API tools faq
paste
paladin316

Exes_a36c3ba7926bc9ff9a8512649e86c73f_exe_2019-07-26_07_30.txt

paladin316
Jul 26th, 2019
2,154
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 130.17 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Agent"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_a36c3ba7926bc9ff9a8512649e86c73f.exe"
  7. * File Size: 590136
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "75472f8b78322869ada7cef8baa29a9566b79e61b3c45a59de1f17f4a47d6b39"
  10. * MD5: "a36c3ba7926bc9ff9a8512649e86c73f"
  11. * SHA1: "c23a36fd8b1a46b66281f3d109393abeaa73999f"
  12. * SHA512: "da654e32bd312f2a136a868d97103407adc5f5ba87b4b5f152b79e34becc5bd0780235125d40c7351e0a35844db34b3d0052af9c96336a0055f85e7a0ac809ab"
  13. * CRC32: "4A3AFE9B"
  14. * SSDEEP: "12288:yEhVA4yppuWBuIpHPIat7OkM+Cgi1GiZu7DBDvfUDOmaWWK:yaVA4XWBB1Aa5OkbCKwudUD0"
  15.  
  16. * Process Execution:
  17. "Exes_a36c3ba7926bc9ff9a8512649e86c73f.exe",
  18. "sqlite3.exe",
  19. "sqlite3.exe",
  20. "sqlite3.exe",
  21. "sqlite3.exe",
  22. "sqlite3.exe",
  23. "sqlite3.exe",
  24. "cmd.exe",
  25. "tasklist.exe",
  26. "cmd.exe",
  27. "regsvr32.exe",
  28. "cmd.exe",
  29. "cmd.exe",
  30. "cmd.exe",
  31. "sqlite3.exe",
  32. "sqlite3.exe",
  33. "cmd.exe",
  34. "cmd.exe",
  35. "tasklist.exe",
  36. "cmd.exe",
  37. "tasklist.exe",
  38. "ReimagePackage.exe",
  39. "cmd.exe",
  40. "tasklist.exe",
  41. "cmd.exe",
  42. "LZMA.EXE",
  43. "LZMA.EXE",
  44. "cmd.exe",
  45. "tasklist.exe",
  46. "regsvr32.exe",
  47. "regsvr32.exe",
  48. "regsvr32.exe",
  49. "regsvr32.exe",
  50. "ProtectorUpdater.exe",
  51. "cmd.exe",
  52. "UniProtectorPackage.exe",
  53. "cmd.exe",
  54. "cmd.exe",
  55. "ReiGuard.exe",
  56. "cmd.exe",
  57. "schtasks.exe",
  58. "ReimageApp.exe",
  59. "Reimage.exe",
  60. "services.exe",
  61. "svchost.exe",
  62. "dllhost.exe",
  63. "WmiPrvSE.exe",
  64. "dllhost.exe",
  65. "WmiPrvSE.exe",
  66. "unsecapp.exe",
  67. "dllhost.exe",
  68. "WmiPrvSE.exe",
  69. "svchost.exe",
  70. "svchost.exe",
  71. "WMIADAP.exe",
  72. "svchost.exe",
  73. "ReiGuard.exe",
  74. "ReiSystem.exe",
  75. "taskhost.exe"
  76.  
  77.  
  78. * Executed Commands:
  79. "\"C:\\Users\\user\\AppData\\Local\\Temp\\sqlite3.exe\" \"C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies\" \"select value, expires_utc from cookies where host_key like '%reimageplus.com' and name='_trackid';\"",
  80. "\"C:\\Users\\user\\AppData\\Local\\Temp\\sqlite3.exe\" \"C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies\" \"select name, expires_utc from cookies where host_key like '%reimageplus.com' and name like '_trackid_%';\"",
  81. "\"C:\\Users\\user\\AppData\\Local\\Temp\\sqlite3.exe\" \"C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies\" \"select value, expires_utc from cookies where host_key like '%reimageplus.com' and name='_tracking';\"",
  82. "\"C:\\Users\\user\\AppData\\Local\\Temp\\sqlite3.exe\" \"C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies\" \"select name, expires_utc from cookies where host_key like '%reimageplus.com' and name like '_tracking_%';\"",
  83. "\"C:\\Users\\user\\AppData\\Local\\Temp\\sqlite3.exe\" \"C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies\" \"select value, expires_utc from cookies where host_key like '%reimageplus.com' and name='_campaign';\"",
  84. "\"C:\\Users\\user\\AppData\\Local\\Temp\\sqlite3.exe\" \"C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies\" \"select name, expires_utc from cookies where host_key like '%reimageplus.com' and name like '_campaign_%';\"",
  85. "cmd /C tasklist /FI \"IMAGENAME eq Reimage.exe\" > C:\\Users\\user\\AppData\\Local\\Temp\\IsProcessActive.txt",
  86. "cmd /C tasklist /FI \"IMAGENAME eq avupdate.exe\" > C:\\Users\\user\\AppData\\Local\\Temp\\IsProcessActive.txt",
  87. "regsvr32 /s \"C:\\Windows\\system32\\jscript.dll\"",
  88. "cmd /C tasklist /FI \"IMAGENAME eq ReimagePackage.exe\" > C:\\Users\\user\\AppData\\Local\\Temp\\IsProcessActive.txt",
  89. "cmd /C tasklist /FI \"IMAGENAME eq HMA! Pro VPN.exe\" > C:\\Users\\user\\AppData\\Local\\Temp\\IsProcessActive.txt",
  90. "cmd /C tasklist /FI \"IMAGENAME eq GeoProxy.exe\" > C:\\Users\\user\\AppData\\Local\\Temp\\IsProcessActive.txt",
  91. "\"C:\\Users\\user\\AppData\\Local\\Temp\\sqlite3.exe\" \"C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies\" \"select value, expires_utc from cookies where host_key like '%reimageplus.com' and name='_country';\"",
  92. "\"C:\\Users\\user\\AppData\\Local\\Temp\\sqlite3.exe\" \"C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies\" \"select name, expires_utc from cookies where host_key like '%reimageplus.com' and name like '_country_%';\"",
  93. "cmd /C tasklist /FI \"IMAGENAME eq Wireshark.exe\" > C:\\Users\\user\\AppData\\Local\\Temp\\IsProcessActive.txt",
  94. "cmd /C tasklist /FI \"IMAGENAME eq Fiddler.exe\" > C:\\Users\\user\\AppData\\Local\\Temp\\IsProcessActive.txt",
  95. "cmd /C tasklist /FI \"IMAGENAME eq smsniff.exe\" > C:\\Users\\user\\AppData\\Local\\Temp\\IsProcessActive.txt",
  96. "C:\\Users\\user\\AppData\\Local\\Temp\\ReimagePackage.exe /GUI=http://www.reimageplus.com/GUI/GUI1898/layout.php?consumer=1&gui_branch=0&trackutil=&MinorSessionID=60a6e143bf904a6abca31bb3bd&lang_code=en&bundle=0&loadresults=0&ShowSettings=false \"/Location=C:\\Users\\user\\AppData\\Local\\Temp\\Exes_a36c3ba7926bc9ff9a8512649e86c73f.exe\" /uninstallX86=TRUE /trackutil= /CookieTracking= /CookieCampaign= /EventUser=New /Update=1 /DownloaderVersion=1898 /RunSilent=false /SessionID=24460283-573e-4e79-baf6-0d2eb60522f1 /IDMinorSession=60a6e143bf904a6abca31bb3bd /pxkp=Delete /ScanSilent=0 /Close=0 /cil=DISABLED /ShowName=False /Language=1033 /GuiLang=en /AgentStatus=ENABLED /StartScan=0 /VersionInfo=versionInfo /ShowSettings=true",
  97. "tasklist /FI \"IMAGENAME eq Reimage.exe\"",
  98. "C:\\Windows\\system32\\DllHost.exe /Processid:AB8902B4-09CA-4BB6-B78D-A8F59079A8D5",
  99. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding",
  100. "C:\\Windows\\system32\\wbem\\unsecapp.exe -Embedding",
  101. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding",
  102. "C:\\Windows\\system32\\svchost.exe -k netsvcs",
  103. "\"C:\\Program Files\\Reimage\\Reimage Protector\\ReiGuard.exe\"",
  104. "\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE wmiadap.exe /F /T /R",
  105. "tasklist /FI \"IMAGENAME eq Fiddler.exe\"",
  106. "tasklist /FI \"IMAGENAME eq smsniff.exe\"",
  107. "\"C:\\Program Files\\Reimage\\Reimage Repair\\lzma.exe\" \"d\" \"C:\\Program Files\\Reimage\\Reimage Repair\\REI_Axcontrol.lza\" \"C:\\Program Files\\Reimage\\Reimage Repair\\REI_Axcontrol.dll\"",
  108. "\"C:\\Program Files\\Reimage\\Reimage Repair\\lzma.exe\" \"d\" \"C:\\Program Files\\Reimage\\Reimage Repair\\REI_Engine.lza\" \"C:\\Program Files\\Reimage\\Reimage Repair\\REI_Engine.dll\"",
  109. "cmd /C tasklist /FI \"IMAGENAME eq REI_avira.exe\" > C:\\Users\\user\\AppData\\Local\\Temp\\IsProcessActive.txt",
  110. "regsvr32 /s \"C:\\Program Files\\Reimage\\Reimage Repair\\REI_Axcontrol.dll\"",
  111. "regsvr32 /s \"C:\\Program Files\\Reimage\\Reimage Repair\\REI_Engine.dll\"",
  112. "\"C:\\Users\\user\\AppData\\Local\\Temp\\nsz2E1.tmp\\ProtectorUpdater.exe\" /S /MinorSessionID=60a6e143bf904a6abca31bb3bd /SessionID=24460283-573e-4e79-baf6-0d2eb60522f1 /TrackID= /AgentLogLocation=C:\\rei\\Results\\Agent /CflLocation=C:\\rei\\cfl.rei /Install=True /DownloaderVersion=1898 /Iav=False",
  113. "cmd /C tasklist /FI \"IMAGENAME eq ReimageApp.exe\" > C:\\Users\\user\\AppData\\Local\\Temp\\IsProcessActive.txt",
  114. "schtasks /Delete /TN ReimageUpdater /F",
  115. "C:\\Program Files\\Reimage\\Reimage Protector\\ReimageApp.exe ",
  116. "C:\\Program Files\\Reimage\\Reimage Repair\\Reimage.exe http://www.reimageplus.com/GUI/GUI1898/layout.php?consumer=1&gui_branch=0&trackutil=&MinorSessionID=60a6e143bf904a6abca31bb3bd&lang_code=en&bundle=0&loadresults=0&ShowSettings=false /Locale=1033",
  117. "tasklist /FI \"IMAGENAME eq REI_avira.exe\"",
  118. "C:\\Windows\\system32\\regsvr32.exe /s \"C:\\Program Files\\Reimage\\Reimage Repair\\REI_Axcontrol.dll\"",
  119. "C:\\Windows\\system32\\regsvr32.exe /s \"C:\\Program Files\\Reimage\\Reimage Repair\\REI_Engine.dll\"",
  120. "cmd /C tasklist /FI \"IMAGENAME eq UniProtectorPackage.exe\" > C:\\Users\\user\\AppData\\Local\\Temp\\IsProcessActive.txt",
  121. "\"C:\\Users\\user\\AppData\\Local\\Temp\\UniProtectorPackage.exe\" /S /MinorSessionID=60a6e143bf904a6abca31bb3bd /SessionID=24460283-573e-4e79-baf6-0d2eb60522f1 /Install=true /UpdateOnly=default /InstallPath= /Iav=False",
  122. "cmd /C tasklist /FI \"IMAGENAME eq ReiScanner.exe\" > C:\\Users\\user\\AppData\\Local\\Temp\\IsProcessActive.txt",
  123. "cmd /C tasklist /FI \"IMAGENAME eq ReiProtectorM.exe\" > C:\\Users\\user\\AppData\\Local\\Temp\\IsProcessActive.txt",
  124. "\"C:\\Program Files\\Reimage\\Reimage Protector\\ReiGuard.exe\" -install"
  125.  
  126.  
  127. * Signatures Detected:
  128.  
  129. "Description": "Creates RWX memory",
  130. "Details":
  131.  
  132.  
  133. "Description": "Attempts to connect to a dead IP:Port (5 unique times)",
  134. "Details":
  135.  
  136. "IP": "192.237.143.168:80"
  137.  
  138.  
  139. "IP": "50.56.53.60:80"
  140.  
  141.  
  142. "IP": "205.185.208.80:80"
  143.  
  144.  
  145. "IP": "23.54.187.27:80"
  146.  
  147.  
  148. "IP": "161.47.7.14:80"
  149.  
  150.  
  151.  
  152.  
  153. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  154. "Details":
  155.  
  156. "ioc": "http://www.symauth.com/cps0"
  157.  
  158.  
  159. "ioc": "http://www.symauth.com/rpa0"
  160.  
  161.  
  162. "ioc": "www.digicert.com1"
  163.  
  164.  
  165. "ioc": "http://www.digicert.com/ssl-cps-repository.htm0"
  166.  
  167.  
  168. "ioc": "http://ocsp.digicert.com0C"
  169.  
  170.  
  171. "ioc": "http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0"
  172.  
  173.  
  174. "ioc": "http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0"
  175.  
  176.  
  177. "ioc": "http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0"
  178.  
  179.  
  180. "ioc": "https://www.digicert.com/CPS0"
  181.  
  182.  
  183. "ioc": "http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08"
  184.  
  185.  
  186. "ioc": "http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w"
  187.  
  188.  
  189. "ioc": "http://ocsp.digicert.com0A"
  190.  
  191.  
  192. "ioc": "http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt"
  193.  
  194.  
  195. "ioc": "https://www.microsoft.com/pki/ssl/cps/WindowsPCA.htm0f"
  196.  
  197.  
  198.  
  199.  
  200. "Description": "Reads data out of its own binary image",
  201. "Details":
  202.  
  203. "self_read": "process: Exes_a36c3ba7926bc9ff9a8512649e86c73f.exe, pid: 2924, offset: 0x00000000, length: 0x0008c898"
  204.  
  205.  
  206. "self_read": "process: Exes_a36c3ba7926bc9ff9a8512649e86c73f.exe, pid: 2924, offset: 0x00011c1c, length: 0x0007ac80"
  207.  
  208.  
  209. "self_read": "process: ReimagePackage.exe, pid: 3052, offset: 0x00000000, length: 0x00e72e2d"
  210.  
  211.  
  212. "self_read": "process: ReimagePackage.exe, pid: 3052, offset: 0x0001561c, length: 0x00e5d815"
  213.  
  214.  
  215. "self_read": "process: ProtectorUpdater.exe, pid: 2444, offset: 0x00000000, length: 0x0005aa8b"
  216.  
  217.  
  218. "self_read": "process: ProtectorUpdater.exe, pid: 2444, offset: 0x0001501c, length: 0x00005708"
  219.  
  220.  
  221. "self_read": "process: ProtectorUpdater.exe, pid: 2444, offset: 0x00027bf5, length: 0x00000d36"
  222.  
  223.  
  224. "self_read": "process: ProtectorUpdater.exe, pid: 2444, offset: 0x00036a54, length: 0x0001f21a"
  225.  
  226.  
  227. "self_read": "process: ProtectorUpdater.exe, pid: 2444, offset: 0x0005908e, length: 0x00001a01"
  228.  
  229.  
  230. "self_read": "process: UniProtectorPackage.exe, pid: 2352, offset: 0x00000000, length: 0x005d567b"
  231.  
  232.  
  233. "self_read": "process: UniProtectorPackage.exe, pid: 2352, offset: 0x0001461c, length: 0x005c1063"
  234.  
  235.  
  236. "self_read": "process: ReiGuard.exe, pid: 1784, offset: 0x00000000, length: 0x00000002"
  237.  
  238.  
  239. "self_read": "process: Reimage.exe, pid: 1788, offset: 0x00000000, length: 0x00000040"
  240.  
  241.  
  242. "self_read": "process: Reimage.exe, pid: 1788, offset: 0x00000138, length: 0x00000108"
  243.  
  244.  
  245.  
  246.  
  247. "Description": "A process created a hidden window",
  248. "Details":
  249.  
  250. "Process": "svchost.exe -> \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE"
  251.  
  252.  
  253.  
  254.  
  255. "Description": "File has been identified by 6 Antiviruses on VirusTotal as malicious",
  256. "Details":
  257.  
  258. "Malwarebytes": "PUP.Optional.Reimage"
  259.  
  260.  
  261. "ClamAV": "Win.Trojan.Agent-7036350-0"
  262.  
  263.  
