Overview

overview

8

Static

static

7

ReimagePackage.exe

windows7-x64

8

ReimagePackage.exe

windows10-2004-x64

7

$PLUGINSDI...ol.dll

windows7-x64

7

$PLUGINSDI...ol.dll

windows10-2004-x64

7

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDI...os.dll

windows7-x64

3

$PLUGINSDI...os.dll

windows10-2004-x64

3

$PLUGINSDI...ig.dll

windows7-x64

3

$PLUGINSDI...ig.dll

windows10-2004-x64

3

$PLUGINSDIR/LogEx.dll

windows7-x64

3

$PLUGINSDIR/LogEx.dll

windows10-2004-x64

3

$PLUGINSDI...er.exe

windows7-x64

3

$PLUGINSDI...er.exe

windows10-2004-x64

3

$PLUGINSDI...ol.dll

windows7-x64

7

$PLUGINSDI...ol.dll

windows10-2004-x64

7

$PLUGINSDI...os.dll

windows7-x64

3

$PLUGINSDI...os.dll

windows10-2004-x64

3

$PLUGINSDI...ig.dll

windows7-x64

3

$PLUGINSDI...ig.dll

windows10-2004-x64

3

$PLUGINSDIR/LogEx.dll

windows7-x64

3

$PLUGINSDIR/LogEx.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...or.dll

windows7-x64

3

$PLUGINSDI...or.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

7

$PLUGINSDI...ll.dll

windows10-2004-x64

7

Analysis

  • max time kernel
    159s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/04/2024, 13:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ReimagePackage.exe

  • Size

    12.3MB

  • MD5

    0cf8715cbdee01676d24f4f78c7b431f

  • SHA1

    74989063fd05ffb28d0d705c583c2c6b1e9aef99

  • SHA256

    4de22f65551da53a761b1e9049abfcfdeddb4f36dfd50503f4ac45a0e4f972a4

  • SHA512

    248e107e97b2c1c1172abcadffee1497fbf8f75a0b343d983cf13410c2c74c6a7bd23f5d5ece32e76b2521b0a1543f4f6b62a4e8e407ba27ce722e2290976327

  • SSDEEP

    196608:pSjaAQ7Z8aVC/xE4hVS930UqN2FItiZESkM8ZCLfsFrrdTM4nGgAU1Q+osH:oOAQaBvWq0QiZH18ZaIr2qG/sH

