277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666

Analysis

max time kernel
129s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
Size

326KB
MD5

79be094ebbacab9532d279b544481c63
SHA1

70440dfceed530a5fc1935ebf5f52d267c58b94c
SHA256

277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666
SHA512

db885234f1415a08e43698473146dd110dfaa808db33f1b5f00c9ce0aa9b8ca53a0587b363a3bb214f04788f17ae5c2e1daa3bf7176a460241f75163e2799793
SSDEEP

6144:THl0ndEmTgkCAaR+aubNawb9VOExRCiMOEoAbzPqGjfRpo:hO5fCAI+Xbswb9VOExxLEB/PdfRp

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll"	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uploadmgr\Parameters\ServiceDll = "C:\\Windows\\system32\\uploadmgr.dll"	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Wmi\Parameters\ServiceDll = "C:\\Windows\\system32\\Wmi.dll"	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LogonHours\Parameters\ServiceDll = "C:\\Windows\\system32\\LogonHours.dll"	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmdmPmSp\Parameters\ServiceDll = "C:\\Windows\\system32\\WmdmPmSp.dll"	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PCAudit\Parameters\ServiceDll = "C:\\Windows\\system32\\PCAudit.dll"	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\helpsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\helpsvc.dll"	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll"	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll"	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll"	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll"	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll"	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SRService\Parameters\ServiceDll = "C:\\Windows\\system32\\SRService.dll"	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe

Loads dropped DLL 42 IoCs

pid	Process
4728	svchost.exe
4864	svchost.exe
4864	svchost.exe
4728	svchost.exe
4864	svchost.exe
4728	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
4180	svchost.exe
4180	svchost.exe
4180	svchost.exe
4204	svchost.exe
4204	svchost.exe
4204	svchost.exe
1632	svchost.exe
1632	svchost.exe
1632	svchost.exe
3176	svchost.exe
3176	svchost.exe
3176	svchost.exe
1232	svchost.exe
1232	svchost.exe
1232	svchost.exe
3872	svchost.exe
3872	svchost.exe
3872	svchost.exe
3872	svchost.exe
3872	svchost.exe
3872	svchost.exe
3828	svchost.exe
3828	svchost.exe
3828	svchost.exe
3200	svchost.exe
3200	svchost.exe
3200	svchost.exe
884	svchost.exe
884	svchost.exe
884	svchost.exe
884	svchost.exe
884	svchost.exe
884	svchost.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
File opened for modification	C:\Windows\SysWOW64\WmdmPmSp.dll	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
File opened for modification	C:\Windows\SysWOW64\uploadmgr.dll	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
File opened for modification	C:\Windows\SysWOW64\Ias.dll	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
File opened for modification	C:\Windows\SysWOW64\Ntmssvc.dll	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
File opened for modification	C:\Windows\SysWOW64\NWCWorkstation.dll	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
File opened for modification	C:\Windows\SysWOW64\helpsvc.dll	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
File opened for modification	C:\Windows\SysWOW64\Irmon.dll	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
File opened for modification	C:\Windows\SysWOW64\Nwsapagent.dll	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
File opened for modification	C:\Windows\SysWOW64\SRService.dll	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
File opened for modification	C:\Windows\SysWOW64\PCAudit.dll	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
File opened for modification	C:\Windows\SysWOW64\Nla.dll	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
File opened for modification	C:\Windows\SysWOW64\Wmi.dll	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
File opened for modification	C:\Windows\SysWOW64\LogonHours.dll	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2524	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
2524	277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe

C:\Users\Admin\AppData\Local\Temp\277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
"C:\Users\Admin\AppData\Local\Temp\277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe"
1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2524

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
1⤵
- Loads dropped DLL
PID:4728

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Irmon
1⤵
- Loads dropped DLL
PID:4864

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nla
1⤵
- Loads dropped DLL
PID:2244

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Ntmssvc
1⤵
- Loads dropped DLL
PID:4180

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation
1⤵
- Loads dropped DLL
PID:4204

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nwsapagent
1⤵
- Loads dropped DLL
PID:1632

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s SRService
1⤵
- Loads dropped DLL
PID:3176

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s WmdmPmSp
1⤵
- Loads dropped DLL
PID:1232

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s LogonHours
1⤵
- Loads dropped DLL
PID:3872

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s PCAudit
1⤵
- Loads dropped DLL
PID:3828

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
1⤵
- Loads dropped DLL
PID:3200

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
1⤵
- Loads dropped DLL
PID:884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\Irmon.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\Irmon.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\Irmon.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\LogonHours.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\LogonHours.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\LogonHours.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\LogonHours.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\LogonHours.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\LogonHours.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\NWCWorkstation.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\NWCWorkstation.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\NWCWorkstation.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\Nla.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\Nla.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\Nla.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\Ntmssvc.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\Ntmssvc.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\Ntmssvc.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\Nwsapagent.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\Nwsapagent.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\Nwsapagent.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\PCAudit.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\PCAudit.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\PCAudit.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\SRService.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\SRService.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\SRService.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\WmdmPmSp.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\WmdmPmSp.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\WmdmPmSp.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\helpsvc.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\helpsvc.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\helpsvc.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\uploadmgr.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\uploadmgr.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\uploadmgr.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\uploadmgr.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\uploadmgr.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
C:\Windows\SysWOW64\uploadmgr.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
\??\c:\windows\SysWOW64\helpsvc.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
\??\c:\windows\SysWOW64\irmon.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
\??\c:\windows\SysWOW64\logonhours.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
\??\c:\windows\SysWOW64\nla.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
\??\c:\windows\SysWOW64\ntmssvc.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
\??\c:\windows\SysWOW64\nwcworkstation.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
\??\c:\windows\SysWOW64\nwsapagent.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
\??\c:\windows\SysWOW64\pcaudit.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
\??\c:\windows\SysWOW64\srservice.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
\??\c:\windows\SysWOW64\uploadmgr.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
\??\c:\windows\SysWOW64\wmdmpmsp.dll

Filesize
326KB

MD5
c5128720a51b74c31e8820549611c93c

SHA1
4ff792a5ab727e53cb27360d447789e97030c078

SHA256
c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

SHA512
f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

Download Submit
memory/2524-144-0x0000000002300000-0x0000000006300000-memory.dmp

Filesize
64.0MB

Download
memory/2524-135-0x0000000002300000-0x0000000006300000-memory.dmp

Filesize
64.0MB

Download
memory/2524-132-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2524-191-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4728-136-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4864-139-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download