  264. "DrWeb": "Program.Unwanted.4185"
  265.  
  266.  
  267. "McAfee-GW-Edition": "ReimagePlus"
  268.  
  269.  
  270. "Endgame": "malicious (high confidence)"
  271.  
  272.  
  273. "ESET-NOD32": "Win32/ReImageRepair.P potentially unwanted"
  274.  
  275.  
  276.  
  277.  
  278. "Description": "Drops a binary and executes it",
  279. "Details":
  280.  
  281. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\sqlite3.exe"
  282.  
  283.  
  284. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\UniProtectorPackage.exe"
  285.  
  286.  
  287. "binary": "C:\\Program Files\\Reimage\\Reimage Protector\\ReiSystem.exe"
  288.  
  289.  
  290. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\nsz2E1.tmp\\ProtectorUpdater.exe"
  291.  
  292.  
  293. "binary": "C:\\Program Files\\Reimage\\Reimage Repair\\LZMA.EXE"
  294.  
  295.  
  296. "binary": "C:\\Program Files\\Reimage\\Reimage Protector\\ReiGuard.exe"
  297.  
  298.  
  299. "binary": "C:\\Program Files\\Reimage\\Reimage Repair\\Reimage.exe"
  300.  
  301.  
  302. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\ReimagePackage.exe"
  303.  
  304.  
  305.  
  306.  
  307. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  308. "Details":
  309.  
  310. "post_no_referer": "HTTP traffic contains a POST request with no referer header"
  311.  
  312.  
  313. "post_no_useragent": "HTTP traffic contains a POST request with no user-agent header"
  314.  
  315.  
  316. "get_no_useragent": "HTTP traffic contains a GET request with no user-agent header"
  317.  
  318.  
  319. "suspicious_request": "http://webservice.reimageplus.com/rei-protect/url_setting.php?user_id=24460283%2D573e%2D4e79%2Dbaf6%2D0d2eb60522f1&install_id=&original_install_id=&="
  320.  
  321.  
  322. "suspicious_request": "http://e-webservice.reimageplus.com/rei-protect/events.php"
  323.  
  324.  
  325. "suspicious_request": "http://cdnrep.reimage.com/protector/ilst.rei"
  326.  
  327.  
  328. "suspicious_request": "http://webservice.reimageplus.com/rei-protect/active_protection_setting.php"
  329.  
  330.  
  331. "suspicious_request": "http://webservice.reimageplus.com/rei-protect/system_settings.php"
  332.  
  333.  
  334. "suspicious_request": "http://www.reimageplus.com/scan_agent_events.php?version=2024&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=INSVR&param=$evr&trackutil=$Cookie_Trackid"
  335.  
  336.  
  337. "suspicious_request": "http://cdnrep.reimage.com/cfl/cfl1891b.rei"
  338.  
  339.  
  340. "suspicious_request": "http://www.reimageplus.com/includes/install_end.php?m_trackid=&m_tracking=&m_campaign=&minorsessionid=60a6e143bf904a6abca31bb3bd&sessionid=24460283-573e-4e79-baf6-0d2eb60522f1"
  341.  
  342.  
  343. "suspicious_request": "http://www.reimageplus.com/events4mem.php?version=1898&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=INSST&param=Downloader%20Started<*>New&trackutil="
  344.  
  345.  
  346. "suspicious_request": "http://www.reimageplus.com/events4mem.php?version=1898&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=INSRN&param=1898<*>New&trackutil="
  347.  
  348.  
  349. "suspicious_request": "http://www.reimageplus.com/GUI/GUI1898/layout.php?consumer=1&gui_branch=0&trackutil=&MinorSessionID=60a6e143bf904a6abca31bb3bd&lang_code=en&bundle=0&loadresults=0&ShowSettings=false"
  350.  
  351.  
  352. "suspicious_request": "http://www.reimageplus.com/GUI/GUI1898/layout_src.php?consumer=1&gui_branch=0&trackutil=&MinorSessionID=60a6e143bf904a6abca31bb3bd&lang_code=en&bundle=0&loadresults=0&ShowSettings=false"
  353.  
  354.  
  355. "suspicious_request": "http://cdnrep.reimage.com/protector/wlst.rei"
  356.  
  357.  
  358. "suspicious_request": "http://www.reimageplus.com/GUI/reimageavmem.php?version=2.0.2.4&virstr=005247e3057bc5d5c3f8c6f886ffc10c&size=182784&path=%5c%5c%3f%5cc%3a%5cwindows%5csystem32%5cwbem%5cwmiadap.exe"
  359.  
  360.  
  361. "suspicious_request": "http://www.reimageplus.com/GUI/reimageavmem.php?version=2.0.2.4&virstr=619a67c9f617b7e69315bb28ecd5e1df&size=372736&path=c%3a%5cwindows%5csystem32%5cwbem%5cwmiprvse.exe"
  362.  
  363.  
  364.  
  365.  
  366. "Description": "Performs some HTTP requests",
  367. "Details":
  368.  
  369. "url": "http://www.reimageplus.com/includes/install_start.php?m_trackid=&m_tracking=&m_campaign=&minorsessionid=60a6e143bf904a6abca31bb3bd&sessionid=24460283-573e-4e79-baf6-0d2eb60522f1&t=CONSUMER&a=ENABLED&u=ENABLED&c=DISABLED&v=1898"
  370.  
  371.  
  372. "url": "http://cdnrep.reimage.com/downloader_version.xml"
  373.  
  374.  
  375. "url": "http://cdnrep.reimage.com/repair_version.xml"
  376.  
  377.  
  378. "url": "http://www.reimageplus.com/events4mem.php?version=1898&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=INSVR&param=1898&trackutil="
  379.  
  380.  
  381. "url": "http://www.reimageplus.com/events4mem.php?version=1898&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=LANG&param=en&trackutil="
  382.  
  383.  
  384. "url": "http://cdnrep.reimage.com/ver/ReimagePackage1898x64c.exe"
  385.  
  386.  
  387. "url": "http://cdnrep.reimage.com/cfl/cfl1898.rei"
  388.  
  389.  
  390. "url": "http://www.reimageplus.com/installer.php?tracking=&sessionid=24460283-573e-4e79-baf6-0d2eb60522f1"
  391.  
  392.  
  393. "url": "http://cdnrep.reimage.com/protector_version.xml"
  394.  
  395.  
  396. "url": "http://www.reimageplus.com/scan_agent_events.php?version=2024&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=INSVR&param=2024&trackutil="
  397.  
  398.  
  399. "url": "http://cdnrep.reimage.com/prot/ProtectorPackage2024x64a.exe"
  400.  
  401.  
  402. "url": "http://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D"
  403.  
  404.  
  405. "url": "http://sv.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEBwmClMv6z6ZQuZqLzHn2IQ%3D"
  406.  
  407.  
  408. "url": "http://webservice.reimageplus.com/rei-protect/url_setting.php?user_id=24460283%2D573e%2D4e79%2Dbaf6%2D0d2eb60522f1&install_id=&original_install_id=&="
  409.  
  410.  
  411. "url": "http://e-webservice.reimageplus.com/rei-protect/events.php"
  412.  
  413.  
  414. "url": "http://cdnrep.reimage.com/protector/ilst.rei"
  415.  
  416.  
  417. "url": "http://webservice.reimageplus.com/rei-protect/active_protection_setting.php"
  418.  
  419.  
  420. "url": "http://webservice.reimageplus.com/rei-protect/system_settings.php"
  421.  
  422.  
  423. "url": "http://www.reimageplus.com/scan_agent_events.php?version=2024&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=INSVR&param=$evr&trackutil=$Cookie_Trackid"
  424.  
  425.  
  426. "url": "http://cdnrep.reimage.com/cfl/cfl1891b.rei"
  427.  
  428.  
  429. "url": "http://www.reimageplus.com/includes/install_end.php?m_trackid=&m_tracking=&m_campaign=&minorsessionid=60a6e143bf904a6abca31bb3bd&sessionid=24460283-573e-4e79-baf6-0d2eb60522f1"
  430.  
  431.  
  432. "url": "http://www.reimageplus.com/events4mem.php?version=1898&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=INSST&param=Downloader%20Started<*>New&trackutil="
  433.  
  434.  
  435. "url": "http://www.reimageplus.com/events4mem.php?version=1898&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=INSRN&param=1898<*>New&trackutil="
  436.  
  437.  
  438. "url": "http://www.reimageplus.com/GUI/GUI1898/layout.php?consumer=1&gui_branch=0&trackutil=&MinorSessionID=60a6e143bf904a6abca31bb3bd&lang_code=en&bundle=0&loadresults=0&ShowSettings=false"
  439.  
  440.  
  441. "url": "http://www.reimageplus.com/GUI/GUI1898/layout_src.php?consumer=1&gui_branch=0&trackutil=&MinorSessionID=60a6e143bf904a6abca31bb3bd&lang_code=en&bundle=0&loadresults=0&ShowSettings=false"
  442.  
  443.  
  444. "url": "http://cdnrep.reimage.com/protector/wlst.rei"
  445.  
  446.  
  447. "url": "http://www.reimageplus.com/GUI/reimageavmem.php?version=2.0.2.4&virstr=005247e3057bc5d5c3f8c6f886ffc10c&size=182784&path=%5c%5c%3f%5cc%3a%5cwindows%5csystem32%5cwbem%5cwmiadap.exe"
  448.  
  449.  
  450. "url": "http://www.reimageplus.com/GUI/reimageavmem.php?version=2.0.2.4&virstr=619a67c9f617b7e69315bb28ecd5e1df&size=372736&path=c%3a%5cwindows%5csystem32%5cwbem%5cwmiprvse.exe"
  451.  
  452.  
  453.  
  454.  
  455. "Description": "Attempts to restart the guest VM",
  456. "Details":
  457.  
  458.  
  459. "Description": "A process attempted to delay the analysis task by a long amount of time.",
  460. "Details":
  461.  
  462. "Process": "ReiGuard.exe tried to sleep 9875 seconds, actually delayed analysis time by 0 seconds"
  463.  
  464.  
  465. "Process": "tasklist.exe tried to sleep 425 seconds, actually delayed analysis time by 0 seconds"
  466.  
  467.  
  468. "Process": "ReimagePackage.exe tried to sleep 309 seconds, actually delayed analysis time by 0 seconds"
  469.  
  470.  
  471. "Process": "svchost.exe tried to sleep 840 seconds, actually delayed analysis time by 0 seconds"
  472.  
  473.  
  474. "Process": "ReiSystem.exe tried to sleep 2411 seconds, actually delayed analysis time by 0 seconds"
  475.  
  476.  
  477. "Process": "WmiPrvSE.exe tried to sleep 960 seconds, actually delayed analysis time by 0 seconds"
  478.  
  479.  
  480.  
  481.  
  482. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  483. "Details":
  484.  
  485. "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 8667119 times"
  486.  
  487.  
  488.  
  489.  
  490. "Description": "Steals private information from local Internet browsers",
  491. "Details":
  492.  
  493. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  494.  
  495.  
  496. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  497.  
  498.  
  499. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences"
  500.  
  501.  
  502. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  503.  
  504.  
  505. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  506.  
  507.  
  508. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History"
  509.  
  510.  
  511. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  512.  
  513.  
  514. "file": "C:\\Users\\user\\AppData\\Roaming\\Mozilla\\FireFox\\places.sqlite"
  515.  
  516.  
  517. "file": "C:\\Users\\user\\AppData\\Roaming\\Mozilla\\Firefox\\cookies.sqlite"
  518.  
  519.  
  520. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  521.  
  522.  
  523. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences"
  524.  
  525.  
  526. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  527.  
  528.  
  529. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  530.  
  531.  
  532. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies"
  533.  
  534.  
  535. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.back024"
  536.  
  537.  
  538. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  539.  
  540.  
  541. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat"
  542.  
  543.  
  544. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  545.  
  546.  
  547. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  548.  
  549.  
  550. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  551.  
  552.  
  553. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  554.  
  555.  
  556. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History.ch"
  557.  
  558.  
  559. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  560.  
  561.  
  562. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  563.  
  564.  
  565. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  566.  
  567.  
  568. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  569.  
  570.  
  571.  
  572.  
  573. "Description": "Network activity contains more than one unique useragent.",
  574. "Details":
  575.  
  576. "Process": "Exes_a36c3ba7926bc9ff9a8512649e86c73f.exe"
  577.  
  578.  
  579. "User-Agent": "NSIS_Inetc (Mozilla)"
  580.  
  581.  
  582. "Process": "Reimage.exe"
  583.  
  584.  
  585. "User-Agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)"
  586.  
  587.  
  588.  
  589.  
  590. "Description": "Installs itself for autorun at Windows startup",
  591. "Details":
  592.  
  593. "service name": "ReimageRealTimeProtector"
  594.  
  595.  
  596. "service path": "\"C:\\Program Files\\Reimage\\Reimage Protector\\ReiGuard.exe\""
  597.  
  598.  
  599. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Reimage"
  600.  
  601.  
  602. "data": "C:\\Program Files\\Reimage\\Reimage Protector\\ReimageApp.exe"
  603.  
  604.  
  605. "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\ReimageRealTimeProtector\\ImagePath"
  606.  
  607.  
  608. "data": "\"C:\\Program Files\\Reimage\\Reimage Protector\\ReiGuard.exe\""
  609.  
  610.  
  611. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c262-6ac0-11cf-b6d1-00aa00bbbb58\\InprocServer32\\(Default)"
  612.  
  613.  
  614. "data": "C:\\Windows\\system32\\jscript.dll"
  615.  
  616.  
  617. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c261-6ac0-11cf-b6d1-00aa00bbbb58\\InprocServer32\\(Default)"
  618.  
  619.  
  620. "data": "C:\\Windows\\system32\\jscript.dll"
  621.  
  622.  
  623. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\801B440B-1EE3-49B0-B05D-2AB076D4E8CB\\InprocServer32\\(Default)"
  624.  
  625.  
  626. "data": "C:\\Program Files\\Reimage\\Reimage Repair\\REI_Axcontrol.dll"
  627.  
  628.  
  629. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\cc5bbec3-db4a-4bed-828d-08d78ee3e1ed\\InprocServer32\\(Default)"
  630.  
  631.  
  632. "data": "C:\\Windows\\system32\\jscript.dll"
  633.  
  634.  
  635. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\10ECCE17-29B5-4880-A8F5-EAD298611484\\InprocServer32\\(Default)"
  636.  
  637.  
  638. "data": "C:\\Program Files\\Reimage\\Reimage Repair\\REI_Axcontrol.dll"
  639.  
  640.  
  641. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c260-6ac0-11cf-b6d1-00aa00bbbb58\\InprocServer32\\(Default)"
  642.  
  643.  
  644. "data": "C:\\Windows\\system32\\jscript.dll"
  645.  
  646.  
  647.  
  648.  
  649. "Description": "Collects information about installed applications",
  650. "Details":
  651.  
  652. "Program": "Microsoft Office Shared 64-bit MUI 2013"
  653.  
  654.  
  655. "Program": "Google Update Helper"
  656.  
  657.  
  658.  
  659.  
  660.  
  661.  
  662. "Program": "Microsoft Excel MUI 2013"
  663.  
  664.  
  665. "Program": "Microsoft Outlook MUI 2013"
  666.  
  667.  
  668.  
  669.  
  670. "Program": "Google Chrome"
  671.  
  672.  
  673.  
  674.  
  675. "Program": "Notepad++"
  676.  
  677.  
  678. "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
  679.  
  680.  
  681. "Program": "Adobe Flash Player 29 ActiveX"
  682.  
  683.  
  684.  
  685.  
  686. "Program": "Microsoft Access MUI 2013"
  687.  
  688.  
  689. "Program": "Reimage Repair"
  690.  
  691.  
  692. "Program": "Microsoft Office 64-bit Components 2013"
  693.  
  694.  
  695. "Program": "Microsoft Office Proofing Tools 2013 - English"
  696.  
  697.  
  698. "Program": "Adobe Flash Player 29 NPAPI"
  699.  
  700.  
  701. "Program": "Adobe Acrobat Reader DC"
  702.  
  703.  
  704. "Program": "Adobe Refresh Manager"
  705.  
  706.  
  707. "Program": "Microsoft Publisher MUI 2013"
  708.  
  709.  
  710. "Program": "Microsoft DCF MUI 2013"
  711.  
  712.  
  713.  
  714.  
  715. "Program": "Microsoft Office Shared MUI 2013"
  716.  
  717.  
  718. "Program": "Microsoft Office OSM MUI 2013"
  719.  
  720.  
  721. "Program": "Microsoft InfoPath MUI 2013"
  722.  
  723.  
  724. "Program": "Microsoft Office Shared Setup Metadata MUI 2013"
  725.  