Score
7/10
discoverypersistencespywarestealerupx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 34 IoCs
  • Drops file in Windows directory 4 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 64 IoCs
  • Registers COM server for autorun 1 TTPs 22 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 8 IoCs
  • Modifies data under HKEY_USERS 49 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\ReimagePackage.exe
    "C:\Users\Admin\AppData\Local\Temp\ReimagePackage.exe"
    1⤵
    • Adds Run key to start application
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:4256
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq Reimage.exe" > C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2432
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "IMAGENAME eq Reimage.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:3580
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq avupdate.exe" > C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5036
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "IMAGENAME eq avupdate.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:1588
    • C:\Program Files\Reimage\Reimage Repair\lzma.exe
      "C:\Program Files\Reimage\Reimage Repair\lzma.exe" "d" "C:\Program Files\Reimage\Reimage Repair\REI_Axcontrol.lza" "C:\Program Files\Reimage\Reimage Repair\REI_Axcontrol.dll"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      PID:1868
    • C:\Program Files\Reimage\Reimage Repair\lzma.exe
      "C:\Program Files\Reimage\Reimage Repair\lzma.exe" "d" "C:\Program Files\Reimage\Reimage Repair\REI_Engine.lza" "C:\Program Files\Reimage\Reimage Repair\REI_Engine.dll"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      PID:1116
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq REI_avira.exe" > C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5012
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "IMAGENAME eq REI_avira.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:1736
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Program Files\Reimage\Reimage Repair\REI_Axcontrol.dll"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:316
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Program Files\Reimage\Reimage Repair\REI_Axcontrol.dll"
        3⤵
        • Loads dropped DLL
        • Registers COM server for autorun
        • Modifies registry class
        PID:3404
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Program Files\Reimage\Reimage Repair\REI_Engine.dll"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3900
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Program Files\Reimage\Reimage Repair\REI_Engine.dll"
        3⤵
        • Loads dropped DLL
        PID:1148
    • C:\Users\Admin\AppData\Local\Temp\nsq3A66.tmp\ProtectorUpdater.exe
      "C:\Users\Admin\AppData\Local\Temp\nsq3A66.tmp\ProtectorUpdater.exe" /S /MinorSessionID=07307ee59dbc447c8ad59fd370 /SessionID=0 /TrackID= /AgentLogLocation=C:\rei\Results\Agent /CflLocation=C:\rei\cfl.rei /Install=True /DownloaderVersion=1956 /Iav=False
      2⤵
      • Drops file in Windows directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1708
      • C:\Windows\SysWOW64\cmd.exe
        cmd /C tasklist /FI "IMAGENAME eq UniProtectorPackage.exe" > C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4484
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist /FI "IMAGENAME eq UniProtectorPackage.exe"
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:3488
      • C:\Users\Admin\AppData\Local\Temp\UniProtectorPackage.exe
        "C:\Users\Admin\AppData\Local\Temp\UniProtectorPackage.exe" /S /MinorSessionID=07307ee59dbc447c8ad59fd370 /SessionID=08449618-2811-47cc-b036-496d0e8e022f /Install=true /UpdateOnly=default /InstallPath= /Iav=False /SessionOk=true
        3⤵
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:548
        • C:\Windows\SysWOW64\cmd.exe
          cmd /C tasklist /FI "IMAGENAME eq ReiScanner.exe" > C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5100
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /FI "IMAGENAME eq ReiScanner.exe"
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1020
        • C:\Windows\SysWOW64\cmd.exe
          cmd /C tasklist /FI "IMAGENAME eq ReiProtectorM.exe" > C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1712
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /FI "IMAGENAME eq ReiProtectorM.exe"
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4388
        • C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe
          "C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe" -install
          4⤵
          • Executes dropped EXE
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          PID:2252
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq ReiGuard.exe" > C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
      2⤵
        PID:680
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist /FI "IMAGENAME eq ReiGuard.exe"
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4992
      • C:\Windows\SysWOW64\cmd.exe
        cmd /C tasklist /FI "IMAGENAME eq ReimageApp.exe" > C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
        2⤵
          PID:2320
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /FI "IMAGENAME eq ReimageApp.exe"
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4508
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Delete /TN ReimageUpdater /F
          2⤵
            PID:4352
          • C:\Program Files\Reimage\Reimage Protector\ReimageApp.exe
            "C:\Program Files\Reimage\Reimage Protector\ReimageApp.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:316
          • C:\Windows\SYSTEM32\regsvr32.exe
            regsvr32 /s "C:\Windows\system32\jscript.dll"
            2⤵
            • Registers COM server for autorun
            • Modifies registry class
            PID:1384
          • C:\Program Files\Reimage\Reimage Repair\Reimage.exe
            "C:\Program Files\Reimage\Reimage Repair\Reimage.exe" /DEFAULT /Locale=1033
            2⤵
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:524
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
          1⤵
            PID:5036
          • C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe
            "C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe"
            1⤵
            • Enumerates connected drives
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3572
            • C:\Program Files\Reimage\Reimage Protector\ReiSystem.exe
              "C:\Program Files\Reimage\Reimage Protector\ReiSystem.exe"
              2⤵
              • Executes dropped EXE
              PID:60
            • C:\Program Files\Reimage\Reimage Protector\ReiSystem.exe
              commadnlinetogetexplorerhistory 3600 "C:\Users\Admin\AppData\Local\Temp\240776109_file.txt"
              2⤵
              • Executes dropped EXE
              PID:4724

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\Reimage\Reimage Protector\ReimageApp.exe
            Filesize

            261KB

            MD5

            88d21bbe0c15959cd71274ed6198804e

            SHA1

            eeca578e046963b359c9a124fe993347ce5b2fb3

            SHA256

            037a67a221096c076d162d5f0f3ad5720ed0d49308d041dea235c5785a557565

            SHA512

            66e4bf84706c69e49526529643911d92aa6be19fc7839c27e07b4d38fcf6648744b738ecb2e26adf83f9132c9a73bf734b4986ef21831224f8151f6b3be53e82

