Overview

overview

10

Static

static

1

reiboot_11...01.exe

windows10-2004-x64

10

reiboot_11...01.exe

windows11-ltsc_2024-x64

4

Analysis

  • user interaction
    yes
  • max time kernel
    113s
  • max time network
    116s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/07/2026, 11:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    reiboot_11784029398451503501.exe
  • Size 73.8MB
  • Sample260714-nv8kgaes21
  • SHA256 f47821370cc87029c6070fb8eba3c18f8d28d0b7c808acdfab63b1384133cd36
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoveryinstallerpersistenceprivilege_escalationspywarevmprotect

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 1 IoCs
    defense_evasion
  • Drops file in Drivers directory 1 IoCs
  • Modifies file permissions 1 TTPs 3 IoCs
    discovery
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Modifies Windows Firewall 2 TTPs 4 IoCs
    defense_evasion
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • ConfuserEx .NET packer 8 IoCs

    Detects ConfuserEx .NET packer.

  • Drops file in System32 directory 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 17 IoCs
  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 4 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\reiboot_11784029398451503501.exe
    "C:\Users\Admin\AppData\Local\Temp\reiboot_11784029398451503501.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3816
    • C:\Users\Admin\AppData\Local\Temp\is-3FDLO.tmp\reiboot_11784029398451503501.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-3FDLO.tmp\reiboot_11784029398451503501.tmp" /SL5="$D0220,76801713,233472,C:\Users\Admin\AppData\Local\Temp\reiboot_11784029398451503501.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4064
      • C:\Windows\SysWOW64\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="Bonjour Service(ts)" program="C:\Program Files (x86)\Tenorshare ReiBoot\Bonjour\mDNSResponder.exe" dir=in action=allow enable=yes protocol=tcp localport=any
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:4852
      • C:\Windows\SysWOW64\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="Bonjour Service(ts)" program="C:\Program Files (x86)\Tenorshare ReiBoot\Bonjour\mDNSResponder.exe" dir=in action=allow enable=yes protocol=udp localport=any
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:1284
      • C:\Windows\SysWOW64\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="Bonjour Service(ts)" program="C:\Program Files (x86)\Tenorshare ReiBoot\Bonjour\mDNSResponder.exe" dir=out action=allow enable=yes protocol=tcp localport=any
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:1416
      • C:\Windows\SysWOW64\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="Bonjour Service(ts)" program="C:\Program Files (x86)\Tenorshare ReiBoot\Bonjour\mDNSResponder.exe" dir=out action=allow enable=yes protocol=udp localport=any
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:4804
      • C:\Program Files (x86)\Tenorshare ReiBoot\NetFrameCheck.exe
        "C:\Program Files (x86)\Tenorshare ReiBoot\NetFrameCheck.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4404
        • C:\Program Files (x86)\Tenorshare ReiBoot\ReiBoot.exe
          "C:\Program Files (x86)\Tenorshare ReiBoot\ReiBoot.exe"
          4⤵
          • Drops file in Drivers directory
          • Checks computer location settings
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2104
          • C:\Program Files (x86)\Tenorshare ReiBoot\Monitor\Monitor.exe
            "C:\Program Files (x86)\Tenorshare ReiBoot\Monitor\Monitor.exe" 2104(#-+)UA-113287545-3(#-+)Tenorshare ReiBoot(#-+)9.6.13.9(#-+)&cd1=9.6.13.9&cd2=unregister&cd3=ts&cd4=2.3.10.0&cd5=Other&cd6=en&cd7=64&cd9=64_Microsoft Windows NT 10.0.19041.0&cd10=NO&cd11=Null&cd12=Null&cd13=UnConnect(#-+)1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:1928
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cbs.tenorshare.com/go?pid=1051&a=i&v=9.6.13
            5⤵
            • Checks processor information in registry
            • Enumerates system info in registry
            • Modifies data under HKEY_USERS
            • Modifies registry class
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:4388
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x330,0x7ffc8d2fc188,0x7ffc8d2fc194,0x7ffc8d2fc1a0
              6⤵
                PID:5096
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,6666343260339813631,4625579001064608224,524288 --field-trial-handle=2472,i,12323557383106857999,14879197105613572543,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:3
                6⤵
                • System Time Discovery
                PID:1840
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,14437907462564923113,13792849478953227375,262144 --field-trial-handle=2472,i,12323557383106857999,14879197105613572543,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:2
                6⤵
                  PID:2052
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,10194900713841525699,18358979257804951231,524288 --field-trial-handle=2472,i,12323557383106857999,14879197105613572543,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:8
                  6⤵
                    PID:752
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,7407585823188896722,6622623432648160196,2097152 --field-trial-handle=2472,i,12323557383106857999,14879197105613572543,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
                    6⤵
                      PID:4528
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,16927884780705727137,327655956954772145,2097152 --field-trial-handle=2472,i,12323557383106857999,14879197105613572543,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
                      6⤵
                        PID:3904
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,4903900419456291359,15650081992512375209,2097152 --field-trial-handle=2472,i,12323557383106857999,14879197105613572543,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
                        6⤵
                          PID:1076
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,7443439113607270341,5270940068240283294,2097152 --field-trial-handle=2472,i,12323557383106857999,14879197105613572543,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
                          6⤵
                            PID:4792
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,13875649662363790347,1960259920578434555,524288 --field-trial-handle=2472,i,12323557383106857999,14879197105613572543,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
                            6⤵
                              PID:3284
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,3266303786176205851,15097372198283908448,524288 --field-trial-handle=2472,i,12323557383106857999,14879197105613572543,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
                              6⤵
                                PID:1844
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,10390820701427742577,10306911515845264378,524288 --field-trial-handle=2472,i,12323557383106857999,14879197105613572543,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
                                6⤵
                                  PID:4224
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,7069935278048924800,9885516390434429170,524288 --field-trial-handle=2472,i,12323557383106857999,14879197105613572543,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
                                  6⤵
                                    PID:1176
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,480697970990182001,4518319236239920149,524288 --field-trial-handle=2472,i,12323557383106857999,14879197105613572543,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
                                    6⤵
                                      PID:2372
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,480697970990182001,4518319236239920149,524288 --field-trial-handle=2472,i,12323557383106857999,14879197105613572543,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
                                      6⤵
                                        PID:2452
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,10554899058845078667,5313254444205711530,524288 --field-trial-handle=2472,i,12323557383106857999,14879197105613572543,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
                                        6⤵
                                          PID:5420
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,2829693527340113428,16808348970577129470,524288 --field-trial-handle=2472,i,12323557383106857999,14879197105613572543,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
                                          6⤵
                                            PID:5668
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,16926982881959552096,6089387076265733755,524288 --field-trial-handle=2472,i,12323557383106857999,14879197105613572543,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
                                            6⤵