  726.  
  727. "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
  728.  
  729.  
  730. "Program": "Microsoft Word MUI 2013"
  731.  
  732.  
  733.  
  734.  
  735.  
  736.  
  737.  
  738.  
  739. "Program": "Microsoft OneDrive"
  740.  
  741.  
  742. "Program": "Microsoft Groove MUI 2013"
  743.  
  744.  
  745. "Program": "Oracle VM VirtualBox Guest Additions 6.0.2"
  746.  
  747.  
  748.  
  749.  
  750.  
  751.  
  752. "Program": "Microsoft Office Shared 64-bit Setup Metadata MUI 2013"
  753.  
  754.  
  755. "Program": "Microsoft Access Setup Metadata MUI 2013"
  756.  
  757.  
  758. "Program": "Microsoft Office OSM UX MUI 2013"
  759.  
  760.  
  761. "Program": "Java Auto Updater"
  762.  
  763.  
  764. "Program": "Microsoft PowerPoint MUI 2013"
  765.  
  766.  
  767. "Program": "Microsoft Office Professional Plus 2013"
  768.  
  769.  
  770. "Program": "Java 8 Update 201"
  771.  
  772.  
  773. "Program": "Microsoft Office Proofing 2013"
  774.  
  775.  
  776. "Program": "Microsoft Lync MUI 2013"
  777.  
  778.  
  779.  
  780.  
  781.  
  782.  
  783. "Program": "Microsoft OneNote MUI 2013"
  784.  
  785.  
  786.  
  787.  
  788. "Description": "Creates a hidden or system file",
  789. "Details":
  790.  
  791. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History.ch"
  792.  
  793.  
  794.  
  795.  
  796. "Description": "Detects VirtualBox through the presence of a registry key",
  797. "Details":
  798.  
  799.  
  800. "Description": "Attempts to modify proxy settings",
  801. "Details":
  802.  
  803.  
  804. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  805. "Details":
  806.  
  807. "target": "clamav:Win.Trojan.Agent-7036350-0, sha256:75472f8b78322869ada7cef8baa29a9566b79e61b3c45a59de1f17f4a47d6b39, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  808.  
  809.  
  810. "dropped": "clamav:Win.Trojan.Agent-7036350-0, sha256:75472f8b78322869ada7cef8baa29a9566b79e61b3c45a59de1f17f4a47d6b39 , guest_paths:C:\\Program Files\\Reimage\\Reimage Repair\\ReimageRepair.exe, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  811.  
  812.  
  813.  
  814.  
  815. "Description": "Creates a copy of itself",
  816. "Details":
  817.  
  818. "copy": "C:\\Program Files\\Reimage\\Reimage Repair\\ReimageRepair.exe"
  819.  
  820.  
  821.  
  822.  
  823.  
  824. * Started Service:
  825. "Winmgmt",
  826. "ReimageRealTimeProtector"
  827.  
  828.  
  829. * Mutexes:
  830. "CicLoadWinStaWinSta0",
  831. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  832. "ReiAgentUpdater",
  833. "ExtractTrackId",
  834. "ServiceDefinitionMutex_Reimage",
  835. "Global\\Reimage.PC_Repair.Mutex",
  836. "Local\\WininetStartupMutex",
  837. "Local\\ZonesCounterMutex",
  838. "Local\\ZoneAttributeCacheCounterMutex",
  839. "Local\\ZonesCacheCounterMutex",
  840. "Local\\ZonesLockedCacheCounterMutex",
  841. "Local\\_!MSFTHISTORY!_",
  842. "Local\\c:!users!user!appdata!local!microsoft!windows!temporary internet files!content.ie5!",
  843. "Local\\c:!users!user!appdata!roaming!microsoft!windows!cookies!",
  844. "Local\\c:!users!user!appdata!local!microsoft!windows!history!history.ie5!",
  845. "Local\\WininetConnectionMutex",
  846. "Local\\WininetProxyRegistryMutex",
  847. "Local\\!IETld!Mutex",
  848. "MSIMGSIZECacheMutex",
  849. "Local\\__DDrawExclMode__",
  850. "Local\\__DDrawCheckExclMode__",
  851. "Local\\DDrawWindowListMutex",
  852. "Local\\DDrawDriverObjectListMutex",
  853. "_!SHMSFTHISTORY!_",
  854. "Local\\c:!users!user!appdata!local!microsoft!windows!history!history.ie5!mshist012019072620190727!",
  855. "Global\\ADAP_WMI_ENTRY",
  856. "Global\\RefreshRA_Mutex",
  857. "Global\\RefreshRA_Mutex_Lib",
  858. "Global\\RefreshRA_Mutex_Flag"
  859.  
  860.  
  861. * Modified Files:
  862. "C:\\Users\\user\\AppData\\Local\\Temp\\nsw64BB.tmp",
  863. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\LogEx.dll",
  864. "C:\\Users\\user\\AppData\\Local\\Temp\\downloader log.txt",
  865. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\System.dll",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\Banner.dll",
  867. "C:\\Windows\\Reimage.ini",
  868. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\UserInfo.dll",
  869. "C:\\Users\\user\\AppData\\Local\\Temp\\sqlite3.exe",
  870. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\ExecDos.dll",
  871. "C:\\Users\\user\\AppData\\Local\\Temp\\Chrome.txt",
  872. "\\Device\\NamedPipe",
  873. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\nsExec.dll",
  874. "C:\\Users\\user\\AppData\\Local\\Temp\\InstallationPixelStart.txt",
  875. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\inetc.dll",
  876. "C:\\Users\\user\\AppData\\Local\\Temp\\InstallationPixel.txt",
  877. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\installer-164x314.bmp",
  878. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\modern-header.bmp",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\nsDialogs.dll",
  880. "\\??\\PIPE\\srvsvc",
  881. "C:\\Users\\Public\\Desktop\\Resume Reimage Repair Installation.lnk",
  882. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\registry.dll",
  883. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\stack.dll",
  884. "C:\\Users\\user\\AppData\\Local\\Temp\\downloader_version.xml",
  885. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\xml.dll",
  886. "C:\\Users\\user\\AppData\\Local\\Temp\\repair_version.xml",
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\ack.txt",
  888. "C:\\Users\\user\\AppData\\Local\\Temp\\ReimagePackage.exe",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\cfl.rei",
  890. "C:\\rei\\cfl.rei",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\Add.xml",
  892. "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\IsProcessActive.txt",
  894. "\\??\\PIPE\\samr",
  895. "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
  896. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
  897. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
  898. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
  899. "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
  900. "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
  901. "C:\\Windows\\sysnative\\LogFiles\\Scm\\5869f1c1-01d7-41f7-84b7-715672259fa8",
  902. "\\??\\WMIDataDevice",
  903. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  904. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\nsz292.tmp",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\nsz2E1.tmp\\System.dll",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\nsz2E1.tmp\\LogEx.dll",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\repair setup log.txt",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\nsz2E1.tmp\\installer-164x314.bmp",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\nsz2E1.tmp\\modern-header.bmp",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\nsz2E1.tmp\\nsExec.dll",
  912. "C:\\Program Files\\Reimage\\Reimage Repair\\LZMA.EXE",
  913. "C:\\Program Files\\Reimage\\Reimage Repair\\ReimageReminder.exe",
  914. "C:\\Program Files\\Reimage\\Reimage Repair\\version.rei",
  915. "C:\\Program Files\\Reimage\\Reimage Repair\\REI_SupportInfoTool.exe",
  916. "C:\\Program Files\\Reimage\\Reimage Repair\\Reimage.exe",
  917. "C:\\Program Files\\Reimage\\Reimage Repair\\ReimageRepair.exe",
  918. "C:\\Program Files\\Reimage\\Reimage Repair\\reimage.dat",
  919. "C:\\Program Files\\Reimage\\Reimage Repair\\engine.dat",
  920. "C:\\Users\\user\\AppData\\Local\\Temp\\nsz2E1.tmp\\DcryptDll.dll",
  921. "C:\\Program Files\\Reimage\\Reimage Repair\\REI_Axcontrol.lza",
  922. "C:\\Program Files\\Reimage\\Reimage Repair\\REI_Engine.lza",
  923. "C:\\Program Files\\Reimage\\Reimage Repair\\Reimageicon.ico",
  924. "C:\\Program Files\\Reimage\\Reimage Repair\\Reimage_uninstall.ico",
  925. "C:\\Program Files\\Reimage\\Reimage Repair\\Reimage_website.ico",
  926. "C:\\Program Files\\Reimage\\Reimage Repair\\Reimage_SafeMode.ico",
  927. "C:\\Program Files\\Reimage\\Reimage Repair\\ReimageSafeMode.exe",
  928. "C:\\Program Files\\Reimage\\Reimage Repair\\savapi.dll",
  929. "C:\\Program Files\\Reimage\\Reimage Repair\\msvcr120.dll",
  930. "C:\\Program Files\\Reimage\\Reimage Repair\\REI_AVIRA.exe",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\nsz2E1.tmp\\ProtectorUpdater.exe",
  932. "C:\\rei\\SupportInfoTool.ini",
  933. "C:\\rei\\About.txt",
  934. "C:\\rei\\AV\\savapi.exe",
  935. "C:\\rei\\AV\\savapi_restart.exe",
  936. "C:\\rei\\AV\\savapi_stub.exe",
  937. "C:\\rei\\AV\\avupdate_msg.avr",
  938. "C:\\rei\\AV\\avupdate.exe",
  939. "C:\\rei\\AV\\HBEDV.KEY",
  940. "C:\\rei\\AV\\cacert.crt",
  941. "C:\\rei\\AV\\productname.dat",
  942. "C:\\rei\\AV\\msvcr120.dll",
  943. "C:\\rei\\AV\\xbvRei.vdf",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\nsz2E1.tmp\\xml.dll",
  945. "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Reimage Repair\\Reimage Repair.lnk",
  946. "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Reimage Repair\\Run in safe mode.lnk",
  947. "C:\\Users\\Public\\Desktop\\PC Scan & Repair by Reimage.lnk",
  948. "C:\\Program Files\\Reimage\\Reimage Repair\\Reimage Repair Help & Support.url",
  949. "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Reimage Repair\\Help & Support.lnk",
  950. "C:\\Program Files\\Reimage\\Reimage Repair\\Reimage Repair Terms of Use.url",
  951. "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Reimage Repair\\Terms of Use.lnk",
  952. "C:\\Program Files\\Reimage\\Reimage Repair\\Reimage Repair Privacy Policy.url",
  953. "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Reimage Repair\\Privacy Policy.lnk",
  954. "C:\\Program Files\\Reimage\\Reimage Repair\\Reimage Repair Uninstall Instructions.url",
  955. "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Reimage Repair\\Uninstall Instructions.lnk",
  956. "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Reimage Repair\\Uninstall.lnk",
  957. "C:\\Program Files\\Reimage\\Reimage Repair\\uninst.exe",
  958. "C:\\Program Files\\Reimage\\Reimage Protector\\ReimageApp.exe",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\nsz2E1.tmp\\inetc.dll",
  960. "C:\\Program Files\\Reimage\\Reimage Repair\\REI_Axcontrol.dll",
  961. "C:\\Program Files\\Reimage\\Reimage Repair\\REI_Engine.dll",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\nsl78BC.tmp\\AccessControl.dll",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\nsl78BC.tmp\\UserInfo.dll",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\nsl78BC.tmp\\System.dll",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\nsl78BC.tmp\\LogEx.dll",
  966. "C:\\ProgramData\\Reimage Protector\\Results\\ProtectorUpdater.log",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\nsl78BC.tmp\\stack.dll",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\nsl78BC.tmp\\inetc.dll",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\protector_version.xml",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\nsl78BC.tmp\\xml.dll",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\nsl78BC.tmp\\nsExec.dll",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\UniProtectorPackage.exe",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\nsk9D99.tmp",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\nsf9DC9.tmp\\System.dll",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\nsf9DC9.tmp\\LogEx.dll",
  976. "C:\\ProgramData\\Reimage Protector\\Results\\ProtectorPackage.log",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\nsf9DC9.tmp\\nsExec.dll",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\nsf9DC9.tmp\\SimpleSC.dll",
  979. "C:\\Program Files\\Reimage\\Reimage Protector\\ReiScanner.exe",
  980. "C:\\Program Files\\Reimage\\Reimage Protector\\ReiProtectorM.exe",
  981. "C:\\Program Files\\Reimage\\Reimage Protector\\ReiSystem.exe",
  982. "C:\\Program Files\\Reimage\\Reimage Protector\\ReiGuard.exe",
  983. "C:\\Program Files\\Reimage\\Reimage Protector\\ProtectorUpdater.exe",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\nsf9DC9.tmp\\stack.dll",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\nsf9DC9.tmp\\xml.dll",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\nsf9DC9.tmp\\inetc.dll",
  987. "C:\\ProgramData\\Reimage Protector\\cfl.rei",
  988. "C:\\ProgramData\\Reimage Protector\\url_setting_definitions.txt",
  989. "C:\\ProgramData\\Reimage Protector\\active_protection.txt",
  990. "C:\\Users\\user\\AppData\\Local\\Tempregistrylog\\.log",
  991. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE",
  992. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE",
  993. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EA618097E393409AFA316F0F87E2C202_FFF52A8221CC87B65D91F2F72E481CF5",
  994. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EA618097E393409AFA316F0F87E2C202_FFF52A8221CC87B65D91F2F72E481CF5",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\CabCBFB.tmp",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\TarCBFC.tmp",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\Local State",
  998. "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History.ch",
  999. "C:\\Users\\user\\AppData\\Roaming\\Mozilla\\FireFox\\places.sqlite.FR1",
  1000. "C:\\Windows\\sysnative\\Tasks\\ReimageUpdater",
  1001. "C:\\Windows\\appcompat\\Programs\\RecentFileCache.bcf",
  1002. "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
  1003. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk",
  1004. "C:\\Windows\\Temp\\Local State",
  1005. "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History",
  1006. "C:\\Users\\user\\AppData\\Roaming\\Mozilla\\FireFox\\places.sqlite",
  1007. "C:\\Windows\\TEMPregistrylog\\.log",
  1008. "C:\\Windows\\Temp\\Secure Preferences",
  1009. "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.back024",
  1010. "C:\\Users\\user\\AppData\\Roaming\\Mozilla\\Firefox\\cookies.sqlite.back98",
  1011. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
  1012. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
  1013. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat",
  1014. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\1321",
  1015. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\splash_screen1",
  1016. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\splash_screen1",
  1017. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\layout1.php",
  1018. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\splash_screen1",
  1019. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\layout_src1.php",
  1020. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\progress_round_43sec1",
  1021. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT",
  1022. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\ok_hover1",
  1023. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\start_repair_green_btn1",
  1024. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\start_repair_green_btn_hot1",
  1025. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\182x39_start_repair_11",
  1026. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\balloon_011",
  1027. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\balloon_021",
  1028. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\balloon_031",
  1029. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\close21",
  1030. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\balloon_041",
  1031. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\balloon_051",
  1032. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\balloon_061",
  1033. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\balloon_071",
  1034. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\balloon_081",
  1035. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\balloon_091",
  1036. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\balloon_101",
  1037. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\user_m1",
  1038. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\info_icon31",
  1039. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\loading-animation1",
  1040. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\button_No1",
  1041. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\button_Yes1",
  1042. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\button_fixItems1",
  1043. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\button_Reboot_modified1",
  1044. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\button_OK1",
  1045. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\button_restart1",
  1046. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\button_Ignore1",
  1047. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\button_TryAgain1",
  1048. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\button_Exit1",
  1049. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\ok1",
  1050. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\license-key1",
  1051. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\upper_button_t1",
  1052. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\button_renew1",
  1053. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\corner_bee_scan1",
  1054. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\corner_bee11",
  1055. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\progress_round_43sec2",
  1056. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\progress_round-full1",
  1057. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\q_mark21",
  1058. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\gauge_back41",
  1059. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\gauge_needle21",
  1060. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\thermo_liquid_top1",
  1061. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\thermo_lines1",
  1062. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\sum-head-warn1",
  1063. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\big_v1",
  1064. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\icon-stability1",
  1065. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\exclamation-red1",
  1066. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\icon-security1",
  1067. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\icon-registry1",
  1068. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\icon-junk1",
  1069. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\progressbar_green_left21",
  1070. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\progressbar_gray1",
  1071. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\progressbar_green31",
  1072. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\progressbar_green_right_middle1",
  1073. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\progressbar_gray_right21",
  1074. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\button_deepScan1",
  1075. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\stop_btn21",
  1076. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\red_led1",
  1077. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019072620190727\\index.dat",
  1078. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h",
  1079. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  1080. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.ini"
  1081.  
  1082.  