            Download Submit

          • C:\Program Files\Reimage\Reimage Repair\LZMA.EXE
            Filesize

            99KB

            MD5

            a59ab79ec748d1da70e326b49b8aa820

            SHA1

            145d254525c6b41251733953e3d4e00e3370f0fd

            SHA256

            871361690289c50c81a6e38c28914121adceab3ff0ba93d043f1cc4e59635955

            SHA512

            5cd4fdfe9e20151313814551a36ab0aab8881fc1b12b5c41e0ccd64d6f4980e908b3493efd569964ce63290853785c10b151285ab19b37c7d3a411b5461275b9

            Download Submit

          • C:\Program Files\Reimage\Reimage Repair\REI_Axcontrol.dll
            Filesize

            517KB

            MD5

            9fc5eab5cb90d5d3c1495dae779df986

            SHA1

            15347cb02ff6c04ee957a6f861a390c56a3fd8ca

            SHA256

            aa5d2d054b67847257926d95b8a8645799fb19d06a28473c8c18fdf4ad0b94d6

            SHA512

            37d24bd3fe80cffd8c650bcd724263be42460d18e2547da42dcfd7fba88adec98c01ac2122677af9b0338d7ebb74c535226b77fb17852413d565bb01bfa910da

            Download Submit

          • C:\Program Files\Reimage\Reimage Repair\REI_Axcontrol.lza
            Filesize

            142KB

            MD5

            cd517a6523aeae7755380415214ecdd1

            SHA1

            dc94e7bfc2157c022eaef55b9132403a938e77c2

            SHA256

            92e59cf5a5f93b94011e2f1119ea9ab421177749fb7439e1017f6e37d4ec6ff0

            SHA512

            0076816a01acfc24d37a4a4729f6b9c18353ee3c1ceef2d7b8138d079f9237ea83e8b6a09df95ff9c0321ad42d249c25b6278e974ecddabfcf6b98600c46cfaf

            Download Submit

          • C:\Program Files\Reimage\Reimage Repair\REI_Engine.dll
            Filesize

            11.4MB

            MD5

            85912149fdd8098d6ae2a183f8b18ea3

            SHA1

            23afc9e77e9731fc416abe91b1e5cae3eeeeb8c9

            SHA256

            41218635867d1c1ec4ff045e29a908aa9e0006c760cbb057302b2fb92b295181

            SHA512

            63fdc4186358110d1d80fe10a01bd476eefb0a08ae931f54c234c635cb9524143afb0f91dcb1044b7402f9b8135f788afdda9896ae344bf9bb010e3228354236

            Download Submit

          • C:\Program Files\Reimage\Reimage Repair\REI_Engine.lza
            Filesize

            3.7MB

            MD5

            f8f13a4be08dd40baeced5083d12e0aa

            SHA1

            bb513d5a2833555b26c4493b80d7de4c9cd1e773

            SHA256

            f3f76537f7a71cc15458c527b56724a9c508c817fae6cb5b70005ef2d17b99ec

            SHA512

            c99a1992f1dc2f97d0460d0a28d400aba424131fe2e5b742faa2701fa6e278e6d3d954c0e21d0051915877b52b3bc208ff9f899600d395e8ab4e64576a3dbbc1

            Download Submit

          • C:\Program Files\Reimage\Reimage Repair\Reimage.exe
            Filesize

            7.0MB

            MD5

            565319f9015978e86083f9cfbe81f3c5

            SHA1

            9ec39e7268ff6bccb65fd29a37cff66fccc0f461

            SHA256

            a42f5b0735c4e6dec3832ef8cc7c76884cc086e7323a2d03728f261936beb325

            SHA512

            ace0f3d19d7c2a4d2e357b9aefba35960e4513258679750d577b6f20755fe8b885b874e8f807aabf69e806ca21177c5d3dd55f9b1c001fd493a83f04532e5e75