                                              PID:5828
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,15082604189370603447,6400546002797548855,524288 --field-trial-handle=2472,i,12323557383106857999,14879197105613572543,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
                                              6⤵
                                                PID:5988
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,2451023262032628807,7149656253881790740,524288 --field-trial-handle=2472,i,12323557383106857999,14879197105613572543,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:8
                                                6⤵
                                                  PID:5432
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,1784120512648932856,10074088814776720942,524288 --field-trial-handle=2472,i,12323557383106857999,14879197105613572543,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
                                                  6⤵
                                                    PID:5720
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,4231317133614754218,18081528533630053150,524288 --field-trial-handle=2472,i,12323557383106857999,14879197105613572543,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
                                                    6⤵
                                                      PID:5660
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,15730967845508306688,6308312124619817840,524288 --field-trial-handle=2472,i,12323557383106857999,14879197105613572543,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
                                                      6⤵
                                                        PID:5680
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,7860671044287772011,9377122866989609046,524288 --field-trial-handle=2472,i,12323557383106857999,14879197105613572543,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
                                                        6⤵
                                                          PID:1776
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,4133513311400766340,10817574453848494703,524288 --field-trial-handle=2472,i,12323557383106857999,14879197105613572543,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
                                                          6⤵
                                                            PID:4492
                                                        • C:\Program Files (x86)\Tenorshare ReiBoot\AppleMobileDeviceProcess.exe
                                                          "C:\Program Files (x86)\Tenorshare ReiBoot\AppleMobileDeviceProcess.exe"
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:640
                                                        • C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\CheckErrorx64.exe
                                                          "C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\CheckErrorx64.exe"
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Checks SCSI registry key(s)
                                                          PID:416
                                                        • C:\Program Files (x86)\Tenorshare ReiBoot\MsgSupport\MsgSupportService.exe
                                                          "C:\Program Files (x86)\Tenorshare ReiBoot\MsgSupport\MsgSupportService.exe" ga_pipe_2104 QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxUZW5vcnNoYXJlIFJlaUJvb3Q= 9.6.13.9
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4916
                                                        • C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\infInstallx64.exe
                                                          "C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\infInstallx64.exe" -d "C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\NewUsbDrivers64\AppleUsb.inf"
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5224
                                                          • C:\Windows\SYSTEM32\takeown.exe
                                                            takeown /F C:\Windows\System32\DriverStore\FileRepository\ /A
                                                            6⤵
                                                            • Modifies file permissions
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:5372
                                                          • C:\Windows\SYSTEM32\cacls.exe
                                                            cacls C:\Windows\System32\DriverStore\FileRepository*.* /E /G Everyone:F
                                                            6⤵
                                                              PID:5456
                                                          • C:\Windows\SYSTEM32\netstat.exe
                                                            "netstat.exe" -a -n -o
                                                            5⤵
                                                            • Gathers network information
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:5240
                                                          • C:\Windows\SYSTEM32\netstat.exe
                                                            "netstat.exe" -a -n -o
                                                            5⤵
                                                            • Gathers network information
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:5364
                                                          • C:\Windows\SYSTEM32\netstat.exe
                                                            "netstat.exe" -a -n -o
                                                            5⤵
                                                            • Gathers network information
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:5484
                                                          • C:\Windows\SYSTEM32\netstat.exe
                                                            "netstat.exe" -a -n -o
                                                            5⤵
                                                            • Gathers network information
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:5536
                                                          • C:\Program Files (x86)\Tenorshare ReiBoot\Bonjour\mDNSResponder.exe
                                                            "C:\Program Files (x86)\Tenorshare ReiBoot\Bonjour\mDNSResponder.exe" -server
                                                            5⤵
                                                            • Modifies firewall policy service
                                                            • Executes dropped EXE
                                                            PID:5572
                                                          • C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\infInstallx64.exe
                                                            "C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\infInstallx64.exe" -d "C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\NetDrivers64\netaapl64.inf"
                                                            5⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5788
                                                            • C:\Windows\SYSTEM32\takeown.exe
                                                              takeown /F C:\Windows\System32\DriverStore\FileRepository\ /A
                                                              6⤵
                                                              • Modifies file permissions
                                                              PID:6064
                                                            • C:\Windows\SYSTEM32\cacls.exe
                                                              cacls C:\Windows\System32\DriverStore\FileRepository*.* /E /G Everyone:F
                                                              6⤵
                                                                PID:6088
                                                            • C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\infInstallx64.exe
                                                              "C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\infInstallx64.exe" -i "C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\NewUsbDrivers64\AppleUsb.inf"
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1488
                                                              • C:\Windows\SYSTEM32\pnputil.exe
                                                                pnputil -i -a "C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\NewUsbDrivers64\AppleUsb.inf"
                                                                6⤵
                                                                • Drops file in Windows directory
                                                                • Checks SCSI registry key(s)
                                                                PID:4136
                                                            • C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\infInstallx64.exe
                                                              "C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\infInstallx64.exe" -i "C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\NetDrivers64\netaapl64.inf"
                                                              5⤵
                                                              • Executes dropped EXE
                                                              PID:716
                                                              • C:\Windows\SYSTEM32\pnputil.exe
                                                                pnputil -i -a "C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\NetDrivers64\netaapl64.inf"
                                                                6⤵
                                                                • Drops file in Windows directory
                                                                • Checks SCSI registry key(s)
                                                                PID:2480
                                                            • C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\infInstallx64.exe
                                                              "C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\infInstallx64.exe" -dkis "C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\AppleKis\AppleKIS.inf"
                                                              5⤵
                                                              • Executes dropped EXE
                                                              PID:6120
                                                              • C:\Windows\SYSTEM32\takeown.exe
                                                                takeown /F C:\Windows\System32\DriverStore\FileRepository\ /A
                                                                6⤵
                                                                • Modifies file permissions
                                                                PID:3904
                                                              • C:\Windows\SYSTEM32\cacls.exe
                                                                cacls C:\Windows\System32\DriverStore\FileRepository*.* /E /G Everyone:F
                                                                6⤵
                                                                  PID:4676
                                                              • C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\infInstallx64.exe
                                                                "C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\infInstallx64.exe" -i "C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\AppleKis\AppleKIS.inf"
                                                                5⤵
                                                                • Executes dropped EXE
                                                                PID:5952
                                                                • C:\Windows\SYSTEM32\pnputil.exe
                                                                  pnputil -i -a "C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\AppleKis\AppleKIS.inf"
                                                                  6⤵
                                                                  • Drops file in Windows directory
                                                                  • Checks SCSI registry key(s)
                                                                  PID:5452
                                                              • C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\infInstallx64.exe
                                                                "C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\infInstallx64.exe" -i "C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\AppleRsm\AppleRSM.inf"
                                                                5⤵
                                                                • Executes dropped EXE
                                                                PID:3924
                                                                • C:\Windows\SYSTEM32\pnputil.exe
                                                                  pnputil -i -a "C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\AppleRsm\AppleRSM.inf"
                                                                  6⤵
                                                                  • Drops file in Windows directory
                                                                  • Checks SCSI registry key(s)
                                                                  PID:5196
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                        1⤵
                                                          PID:756
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                          1⤵
                                                          • Drops file in Windows directory
                                                          • Checks SCSI registry key(s)
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5476
                                                          • C:\Windows\system32\DrvInst.exe
                                                            DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{d1e9d8ef-5e70-844d-9b85-01e972b32d6b}\AppleUsb.inf" "9" "49b1b23bb" "0000000000000138" "WinSta0\Default" "0000000000000148" "208" "C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\NewUsbDrivers64"
                                                            2⤵
                                                            • Drops file in System32 directory
                                                            • Drops file in Windows directory
                                                            • Checks SCSI registry key(s)
                                                            • Modifies data under HKEY_USERS
                                                            PID:5376
                                                          • C:\Windows\system32\DrvInst.exe
                                                            DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{231ce1d2-3e47-fb47-84fa-7723dbd27a2b}\netaapl64.inf" "9" "4c4507c6f" "00000000000000F8" "WinSta0\Default" "0000000000000148" "208" "C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\NetDrivers64"
                                                            2⤵
                                                            • Drops file in System32 directory
                                                            • Drops file in Windows directory
                                                            • Checks SCSI registry key(s)
                                                            • Modifies data under HKEY_USERS
                                                            PID:3388
                                                          • C:\Windows\system32\DrvInst.exe
                                                            DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{1ecf796f-970c-8148-8248-e017a6b49021}\AppleKIS.inf" "9" "46807205f" "0000000000000148" "WinSta0\Default" "00000000000000F4" "208" "C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\AppleKis"
                                                            2⤵
                                                            • Drops file in System32 directory
                                                            • Drops file in Windows directory
                                                            • Checks SCSI registry key(s)
                                                            • Modifies data under HKEY_USERS
                                                            PID:5544
                                                          • C:\Windows\system32\DrvInst.exe
                                                            DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{4eb5e1a7-3540-2e49-96e1-015cce9e3083}\AppleRSM.inf" "9" "403a25637" "00000000000000F4" "WinSta0\Default" "0000000000000134" "208" "C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\AppleRsm"
                                                            2⤵
                                                            • Drops file in System32 directory
                                                            • Drops file in Windows directory
                                                            • Checks SCSI registry key(s)
                                                            • Modifies data under HKEY_USERS
                                                            PID:5840

                                                        Network

                                                              MITRE ATT&CK Enterprise v16

                                                              Reconnaissance

                                                              Resource Development

                                                              Initial Access

                                                              Execution

                                                              Command and Scripting Interpreter

                                                              1
                                                              T1059

                                                              Persistence

                                                              Create or Modify System Process

                                                              2
                                                              T1543

                                                              Windows Service

                                                              2
                                                              T1543.003

                                                              Event Triggered Execution

                                                              1
                                                              T1546

                                                              Netsh Helper DLL

                                                              1
                                                              T1546.007

                                                              Privilege Escalation

                                                              Create or Modify System Process

                                                              2
                                                              T1543

                                                              Windows Service

                                                              2
                                                              T1543.003

                                                              Event Triggered Execution

                                                              1
                                                              T1546

                                                              Netsh Helper DLL

                                                              1
                                                              T1546.007

                                                              Defense Evasion

                                                              File and Directory Permissions Modification

                                                              1
                                                              T1222

                                                              Impair Defenses

                                                              2
                                                              T1562

                                                              Disable or Modify System Firewall

                                                              2
                                                              T1562.004

                                                              Modify Registry

                                                              2
                                                              T1112

                                                              Credential Access

                                                              Discovery

                                                              Browser Information Discovery

                                                              1
                                                              T1217

                                                              Network Share Discovery

                                                              1
                                                              T1135

                                                              Peripheral Device Discovery

                                                              1
                                                              T1120

                                                              Query Registry

                                                              5
                                                              T1012

                                                              System Information Discovery

                                                              6
                                                              T1082

                                                              System Location Discovery

                                                              1
                                                              T1614

                                                              System Language Discovery

                                                              1
                                                              T1614.001

                                                              System Time Discovery

                                                              1
                                                              T1124

                                                              Lateral Movement

                                                              Collection

                                                              Command and Control

                                                              Exfiltration

                                                              Impact

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              5yky2zwq.newcfg
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\5yky2zwq.newcfg
                                                              • Size 3KB
                                                              • SHA256 6abffe924f71158a8a6156a77dda9f2341241e334228ec1208ccfcaaa47b1430
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              AccountCenterV3.Views.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\AccountCenterV3.Views.dll
                                                              • Size 2.0MB
                                                              • SHA256 90b90f9a04254564d37641f9514db0b8ae11df3abfb50894686f8a63d68969dc
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              AgentSupportCLR.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\AgentSupportCLR.dll
                                                              • Size 1.3MB
                                                              • SHA256 0878caf22c1ca752bf36e32a457d796836b4b42c4b93eedfad078896c94d9088
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              AntiCrack.dat
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\AntiCrack.dat
                                                              • Size 320B
                                                              • SHA256 81b73b78be2992da5e7b61f07ef1d2d33a7300bfae1d994bd63cf2b94a485038
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              AppService.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\AppService.dll
                                                              • Size 58KB
                                                              • SHA256 e6dfb4e101e24534bc06a866969600de4132778015fed5200b2f8f977fef76ec
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              CommonRegister.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\CommonRegister.dll
                                                              • Size 742KB
                                                              • SHA256 e9c9de4dd6edb9cb4092d7b59eb30d9fabba0d97ac71ad1933d30ab13d1aeab4
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              IbkinfoCLR.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\IbkinfoCLR.dll
                                                              • Size 187KB
                                                              • SHA256 4956a43bcfc1a26d2d66d05a85080c1eb7f362588a3c610e0f54a0ceadc55abc
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              2026-07-14.log
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\Logs\2026-07-14.log
                                                              • Size 1KB
                                                              • SHA256 79dbcc482e9bfd29f86828ab9b50a15a7d9f92603c1169a47f9949bb967399e3
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              2026-07-14.log
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\Logs\2026-07-14.log
                                                              • Size 2KB
                                                              • SHA256 b109ba95e723c81981af76b5f46189771d919da1a53ff08932438996e117b32f
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              ReiBoot.log
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\Logs\ReiBoot.log
                                                              • Size 1KB
                                                              • SHA256 71258fe4e882fe1959b41a9bea015b4bd1c8f3d4dd51a10f42ee70bda9d1ca2b
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              RepairItunes.log
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\Logs\RepairItunes.log
                                                              • Size 730B
                                                              • SHA256 acbeadc5655ca78efe4baf2e1f6398e5144c967d2d0e3e0e0e473b6d811cefd4
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              RepairItunes.log
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\Logs\RepairItunes.log
                                                              • Size 3KB
                                                              • SHA256 168c209374a1f15be3bda30cc5ed3be323b0efe9ea5233462f8ae99a6cf515b3
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              RepairItunes.log
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\Logs\RepairItunes.log
                                                              • Size 5KB
                                                              • SHA256 ade11d83a9ed88aa078fb8612b3b022d0a22acaac59f32745f62af75d666deeb
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              NetFrameCheck.db
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\NetFrameCheck.db
                                                              • Size 9KB
                                                              • SHA256 562affd4d0ce6fcafe1530497be7a911fa42019ce6eb1661bd14ad0019b1bab2
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              NetFrameCheck.exe
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\NetFrameCheck.exe
                                                              • Size 4.7MB
                                                              • SHA256 f6d0f776f8ccd84a19408a79d35f6b3395cedd313ccdd2f7d58b288473926717
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Newtonsoft.Json.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\Newtonsoft.Json.dll
                                                              • Size 695KB
                                                              • SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Register.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\Register.dll
                                                              • Size 430KB
                                                              • SHA256 f073ddb7a55560bc0a9e96808e6ddb832729bd70d79d83d85fabb7f93bcfd786
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ReiBoot.exe
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\ReiBoot.exe
                                                              • Size 24.6MB
                                                              • SHA256 49b46adb8376ffbeea57b89cf20e5bde80266b37343299e22fd633923aa40070
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ReiBoot.exe.Config
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\ReiBoot.exe.Config
                                                              • Size 3KB
                                                              • SHA256 ba4bf731e771b428c3480682bcee67c9afd4c11e0b694350c7cb784378fbd7ac
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              ReiBoot.exe.config
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\ReiBoot.exe.config
                                                              • Size 3KB
                                                              • SHA256 5d1bf2ce6c3cfc3d8a9b0a497988a22f130f8376138d8d9ddd794c53f93a74c6
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              Reiboot.Native.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\Reiboot.Native.dll
                                                              • Size 223KB
                                                              • SHA256 e0a0be6b8a51910c19a218a5d88ab64b49d986b735113a07ea1e8de57555274b
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              SoftwareLog.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\SoftwareLog.dll
                                                              • Size 1.5MB
                                                              • SHA256 59a36e83bbe760dfd3d109f437bd064a8c261931a4510f707f3153444a576fb4
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              TS.Common.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\TS.Common.dll
                                                              • Size 466KB
                                                              • SHA256 f2053d240ef402279770b827c6aa6627c1fe37f902370fcebd9c9bca1f93728f
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              TS.Framework.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\TS.Framework.dll
                                                              • Size 19KB
                                                              • SHA256 bc5b7c92f869bf79bbc49d12ef579f1586a6338fa5feb8a2a1431618dc9b15a1
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              TS.MsgSupport.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\TS.MsgSupport.dll
                                                              • Size 27KB
                                                              • SHA256 9f6a66750018ec66a818eb5f4863cc0fb6b19aa591ee43efbafe1fde573122fc
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              TS.MvvmLight.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\TS.MvvmLight.dll
                                                              • Size 547KB
                                                              • SHA256 7032bf084a3868c1d5458e46703c7ce45ed4f05003f387c6bb7b1964edfd5f55
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              TS.UI.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\TS.UI.dll
                                                              • Size 328KB
                                                              • SHA256 42d487d33969a1a63bf557097ad128ac0436cd953c501fc0b7427e3d54ccdb96
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              TSConfig.json
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\TSConfig.json
                                                              • Size 7KB
                                                              • SHA256 a715a0a387cd33e9af1520c699fc71107a543b0aa6b350ea43b445d2fa0b400b
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              TSEmbeddedPurchase.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\TSEmbeddedPurchase.dll
                                                              • Size 314KB
                                                              • SHA256 c747b7f153317524046cbdf6c3bc405736c72e409abd65be5e8d233b6ed05c5d
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              TSMonitorCLR.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\TSMonitorCLR.dll
                                                              • Size 206KB
                                                              • SHA256 ae8551f6456195700b2fa0dc980458e9a1cfe70272d59ebfcc3e4851c5cb33fa
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Configure.json
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\Uninstall\Configure.json
                                                              • Size 1KB
                                                              • SHA256 e83398e666897c881cc1a8dcdf77bf0dbeab79875dc5de5cb8ea4a0776c68ae6
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              cloud
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\cloud
                                                              • Size 135B
                                                              • SHA256 be7a52d6d1b2e5e2c7a9e338f3ab71b4b2e76797f19cc06d5899aece2701365b
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              log.config
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\config\log.config
                                                              • Size 2KB
                                                              • SHA256 439c35c1e539cf18c3bfd0a889e0f0e05143399a9d75a52d518552e6a63153b6
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              infInstallx64.exe
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\iTunesRepairResources\x64\infInstallx64.exe
                                                              • Size 339KB
                                                              • SHA256 5159bf34a342d497da9d786f38d143c6d5f22ad31f67efb9506629cd969b59b8
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ibkinfo.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\ibkinfo.dll
                                                              • Size 756KB
                                                              • SHA256 3cbbe631b06f55f82464aa281a9bd40c1c9bf216737b62842ba9640304c7b9c8
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              libcrypto-3-x64.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\libcrypto-3-x64.dll
                                                              • Size 6.8MB
                                                              • SHA256 90f5604d5e47d43cd3e14afd7cbca0299f06c037c47ecd76132dafff924255ae
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              libimobiledevice-glue.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\libimobiledevice-glue.dll
                                                              • Size 233KB
                                                              • SHA256 9ed04b0032dae3ed7ee5e6275f72f30737b4e898f8b1b159ed450c535c676aed
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              libimobiledevice.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\libimobiledevice.dll
                                                              • Size 292KB
                                                              • SHA256 42d9d8bbbd0db692357feb1c486d786b4be519428b67ab1cbc98acb9da43c59e
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              libssl-3-x64.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\libssl-3-x64.dll
                                                              • Size 1.3MB
                                                              • SHA256 88237fc7567550a39617835116ad96e13feac1d3c0805d7e247531ddbdaa6a85
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              libusbmuxd.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\libusbmuxd.dll
                                                              • Size 160KB
                                                              • SHA256 b45ea6ea46e28c2ef0656070e557c8d52887544cbc7ff6e12bc3db95d714858e
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              log4net.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\log4net.dll
                                                              • Size 266KB
                                                              • SHA256 428b01023d255c103724046081edd7f58d7bf45751f71db967ba5942ccbae81b
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              msvcp140.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\msvcp140.dll
                                                              • Size 613KB
                                                              • SHA256 99e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              nzuomroz.newcfg
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\nzuomroz.newcfg
                                                              • Size 3KB
                                                              • SHA256 94825b39e9f047a6ab8caab9736d992d4b86c02eca5fd9316e70441b58b464ef
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              plist.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\plist.dll
                                                              • Size 282KB
                                                              • SHA256 0972343d7c5d750958c1f043c773979962dbb06ad6d23fe3e787ed56efa50bea
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              reiboot.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\reiboot.dll
                                                              • Size 395KB
                                                              • SHA256 aa080ca00d5f250af8555317f4d69a22922d64308390d593e6850ddf4002e664
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              vcruntime140.dll
                                                              • Path C:\Program Files (x86)\Tenorshare ReiBoot\vcruntime140.dll
                                                              • Size 83KB
                                                              • SHA256 2b7602cc1521101d116995e3e2ddfe0943349806378a0d40add81ba64e359b6c
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              manifest.json
                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1495238252\manifest.json
                                                              • Size 43B
                                                              • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              blocklist
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                              • Size 105KB
                                                              • SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              settings.dat
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                              • Size 280B
                                                              • SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              settings.dat
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                              • Size 280B
                                                              • SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              5aeb9ac7-0cf9-46d2-bfd9-d26024b19e2f.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5aeb9ac7-0cf9-46d2-bfd9-d26024b19e2f.tmp
                                                              • Size 6B
                                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              the-real-index
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                              • Size 4KB
                                                              • SHA256 f675bd6931247eaa3c7a83054fc919b54ca5201bf2689403372f79a973f741df
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              the-real-index~RFe590b31.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590b31.TMP
                                                              • Size 3KB
                                                              • SHA256 1af8b84b8f11c32b95a34c75e82992b9ebb8a1fa502f596ff7c73214d848a285
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              f215738c-6d78-4bbc-baf2-baf3ab886796.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\f215738c-6d78-4bbc-baf2-baf3ab886796.tmp
                                                              • Size 2B
                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Edge Profile.ico
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                              • Size 70KB
                                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              HubApps
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                              • Size 106KB
                                                              • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Network Persistent State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                              • Size 111B
                                                              • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              Network Persistent State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                              • Size 6KB
                                                              • SHA256 ab364eb0adb93242e9967d634cb01dc59dbe23ddcd26ccbf52000eb5105b7378
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              SCT Auditing Pending Reports
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                              • Size 2B
                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              • Size 14KB
                                                              • SHA256 8e7ad9023e9cb683bfc3f42124e29828582762aa49dfc8f0008301069db04eed
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Secure Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                              • Size 35KB
                                                              • SHA256 5cf5377404dd0a2bc10ad979123924323078794a19e7380b78a2855c39168707
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              sync_diagnostic.log
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                              • Size 5KB
                                                              • SHA256 0d567c13cac7d8072b298e5f51b005daea427b486f017eb5a2fa8b76165ee80a
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              f0abdf8a-751a-48ab-acae-296ce5311af0.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f0abdf8a-751a-48ab-acae-296ce5311af0.tmp
                                                              • Size 22KB
                                                              • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 19KB
                                                              • SHA256 1522107246829685f628b3451b2af3356807985efc6e26bd618ed1313931d5b2
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 19KB
                                                              • SHA256 b0ad2edf502ab1ba4f985d84383c3062f150c99bd4175a78408ab5b9804ca826
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 30KB
                                                              • SHA256 e07211b3f8a1129baba72be895ae23ba9f6eacccd6b9d98d83f4492e6d11d926
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 8KB
                                                              • SHA256 fcc95651c5f50ad2fe423c0380fb3a2b59a0f75982e21c95f4cecfa885ea758c
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 8KB
                                                              • SHA256 7d5080efad317b1bccdd83f13925a36a5903e3d63c4fe3b17f67c7e903629d53
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                              • Size 132B
                                                              • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              9e0b27b8-8983-44b7-91cf-13279cffc0de.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9e0b27b8-8983-44b7-91cf-13279cffc0de.tmp
                                                              • Size 13B
                                                              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                              • Size 2KB
                                                              • SHA256 773423d170f8d7678101c0c5273431ae2803bb39da59396a5862695e823b6231
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              42f0b18c-befd-4176-83c6-e96c026dd7f8.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Temp\42f0b18c-befd-4176-83c6-e96c026dd7f8.tmp
                                                              • Size 10KB
                                                              • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              7a4ea476-343e-4b45-9223-abe489e215b8.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Temp\7a4ea476-343e-4b45-9223-abe489e215b8.tmp
                                                              • Size 1B
                                                              • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              reiboot_11784029398451503501.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-3FDLO.tmp\reiboot_11784029398451503501.tmp
                                                              • Size 1.2MB
                                                              • SHA256 d12a040e3f592833148060cc492fa4522b82b186b1f1f4fc1f3b677cfaa355d4
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              28f8f0ef-b904-49ce-adc2-6d837b4c623d.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4388_175189603\28f8f0ef-b904-49ce-adc2-6d837b4c623d.tmp
                                                              • Size 152KB
                                                              • SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              content_new.js
                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4388_459415173\CRX_INSTALL\content_new.js
                                                              • Size 10KB
                                                              • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              AppleKIS.cat
                                                              • Path C:\Users\Admin\AppData\Local\Temp\{1ecf796f-970c-8148-8248-e017a6b49021}\AppleKIS.cat
                                                              • Size 11KB
                                                              • SHA256 32a07ee9313ae0b4bae928e5ba0e2eb9d99a5577946fb44dcd0e81d8062859ac
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              AppleKIS.inf
                                                              • Path C:\Users\Admin\AppData\Local\Temp\{1ecf796f-970c-8148-8248-e017a6b49021}\AppleKIS.inf
                                                              • Size 2KB
                                                              • SHA256 b385f6d5839e6a031451947f8ce57a361b2866ba888bea58ce37f425d36c020e
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              AppleKIS.sys
                                                              • Path C:\Users\Admin\AppData\Local\Temp\{1ecf796f-970c-8148-8248-e017a6b49021}\AppleKIS.sys
                                                              • Size 66KB
                                                              • SHA256 97830acae22500125bb9fd2c0ad39471ac97bf95eb6787bc368c1365dc608390
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              AppleKISInterface.dll
                                                              • Path C:\Users\Admin\AppData\Local\Temp\{1ecf796f-970c-8148-8248-e017a6b49021}\AppleKISInterface.dll
                                                              • Size 36KB
                                                              • SHA256 9a160fcae82c933fe3930830782b7458707defbf2200f46d370f6bf1a699c376
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              SETB4D4.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Temp\{231ce1d2-3e47-fb47-84fa-7723dbd27a2b}\SETB4D4.tmp
                                                              • Size 1.6MB
                                                              • SHA256 18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              SETB4D5.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Temp\{231ce1d2-3e47-fb47-84fa-7723dbd27a2b}\SETB4D5.tmp
                                                              • Size 10KB
                                                              • SHA256 2b8a6ebc3e10d06a6ebbcb4ef89992978836eb52d2ad1c09e19b137b0963c2f9
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              SETB4D6.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Temp\{231ce1d2-3e47-fb47-84fa-7723dbd27a2b}\SETB4D6.tmp
                                                              • Size 4KB
                                                              • SHA256 6db20d1374088a64b5a435189e3cbf1c0f30496d4a2c80346bc904605f3d0261
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              SETB4E7.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Temp\{231ce1d2-3e47-fb47-84fa-7723dbd27a2b}\SETB4E7.tmp
                                                              • Size 22KB
                                                              • SHA256 d774db020d9c46d1aa0b2db9fa2c36c4a9c38d904cc6929695321d32aca0d4d1
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              AppleRSM.cat
                                                              • Path C:\Users\Admin\AppData\Local\Temp\{4eb5e1a7-3540-2e49-96e1-015cce9e3083}\AppleRSM.cat
                                                              • Size 11KB
                                                              • SHA256 df42e6ae66f82785552cbe1815246128cea10029e9dbb463e211590941a81bc1
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              AppleRSM.inf
                                                              • Path C:\Users\Admin\AppData\Local\Temp\{4eb5e1a7-3540-2e49-96e1-015cce9e3083}\AppleRSM.inf
                                                              • Size 1KB
                                                              • SHA256 10aac2d96e5b2c8f55605fd6acf6a39c7ef3d092018a5bc622011ec46c139a7c
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              AppleRSM.sys
                                                              • Path C:\Users\Admin\AppData\Local\Temp\{4eb5e1a7-3540-2e49-96e1-015cce9e3083}\AppleRSM.sys
                                                              • Size 77KB
                                                              • SHA256 30bebe8d26c16e1d22d776e641f7a68b9ccd1c70a3804964db6753b821eee4b6
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              AppleRSMInterface.dll
                                                              • Path C:\Users\Admin\AppData\Local\Temp\{4eb5e1a7-3540-2e49-96e1-015cce9e3083}\AppleRSMInterface.dll
                                                              • Size 36KB
                                                              • SHA256 35075c0a280d7544b402c1f030ae9acd3c917fc1bd6a52145fae9b2a55320ecc
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              SETADEE.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Temp\{d1e9d8ef-5e70-844d-9b85-01e972b32d6b}\SETADEE.tmp
                                                              • Size 54KB
                                                              • SHA256 ac3469ac659287626b05cda0da457b63ed78241d4f20c60778f6292d6e158346
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              SETADEF.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Temp\{d1e9d8ef-5e70-844d-9b85-01e972b32d6b}\SETADEF.tmp
                                                              • Size 22KB
                                                              • SHA256 775e43292702903d1f3991b655dde23ccb378052d28f7e0e8f89e2f4580a7387
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              SETAE00.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Temp\{d1e9d8ef-5e70-844d-9b85-01e972b32d6b}\SETAE00.tmp
                                                              • Size 16KB
                                                              • SHA256 71ef7dbef3e7b2c1bdc32c1a4400aa5f92c5c7eee9ef6261385c54cd9d0e26a6
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              SETAE01.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Temp\{d1e9d8ef-5e70-844d-9b85-01e972b32d6b}\SETAE01.tmp
                                                              • Size 131KB
                                                              • SHA256 17fa26ea576e98f40eb2a353123d27232335e3a20c8d91465ec83710bc1a8eae
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              SETAE12.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Temp\{d1e9d8ef-5e70-844d-9b85-01e972b32d6b}\SETAE12.tmp
                                                              • Size 38KB
                                                              • SHA256 72fe475d8ada0cc2e26a4e659ca7d03bdb8d3061b4a689016a54eb52b18773a3
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              memory/2104-1180-0x0000019DFD790000-0x0000019DFD7CE000-memory.dmp
                                                              Download

                                                              memory/2104-810-0x0000019DF7560000-0x0000019DF76A9000-memory.dmp
                                                              Download

                                                              memory/2104-1179-0x0000019D98260000-0x0000019D98278000-memory.dmp
                                                              Download

                                                              memory/2104-796-0x0000019DF6EF0000-0x0000019DF6F7C000-memory.dmp
                                                              Download

                                                              memory/2104-837-0x0000019DF7FC0000-0x0000019DF807C000-memory.dmp
                                                              Download

                                                              memory/2104-852-0x0000019DF7930000-0x0000019DF7962000-memory.dmp
                                                              Download

                                                              memory/2104-848-0x0000019DF7920000-0x0000019DF7928000-memory.dmp
                                                              Download

                                                              memory/2104-932-0x0000019DF8E50000-0x0000019DF8E64000-memory.dmp
                                                              Download

                                                              memory/2104-933-0x0000019DF8EE0000-0x0000019DF8F4A000-memory.dmp
                                                              Download

                                                              memory/2104-934-0x0000019DF8E70000-0x0000019DF8EB1000-memory.dmp
                                                              Download

                                                              memory/2104-800-0x0000019DF7010000-0x0000019DF7066000-memory.dmp
                                                              Download

                                                              memory/2104-822-0x0000019DF7220000-0x0000019DF7242000-memory.dmp
                                                              Download

                                                              memory/2104-821-0x0000019DF79B0000-0x0000019DF7A62000-memory.dmp
                                                              Download

                                                              memory/2104-924-0x0000019DF8720000-0x0000019DF8E0B000-memory.dmp
                                                              Download

                                                              memory/2104-802-0x0000019DF7360000-0x0000019DF7558000-memory.dmp
                                                              Download

                                                              memory/2104-817-0x0000019DF6040000-0x0000019DF604A000-memory.dmp
                                                              Download

                                                              memory/2104-806-0x0000019DF72A0000-0x0000019DF7318000-memory.dmp
                                                              Download

                                                              memory/2104-843-0x0000019DF7320000-0x0000019DF735B000-memory.dmp
                                                              Download

                                                              memory/2104-871-0x0000019DF80C0000-0x0000019DF80D4000-memory.dmp
                                                              Download

                                                              memory/2104-798-0x0000019DF5690000-0x0000019DF56D6000-memory.dmp
                                                              Download

                                                              memory/2104-1139-0x0000019DFA080000-0x0000019DFA0B8000-memory.dmp
                                                              Download

                                                              memory/2104-1140-0x0000019DFA040000-0x0000019DFA04E000-memory.dmp
                                                              Download

                                                              memory/2104-1018-0x0000019DF8F80000-0x0000019DF8FAE000-memory.dmp
                                                              Download

                                                              memory/2104-902-0x0000019DF8570000-0x0000019DF857A000-memory.dmp
                                                              Download

                                                              memory/2104-804-0x0000019DF71C0000-0x0000019DF7212000-memory.dmp
                                                              Download

                                                              memory/2104-1027-0x0000019DF8F70000-0x0000019DF8F80000-memory.dmp
                                                              Download

                                                              memory/2104-794-0x0000019DF5620000-0x0000019DF5632000-memory.dmp
                                                              Download

                                                              memory/2104-882-0x0000019DF85C0000-0x0000019DF860C000-memory.dmp
                                                              Download

                                                              memory/2104-833-0x0000019DF7180000-0x0000019DF71B7000-memory.dmp
                                                              Download

                                                              memory/2104-1119-0x0000019DFA030000-0x0000019DFA038000-memory.dmp
                                                              Download

                                                              memory/2104-1082-0x0000019DF9120000-0x0000019DF9128000-memory.dmp
                                                              Download

                                                              memory/2104-792-0x0000019DF2210000-0x0000019DF3AAC000-memory.dmp
                                                              Download

                                                              memory/2104-1045-0x0000019DF9110000-0x0000019DF9118000-memory.dmp
                                                              Download

                                                              memory/2104-876-0x0000019DF83F0000-0x0000019DF842E000-memory.dmp
                                                              Download

                                                              memory/2104-877-0x0000019DF8250000-0x0000019DF825E000-memory.dmp
                                                              Download

                                                              memory/2104-878-0x0000019DF83D0000-0x0000019DF83EC000-memory.dmp
                                                              Download

                                                              memory/2104-874-0x0000019DF8270000-0x0000019DF83B0000-memory.dmp
                                                              Download

                                                              memory/2104-872-0x0000019DF81F0000-0x0000019DF81F8000-memory.dmp
                                                              Download

                                                              memory/3816-301-0x0000000000400000-0x0000000000443000-memory.dmp
                                                              Download

                                                              memory/3816-791-0x0000000000400000-0x0000000000443000-memory.dmp
                                                              Download

                                                              memory/3816-0-0x0000000000400000-0x0000000000443000-memory.dmp
                                                              Download

                                                              memory/4064-5-0x0000000000690000-0x0000000000691000-memory.dmp
                                                              Download

                                                              memory/4064-307-0x0000000000690000-0x0000000000691000-memory.dmp
                                                              Download

                                                              memory/4064-306-0x0000000000400000-0x0000000000548000-memory.dmp
                                                              Download

                                                              memory/4064-790-0x0000000000400000-0x0000000000548000-memory.dmp
                                                              Download

                                                              memory/4916-1135-0x0000000000DD0000-0x0000000000DF6000-memory.dmp
                                                              Download

                                                              memory/4916-1160-0x0000000005DD0000-0x0000000005E9E000-memory.dmp
                                                              Download

                                                              memory/4916-1229-0x00000000061F0000-0x000000000623C000-memory.dmp
                                                              Download

                                                              memory/4916-1214-0x0000000005ED0000-0x0000000005ED1000-memory.dmp
                                                              Download

                                                              memory/4916-1215-0x000000006D8B0000-0x000000006E1C8000-memory.dmp
                                                              Download