  1083. * Deleted Files:
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\nsb648B.tmp",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\Chrome.txt",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\IsProcessActive.txt",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\InstallationPixel.txt",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\cfl.rei",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\Add.xml",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\sqlite3.exe",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\Banner.dll",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\ExecDos.dll",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\inetc.dll",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\installer-164x314.bmp",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\LogEx.dll",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\modern-header.bmp",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\nsDialogs.dll",
  1099. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\nsExec.dll",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\registry.dll",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\stack.dll",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\System.dll",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\UserInfo.dll",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\xml.dll",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\nsc64DC.tmp\\",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\nsy20.tmp",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\nsz2E1.tmp",
  1108. "C:\\Program Files\\Reimage\\Reimage Repair\\reimage.dat",
  1109. "C:\\Program Files\\Reimage\\Reimage Repair\\engine.dat",
  1110. "C:\\Users\\Public\\Desktop\\Resume Reimage Repair Installation.lnk",
  1111. "C:\\Users\\user\\AppData\\Local\\Temp\\nsz2E1.tmp\\DcryptDll.dll",
  1112. "C:\\Users\\user\\AppData\\Local\\Temp\\nsz2E1.tmp\\inetc.dll",
  1113. "C:\\Users\\user\\AppData\\Local\\Temp\\nsz2E1.tmp\\installer-164x314.bmp",
  1114. "C:\\Users\\user\\AppData\\Local\\Temp\\nsz2E1.tmp\\LogEx.dll",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\nsz2E1.tmp\\modern-header.bmp",
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\nsz2E1.tmp\\nsExec.dll",
  1117. "C:\\Users\\user\\AppData\\Local\\Temp\\nsz2E1.tmp\\ProtectorUpdater.exe",
  1118. "C:\\Users\\user\\AppData\\Local\\Temp\\nsz2E1.tmp\\System.dll",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\nsz2E1.tmp\\xml.dll",
  1120. "C:\\Users\\user\\AppData\\Local\\Temp\\nsz2E1.tmp\\",
  1121. "C:\\Users\\user\\AppData\\Local\\Temp\\nsv785D.tmp",
  1122. "C:\\Users\\user\\AppData\\Local\\Temp\\nsl78BC.tmp",
  1123. "C:\\Users\\user\\AppData\\Local\\Temp\\UniProtectorPackage.exe",
  1124. "C:\\Users\\user\\AppData\\Local\\Temp\\nsl78BC.tmp\\AccessControl.dll",
  1125. "C:\\Users\\user\\AppData\\Local\\Temp\\nsl78BC.tmp\\inetc.dll",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\nsl78BC.tmp\\LogEx.dll",
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\nsl78BC.tmp\\nsExec.dll",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\nsl78BC.tmp\\stack.dll",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\nsl78BC.tmp\\System.dll",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\nsl78BC.tmp\\UserInfo.dll",
  1131. "C:\\Users\\user\\AppData\\Local\\Temp\\nsl78BC.tmp\\xml.dll",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\nsl78BC.tmp\\",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\nsu9CFC.tmp",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\nsf9DC9.tmp",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\nsf9DC9.tmp\\inetc.dll",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\nsf9DC9.tmp\\LogEx.dll",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\nsf9DC9.tmp\\nsExec.dll",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\nsf9DC9.tmp\\SimpleSC.dll",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\nsf9DC9.tmp\\stack.dll",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\nsf9DC9.tmp\\System.dll",
  1141. "C:\\Users\\user\\AppData\\Local\\Temp\\nsf9DC9.tmp\\xml.dll",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\nsf9DC9.tmp\\",
  1143. "C:\\ProgramData\\Reimage Protector\\Results\\url_setting_definitions.txt",
  1144. "C:\\ProgramData\\Reimage Protector\\Results\\active_protection.txt",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\CabCBFB.tmp",
  1146. "C:\\Users\\user\\AppData\\Local\\Temp\\TarCBFC.tmp",
  1147. "C:\\Users\\user\\AppData\\Local\\Temp\\Local State",
  1148. "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History.ch",
  1149. "C:\\Users\\user\\AppData\\Roaming\\Mozilla\\FireFox\\places.sqlite.FR1",
  1150. "C:\\Windows\\Tasks\\ReimageUpdater.job",
  1151. "C:\\Windows\\sysnative\\Tasks\\ReimageUpdater",
  1152. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log",
  1153. "C:\\Windows\\Temp\\Local State",
  1154. "C:\\Windows\\Temp\\Secure Preferences",
  1155. "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.back024",
  1156. "C:\\Users\\user\\AppData\\Roaming\\Mozilla\\Firefox\\cookies.sqlite.back98",
  1157. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\splash_screen1",
  1158. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\progress_round_43sec1",
  1159. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019052620190527\\index.dat",
  1160. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019052620190527\\",
  1161. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  1162. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h"
  1163.  
  1164.  
  1165. * Modified Registry Keys:
  1166. "HKEY_LOCAL_MACHINE\\Software\\Reimage\\Reimage Repair",
  1167. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Repair\\Installer Language",
  1168. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\GlobalAssocChangedCounter",
  1169. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Reimage Repair",
  1170. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Reimage Repair\\DownloaderVersion",
  1171. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  1172. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
  1173. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
  1174. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
  1175. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
  1176. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript",
  1177. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript\\OLEScript",
  1178. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript\\(Default)",
  1179. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript\\CLSID",
  1180. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript\\CLSID\\(Default)",
  1181. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\LiveScript",
  1182. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\LiveScript\\OLEScript",
  1183. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\LiveScript\\(Default)",
  1184. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\LiveScript\\CLSID",
  1185. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\LiveScript\\CLSID\\(Default)",
  1186. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript",
  1187. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript\\OLEScript",
  1188. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript\\(Default)",
  1189. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript\\CLSID",
  1190. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript\\CLSID\\(Default)",
  1191. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript1.1",
  1192. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript1.1\\OLEScript",
  1193. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript1.1\\(Default)",
  1194. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript1.1\\CLSID",
  1195. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript1.1\\CLSID\\(Default)",
  1196. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript1.2",
  1197. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript1.2\\OLEScript",
  1198. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript1.2\\(Default)",
  1199. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript1.2\\CLSID",
  1200. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript1.2\\CLSID\\(Default)",
  1201. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript1.3",
  1202. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript1.3\\OLEScript",
  1203. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript1.3\\(Default)",
  1204. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript1.3\\CLSID",
  1205. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript1.3\\CLSID\\(Default)",
  1206. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\ECMAScript",
  1207. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\ECMAScript\\OLEScript",
  1208. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\ECMAScript\\(Default)",
  1209. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\ECMAScript\\CLSID",
  1210. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\ECMAScript\\CLSID\\(Default)",
  1211. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c260-6ac0-11cf-b6d1-00aa00bbbb58",
  1212. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c260-6ac0-11cf-b6d1-00aa00bbbb58\\OLEScript",
  1213. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c260-6ac0-11cf-b6d1-00aa00bbbb58\\(Default)",
  1214. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c260-6ac0-11cf-b6d1-00aa00bbbb58\\ProgID",
  1215. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c260-6ac0-11cf-b6d1-00aa00bbbb58\\ProgID\\(Default)",
  1216. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c260-6ac0-11cf-b6d1-00aa00bbbb58\\InprocServer32",
  1217. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c260-6ac0-11cf-b6d1-00aa00bbbb58\\InprocServer32\\(Default)",
  1218. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c260-6ac0-11cf-b6d1-00aa00bbbb58\\InprocServer32\\ThreadingModel",
  1219. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Component Categories\\F0B7A1A1-9847-11CF-8F20-00805F2CD064\\409",
  1220. "HKEY_CLASSES_ROOT\\CLSID\\F414C260-6AC0-11CF-B6D1-00AA00BBBB58\\Implemented Categories",
  1221. "HKEY_CLASSES_ROOT\\CLSID\\F414C260-6AC0-11CF-B6D1-00AA00BBBB58\\Implemented Categories\\F0B7A1A1-9847-11CF-8F20-00805F2CD064",
  1222. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Component Categories\\F0B7A1A2-9847-11CF-8F20-00805F2CD064\\409",
  1223. "HKEY_CLASSES_ROOT\\CLSID\\F414C260-6AC0-11CF-B6D1-00AA00BBBB58\\Implemented Categories\\F0B7A1A2-9847-11CF-8F20-00805F2CD064",
  1224. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript Author",
  1225. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript Author\\OLEScript",
  1226. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript Author\\(Default)",
  1227. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript Author\\CLSID",
  1228. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript Author\\CLSID\\(Default)",
  1229. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript.Compact Author",
  1230. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript.Compact Author\\OLEScript",
  1231. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript.Compact Author\\(Default)",
  1232. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript.Compact Author\\CLSID",
  1233. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript.Compact Author\\CLSID\\(Default)",
  1234. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\LiveScript Author",
  1235. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\LiveScript Author\\OLEScript",
  1236. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\LiveScript Author\\(Default)",
  1237. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\LiveScript Author\\CLSID",
  1238. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\LiveScript Author\\CLSID\\(Default)",
  1239. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript Author",
  1240. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript Author\\OLEScript",
  1241. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript Author\\(Default)",
  1242. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript Author\\CLSID",
  1243. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript Author\\CLSID\\(Default)",
  1244. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript1.1 Author",
  1245. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript1.1 Author\\OLEScript",
  1246. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript1.1 Author\\(Default)",
  1247. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript1.1 Author\\CLSID",
  1248. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript1.1 Author\\CLSID\\(Default)",
  1249. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript1.2 AuthorJavaScript1.3 Author",
  1250. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript1.2 AuthorJavaScript1.3 Author\\OLEScript",
  1251. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript1.2 AuthorJavaScript1.3 Author\\(Default)",
  1252. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript1.2 AuthorJavaScript1.3 Author\\CLSID",
  1253. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JavaScript1.2 AuthorJavaScript1.3 Author\\CLSID\\(Default)",
  1254. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\ECMAScript Author",
  1255. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\ECMAScript Author\\OLEScript",
  1256. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\ECMAScript Author\\(Default)",
  1257. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\ECMAScript Author\\CLSID",
  1258. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\ECMAScript Author\\CLSID\\(Default)",
  1259. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c261-6ac0-11cf-b6d1-00aa00bbbb58",
  1260. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c261-6ac0-11cf-b6d1-00aa00bbbb58\\OLEScript",
  1261. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c261-6ac0-11cf-b6d1-00aa00bbbb58\\(Default)",
  1262. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c261-6ac0-11cf-b6d1-00aa00bbbb58\\ProgID",
  1263. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c261-6ac0-11cf-b6d1-00aa00bbbb58\\ProgID\\(Default)",
  1264. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c261-6ac0-11cf-b6d1-00aa00bbbb58\\InprocServer32",
  1265. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c261-6ac0-11cf-b6d1-00aa00bbbb58\\InprocServer32\\(Default)",
  1266. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c261-6ac0-11cf-b6d1-00aa00bbbb58\\InprocServer32\\ThreadingModel",
  1267. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Component Categories\\0AEE2A92-BCBB-11D0-8C72-00C04FC2B085\\409",
  1268. "HKEY_CLASSES_ROOT\\CLSID\\F414C261-6AC0-11CF-B6D1-00AA00BBBB58\\Implemented Categories",
  1269. "HKEY_CLASSES_ROOT\\CLSID\\F414C261-6AC0-11CF-B6D1-00AA00BBBB58\\Implemented Categories\\0AEE2A92-BCBB-11D0-8C72-00C04FC2B085",
  1270. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript.Encode",
  1271. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript.Encode\\OLEScript",
  1272. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript.Encode\\(Default)",
  1273. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript.Encode\\CLSID",
  1274. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript.Encode\\CLSID\\(Default)",
  1275. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c262-6ac0-11cf-b6d1-00aa00bbbb58",
  1276. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c262-6ac0-11cf-b6d1-00aa00bbbb58\\OLEScript",
  1277. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c262-6ac0-11cf-b6d1-00aa00bbbb58\\(Default)",
  1278. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c262-6ac0-11cf-b6d1-00aa00bbbb58\\ProgID",
  1279. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c262-6ac0-11cf-b6d1-00aa00bbbb58\\ProgID\\(Default)",
  1280. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c262-6ac0-11cf-b6d1-00aa00bbbb58\\InprocServer32",
  1281. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c262-6ac0-11cf-b6d1-00aa00bbbb58\\InprocServer32\\(Default)",
  1282. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\f414c262-6ac0-11cf-b6d1-00aa00bbbb58\\InprocServer32\\ThreadingModel",
  1283. "HKEY_CLASSES_ROOT\\CLSID\\F414C262-6AC0-11CF-B6D1-00AA00BBBB58\\Implemented Categories",
  1284. "HKEY_CLASSES_ROOT\\CLSID\\F414C262-6AC0-11CF-B6D1-00AA00BBBB58\\Implemented Categories\\F0B7A1A1-9847-11CF-8F20-00805F2CD064",
  1285. "HKEY_CLASSES_ROOT\\CLSID\\F414C262-6AC0-11CF-B6D1-00AA00BBBB58\\Implemented Categories\\F0B7A1A2-9847-11CF-8F20-00805F2CD064",
  1286. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Component Categories\\F0B7A1A3-9847-11CF-8F20-00805F2CD064\\409",
  1287. "HKEY_CLASSES_ROOT\\CLSID\\F414C262-6AC0-11CF-B6D1-00AA00BBBB58\\Implemented Categories\\F0B7A1A3-9847-11CF-8F20-00805F2CD064",
  1288. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript.Compact",
  1289. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript.Compact\\OLEScript",
  1290. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript.Compact\\(Default)",
  1291. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript.Compact\\CLSID",
  1292. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript.Compact\\CLSID\\(Default)",
  1293. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\cc5bbec3-db4a-4bed-828d-08d78ee3e1ed",
  1294. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\cc5bbec3-db4a-4bed-828d-08d78ee3e1ed\\OLEScript",
  1295. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\cc5bbec3-db4a-4bed-828d-08d78ee3e1ed\\(Default)",
  1296. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\cc5bbec3-db4a-4bed-828d-08d78ee3e1ed\\ProgID",
  1297. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\cc5bbec3-db4a-4bed-828d-08d78ee3e1ed\\ProgID\\(Default)",
  1298. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\cc5bbec3-db4a-4bed-828d-08d78ee3e1ed\\InprocServer32",
  1299. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\cc5bbec3-db4a-4bed-828d-08d78ee3e1ed\\InprocServer32\\(Default)",
  1300. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\cc5bbec3-db4a-4bed-828d-08d78ee3e1ed\\InprocServer32\\ThreadingModel",
  1301. "HKEY_CLASSES_ROOT\\CLSID\\CC5BBEC3-DB4A-4BED-828D-08D78EE3E1ED\\Implemented Categories",
  1302. "HKEY_CLASSES_ROOT\\CLSID\\CC5BBEC3-DB4A-4BED-828D-08D78EE3E1ED\\Implemented Categories\\F0B7A1A1-9847-11CF-8F20-00805F2CD064",
  1303. "HKEY_CLASSES_ROOT\\CLSID\\CC5BBEC3-DB4A-4BED-828D-08D78EE3E1ED\\Implemented Categories\\F0B7A1A2-9847-11CF-8F20-00805F2CD064",
  1304. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\ReimageRealTimeProtector",
  1305. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\ReimageRealTimeProtector\\Type",
  1306. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\ReimageRealTimeProtector\\Start",
  1307. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\ReimageRealTimeProtector\\ErrorControl",
  1308. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\ReimageRealTimeProtector\\ImagePath",
  1309. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\ReimageRealTimeProtector\\DisplayName",
  1310. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\ReimageRealTimeProtector\\ObjectName",
  1311. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
  1312. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ThrottleDrege",
  1313. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Parameters\\ServiceDllUnloadOnStop",
  1314. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStopMissed",
  1315. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
  1316. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
  1317. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider",
  1318. "HKEY_LOCAL_MACHINE\\Software\\Reimage\\Reimage Protector",
  1319. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\ReimageRepairLocation",
  1320. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\Reimage.exe",
  1321. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\Reimage.exe\\(Default)",
  1322. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Reimage Repair\\DisplayName",
