home

dreamx.exe

SAPO

The executable dreamx.exe has been detected as malware by 1 anti-virus scanner. It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘MediaCenter’.
Publisher:
SAPO  (signed and verified)

Version:
1.0.0.0

MD5:
95ae07852b3880aff0faeaab905691a5

SHA-1:
3858fe7f51cf97122b27d0e4e399bc51a83bc4d0

SHA-256:
8992b5dc3bb37da04181fbb4cd37f5361ea4c2b89d562e96e303a0937a157ecd

Scanner detections:
1 / 68

Status:
Malware

Analysis date:
7/7/2025 3:40:58 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP (M)
16.8.9.14

File size:
10.9 MB (11,461,240 bytes)

Product version:
1.0.0.0

File type:
Executable application (Win32 EXE)

Language:
Maltês (Malta)

Common path:
C:\users\{user}\appdata\roaming\dreamx.exe

Digital Signature
Signed by:
SAPO

Authority:
SAPO

Valid from:
6/5/2015 1:08:35 PM

Valid to:
6/5/2016 1:08:35 PM

Subject:
E=cmd@sapo.pt, CN=SAPO.PT, OU=SAPO Division of Protocol, O=SAPO, L=Opalo, S=Jobila, C=AS

Issuer:
E=cmd@sapo.pt, CN=SAPO.PT, OU=SAPO Division of Protocol, O=SAPO, L=Opalo, S=Jobila, C=AS

Serial number:
00A7AB2CD21ECC7345

File PE Metadata
Compilation timestamp:
6/10/2015 5:11:37 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
196608:FQ+4jmaHcNUXXWyM9vtHIRA3zP1/6MNh0n09+fBU8X+Ch1aJctao:FQSaHcNUXhOvyqwe0n0wraIao

Entry address:
0x1889471

Entry point:
9C, E9, D2, C0, 63, FF, BA, A4, DE, 4C, 3B, FD, 22, D3, B5, AE, D6, 00, 7D, 4E, 30, A3, C3, 09, 82, 48, 39, 97, 08, CD, A3, 2F, B1, A8, EA, EE, 99, 40, 44, 89, 91, 84, 31, 1A, 4F, AA, 0F, B1, 82, 4B, B4, A3, F0, D2, 3A, E5, 60, A2, 51, FD, C6, 85, 9B, 76, 60, E4, 4A, 78, 56, 3F, 8F, 06, C6, 22, A3, 6F, BC, 3F, 5D, E9, 57, 28, D8, 52, 1D, 37, D6, 69, A5, 4B, AD, FF, 64, B2, 5C, 6B, 23, 3D, 7F, 35, 26, 87, 32, E1, 5E, 9C, 0B, E8, B2, EE, E9, DA, B5, 22, 58, 79, 34, 8B, 25, A3, F2, CC, 96, 65, 2A, 93, 13, A9...
 
[+]

Code size:
3.1 MB (3,236,864 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
MediaCenter

Command:
C:\users\{user}\appdata\roaming\dreamx.exe


Remove dreamx.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.