            Download Submit

          • C:\Program Files\Reimage\Reimage Repair\ReimageRepair.exe
            Filesize

            572KB

            MD5

            f5af9d859c9a031ab6bea66048fab6e1

            SHA1

            d0ee45d3534cc23cbd0d7c3765203ed926a7eb0a

            SHA256

            4efd1bc1bdc12da1bbdc597cf3f37f0c65e582f42e353cf781ac1fe422dfa68c

            SHA512

            c771c3e7ef88116168b9e3e0d0e4dbb2f2ad03dec0a87b9d3427faf7edb0a2510bb80dcb57b50fb6bcb9f683f23d876f35dc91a85006973bdb3fec41d51145a5

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\events4mem[1].htm
            Filesize

            2B

            MD5

            444bcb3a3fcf8389296c49467f27e1d6

            SHA1

            7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb

            SHA256

            2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

            SHA512

            9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
            Filesize

            64B

            MD5

            dea052a2ad11945b1960577c0192f2eb

            SHA1

            1d02626a05a546a90c05902b2551f32c20eb3708

            SHA256

            943b315e065238b7073b033f534ef954b6b6461fb3f03a3f5b8555b11bc4c0a2

            SHA512

            5496b10e2a77aee11055d71bdaaed835df1770e85fa4d0f9433330470bbcf76c932c04778a0b47f4193eee14813db2e2b19ecc50b4a6a193faa19b4019705917

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\UniProtectorPackage.exe
            Filesize

            6.0MB

            MD5

            0a21dab75a58f818abae4b824087a1e8

            SHA1

            6f0798ff9b9128233c1fb7b641332730b1702535

            SHA256

            99ebcdeab3f755f402bce0d8b59a736056b64e0db96d486466735d23ec856b86

            SHA512

            1ebfe810e2bd693bea4899f00d438bc0032abe15d47c4241fec14183bb45882185999f232a126ad885c51e9b6e9468e8333ed453880777a94b4545e88d7648a2

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\cfl.rei
            Filesize

            971KB

            MD5

            41b797743d2d08233b680501b086d669

            SHA1

            e19aaa402c3e6fedbf4f8cfd0256b537cb001ca5

            SHA256

            5805c8a496c13e9085f624a9c4f20188587d7b13d9c3e5f79f0f78367df74cf5

            SHA512

            13fbcc4d53c65ce1b09fb6fa088824384659a9d4bcf1713ce8c75caa08a0f3df9e14061d42f4696608547b326a6fd1ef18fa92cbd3e3016559630d2e57358b80

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\downloader_version.xml
            Filesize

            2KB

            MD5

            919d48cafc7b57dfb2c01f986da92f61

            SHA1

            df594b0569821ab449a05ae9824d0f7965308536

            SHA256

            0e303a2be594711cd28768e44d98edbeabe110acce0f4c76da4c842d1db55686

            SHA512

            039eb656f0335a4f4e230768c51749a589c5d98c89506c619b6bac40f59bf22a8ac56419f6c04c42e6c8e0072546028489e4b8bff218d151779c5e9fed962a03

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\nsq3A66.tmp\DcryptDll.dll
            Filesize

            156KB

            MD5

            4c373143ee342a75b469e0748049cd24

            SHA1

            d4e0e5155e78b99ec9459136acece2364bc2e935

            SHA256

            b4b5772a893e56aa5382aa3f0fef7837fa471e3b3e46db70b8bc702f2037e589

            SHA512

            569f92c3ff9a6e105cf9b3806d8b696442a5679dfa5d7c9362b0649a67cbea2478ca28a5da6c3bd0edacdb634509d8584c6959a4cc13c38d596458f372832f61

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\nsq3A66.tmp\LogEx.dll
            Filesize

            44KB

            MD5

            0f96d9eb959ad4e8fd205e6d58cf01b8

            SHA1

            7c45512cbdb24216afd23a9e8cdce0cfeaa7660f

            SHA256

            57ede354532937e38c4ae9da3710ee295705ea9770c402dfb3a5c56a32fd4314

            SHA512

            9f3afb61d75ac7b7dc84abcbf1b04f759b7055992d46140dc5dcc269aed22268d044ee8030f5ea260bbb912774e5bbb751560c16e54efa99c700b9fc7d48832c

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\nsq3A66.tmp\ProtectorUpdater.exe
            Filesize