  1323. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Reimage Repair\\UninstallString",
  1324. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Reimage Repair\\DisplayIcon",
  1325. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Reimage Repair\\DisplayVersion",
  1326. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Reimage Repair\\URLInfoAbout",
  1327. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Reimage Repair\\Publisher",
  1328. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Reimage Repair\\InstallFile",
  1329. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Reimage Repair\\InstallLocation",
  1330. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Reimage Repair\\VersionMajor",
  1331. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Reimage Repair\\VersionMinor",
  1332. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Reimage",
  1333. "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\28FF42B8-A0DA-4BE5-9B81-E26DD59B350A",
  1334. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\28FF42B8-A0DA-4BE5-9B81-E26DD59B350A\\(Default)",
  1335. "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\REI_AxControl.DLL",
  1336. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\REI_AxControl.DLL\\AppID",
  1337. "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\801B440B-1EE3-49B0-B05D-2AB076D4E8CB",
  1338. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\801B440B-1EE3-49B0-B05D-2AB076D4E8CB\\(Default)",
  1339. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\801B440B-1EE3-49B0-B05D-2AB076D4E8CB\\InprocServer32",
  1340. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\801B440B-1EE3-49B0-B05D-2AB076D4E8CB\\InprocServer32\\(Default)",
  1341. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\801B440B-1EE3-49B0-B05D-2AB076D4E8CB\\InprocServer32\\ThreadingModel",
  1342. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\801B440B-1EE3-49B0-B05D-2AB076D4E8CB\\TypeLib",
  1343. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\801B440B-1EE3-49B0-B05D-2AB076D4E8CB\\TypeLib\\(Default)",
  1344. "HKEY_CLASSES_ROOT\\REI_AxControl.ReiEngine.1",
  1345. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\REI_AxControl.ReiEngine.1\\(Default)",
  1346. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\REI_AxControl.ReiEngine.1\\CLSID",
  1347. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\REI_AxControl.ReiEngine.1\\CLSID\\(Default)",
  1348. "HKEY_CLASSES_ROOT\\REI_AxControl.ReiEngine",
  1349. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\REI_AxControl.ReiEngine\\(Default)",
  1350. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\REI_AxControl.ReiEngine\\CLSID",
  1351. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\REI_AxControl.ReiEngine\\CLSID\\(Default)",
  1352. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\REI_AxControl.ReiEngine\\CurVer",
  1353. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\REI_AxControl.ReiEngine\\CurVer\\(Default)",
  1354. "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\10ECCE17-29B5-4880-A8F5-EAD298611484",
  1355. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\10ECCE17-29B5-4880-A8F5-EAD298611484\\(Default)",
  1356. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\10ECCE17-29B5-4880-A8F5-EAD298611484\\ProgID",
  1357. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\10ECCE17-29B5-4880-A8F5-EAD298611484\\ProgID\\(Default)",
  1358. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\10ECCE17-29B5-4880-A8F5-EAD298611484\\VersionIndependentProgID",
  1359. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\10ECCE17-29B5-4880-A8F5-EAD298611484\\VersionIndependentProgID\\(Default)",
  1360. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\10ECCE17-29B5-4880-A8F5-EAD298611484\\Programmable",
  1361. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\10ECCE17-29B5-4880-A8F5-EAD298611484\\InprocServer32",
  1362. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\10ECCE17-29B5-4880-A8F5-EAD298611484\\InprocServer32\\(Default)",
  1363. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\10ECCE17-29B5-4880-A8F5-EAD298611484\\InprocServer32\\ThreadingModel",
  1364. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\10ECCE17-29B5-4880-A8F5-EAD298611484\\AppID",
  1365. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\10ECCE17-29B5-4880-A8F5-EAD298611484\\Control",
  1366. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\10ECCE17-29B5-4880-A8F5-EAD298611484\\ToolboxBitmap32",
  1367. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\10ECCE17-29B5-4880-A8F5-EAD298611484\\ToolboxBitmap32\\(Default)",
  1368. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\10ECCE17-29B5-4880-A8F5-EAD298611484\\MiscStatus",
  1369. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\10ECCE17-29B5-4880-A8F5-EAD298611484\\MiscStatus\\(Default)",
  1370. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\10ECCE17-29B5-4880-A8F5-EAD298611484\\MiscStatus\\1",
  1371. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\10ECCE17-29B5-4880-A8F5-EAD298611484\\MiscStatus\\1\\(Default)",
  1372. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\10ECCE17-29B5-4880-A8F5-EAD298611484\\TypeLib",
  1373. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\10ECCE17-29B5-4880-A8F5-EAD298611484\\TypeLib\\(Default)",
  1374. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\10ECCE17-29B5-4880-A8F5-EAD298611484\\Version",
  1375. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\10ECCE17-29B5-4880-A8F5-EAD298611484\\Version\\(Default)",
  1376. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36",
  1377. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36\\1.0",
  1378. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36\\1.0\\(Default)",
  1379. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36\\1.0\\FLAGS",
  1380. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36\\1.0\\FLAGS\\(Default)",
  1381. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36\\1.0\\0",
  1382. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36\\1.0\\0\\win64",
  1383. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36\\1.0\\0\\win64\\(Default)",
  1384. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36\\1.0\\HELPDIR",
  1385. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36\\1.0\\HELPDIR\\(Default)",
  1386. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\A817E7A2-43FA-11D0-9E44-00AA00B6770A\\TypeLib\\(Default)",
  1387. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\A817E7A2-43FA-11D0-9E44-00AA00B6770A\\TypeLib\\(Default)",
  1388. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\BD51A48E-EB5F-4454-8774-EF962DF64546",
  1389. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\BD51A48E-EB5F-4454-8774-EF962DF64546\\(Default)",
  1390. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\BD51A48E-EB5F-4454-8774-EF962DF64546\\ProxyStubClsid32",
  1391. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\BD51A48E-EB5F-4454-8774-EF962DF64546\\ProxyStubClsid32\\(Default)",
  1392. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\BD51A48E-EB5F-4454-8774-EF962DF64546\\TypeLib",
  1393. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\BD51A48E-EB5F-4454-8774-EF962DF64546\\TypeLib\\(Default)",
  1394. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\BD51A48E-EB5F-4454-8774-EF962DF64546\\TypeLib\\Version",
  1395. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\BD51A48E-EB5F-4454-8774-EF962DF64546",
  1396. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\BD51A48E-EB5F-4454-8774-EF962DF64546\\(Default)",
  1397. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\BD51A48E-EB5F-4454-8774-EF962DF64546\\ProxyStubClsid32",
  1398. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\BD51A48E-EB5F-4454-8774-EF962DF64546\\ProxyStubClsid32\\(Default)",
  1399. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\BD51A48E-EB5F-4454-8774-EF962DF64546\\TypeLib",
  1400. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\BD51A48E-EB5F-4454-8774-EF962DF64546\\TypeLib\\(Default)",
  1401. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\BD51A48E-EB5F-4454-8774-EF962DF64546\\TypeLib\\Version",
  1402. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\9BB31AD8-5DB2-459E-A901-DEA536F23BA4",
  1403. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\9BB31AD8-5DB2-459E-A901-DEA536F23BA4\\(Default)",
  1404. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\9BB31AD8-5DB2-459E-A901-DEA536F23BA4\\ProxyStubClsid32",
  1405. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\9BB31AD8-5DB2-459E-A901-DEA536F23BA4\\ProxyStubClsid32\\(Default)",
  1406. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\9BB31AD8-5DB2-459E-A901-DEA536F23BA4\\TypeLib",
  1407. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\9BB31AD8-5DB2-459E-A901-DEA536F23BA4\\TypeLib\\(Default)",
  1408. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\9BB31AD8-5DB2-459E-A901-DEA536F23BA4\\TypeLib\\Version",
  1409. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\9BB31AD8-5DB2-459E-A901-DEA536F23BA4",
  1410. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\9BB31AD8-5DB2-459E-A901-DEA536F23BA4\\(Default)",
  1411. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\9BB31AD8-5DB2-459E-A901-DEA536F23BA4\\ProxyStubClsid32",
  1412. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\9BB31AD8-5DB2-459E-A901-DEA536F23BA4\\ProxyStubClsid32\\(Default)",
  1413. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\9BB31AD8-5DB2-459E-A901-DEA536F23BA4\\TypeLib",
  1414. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\9BB31AD8-5DB2-459E-A901-DEA536F23BA4\\TypeLib\\(Default)",
  1415. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\9BB31AD8-5DB2-459E-A901-DEA536F23BA4\\TypeLib\\Version",
  1416. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\CflPath",
  1417. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\LogsPath",
  1418. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\SessionID",
  1419. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Version",
  1420. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1421. "HKEY_LOCAL_MACHINE\\Software\\reimage\\reimage protector\\Service",
  1422. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Service\\RECHECK_AFTER_CAMPAIGN",
  1423. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Service\\SERIAL_REQUEST",
  1424. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Service\\StartProtector",
  1425. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Service\\ACTIVE_TIMER",
  1426. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Service\\CheckForUpdate",
  1427. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Service\\SendTimeAfterInstall",
  1428. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Service\\CHECK_FOR_SETTING_OF_URL",
  1429. "HKEY_LOCAL_MACHINE\\Software\\reimage\\reimage protector\\Service\\General",
  1430. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Service\\General\\uhis",
  1431. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Service\\OriginalInstallDate",
  1432. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Service\\InstallDate",
  1433. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Service\\General\\installstart",
  1434. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Service\\General\\installend",
  1435. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Service\\General\\pLst",
  1436. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A1AA291B-3BCB-43BF-96F4-D85996580F80\\Path",
  1437. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A1AA291B-3BCB-43BF-96F4-D85996580F80\\Hash",
  1438. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\ReimageUpdater\\Id",
  1439. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\ReimageUpdater\\Index",
  1440. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A1AA291B-3BCB-43BF-96F4-D85996580F80\\Triggers",
  1441. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A1AA291B-3BCB-43BF-96F4-D85996580F80\\DynamicInfo",
  1442. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Service\\CHECK_FOR_ACTIVE_PROTECTION",
  1443. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Service\\General\\bHis",
  1444. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Service\\dmnOK",
  1445. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Service\\General\\pmLst",
  1446. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Service\\pmOK",
  1447. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Service\\General\\eLst",
  1448. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Service\\extOK",
  1449. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Service\\AdpaterTimeOut",
  1450. "HKEY_LOCAL_MACHINE\\Software\\reimage\\reimage protector\\Cache",
  1451. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Cache\\tid_1",
  1452. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Cache\\trk_1",
  1453. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Cache\\cmp_1",
  1454. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Service\\General\\pail",
  1455. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\Service\\General\\products",
  1456. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1457. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\AlreadyRan",
  1458. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Reimage\\Reimage Protector\\AlreadyRan\\regunpn",
  1459. "HKEY_CURRENT_USER\\Software\\Local AppWizard-Generated Applications",
  1460. "HKEY_CURRENT_USER\\Software\\Local AppWizard-Generated Applications\\Fixer - Windows Problem Relief.",
  1461. "HKEY_CURRENT_USER\\Software\\Local AppWizard-Generated Applications\\Fixer - Windows Problem Relief.\\Recent File List",
  1462. "HKEY_CURRENT_USER\\Software\\Local AppWizard-Generated Applications\\Fixer - Windows Problem Relief.\\Settings",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyEnable",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\SavedLegacySettings",
  1468. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\DirectDraw\\MostRecentApplication",
  1469. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\DirectDraw\\MostRecentApplication\\Name",
  1470. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\DirectDraw\\MostRecentApplication\\ID",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019072620190727",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019072620190727\\CachePath",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019072620190727\\CachePrefix",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019072620190727\\CacheLimit",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019072620190727\\CacheOptions",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019072620190727\\CacheRepair",
  1477. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\IDE\\DiskVBOX_HARDDISK___________________________1.0_____\\5&33d1638a&0&0.0.0_0-00000000-0000-0000-0000-000000000000",
  1478. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\advapi32.dllMofResourceName",
  1479. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\en-US\\advapi32.dll.muiMofResourceName",
  1480. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ACPI.sysACPIMOFResource",
  1481. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ACPI.sys.muiACPIMOFResource",
  1482. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ndis.sysMofResourceName",
  1483. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ndis.sys.muiMofResourceName",
  1484. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\mssmbios.sysMofResource",
  1485. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\mssmbios.sys.muiMofResource",
  1486. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\HDAudBus.sysHDAudioMofName",
  1487. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\HDAudBus.sys.muiHDAudioMofName",
  1488. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\intelppm.sysPROCESSORWMI",
  1489. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\intelppm.sys.muiPROCESSORWMI",
  1490. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\portcls.SYSPortclsMof",
  1491. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\en-US\\portcls.SYS.muiPortclsMof",
  1492. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sysMonitorWMI"
  1493.  
  1494.  
  1495. * Deleted Registry Keys:
  1496. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\ReimageUpdater.job",
  1497. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\ReimageUpdater.job.fp",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  1499. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  1501. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyOverride",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL",
  1504. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sysMonitorWMI"
  1505.  
  1506.  
  1507. * DNS Communications:
  1508.  
  1509. "type": "A",
  1510. "request": "www.reimageplus.com",
  1511. "answers":
  1512.  
  1513. "data": "161.47.7.14",
  1514. "type": "A"
  1515.  
  1516.  
  1517. "data": "reimageplus.com",
  1518. "type": "CNAME"
  1519.  
  1520.  
  1521.  
  1522.  
  1523. "type": "A",
  1524. "request": "cdnrep.reimage.com",
  1525. "answers":
  1526.  
  1527. "data": "vip0x050.ssl.hwcdn.net",
  1528. "type": "CNAME"
  1529.  
  1530.  
  1531. "data": "205.185.208.80",
  1532. "type": "A"
  1533.  
  1534.  
  1535.  
  1536.  
  1537. "type": "A",
  1538. "request": "s2.symcb.com",
  1539. "answers":
  1540.  
  1541. "data": "ocsp-ds.ws.symantec.com.edgekey.net",
  1542. "type": "CNAME"
  1543.  
  1544.  
  1545. "data": "e8218.dscb1.akamaiedge.net",
  1546. "type": "CNAME"
  1547.  
  1548.  
  1549. "data": "23.54.187.27",
  1550. "type": "A"
  1551.  
  1552.  
  1553.  
  1554.  
  1555. "type": "A",
  1556. "request": "sv.symcd.com",
  1557. "answers":
  1558.  
  1559. "data": "ocsp-ds.ws.symantec.com.edgekey.net",
  1560. "type": "CNAME"
  1561.  
  1562.  
  1563. "data": "e8218.dscb1.akamaiedge.net",
  1564. "type": "CNAME"
  1565.  
  1566.  
  1567. "data": "23.54.187.27",
  1568. "type": "A"
  1569.  
  1570.  
  1571.  
  1572.  
  1573. "type": "A",
  1574. "request": "webservice.reimageplus.com",
  1575. "answers":
  1576.  
  1577. "data": "50.56.53.60",
  1578. "type": "A"
  1579.  
  1580.  
  1581.  
  1582.  
  1583. "type": "A",
  1584. "request": "e-webservice.reimageplus.com",
  1585. "answers":
  1586.  
  1587. "data": "192.237.143.168",
  1588. "type": "A"
  1589.  
  1590.  
  1591.  
  1592.  
  1593.  
  1594. * Domains:
  1595.  
  1596. "ip": "50.56.53.60",
  1597. "domain": "webservice.reimageplus.com"
  1598.  
  1599.  
  1600. "ip": "192.237.143.168",
  1601. "domain": "e-webservice.reimageplus.com"
  1602.  
  1603.  
  1604. "ip": "205.185.208.80",
  1605. "domain": "cdnrep.reimage.com"
  1606.  
  1607.  
  1608. "ip": "23.60.139.27",
  1609. "domain": "sv.symcd.com"
  1610.  
  1611.  
  1612. "ip": "23.60.139.27",
  1613. "domain": "s2.symcb.com"
  1614.  
  1615.  
  1616. "ip": "161.47.7.14",
  1617. "domain": "www.reimageplus.com"
  1618.  
  1619.  
  1620.  
  1621. * Network Communication - ICMP:
  1622.  
  1623. * Network Communication - HTTP:
  1624.  
  1625. "count": 1,
  1626. "body": "",
  1627. "uri": "http://www.reimageplus.com/includes/install_start.php?m_trackid=&m_tracking=&m_campaign=&minorsessionid=60a6e143bf904a6abca31bb3bd&sessionid=24460283-573e-4e79-baf6-0d2eb60522f1&t=CONSUMER&a=ENABLED&u=ENABLED&c=DISABLED&v=1898",
  1628. "user-agent": "NSIS_Inetc (Mozilla)",
  1629. "method": "GET",
  1630. "host": "www.reimageplus.com",
  1631. "version": "1.1",
  1632. "path": "/includes/install_start.php?m_trackid=&m_tracking=&m_campaign=&minorsessionid=60a6e143bf904a6abca31bb3bd&sessionid=24460283-573e-4e79-baf6-0d2eb60522f1&t=CONSUMER&a=ENABLED&u=ENABLED&c=DISABLED&v=1898",
  1633. "data": "GET /includes/install_start.php?m_trackid=&m_tracking=&m_campaign=&minorsessionid=60a6e143bf904a6abca31bb3bd&sessionid=24460283-573e-4e79-baf6-0d2eb60522f1&t=CONSUMER&a=ENABLED&u=ENABLED&c=DISABLED&v=1898 HTTP/1.1\r\nUser-Agent: NSIS_Inetc (Mozilla)\r\nHost: www.reimageplus.com\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n",
  1634. "port": 80
  1635.  
