b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa

Analysis

max time kernel
70s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 22:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
Size

234KB
MD5

2dc39b33046a5f6a440e4309efd9dde7
SHA1

680e6c660a917e586946068efae04cbfd15476d3
SHA256

b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa
SHA512

47870e93a9a83815eafb532945a0a99adb2959a822de94dc7e44e128dc0d25af19a7a5eb0806a75f09f37669b2ead27898ce119df284cb0bf231344bac1ab3a9
SSDEEP

6144:XHl0ndE3gkCAaRDkubNawb9VOExRCiMOEo:VO2CAID9bswb9VOExxLE

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll"	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll"	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Wmi\Parameters\ServiceDll = "C:\\Windows\\system32\\Wmi.dll"	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\uploadmgr\Parameters\ServiceDll = "C:\\Windows\\system32\\uploadmgr.dll"	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll"	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\LogonHours\Parameters\ServiceDll = "C:\\Windows\\system32\\LogonHours.dll"	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\helpsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\helpsvc.dll"	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll"	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SRService\Parameters\ServiceDll = "C:\\Windows\\system32\\SRService.dll"	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll"	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll"	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WmdmPmSp\Parameters\ServiceDll = "C:\\Windows\\system32\\WmdmPmSp.dll"	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PCAudit\Parameters\ServiceDll = "C:\\Windows\\system32\\PCAudit.dll"	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe

Loads dropped DLL 24 IoCs

pid	Process
1532	svchost.exe
1532	svchost.exe
372	svchost.exe
372	svchost.exe
1752	svchost.exe
1752	svchost.exe
1536	svchost.exe
1536	svchost.exe
1744	svchost.exe
1744	svchost.exe
1044	svchost.exe
1044	svchost.exe
916	svchost.exe
916	svchost.exe
1768	svchost.exe
1768	svchost.exe
1740	svchost.exe
1740	svchost.exe
748	svchost.exe
748	svchost.exe
1560	svchost.exe
1560	svchost.exe
1784	svchost.exe
1784	svchost.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ias.dll	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
File opened for modification	C:\Windows\SysWOW64\Nwsapagent.dll	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
File opened for modification	C:\Windows\SysWOW64\SRService.dll	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
File opened for modification	C:\Windows\SysWOW64\WmdmPmSp.dll	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
File opened for modification	C:\Windows\SysWOW64\Nla.dll	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
File opened for modification	C:\Windows\SysWOW64\NWCWorkstation.dll	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
File opened for modification	C:\Windows\SysWOW64\Irmon.dll	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
File opened for modification	C:\Windows\SysWOW64\Ntmssvc.dll	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
File opened for modification	C:\Windows\SysWOW64\Wmi.dll	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
File opened for modification	C:\Windows\SysWOW64\PCAudit.dll	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
File opened for modification	C:\Windows\SysWOW64\helpsvc.dll	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
File opened for modification	C:\Windows\SysWOW64\uploadmgr.dll	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
File opened for modification	C:\Windows\SysWOW64\LogonHours.dll	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1288	b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe

C:\Users\Admin\AppData\Local\Temp\b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe
"C:\Users\Admin\AppData\Local\Temp\b18f171e9f15af64c169b90e088b76e42a2585b255e0e45541feeff917c880fa.exe"
1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1288

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1532

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:372

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1752

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1536

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1744

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1044

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:916

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
PID:1676

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1768

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1740

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:748

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1560

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\??\c:\windows\SysWOW64\helpsvc.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\??\c:\windows\SysWOW64\irmon.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\??\c:\windows\SysWOW64\logonhours.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\??\c:\windows\SysWOW64\nla.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\??\c:\windows\SysWOW64\ntmssvc.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\??\c:\windows\SysWOW64\nwcworkstation.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\??\c:\windows\SysWOW64\nwsapagent.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\??\c:\windows\SysWOW64\pcaudit.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\??\c:\windows\SysWOW64\srservice.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\??\c:\windows\SysWOW64\uploadmgr.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\??\c:\windows\SysWOW64\wmdmpmsp.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\Windows\SysWOW64\Irmon.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\Windows\SysWOW64\Irmon.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\Windows\SysWOW64\LogonHours.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\Windows\SysWOW64\LogonHours.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\Windows\SysWOW64\NWCWorkstation.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\Windows\SysWOW64\NWCWorkstation.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\Windows\SysWOW64\Nla.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\Windows\SysWOW64\Nla.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\Windows\SysWOW64\Ntmssvc.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\Windows\SysWOW64\Ntmssvc.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\Windows\SysWOW64\Nwsapagent.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\Windows\SysWOW64\Nwsapagent.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\Windows\SysWOW64\PCAudit.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\Windows\SysWOW64\PCAudit.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\Windows\SysWOW64\SRService.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\Windows\SysWOW64\SRService.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\Windows\SysWOW64\WmdmPmSp.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\Windows\SysWOW64\WmdmPmSp.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\Windows\SysWOW64\helpsvc.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\Windows\SysWOW64\helpsvc.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\Windows\SysWOW64\uploadmgr.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
\Windows\SysWOW64\uploadmgr.dll

Filesize
234KB

MD5
83bba8acfad137f758de66c217ce14da

SHA1
400dacfeba2b64ed8e33344d1174daa174b641b1

SHA256
205c4e60ed9f9fb3f362050d1ccfae57613f501d84057772e12a9b98ad894b32

SHA512
34b6e3f630ad90762177da9d7dc3023c047ced93daa1727582290c80443ecfaac83bb62d927cd24eaf37ed63150d012b8b6f12ab5c6daf68461219232832ddca

Download Submit
memory/372-67-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/372-66-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/1288-78-0x0000000002030000-0x0000000006030000-memory.dmp

Filesize
64.0MB

Download
memory/1288-74-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/1288-60-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/1288-59-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/1288-61-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/1288-62-0x0000000002030000-0x0000000006030000-memory.dmp

Filesize
64.0MB

Download
memory/1288-58-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1288-54-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/1288-73-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/1288-103-0x0000000000230000-0x000000000023D000-memory.dmp

Filesize
52KB

Download