            371KB

            MD5

            7aa7e8423194f3edf6d1d82ade82acb3

            SHA1

            a4ca6d67fc43dd742e87b4c82237cdc8b1bb22d9

            SHA256

            1ba53128ef67d7e355b2e44c90c4bfe3dddff4546ad4e9c75e249d4850250361

            SHA512

            e5fc8a1b515f41f60810ec12f5e36263c889c60b06c6b94450eec910a32ba91fba74bd757d54966d657d37a5ca3c5e9bb23f58f3de4255c276e046b6f1be28bb

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\nsq3A66.tmp\System.dll
            Filesize

            11KB

            MD5

            bf712f32249029466fa86756f5546950

            SHA1

            75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

            SHA256

            7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

            SHA512

            13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\nsq3A66.tmp\inetc.dll
            Filesize

            31KB

            MD5

            5da9df435ff20853a2c45026e7681cef

            SHA1

            39b1d70a7a03e7c791cb21a53d82fd949706a4b4

            SHA256

            9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2

            SHA512

            4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\nsq3A66.tmp\nsExec.dll
            Filesize

            6KB

            MD5

            132e6153717a7f9710dcea4536f364cd

            SHA1

            e39bc82c7602e6dd0797115c2bd12e872a5fb2ab

            SHA256

            d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2

            SHA512

            9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\nsq3A66.tmp\stack.dll
            Filesize

            10KB

            MD5

            867af9bea8b24c78736bf8d0fdb5a78e

            SHA1

            05839fad98aa2bcd9f6ecb22de4816e0c75bf97d

            SHA256

            732164fb36f46dd23dafb6d7621531e70f1f81e2967b3053727ec7b5492d0ae9

            SHA512

            b7f54d52ff08b29a04b4f5887e6e3ae0e74fa45a86e55e0a4d362bc3603426c42c1d6a0b2fc2ef574bec0f6c7152de756ff48415e37ae6a7a9c296303562df4b

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\nsq3A66.tmp\xml.dll
            Filesize

            182KB

            MD5

            ebce8f5e440e0be57665e1e58dfb7425

            SHA1

            573dc1abd2b03512f390f569058fd2cf1d02ce91

            SHA256

            d1aaacc0aaf477b6b9f084697adcb444fc2333b32e8d99d224dca89516e762a7

            SHA512

            4786c9124973b6543d7291047d4c4a06c05282a3766212dbd3b8ce9b9560afddca20c491f791db2258c14ab767d5d3f480daa4706492949eae2ceb4a35aaef85

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\nsrC793.tmp\SimpleSC.dll
            Filesize

            39KB

            MD5

            3f1be1321461c7b7a3b4322391c818f0

            SHA1

            f59b7a1e65f60a446f4355e22f0a10bddec3d21b

            SHA256

            3d7a8cf88fbed3417ff7bf998188f830c2f52da4e9a36da3edb438310ad1b1cd

            SHA512

            2f11c28694746ad8dcbd1e04988d682152986f81959a425aab542483872aa5e30eadb36af0838f5301867279687b2c4b6417bd4b93053dcab6a13b6802164bb7

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\nstA5C2.tmp\AccessControl.dll
            Filesize

            8KB

            MD5

            65d017ba65785b43720de6c9979a2e8c

            SHA1

            0aed2846e1b338077bae5a7f756c345a5c90d8a9

            SHA256

            ccc6aaf1071d9077475b574d9bf1fc23de40a06547fc90cf4255a44d3bf631ac

            SHA512

            31a19105892d5a9b49eb81a90a2330c342a5504fa4940b99a12279a63e1a19ee5d4b257d0900794ff7021a09408995a5d12e95cc38f09cf12fb2fd860d205c95

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\nstA5C2.tmp\UserInfo.dll
            Filesize

            4KB

            MD5

            c7ce0e47c83525983fd2c4c9566b4aad

            SHA1

            38b7ad7bb32ffae35540fce373b8a671878dc54e

            SHA256

            6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae

            SHA512

            ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e

            Download Submit

          • C:\Windows\Reimage.ini
            Filesize

            64B

            MD5

            f1a20ed4e7b91c00f105bf00ba650069

            SHA1

            05459f7722c34b33850c0207bb916739041aabcb

            SHA256

            f873527ad7fa12a2d276cc6953c0755e4d3e976567a4252093c1fe3ad401955f

            SHA512

            504c1f1e1c2e56dee8e9add33e4a9c05c75fce65299fdf38f5e3cd612c06b3b348829c033bc1f0281a278e9e87b2f256702d8d1d5ec0a2666fffaed0e5252426

            Download Submit

          • C:\Windows\Reimage.ini
            Filesize

            99B

            MD5

            f53cbf0198b49733a5e74de6ae928afd

            SHA1

            fe6967b3d3d82c0d5cb651a7289b232f22977340

            SHA256

            786db4fab30e3c0755f55cde91317138ac8e24cda72fa929c10b37a3903a072d

            SHA512

            5448d7f77a78b336c588bc32f57e04807f7709d76a5f7fe3b84104c9b75984795463bc3a5c36ab8b076c80a72b37b5cbd222d69bc383532a3273c04a5421e9f3

            Download Submit

          • C:\Windows\Temp\Local State
            Filesize

            128KB

            MD5

            f31c226181d5003872a77331412bed4a

            SHA1

            62866288f57a80062b34cc5196b176c5b423eaff

            SHA256

            06e262e39414d59267e5e1116442365b69e81cce82d89727c3a22b1593254c7b

            SHA512

            157364b8f240e2c0be11bab81a0b31bfce97c59f3ae917d5b1d93db94a07b18eeea54417ba983f53d73741bfae3088b359d59875cb900b54b609dd32c42f395d

            Download Submit

          • C:\Windows\Temp\Secure Preferences
            Filesize

            10KB

            MD5

            b02a40a554ba541d09bb65338525fbc9

            SHA1

            755ab4322d7ae4d1c3c14adf8818eed12ce81208

            SHA256

            08d6ca9f2c24148cf9fbb1abfef439d27645df5db34b52913ce9f4723cce60d0

            SHA512

            361982eed15cacf44cab7c125143bfcf0176b697e7186eaf7a5a9aecdf929b97e724a186d8e5260bd930c92c8044b14bd4066f80e2ed1b9b9f916e681af06025

            Download Submit

          • memory/524-586-0x0000019CA2820000-0x0000019CA3E97000-memory.dmp

            Filesize

            22.5MB

            Download

          • memory/524-515-0x0000019CA2820000-0x0000019CA3E97000-memory.dmp

            Filesize

            22.5MB

            Download

          • memory/524-517-0x0000019CA2820000-0x0000019CA3E97000-memory.dmp

            Filesize

            22.5MB

            Download

          • memory/524-587-0x0000019CA2820000-0x0000019CA3E97000-memory.dmp

            Filesize

            22.5MB

            Download

          • memory/524-516-0x0000019CA2820000-0x0000019CA3E97000-memory.dmp

            Filesize

            22.5MB

            Download

          • memory/524-588-0x0000019CA2820000-0x0000019CA3E97000-memory.dmp

            Filesize

            22.5MB

            Download

          • memory/524-514-0x0000019CA2820000-0x0000019CA3E97000-memory.dmp

            Filesize

            22.5MB

            Download

          • memory/548-341-0x00000000025E0000-0x00000000025EB000-memory.dmp

            Filesize

            44KB

            Download

          • memory/1708-216-0x0000000002A00000-0x0000000002A0B000-memory.dmp

            Filesize

            44KB

            Download

          • memory/1708-326-0x0000000073940000-0x000000007394B000-memory.dmp

            Filesize

            44KB

            Download

          • memory/1708-196-0x0000000073940000-0x000000007394B000-memory.dmp

            Filesize

            44KB

            Download

          • memory/4256-447-0x0000000000E70000-0x0000000000E7B000-memory.dmp

            Filesize

            44KB

            Download

          • memory/4256-430-0x00000000009A0000-0x00000000009AB000-memory.dmp

            Filesize

            44KB

            Download

          • memory/4256-411-0x0000000000980000-0x000000000098B000-memory.dmp

            Filesize

            44KB

            Download

          • memory/4256-137-0x00000000051D0000-0x00000000051DB000-memory.dmp

            Filesize

            44KB

            Download

          • memory/4256-40-0x00000000050B0000-0x00000000050BB000-memory.dmp

            Filesize

            44KB

            Download