  1636.  
  1637. "count": 1,
  1638. "body": "",
  1639. "uri": "http://cdnrep.reimage.com/downloader_version.xml",
  1640. "user-agent": "NSIS_Inetc (Mozilla)",
  1641. "method": "GET",
  1642. "host": "cdnrep.reimage.com",
  1643. "version": "1.1",
  1644. "path": "/downloader_version.xml",
  1645. "data": "GET /downloader_version.xml HTTP/1.1\r\nUser-Agent: NSIS_Inetc (Mozilla)\r\nHost: cdnrep.reimage.com\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n",
  1646. "port": 80
  1647.  
  1648.  
  1649. "count": 1,
  1650. "body": "",
  1651. "uri": "http://cdnrep.reimage.com/repair_version.xml",
  1652. "user-agent": "NSIS_Inetc (Mozilla)",
  1653. "method": "GET",
  1654. "host": "cdnrep.reimage.com",
  1655. "version": "1.1",
  1656. "path": "/repair_version.xml",
  1657. "data": "GET /repair_version.xml HTTP/1.1\r\nUser-Agent: NSIS_Inetc (Mozilla)\r\nHost: cdnrep.reimage.com\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n",
  1658. "port": 80
  1659.  
  1660.  
  1661. "count": 1,
  1662. "body": "",
  1663. "uri": "http://www.reimageplus.com/events4mem.php?version=1898&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=INSVR&param=1898&trackutil=",
  1664. "user-agent": "NSIS_Inetc (Mozilla)",
  1665. "method": "GET",
  1666. "host": "www.reimageplus.com",
  1667. "version": "1.1",
  1668. "path": "/events4mem.php?version=1898&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=INSVR&param=1898&trackutil=",
  1669. "data": "GET /events4mem.php?version=1898&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=INSVR&param=1898&trackutil= HTTP/1.1\r\nUser-Agent: NSIS_Inetc (Mozilla)\r\nHost: www.reimageplus.com\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\nCookie: X-Mapping-fjhppofk=9C33845D75B18B4DED694AACA8CA00F1; PHPSESSID=8h7195k6ln6shg4ldqlei1e2n3; _trackid=6575690465; _trackid_6575690465=6575690465; _tracking=agent; _tracking_agent=agent; _campaign=f_malware-scanner; _campaign_f_malware-scanner=f_malware-scanner; _adgroup=age_242; _adgroup_age_242=age_242; _keyword=direct; _keyword_direct=direct; _ads=17-07-2019; _ads_17-07-2019=17-07-2019; _browser=IE; _browser_IE=IE; _country=United+States; _country_United%20States=United%20States\r\n\r\n",
  1670. "port": 80
  1671.  
  1672.  
  1673. "count": 1,
  1674. "body": "",
  1675. "uri": "http://www.reimageplus.com/events4mem.php?version=1898&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=LANG&param=en&trackutil=",
  1676. "user-agent": "NSIS_Inetc (Mozilla)",
  1677. "method": "GET",
  1678. "host": "www.reimageplus.com",
  1679. "version": "1.1",
  1680. "path": "/events4mem.php?version=1898&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=LANG&param=en&trackutil=",
  1681. "data": "GET /events4mem.php?version=1898&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=LANG&param=en&trackutil= HTTP/1.1\r\nUser-Agent: NSIS_Inetc (Mozilla)\r\nHost: www.reimageplus.com\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\nCookie: X-Mapping-fjhppofk=9C33845D75B18B4DED694AACA8CA00F1; PHPSESSID=8h7195k6ln6shg4ldqlei1e2n3; _trackid=6575690465; _trackid_6575690465=6575690465; _tracking=agent; _tracking_agent=agent; _campaign=f_malware-scanner; _campaign_f_malware-scanner=f_malware-scanner; _adgroup=age_242; _adgroup_age_242=age_242; _keyword=direct; _keyword_direct=direct; _ads=17-07-2019; _ads_17-07-2019=17-07-2019; _browser=IE; _browser_IE=IE; _country=United+States; _country_United%20States=United%20States\r\n\r\n",
  1682. "port": 80
  1683.  
  1684.  
  1685. "count": 1,
  1686. "body": "",
  1687. "uri": "http://cdnrep.reimage.com/ver/ReimagePackage1898x64c.exe",
  1688. "user-agent": "NSIS_Inetc (Mozilla)",
  1689. "method": "GET",
  1690. "host": "cdnrep.reimage.com",
  1691. "version": "1.1",
  1692. "path": "/ver/ReimagePackage1898x64c.exe",
  1693. "data": "GET /ver/ReimagePackage1898x64c.exe HTTP/1.1\r\nUser-Agent: NSIS_Inetc (Mozilla)\r\nHost: cdnrep.reimage.com\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n",
  1694. "port": 80
  1695.  
  1696.  
  1697. "count": 1,
  1698. "body": "",
  1699. "uri": "http://cdnrep.reimage.com/cfl/cfl1898.rei",
  1700. "user-agent": "NSIS_Inetc (Mozilla)",
  1701. "method": "GET",
  1702. "host": "cdnrep.reimage.com",
  1703. "version": "1.1",
  1704. "path": "/cfl/cfl1898.rei",
  1705. "data": "GET /cfl/cfl1898.rei HTTP/1.1\r\nUser-Agent: NSIS_Inetc (Mozilla)\r\nHost: cdnrep.reimage.com\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n",
  1706. "port": 80
  1707.  
  1708.  
  1709. "count": 1,
  1710. "body": "",
  1711. "uri": "http://www.reimageplus.com/installer.php?tracking=&sessionid=24460283-573e-4e79-baf6-0d2eb60522f1",
  1712. "user-agent": "NSIS_Inetc (Mozilla)",
  1713. "method": "GET",
  1714. "host": "www.reimageplus.com",
  1715. "version": "1.1",
  1716. "path": "/installer.php?tracking=&sessionid=24460283-573e-4e79-baf6-0d2eb60522f1",
  1717. "data": "GET /installer.php?tracking=&sessionid=24460283-573e-4e79-baf6-0d2eb60522f1 HTTP/1.1\r\nUser-Agent: NSIS_Inetc (Mozilla)\r\nHost: www.reimageplus.com\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\nCookie: X-Mapping-fjhppofk=9C33845D75B18B4DED694AACA8CA00F1; PHPSESSID=8h7195k6ln6shg4ldqlei1e2n3; _trackid=6575690465; _trackid_6575690465=6575690465; _tracking=agent; _tracking_agent=agent; _campaign=f_malware-scanner; _campaign_f_malware-scanner=f_malware-scanner; _adgroup=age_242; _adgroup_age_242=age_242; _keyword=direct; _keyword_direct=direct; _ads=17-07-2019; _ads_17-07-2019=17-07-2019; _browser=IE; _browser_IE=IE; _country=United+States; _country_United%20States=United%20States\r\n\r\n",
  1718. "port": 80
  1719.  
  1720.  
  1721. "count": 1,
  1722. "body": "",
  1723. "uri": "http://cdnrep.reimage.com/protector_version.xml",
  1724. "user-agent": "NSIS_Inetc (Mozilla)",
  1725. "method": "GET",
  1726. "host": "cdnrep.reimage.com",
  1727. "version": "1.1",
  1728. "path": "/protector_version.xml",
  1729. "data": "GET /protector_version.xml HTTP/1.1\r\nUser-Agent: NSIS_Inetc (Mozilla)\r\nHost: cdnrep.reimage.com\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n",
  1730. "port": 80
  1731.  
  1732.  
  1733. "count": 1,
  1734. "body": "",
  1735. "uri": "http://www.reimageplus.com/scan_agent_events.php?version=2024&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=INSVR&param=2024&trackutil=",
  1736. "user-agent": "NSIS_Inetc (Mozilla)",
  1737. "method": "GET",
  1738. "host": "www.reimageplus.com",
  1739. "version": "1.1",
  1740. "path": "/scan_agent_events.php?version=2024&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=INSVR&param=2024&trackutil=",
  1741. "data": "GET /scan_agent_events.php?version=2024&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=INSVR&param=2024&trackutil= HTTP/1.1\r\nUser-Agent: NSIS_Inetc (Mozilla)\r\nHost: www.reimageplus.com\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\nCookie: _trackid=6575690465; _trackid_6575690465=6575690465; _tracking=agent; _tracking_agent=agent; _campaign=f_malware-scanner; _campaign_f_malware-scanner=f_malware-scanner; _adgroup=age_242; _adgroup_age_242=age_242; _keyword=direct; _keyword_direct=direct; _ads=17-07-2019; _ads_17-07-2019=17-07-2019; _browser=IE; _browser_IE=IE; _country=United+States; _country_United%20States=United%20States\r\n\r\n",
  1742. "port": 80
  1743.  
  1744.  
  1745. "count": 1,
  1746. "body": "",
  1747. "uri": "http://cdnrep.reimage.com/prot/ProtectorPackage2024x64a.exe",
  1748. "user-agent": "NSIS_Inetc (Mozilla)",
  1749. "method": "GET",
  1750. "host": "cdnrep.reimage.com",
  1751. "version": "1.1",
  1752. "path": "/prot/ProtectorPackage2024x64a.exe",
  1753. "data": "GET /prot/ProtectorPackage2024x64a.exe HTTP/1.1\r\nUser-Agent: NSIS_Inetc (Mozilla)\r\nHost: cdnrep.reimage.com\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n",
  1754. "port": 80
  1755.  
  1756.  
  1757. "count": 1,
  1758. "body": "",
  1759. "uri": "http://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D",
  1760. "user-agent": "Microsoft-CryptoAPI/6.1",
  1761. "method": "GET",
  1762. "host": "s2.symcb.com",
  1763. "version": "1.1",
  1764. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D",
  1765. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: s2.symcb.com\r\n\r\n",
  1766. "port": 80
  1767.  
  1768.  
  1769. "count": 1,
  1770. "body": "",
  1771. "uri": "http://sv.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEBwmClMv6z6ZQuZqLzHn2IQ%3D",
  1772. "user-agent": "Microsoft-CryptoAPI/6.1",
  1773. "method": "GET",
  1774. "host": "sv.symcd.com",
  1775. "version": "1.1",
  1776. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEBwmClMv6z6ZQuZqLzHn2IQ%3D",
  1777. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEBwmClMv6z6ZQuZqLzHn2IQ%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: sv.symcd.com\r\n\r\n",
  1778. "port": 80
  1779.  
  1780.  
  1781. "count": 1,
  1782. "body": "",
  1783. "uri": "http://webservice.reimageplus.com/rei-protect/url_setting.php?user_id=24460283%2D573e%2D4e79%2Dbaf6%2D0d2eb60522f1&install_id=&original_install_id=&=",
  1784. "user-agent": "",
  1785. "method": "GET",
  1786. "host": "webservice.reimageplus.com",
  1787. "version": "1.1",
  1788. "path": "/rei-protect/url_setting.php?user_id=24460283%2D573e%2D4e79%2Dbaf6%2D0d2eb60522f1&install_id=&original_install_id=&=",
  1789. "data": "GET /rei-protect/url_setting.php?user_id=24460283%2D573e%2D4e79%2Dbaf6%2D0d2eb60522f1&install_id=&original_install_id=&= HTTP/1.1\r\nCookie: user=\"mary\"; city=Chicago\r\nHost: webservice.reimageplus.com\r\n\r\n",
  1790. "port": 80
  1791.  
  1792.  
  1793. "count": 1,
  1794. "body": "param1=5fALyDv8%2F%2BA2MOSfFmdA5knOXV0mVDYdKMHF2Q53tzYamSGbmclByTFrNuAhAPLejSk%2F5dbO9bt2lzzCB3hyH8%2BzHMq%2F0jPsylGku3fEy5rzSn40FuxzC5qnmOEDlwoXstXq0LGDX52W0XwFIBcn0BWcArsPHiCMX1PuFQVgq1DsrVD7ztnCf0matRRki85MbY2xW2TnLskW1Bb44O5ljOF3LAYSmBRlAVme6Zy5AOy3dBzlYuzi3FNgxFEqNEghTjw4Y29a0WRZUuZDcDW7XFq0w8qRC6J0hbWS%2F5AIxyntWdcL9SY8o0SJi8I8xHth3gqgvDsFSTILATA3jF8%2FhvFkvZ3YyHtohfkDJRwiBPTUR6J4KHPYZwFPerZNxhKSdVq0l4UK2rTg5dBfl2DcH0943WRqVjCkdKhQ%2FyhuihOtghJRBGTPVqV4CMUfgTo2%2BMdl9TeXOuv6kLadOBUFe3ScIwWjKzxfwGX24vhvIy7nT6yVxY4qVEt5Vyagl5HTTK7D1uLZhEfgCCSBQf9CLFW4rlw9QIfCM%2BmCQFtTfwUAqETXVDHtHKy64QC8hwVv",
  1795. "uri": "http://e-webservice.reimageplus.com/rei-protect/events.php",
  1796. "user-agent": "",
  1797. "method": "POST",
  1798. "host": "e-webservice.reimageplus.com",
  1799. "version": "1.1",
  1800. "path": "/rei-protect/events.php",
  1801. "data": "POST /rei-protect/events.php HTTP/1.1\r\nHost: e-webservice.reimageplus.com\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 603\r\n\r\nparam1=5fALyDv8%2F%2BA2MOSfFmdA5knOXV0mVDYdKMHF2Q53tzYamSGbmclByTFrNuAhAPLejSk%2F5dbO9bt2lzzCB3hyH8%2BzHMq%2F0jPsylGku3fEy5rzSn40FuxzC5qnmOEDlwoXstXq0LGDX52W0XwFIBcn0BWcArsPHiCMX1PuFQVgq1DsrVD7ztnCf0matRRki85MbY2xW2TnLskW1Bb44O5ljOF3LAYSmBRlAVme6Zy5AOy3dBzlYuzi3FNgxFEqNEghTjw4Y29a0WRZUuZDcDW7XFq0w8qRC6J0hbWS%2F5AIxyntWdcL9SY8o0SJi8I8xHth3gqgvDsFSTILATA3jF8%2FhvFkvZ3YyHtohfkDJRwiBPTUR6J4KHPYZwFPerZNxhKSdVq0l4UK2rTg5dBfl2DcH0943WRqVjCkdKhQ%2FyhuihOtghJRBGTPVqV4CMUfgTo2%2BMdl9TeXOuv6kLadOBUFe3ScIwWjKzxfwGX24vhvIy7nT6yVxY4qVEt5Vyagl5HTTK7D1uLZhEfgCCSBQf9CLFW4rlw9QIfCM%2BmCQFtTfwUAqETXVDHtHKy64QC8hwVv",
  1802. "port": 80
  1803.  
  1804.  
  1805. "count": 1,
  1806. "body": "param1=5fALyDv8%2F%2BA2MOSfFmdA5knOXV0mVDYdKMHF2Q53tzYamSGbmclByTFrNuAhAPLecsscs%2BAMYRb43AMGvVGU1k4ClMdU%2B4W5AQp4m%2B4B67zIQ%2Bg7IfDHYLWiG31oZ9rOSMkL5Jah9Bt1WZcSfTQwsHZ%2FvOCfRIfJeCY31NCXhvcee5FP1%2By%2Be4B8xcK0tNjbUaxY9%2FvhTCxN%2FEvPU8Ux9Vg33yxMqveU0i6NQCnwtJQ%3D",
  1807. "uri": "http://e-webservice.reimageplus.com/rei-protect/events.php",
  1808. "user-agent": "",
  1809. "method": "POST",
  1810. "host": "e-webservice.reimageplus.com",
  1811. "version": "1.1",
  1812. "path": "/rei-protect/events.php",
  1813. "data": "POST /rei-protect/events.php HTTP/1.1\r\nHost: e-webservice.reimageplus.com\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 267\r\n\r\nparam1=5fALyDv8%2F%2BA2MOSfFmdA5knOXV0mVDYdKMHF2Q53tzYamSGbmclByTFrNuAhAPLecsscs%2BAMYRb43AMGvVGU1k4ClMdU%2B4W5AQp4m%2B4B67zIQ%2Bg7IfDHYLWiG31oZ9rOSMkL5Jah9Bt1WZcSfTQwsHZ%2FvOCfRIfJeCY31NCXhvcee5FP1%2By%2Be4B8xcK0tNjbUaxY9%2FvhTCxN%2FEvPU8Ux9Vg33yxMqveU0i6NQCnwtJQ%3D",
  1814. "port": 80
  1815.  
