Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    129s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2022, 00:52

General

  • Target

    277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe

  • Size

    326KB

  • MD5

    79be094ebbacab9532d279b544481c63

  • SHA1

    70440dfceed530a5fc1935ebf5f52d267c58b94c

  • SHA256

    277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666

  • SHA512

    db885234f1415a08e43698473146dd110dfaa808db33f1b5f00c9ce0aa9b8ca53a0587b363a3bb214f04788f17ae5c2e1daa3bf7176a460241f75163e2799793

  • SSDEEP

    6144:THl0ndEmTgkCAaR+aubNawb9VOExRCiMOEoAbzPqGjfRpo:hO5fCAI+Xbswb9VOExxLEB/PdfRp

Score
8/10

Malware Config

Signatures

  • Sets DLL path for service in the registry 2 TTPs 14 IoCs
  • Loads dropped DLL 42 IoCs
  • Drops file in System32 directory 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
    "C:\Users\Admin\AppData\Local\Temp\277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe"
    1⤵
    • Sets DLL path for service in the registry
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:2524
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
    1⤵
    • Loads dropped DLL
    PID:4728
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Irmon
    1⤵
    • Loads dropped DLL
    PID:4864
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nla
    1⤵
    • Loads dropped DLL
    PID:2244
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Ntmssvc
    1⤵
    • Loads dropped DLL
    PID:4180
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation
    1⤵
    • Loads dropped DLL
    PID:4204
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nwsapagent
    1⤵
    • Loads dropped DLL
    PID:1632
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s SRService
    1⤵
    • Loads dropped DLL
    PID:3176
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s WmdmPmSp
    1⤵
    • Loads dropped DLL
    PID:1232
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s LogonHours
    1⤵
    • Loads dropped DLL
    PID:3872
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s PCAudit
    1⤵
    • Loads dropped DLL
    PID:3828
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
    1⤵
    • Loads dropped DLL
    PID:3200
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
    1⤵
    • Loads dropped DLL
    PID:884

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\Irmon.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\Irmon.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\Irmon.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\LogonHours.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\LogonHours.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\LogonHours.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\LogonHours.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\LogonHours.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\LogonHours.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\NWCWorkstation.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\NWCWorkstation.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\NWCWorkstation.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\Nla.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\Nla.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\Nla.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\Ntmssvc.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\Ntmssvc.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\Ntmssvc.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\Nwsapagent.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\Nwsapagent.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\Nwsapagent.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\PCAudit.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\PCAudit.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\PCAudit.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\SRService.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\SRService.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\SRService.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\WmdmPmSp.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\WmdmPmSp.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\WmdmPmSp.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\helpsvc.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\helpsvc.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\helpsvc.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\uploadmgr.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\uploadmgr.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\uploadmgr.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\uploadmgr.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\uploadmgr.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • C:\Windows\SysWOW64\uploadmgr.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • \??\c:\windows\SysWOW64\helpsvc.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • \??\c:\windows\SysWOW64\irmon.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • \??\c:\windows\SysWOW64\logonhours.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • \??\c:\windows\SysWOW64\nla.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • \??\c:\windows\SysWOW64\ntmssvc.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • \??\c:\windows\SysWOW64\nwcworkstation.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • \??\c:\windows\SysWOW64\nwsapagent.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • \??\c:\windows\SysWOW64\pcaudit.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • \??\c:\windows\SysWOW64\srservice.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • \??\c:\windows\SysWOW64\uploadmgr.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • \??\c:\windows\SysWOW64\wmdmpmsp.dll

    Filesize

    326KB

    MD5

    c5128720a51b74c31e8820549611c93c

    SHA1

    4ff792a5ab727e53cb27360d447789e97030c078

    SHA256

    c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

    SHA512

    f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

  • memory/2524-144-0x0000000002300000-0x0000000006300000-memory.dmp

    Filesize

    64.0MB

  • memory/2524-135-0x0000000002300000-0x0000000006300000-memory.dmp

    Filesize

    64.0MB

  • memory/2524-132-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/2524-191-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/4728-136-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/4864-139-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB