d8305b5c2810e2e135f87bb32d62810e

SHA1
e78991c4d920b61f068c27071253ab5e825572bc

SHA256
a035dde03f95ad199a74e141089ea94d24abb42f56a9cc14c86c76c6ce6932ec

SHA512
c01145ec54a3e2010d777625b65660f4d88a6488de171a97fdfe29b7da15c45aaa88b49a54046d42d199d5685560670ef2ccc6df3c915fda77a02796069123ab

Download Submit
C:\Program Files (x86)\CashReminder\nfapi.dll
Filesize
116KB

MD5
d8305b5c2810e2e135f87bb32d62810e

SHA1
e78991c4d920b61f068c27071253ab5e825572bc

SHA256
a035dde03f95ad199a74e141089ea94d24abb42f56a9cc14c86c76c6ce6932ec

SHA512
c01145ec54a3e2010d777625b65660f4d88a6488de171a97fdfe29b7da15c45aaa88b49a54046d42d199d5685560670ef2ccc6df3c915fda77a02796069123ab

Download Submit
C:\Program Files (x86)\CashReminder\nfregdrv.exe
Filesize
48KB

MD5
01b5780505301ada6dc102fb77b2298c

SHA1
328c3931a54af2d7adb88ba4c4c18ce1af8d5a72

SHA256
aad2d85472448abe8250cf3180c3d0373540f46e8a8e76d8ef2f78db62be0812

SHA512
bc5bd91c46f452a76ae0595287622256e8c79e90158171bedf6b68d4439dfefceb06948bd49deb0aeb1344ce89a312bb87b01e2daf3880729fff642951c33947

Download Submit
C:\Program Files (x86)\CashReminder\nfregdrv.exe
Filesize
48KB

MD5
01b5780505301ada6dc102fb77b2298c

SHA1
328c3931a54af2d7adb88ba4c4c18ce1af8d5a72

SHA256
aad2d85472448abe8250cf3180c3d0373540f46e8a8e76d8ef2f78db62be0812

SHA512
bc5bd91c46f452a76ae0595287622256e8c79e90158171bedf6b68d4439dfefceb06948bd49deb0aeb1344ce89a312bb87b01e2daf3880729fff642951c33947

Download Submit
C:\Program Files (x86)\CashReminder\ssleay32.dll
Filesize
344KB

MD5
da6f5524c9e5b5804dc5117022d08331

SHA1
31054708152012d0c37013ca4945097958169079

SHA256
5083b5da5edcf022c593ce40c2e8bfa90913b4e556401b4908fa29efd3cce5b8

SHA512
1e42b143d40bf5726d5ba632112c97342dbb0cc282ffcd2a05da1f389d6899b8ad3513d4cd099ad71039086dae1ace995b85047afc24b7c80e51ee5dea246dad

Download Submit
C:\Program Files (x86)\CashReminder\ssleay32.dll
Filesize
344KB

MD5
da6f5524c9e5b5804dc5117022d08331

SHA1
31054708152012d0c37013ca4945097958169079

SHA256
5083b5da5edcf022c593ce40c2e8bfa90913b4e556401b4908fa29efd3cce5b8

SHA512
1e42b143d40bf5726d5ba632112c97342dbb0cc282ffcd2a05da1f389d6899b8ad3513d4cd099ad71039086dae1ace995b85047afc24b7c80e51ee5dea246dad

Download Submit
C:\Program Files (x86)\CashReminder\ssleay32.dll
Filesize
344KB

MD5
da6f5524c9e5b5804dc5117022d08331

SHA1
31054708152012d0c37013ca4945097958169079

SHA256
5083b5da5edcf022c593ce40c2e8bfa90913b4e556401b4908fa29efd3cce5b8

SHA512
1e42b143d40bf5726d5ba632112c97342dbb0cc282ffcd2a05da1f389d6899b8ad3513d4cd099ad71039086dae1ace995b85047afc24b7c80e51ee5dea246dad

Download Submit
C:\Program Files (x86)\CashReminder\ssleay32.dll
Filesize
344KB

MD5
da6f5524c9e5b5804dc5117022d08331

SHA1
31054708152012d0c37013ca4945097958169079

SHA256
5083b5da5edcf022c593ce40c2e8bfa90913b4e556401b4908fa29efd3cce5b8

SHA512
1e42b143d40bf5726d5ba632112c97342dbb0cc282ffcd2a05da1f389d6899b8ad3513d4cd099ad71039086dae1ace995b85047afc24b7c80e51ee5dea246dad

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz85DB.tmp\SelfDel.dll
Filesize
5KB

MD5
e5786e8703d651bc8bd4bfecf46d3844

SHA1
fee5aa4b325deecbf69ccb6eadd89bd5ae59723f

SHA256
d115bce0a787b4f895e700efe943695c8f1087782807d91d831f6015b0f98774

SHA512
d14ad43a01db19428cd8ccd2fe101750860933409b5be2eb85a3e400efcd37b1b6425ce84e87a7fe46ecabc7b91c4b450259e624c178b86e194ba7da97957ba3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz85DB.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz85DB.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz85DB.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
memory/1264-166-0x0000000000000000-mapping.dmp

Download
memory/1620-150-0x0000000073180000-0x0000000073189000-memory.dmp

Filesize
36KB

Download
memory/1620-140-0x00000000042A0000-0x00000000042B3000-memory.dmp

Filesize
76KB

Download
memory/2156-165-0x0000000000000000-mapping.dmp

Download
memory/3124-133-0x0000000000000000-mapping.dmp

Download
memory/3528-172-0x0000000000540000-0x000000000054C000-memory.dmp

Filesize
48KB

Download
memory/3528-176-0x0000000000950000-0x00000000009A7000-memory.dmp

Filesize
348KB

Download
memory/3528-180-0x0000000000A7B000-0x0000000000AD1000-memory.dmp

Filesize
344KB

Download
memory/4404-155-0x0000000000000000-mapping.dmp

Download
memory/4744-158-0x0000000000A90000-0x0000000000AE7000-memory.dmp

Filesize
348KB

Download
memory/4744-141-0x0000000000000000-mapping.dmp

Download
memory/4744-149-0x0000000000610000-0x0000000000665000-memory.dmp

Filesize
340KB

Download
memory/4744-163-0x0000000000BBB000-0x0000000000C11000-memory.dmp

Filesize
344KB

Download
memory/4756-164-0x0000000000000000-mapping.dmp

Download