  1816.  
  1817. "count": 1,
  1818. "body": "param1=5fALyDv8%2F%2BA2MOSfFmdA5knOXV0mVDYdKMHF2Q53tzYamSGbmclByTFrNuAhAPLecsscs%2BAMYRb43AMGvVGU1k4ClMdU%2B4W5AQp4m%2B4B67zIQ%2Bg7IfDHYLWiG31oZ9rOSMkL5Jah9Bt1WZcSfTQwsHZ%2FvOCfRIfJeCY31NCXhvcee5FP1%2By%2Be4B8xcK0tNjbUaxY9%2FvhTCxN%2FEvPU8Ux9YrXgfHVYZvfsgtfNzHTM8Q%3D",
  1819. "uri": "http://e-webservice.reimageplus.com/rei-protect/events.php",
  1820. "user-agent": "",
  1821. "method": "POST",
  1822. "host": "e-webservice.reimageplus.com",
  1823. "version": "1.1",
  1824. "path": "/rei-protect/events.php",
  1825. "data": "POST /rei-protect/events.php HTTP/1.1\r\nHost: e-webservice.reimageplus.com\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 267\r\n\r\nparam1=5fALyDv8%2F%2BA2MOSfFmdA5knOXV0mVDYdKMHF2Q53tzYamSGbmclByTFrNuAhAPLecsscs%2BAMYRb43AMGvVGU1k4ClMdU%2B4W5AQp4m%2B4B67zIQ%2Bg7IfDHYLWiG31oZ9rOSMkL5Jah9Bt1WZcSfTQwsHZ%2FvOCfRIfJeCY31NCXhvcee5FP1%2By%2Be4B8xcK0tNjbUaxY9%2FvhTCxN%2FEvPU8Ux9YrXgfHVYZvfsgtfNzHTM8Q%3D",
  1826. "port": 80
  1827.  
  1828.  
  1829. "count": 2,
  1830. "body": "",
  1831. "uri": "http://cdnrep.reimage.com/protector/ilst.rei",
  1832. "user-agent": "",
  1833. "method": "GET",
  1834. "host": "cdnrep.reimage.com",
  1835. "version": "1.1",
  1836. "path": "/protector/ilst.rei",
  1837. "data": "GET /protector/ilst.rei HTTP/1.1\r\nCookie: user=\"mary\"; city=Chicago\r\nHost: cdnrep.reimage.com\r\n\r\n",
  1838. "port": 80
  1839.  
  1840.  
  1841. "count": 1,
  1842. "body": "param1=HuabZlqFa4Pq%2BZiJyWQ62F39vCQ0LuX0UqfbyG6JXUFNElcmjvIDDeFER%2BIn6ggP0O1SAsnLKuScuFFnpRZTRs4o2YiXvPYrgMQFjpDxJmZ6%2FKEhOlBDtvrqD8F%2BnAOXEK81mUrUXrBEYOYZcYn8LsHcwkk8unKq5IJ5SxbFctAOdnvRuFGLlY2J90k83EANVJrMxr86LXSXSbCPix%2FG0ecTyJuMAukNpeu2mugFhb5SlHJSFW48DYJgpp9teqDgYBKzgCJRvzSGAwmEnQlZfFMYulOj%2FqS5CJuyKiurYUC8I5hp%2BKtgTLchj%2B3SoMTH8H0n1BBfHraxuMMU8jpkrg%3D%3D",
  1843. "uri": "http://webservice.reimageplus.com/rei-protect/active_protection_setting.php",
  1844. "user-agent": "",
  1845. "method": "POST",
  1846. "host": "webservice.reimageplus.com",
  1847. "version": "1.1",
  1848. "path": "/rei-protect/active_protection_setting.php",
  1849. "data": "POST /rei-protect/active_protection_setting.php HTTP/1.1\r\nHost: webservice.reimageplus.com\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 371\r\n\r\nparam1=HuabZlqFa4Pq%2BZiJyWQ62F39vCQ0LuX0UqfbyG6JXUFNElcmjvIDDeFER%2BIn6ggP0O1SAsnLKuScuFFnpRZTRs4o2YiXvPYrgMQFjpDxJmZ6%2FKEhOlBDtvrqD8F%2BnAOXEK81mUrUXrBEYOYZcYn8LsHcwkk8unKq5IJ5SxbFctAOdnvRuFGLlY2J90k83EANVJrMxr86LXSXSbCPix%2FG0ecTyJuMAukNpeu2mugFhb5SlHJSFW48DYJgpp9teqDgYBKzgCJRvzSGAwmEnQlZfFMYulOj%2FqS5CJuyKiurYUC8I5hp%2BKtgTLchj%2B3SoMTH8H0n1BBfHraxuMMU8jpkrg%3D%3D",
  1850. "port": 80
  1851.  
  1852.  
  1853. "count": 1,
  1854. "body": "",
  1855. "uri": "http://webservice.reimageplus.com/rei-protect/system_settings.php",
  1856. "user-agent": "",
  1857. "method": "POST",
  1858. "host": "webservice.reimageplus.com",
  1859. "version": "1.1",
  1860. "path": "/rei-protect/system_settings.php",
  1861. "data": "POST /rei-protect/system_settings.php HTTP/1.1\r\nHost: webservice.reimageplus.com\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 1473\r\n\r\ngzip=true&param1=SiXBLSFKXTBcCAlvjqgnyRuRKMlqtBmdL5U2D4kIDwG6xCfo8tcwpgTmTwme%2F4jMNrI%2F15hbjSFEfaXB3NCDCXJnlrz2MAAxWhVS5Bys%2B%2B8GdJ1rVqXueLdywnM2mugTJ%2B6AD0phqOL4zNbsakV9le%2FFgct3YdogThBgoMZJK4WtvraUMBAzOTMfKncGVOVd0z1rAwhIT39ub6RfD3l5phamwSoG10xRjSImqT87PVOm8PirR5EydJBZH3uIRPaCOs%2BL695iPpITDY3%2FJRY4kcQbxAzshQ19BVym5dDZiE5RvM%2Fi%2F6cq015veppDQIQwAX6jFvrzLB%2F0ap0Vrpw5gVLEfnd8cBuV733SSlFY3mCsTqvZ3IpUy8UYaoE3W7TPITav3SnVQA4J8Gvfsp1%2FuM0wC5UBM4VXiAtoNWruDz9n2vgDt5P2sUCVtfEficYXZ9wDDkyA%2BNgcSDVHrQ0RgUEhUfn0DFKz2ZDf20jc5JOIW8DUbNj4AEmnpnz2FYBtG4QYEuY7%2Fg6pGvF%2FOMU34iTEjdeXLWFQr%2FE%2Fs0vPfGE%2FsVrDZyhS1qh3TpekCZUv1Z7qjfVLy%2F6o2T",
  1862. "port": 80
  1863.  
  1864.  
  1865. "count": 1,
  1866. "body": "",
  1867. "uri": "http://e-webservice.reimageplus.com/rei-protect/events.php",
  1868. "user-agent": "",
  1869. "method": "POST",
  1870. "host": "e-webservice.reimageplus.com",
  1871. "version": "1.1",
  1872. "path": "/rei-protect/events.php",
  1873. "data": "POST /rei-protect/events.php HTTP/1.1\r\nHost: e-webservice.reimageplus.com\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 10255\r\n\r\nparam1=5fALyDv8%2F%2BA2MOSfFmdA5knOXV0mVDYdKMHF2Q53tzYamSGbmclByTFrNuAhAPLecsscs%2BAMYRb43AMGvVGU1k4ClMdU%2B4W5AQp4m%2B4B67zIQ%2Bg7IfDHYLWiG31oZ9rOQ3e02nSYuU1Vg0pIwW1S718jsJXb2NfxU0eBrPRgspduT9ZkYyqLwe5fBM2V1qoDSFQDev4rNwzL8sNguBxYPWGQ8bj6ZgcgnDqQpULtd9QsCu4pGuAtk6735sHmIcu%2FedXBWcW0yJOT4mP5UGXflNS8bPRbu8xwTae0oM0F6jon6PXADh9AD3Ya%2BEBZir%2BCOY8%2FIQlqxLPtIR4TNMC2mOnbHSl3n7Kt51BaxzPPx63VTQhlJnbBxJAZQRLy5qru6EGn4rYD6jb1Xx953RMv7iZUkayiDNh1auCHTEEgiZQdRNwBaPnxVQ9PoWAxoxLnY5SDgZJJdu%2FRf%2B536HxtMZUqqeE2Mr%2Bo%2FAYnxCskmRK5MYxhIErBBMKRDurd6dW4C68p7sgZdjQxtKRfiW6j5L6NH2szKIhR7eADjOdmJ9%2B5%2BrnEPcgbyrSzqtTpCYKW9VDqc%2BS2EypMWOyU09%2FfYFaXLyhrvr9z",
  1874. "port": 80
  1875.  
  1876.  
  1877. "count": 1,
  1878. "body": "",
  1879. "uri": "http://www.reimageplus.com/scan_agent_events.php?version=2024&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=INSVR&param=$evr&trackutil=$Cookie_Trackid",
  1880. "user-agent": "NSIS_Inetc (Mozilla)",
  1881. "method": "GET",
  1882. "host": "www.reimageplus.com",
  1883. "version": "1.1",
  1884. "path": "/scan_agent_events.php?version=2024&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=INSVR&param=$evr&trackutil=$Cookie_Trackid",
  1885. "data": "GET /scan_agent_events.php?version=2024&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=INSVR&param=$evr&trackutil=$Cookie_Trackid HTTP/1.1\r\nUser-Agent: NSIS_Inetc (Mozilla)\r\nHost: www.reimageplus.com\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\nCookie: _trackid=6575690465; _trackid_6575690465=6575690465; _tracking=agent; _tracking_agent=agent; _campaign=f_malware-scanner; _campaign_f_malware-scanner=f_malware-scanner; _adgroup=age_242; _adgroup_age_242=age_242; _keyword=direct; _keyword_direct=direct; _ads=17-07-2019; _ads_17-07-2019=17-07-2019; _browser=IE; _browser_IE=IE; _country=United+States; _country_United%20States=United%20States\r\n\r\n",
  1886. "port": 80
  1887.  
  1888.  
  1889. "count": 1,
  1890. "body": "",
  1891. "uri": "http://cdnrep.reimage.com/cfl/cfl1891b.rei",
  1892. "user-agent": "NSIS_Inetc (Mozilla)",
  1893. "method": "GET",
  1894. "host": "cdnrep.reimage.com",
  1895. "version": "1.1",
  1896. "path": "/cfl/cfl1891b.rei",
  1897. "data": "GET /cfl/cfl1891b.rei HTTP/1.1\r\nUser-Agent: NSIS_Inetc (Mozilla)\r\nHost: cdnrep.reimage.com\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n",
  1898. "port": 80
  1899.  
  1900.  
  1901. "count": 1,
  1902. "body": "",
  1903. "uri": "http://www.reimageplus.com/includes/install_end.php?m_trackid=&m_tracking=&m_campaign=&minorsessionid=60a6e143bf904a6abca31bb3bd&sessionid=24460283-573e-4e79-baf6-0d2eb60522f1",
  1904. "user-agent": "NSIS_Inetc (Mozilla)",
  1905. "method": "GET",
  1906. "host": "www.reimageplus.com",
  1907. "version": "1.1",
  1908. "path": "/includes/install_end.php?m_trackid=&m_tracking=&m_campaign=&minorsessionid=60a6e143bf904a6abca31bb3bd&sessionid=24460283-573e-4e79-baf6-0d2eb60522f1",
  1909. "data": "GET /includes/install_end.php?m_trackid=&m_tracking=&m_campaign=&minorsessionid=60a6e143bf904a6abca31bb3bd&sessionid=24460283-573e-4e79-baf6-0d2eb60522f1 HTTP/1.1\r\nUser-Agent: NSIS_Inetc (Mozilla)\r\nHost: www.reimageplus.com\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\nCookie: _trackid=6575690465; _trackid_6575690465=6575690465; _tracking=agent; _tracking_agent=agent; _campaign=f_malware-scanner; _campaign_f_malware-scanner=f_malware-scanner; _adgroup=age_242; _adgroup_age_242=age_242; _keyword=direct; _keyword_direct=direct; _ads=17-07-2019; _ads_17-07-2019=17-07-2019; _browser=IE; _browser_IE=IE; _country=United+States; _country_United%20States=United%20States\r\n\r\n",
  1910. "port": 80
  1911.  
  1912.  
  1913. "count": 1,
  1914. "body": "",
  1915. "uri": "http://www.reimageplus.com/events4mem.php?version=1898&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=INSST&param=Downloader%20Started<*>New&trackutil=",
  1916. "user-agent": "NSIS_Inetc (Mozilla)",
  1917. "method": "GET",
  1918. "host": "www.reimageplus.com",
  1919. "version": "1.1",
  1920. "path": "/events4mem.php?version=1898&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=INSST&param=Downloader%20Started<*>New&trackutil=",
  1921. "data": "GET /events4mem.php?version=1898&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=INSST&param=Downloader%20Started<*>New&trackutil= HTTP/1.1\r\nUser-Agent: NSIS_Inetc (Mozilla)\r\nHost: www.reimageplus.com\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\nCookie: _trackid=6575690465; _trackid_6575690465=6575690465; _tracking=agent; _tracking_agent=agent; _campaign=f_malware-scanner; _campaign_f_malware-scanner=f_malware-scanner; _adgroup=age_242; _adgroup_age_242=age_242; _keyword=direct; _keyword_direct=direct; _ads=17-07-2019; _ads_17-07-2019=17-07-2019; _browser=IE; _browser_IE=IE; _country=United+States; _country_United%20States=United%20States; X-Mapping-fjhppofk=99871FC06F2D55B1B81E99FE1E98A783\r\n\r\n",
  1922. "port": 80
  1923.  
  1924.  
  1925. "count": 1,
  1926. "body": "",
  1927. "uri": "http://www.reimageplus.com/events4mem.php?version=1898&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=INSRN&param=1898<*>New&trackutil=",
  1928. "user-agent": "NSIS_Inetc (Mozilla)",
  1929. "method": "GET",
  1930. "host": "www.reimageplus.com",
  1931. "version": "1.1",
  1932. "path": "/events4mem.php?version=1898&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=INSRN&param=1898<*>New&trackutil=",
  1933. "data": "GET /events4mem.php?version=1898&SessionID=24460283-573e-4e79-baf6-0d2eb60522f1&MinorSessionID=60a6e143bf904a6abca31bb3bd&id=INSRN&param=1898<*>New&trackutil= HTTP/1.1\r\nUser-Agent: NSIS_Inetc (Mozilla)\r\nHost: www.reimageplus.com\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\nCookie: _trackid=6575690465; _trackid_6575690465=6575690465; _tracking=agent; _tracking_agent=agent; _campaign=f_malware-scanner; _campaign_f_malware-scanner=f_malware-scanner; _adgroup=age_242; _adgroup_age_242=age_242; _keyword=direct; _keyword_direct=direct; _ads=17-07-2019; _ads_17-07-2019=17-07-2019; _browser=IE; _browser_IE=IE; _country=United+States; _country_United%20States=United%20States; X-Mapping-fjhppofk=99871FC06F2D55B1B81E99FE1E98A783\r\n\r\n",
  1934. "port": 80
  1935.  
  1936.  
  1937. "count": 1,
  1938. "body": "",
  1939. "uri": "http://www.reimageplus.com/GUI/GUI1898/layout.php?consumer=1&gui_branch=0&trackutil=&MinorSessionID=60a6e143bf904a6abca31bb3bd&lang_code=en&bundle=0&loadresults=0&ShowSettings=false",
  1940. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1941. "method": "GET",
  1942. "host": "www.reimageplus.com",
  1943. "version": "1.1",
  1944. "path": "/GUI/GUI1898/layout.php?consumer=1&gui_branch=0&trackutil=&MinorSessionID=60a6e143bf904a6abca31bb3bd&lang_code=en&bundle=0&loadresults=0&ShowSettings=false",
  1945. "data": "GET /GUI/GUI1898/layout.php?consumer=1&gui_branch=0&trackutil=&MinorSessionID=60a6e143bf904a6abca31bb3bd&lang_code=en&bundle=0&loadresults=0&ShowSettings=false HTTP/1.1\r\nAccept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, */*\r\nAccept-Language: en-US\r\nDefaultBrowser: browser:chrome.exe,version:74.0.3729.169,description:Google Chrome\r\nUA-CPU: AMD64\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: www.reimageplus.com\r\nConnection: Keep-Alive\r\nCookie: _trackid=6575690465; _trackid_6575690465=6575690465; _tracking=agent; _tracking_agent=agent; _campaign=f_malware-scanner; _campaign_f_malware-scanner=f_malware-scanner; _adgroup=age_242; _adgroup_age_242=age_242; _keyword=direct; _keyword_direct=direct; _ads=17-07-2019; _ads_17-07-2019=17-07-2019; _browser=IE; _browser_IE=IE; _country=United+States; _country_United%20States=United%20States\r\n\r\n",
  1946. "port": 80
  1947.  
  1948.  
  1949. "count": 1,
  1950. "body": "",
  1951. "uri": "http://www.reimageplus.com/GUI/GUI1898/layout_src.php?consumer=1&gui_branch=0&trackutil=&MinorSessionID=60a6e143bf904a6abca31bb3bd&lang_code=en&bundle=0&loadresults=0&ShowSettings=false",
  1952. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1953. "method": "GET",
  1954. "host": "www.reimageplus.com",
  1955. "version": "1.1",
  1956. "path": "/GUI/GUI1898/layout_src.php?consumer=1&gui_branch=0&trackutil=&MinorSessionID=60a6e143bf904a6abca31bb3bd&lang_code=en&bundle=0&loadresults=0&ShowSettings=false",
  1957. "data": "GET /GUI/GUI1898/layout_src.php?consumer=1&gui_branch=0&trackutil=&MinorSessionID=60a6e143bf904a6abca31bb3bd&lang_code=en&bundle=0&loadresults=0&ShowSettings=false HTTP/1.1\r\nAccept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, */*\r\nReferer: http://www.reimageplus.com/GUI/GUI1898/layout.php?consumer=1&gui_branch=0&trackutil=&MinorSessionID=60a6e143bf904a6abca31bb3bd&lang_code=en&bundle=0&loadresults=0&ShowSettings=false\r\nAccept-Language: en-US\r\nUA-CPU: AMD64\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: www.reimageplus.com\r\nConnection: Keep-Alive\r\nCookie: _trackid=6575690465; _trackid_6575690465=6575690465; _tracking=agent; _tracking_agent=agent; _campaign=f_malware-scanner; _campaign_f_malware-scanner=f_malware-scanner; _adgroup=age_242; _adgroup_age_242=age_242; _keyword=direct; _keyword_direct=direct; _ads=17-07-2019; _ads_17-07-2019=17-07-2019; _browser=IE; _browser_IE=IE; _country=United+States; _country_United%20States=United%20States; X-Mapping-fjhppofk=1DFA07D4C48259B708844DF3EEDF5AB6\r\n\r\n",
  1958. "port": 80
  1959.  
  1960.  
  1961. "count": 1,
  1962. "body": "",
  1963. "uri": "http://e-webservice.reimageplus.com/rei-protect/events.php",
  1964. "user-agent": "",
  1965. "method": "POST",
  1966. "host": "e-webservice.reimageplus.com",
  1967. "version": "1.1",
  1968. "path": "/rei-protect/events.php",
  1969. "data": "POST /rei-protect/events.php HTTP/1.1\r\nHost: e-webservice.reimageplus.com\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 1275\r\n\r\nparam1=5fALyDv8%2F%2BA2MOSfFmdA5knOXV0mVDYdKMHF2Q53tzYamSGbmclByTFrNuAhAPLecsscs%2BAMYRb43AMGvVGU1k4ClMdU%2B4W5AQp4m%2B4B67zIQ%2Bg7IfDHYLWiG31oZ9rOplmr%2F88yY%2Bhyg9SwKSRPuNK7umNKei5PB5uwo9tJdFlDXAnNZVjGdOYX60AXiL9WdOXgYcB3TrwytmNvoYWyFwoL1sZsMsq9t1pFq%2B49uKXBTMnaOeIHSs3nBiSmH%2FDXGcintDsxkNF6h8wGh1ILYJhnjDwJ8RCyn3w2VAU6479ZvGPfn3CV497UBmEPrt%2FwBEAdkim5TKkyPRpNZ2%2BW2rleY%2FAMaHsivSXAYvymf%2BhrosNCpoH8KA4%2FIRlBbYI5qS083NzegUUsohit26p%2BXa4UjlFERdYHQOFArRGbpVrKszPXp8V8xIamEf1Ft9K4Iat8dMl%2F9tSLDcnyxcFvovWb2gvrB%2BYxeWczYd3O9hpIBSP0IrYk3U%2BF0s%2BtzRnzheOXC3qTkx8UJFY4JEf4isv3WCCV%2Flrb8L9OpzDEkKGlIm80bOtAzGkERUrQcD6PWw93%2FZr32ktf%2FjUfMJKpSDh",
  1970. "port": 80
  1971.  
  1972.  
  1973. "count": 1,
  1974. "body": "",
  1975. "uri": "http://e-webservice.reimageplus.com/rei-protect/events.php",
  1976. "user-agent": "",
  1977. "method": "POST",
  1978. "host": "e-webservice.reimageplus.com",
  1979. "version": "1.1",
  1980. "path": "/rei-protect/events.php",
  1981. "data": "POST /rei-protect/events.php HTTP/1.1\r\nHost: e-webservice.reimageplus.com\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 5063\r\n\r\nparam1=5fALyDv8%2F%2BA2MOSfFmdA5knOXV0mVDYdKMHF2Q53tzYamSGbmclByTFrNuAhAPLecsscs%2BAMYRb43AMGvVGU1k4ClMdU%2B4W5AQp4m%2B4B67zIQ%2Bg7IfDHYLWiG31oZ9rOYjXdTy6MDXRRI6HaCGCUtAZafkzZGvfjofKFUKaSJND6TIaM7dRKP24x%2BZUjG73zLhp7Ui%2FHMbMAxdz4ZFWDv5xao4VG0Lk76GK4ND2niWeEQMu4BcX4clNbAv9yI8x28gs4lFMP31X%2FxdxO5sBiN%2BfsArhNqiviCFdzpOl2LPJNSrn4Oq9oRMVUByNgYNjA6dLmzffIJONtOeEabUO4XfrwZEWILTc23U8IuXo8u3jndyJFnh4W%2FpLi6ZTF1Y2FVoBF7YIjjTKBHIKX8MVCSJISWY2qu6U%2BbgKsOuXrkNqK0%2FYGagOJtjcpmEbGif1LZQOKdJZ6lxMmTbMt59ODVnR91MsHe4A9ezRxqSOgDrqX3Ub9wA%2BtuPK2P%2Bq4zclgdViJz5Rwe3sp3K4swm3JqMCh7h7G8SycicmhkGKITmayot252QGNUYnjmwGmyBhvqeQ7831RrWnaEYiJGoXTb1wIH63Q7L%2F5vtofd",
  1982. "port": 80
  1983.  
  1984.  
  1985. "count": 1,
  1986. "body": "",
  1987. "uri": "http://cdnrep.reimage.com/protector/wlst.rei",
  1988. "user-agent": "",
  1989. "method": "GET",
  1990. "host": "cdnrep.reimage.com",
  1991. "version": "1.1",
  1992. "path": "/protector/wlst.rei",
  1993. "data": "GET /protector/wlst.rei HTTP/1.1\r\nCookie: user=\"mary\"; city=Chicago\r\nHost: cdnrep.reimage.com\r\n\r\n",
  1994. "port": 80
  1995.  
  1996.  
  1997. "count": 1,
  1998. "body": "",
  1999. "uri": "http://e-webservice.reimageplus.com/rei-protect/events.php",
  2000. "user-agent": "",
  2001. "method": "POST",
  2002. "host": "e-webservice.reimageplus.com",
  2003. "version": "1.1",
  2004. "path": "/rei-protect/events.php",
  2005. "data": "POST /rei-protect/events.php HTTP/1.1\r\nHost: e-webservice.reimageplus.com\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 1029\r\n\r\nparam1=5fALyDv8%2F%2BA2MOSfFmdA5knOXV0mVDYdKMHF2Q53tzYamSGbmclByTFrNuAhAPLecsscs%2BAMYRb43AMGvVGU1k4ClMdU%2B4W5AQp4m%2B4B67zIQ%2Bg7IfDHYLWiG31oZ9rOI9JkBR%2BhymnWtVuj52jWzPyBz6RkVXOovU8vBHtp6FqOr0Ikq5Ddy247sDwDoNsmNRh5iLKyReqJzfDFk%2BmY5Ysf%2BTdxPIIvtBSivxE2OPSXLLGPikCU2EVoFv70goatTJCB0nHAwS4rTu3tRcEJEY%2FRxzS%2FlYKnNmY4WZQMQ82YunVQHcqAX1e%2BjRv6ifz3dDTdFfCcHHVQEYT%2FLKVaUTf9clfisHo8BGLHnbqSvIkIuziMsiJw5S2ztOCV53KlWFP5EDrI8ZHPsU%2BNWc7Ygvgic6aRcNHfWSTlv3dXe0%2F2JLnYWyGxjxOCaMSSRf7pP2sT7zx1GTfP5L0b6NLjSIqFW0K0gz5wuWr%2F5OsprBJLYPPoVOdF%2BcnU6XPR8Gda8JrfshIwhTExu6gzXFauFgIEeNSFY5bdwytkHU0txMV29A%2Bl1P3o%2BRam5xQ%2BgLAvOaWmkQ0lt1H78Qn5dxCEUofsD1cyU",
  2006. "port": 80
  2007.  
  2008.  
  2009. "count": 1,
  2010. "body": "",
  2011. "uri": "http://e-webservice.reimageplus.com/rei-protect/events.php",
  2012. "user-agent": "",
  2013. "method": "POST",
  2014. "host": "e-webservice.reimageplus.com",
  2015. "version": "1.1",
  2016. "path": "/rei-protect/events.php",
  2017. "data": "POST /rei-protect/events.php HTTP/1.1\r\nHost: e-webservice.reimageplus.com\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 717\r\n\r\nparam1=5fALyDv8%2F%2BA2MOSfFmdA5knOXV0mVDYdKMHF2Q53tzYamSGbmclByTFrNuAhAPLecsscs%2BAMYRb43AMGvVGU1k4ClMdU%2B4W5AQp4m%2B4B67zIQ%2Bg7IfDHYLWiG31oZ9rOntruOR3%2BXK5%2BPoYVlHw5xN9M7WnNM%2FqnGFLDCZp0nfVFqtq6ZKgWae0DUjVJisWM13xIN%2B8XQgdAAuQhDaEQ2q4dUacDWJWl9wikOoUBF9shbwgzhl%2BZi0LUlTr2FNC1uP3bheXDl10dhAWg5NKbp5fZpmq6%2ByvBFdJvr8bN7Z6HxJbc1XCn%2BKX7wvEoZ5DcA%2Fff3oReM4lrxkB%2FnJditZB21JpRwmWwY4vrKtjwoxSAqjYqMA%2F1X0Vd43cMV6qGIWAaYGMpt4JmiMyWowsIg97vL5iQ6OaLup0kqexlnydmQjkoF7aIgA%2BwXJ4wvOkbkCg6RlrYvhK9HaZYgnghf6eXMhi63Agamd1QIx0XpaGbIJOU6R5AupN29VlRAysRS7sETtkm69cn6Ku0LVgN22Mc%2BY8lp3tjNMDC9CokVAuQ8rjS1gV9BE0KvOJCB%2FofIRpykKlyhAFmiTtIjBon12BvMaa%2Bb3",
  2018. "port": 80
  2019.  
  2020.  
  2021. "count": 1,
  2022. "body": "",
  2023. "uri": "http://e-webservice.reimageplus.com/rei-protect/events.php",
  2024. "user-agent": "",
  2025. "method": "POST",
  2026. "host": "e-webservice.reimageplus.com",
  2027. "version": "1.1",
  2028. "path": "/rei-protect/events.php",
  2029. "data": "POST /rei-protect/events.php HTTP/1.1\r\nHost: e-webservice.reimageplus.com\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 687\r\n\r\nparam1=5fALyDv8%2F%2BA2MOSfFmdA5knOXV0mVDYdKMHF2Q53tzYamSGbmclByTFrNuAhAPLecsscs%2BAMYRb43AMGvVGU1k4ClMdU%2B4W5AQp4m%2B4B67zIQ%2Bg7IfDHYLWiG31oZ9rOZW15CtcWL%2FYjBCKhG0c7Dzz%2BUbCVEPAxN6IEK9MVj8HSL3%2Bbxwb5v4qXOY6o3yN3W%2BKoxbGx2aCWWtI1qdsghRpec5qx3HvsWG665wtrmGXF6FjScUT7Ku7weyBybENqNaM14Koc8ChQ3%2BBPrQuayCK%2FZzTxNIF3xt1an9U8LqgtkfJD3B3CDNQ1%2BwzQH0zDQrSDDG0lLTbndQ8HZl%2B57P4n2VbLSwrt92ZquAAbX988%2B6ZnSSEctsyUy57wj%2B2hQiVim%2FAXREGaYlF7mVU5bQ5ZI4VhDnRboOAqb40DAmHtqcUsY9cQQ6KZHBOx2uDjYk6FLXy2pVCj8AwPKsxAxUAhDT85STInzyO5C1OQuj513b5AMBSeOKol7qzKk3ZC4eJUz71GvprbsPmRB4oTlxNjFgnHVCewYGARigBHB2OyuHOAwLO6p%2F1hhvhA%2BTSbd9XKSULTMw2vnYnIEJxBSCy54XYxt6ZJ",
  2030. "port": 80
  2031.  
  2032.  
  2033. "count": 1,
  2034. "body": "",
  2035. "uri": "http://www.reimageplus.com/GUI/reimageavmem.php?version=2.0.2.4&virstr=005247e3057bc5d5c3f8c6f886ffc10c&size=182784&path=%5c%5c%3f%5cc%3a%5cwindows%5csystem32%5cwbem%5cwmiadap.exe",
  2036. "user-agent": "Chilkat/1.0.0 (+http://www.chilkatsoft.com/ChilkatHttpUA.asp)",
  2037. "method": "GET",
  2038. "host": "www.reimageplus.com",
  2039. "version": "1.1",
  2040. "path": "/GUI/reimageavmem.php?version=2.0.2.4&virstr=005247e3057bc5d5c3f8c6f886ffc10c&size=182784&path=%5c%5c%3f%5cc%3a%5cwindows%5csystem32%5cwbem%5cwmiadap.exe",
  2041. "data": "GET /GUI/reimageavmem.php?version=2.0.2.4&virstr=005247e3057bc5d5c3f8c6f886ffc10c&size=182784&path=%5c%5c%3f%5cc%3a%5cwindows%5csystem32%5cwbem%5cwmiadap.exe HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip\r\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\nAccept-Language: en-us,en;q=0.5\r\nUser-Agent: Chilkat/1.0.0 (+http://www.chilkatsoft.com/ChilkatHttpUA.asp)\r\nHost: www.reimageplus.com\r\nConnection: Keep-Alive\r\n\r\n",
  2042. "port": 80
  2043.  
  2044.  
  2045. "count": 1,
  2046. "body": "",
  2047. "uri": "http://www.reimageplus.com/GUI/reimageavmem.php?version=2.0.2.4&virstr=619a67c9f617b7e69315bb28ecd5e1df&size=372736&path=c%3a%5cwindows%5csystem32%5cwbem%5cwmiprvse.exe",
  2048. "user-agent": "Chilkat/1.0.0 (+http://www.chilkatsoft.com/ChilkatHttpUA.asp)",
  2049. "method": "GET",
  2050. "host": "www.reimageplus.com",
  2051. "version": "1.1",
  2052. "path": "/GUI/reimageavmem.php?version=2.0.2.4&virstr=619a67c9f617b7e69315bb28ecd5e1df&size=372736&path=c%3a%5cwindows%5csystem32%5cwbem%5cwmiprvse.exe",
  2053. "data": "GET /GUI/reimageavmem.php?version=2.0.2.4&virstr=619a67c9f617b7e69315bb28ecd5e1df&size=372736&path=c%3a%5cwindows%5csystem32%5cwbem%5cwmiprvse.exe HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip\r\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\nAccept-Language: en-us,en;q=0.5\r\nUser-Agent: Chilkat/1.0.0 (+http://www.chilkatsoft.com/ChilkatHttpUA.asp)\r\nHost: www.reimageplus.com\r\nConnection: Keep-Alive\r\n\r\n",
  2054. "port": 80
  2055.  
  2056.  
  2057.  
  2058. * Network Communication - SMTP:
  2059.  
  2060. * Network Communication - Hosts:
  2061.  
  2062. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!