2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 22:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
Size

88KB
MD5

733672cd3f9799b07506b92d1839d4f8
SHA1

a07f65bd6582a7223abbc7d2d56b269b38f4695d
SHA256

2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957
SHA512

aa421cb3cd8a829eabec49731d50bbf866768ee2d9e3b265f4bf7402594bb8b1482f3b05ff58709b416e43cf5e0890c655287a839f1d74228711d1da2b0cbb72
SSDEEP

1536:etZHJGPKZi+unw3uzV1cuuAVBljDxppoNr9hTcOujjwGTr0aIiksSaV1K7ZNk:M3GCZi+u93XVBR2Nr9hoOVGToadTutNk

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll"	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LogonHours\Parameters\ServiceDll = "C:\\Windows\\system32\\LogonHours.dll"	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll"	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll"	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll"	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll"	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uploadmgr\Parameters\ServiceDll = "C:\\Windows\\system32\\uploadmgr.dll"	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll"	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SRService\Parameters\ServiceDll = "C:\\Windows\\system32\\SRService.dll"	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\helpsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\helpsvc.dll"	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Wmi\Parameters\ServiceDll = "C:\\Windows\\system32\\Wmi.dll"	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmdmPmSp\Parameters\ServiceDll = "C:\\Windows\\system32\\WmdmPmSp.dll"	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PCAudit\Parameters\ServiceDll = "C:\\Windows\\system32\\PCAudit.dll"	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe

Loads dropped DLL 36 IoCs

pid	Process
1088	svchost.exe
1088	svchost.exe
1088	svchost.exe
1444	svchost.exe
1444	svchost.exe
1444	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
1812	svchost.exe
1812	svchost.exe
1812	svchost.exe
2844	svchost.exe
2844	svchost.exe
2844	svchost.exe
1556	svchost.exe
1556	svchost.exe
1556	svchost.exe
3880	svchost.exe
3880	svchost.exe
3880	svchost.exe
3696	svchost.exe
3696	svchost.exe
3696	svchost.exe
3624	svchost.exe
3624	svchost.exe
3624	svchost.exe
1404	svchost.exe
1404	svchost.exe
1404	svchost.exe
2952	svchost.exe
2952	svchost.exe
2952	svchost.exe
5108	svchost.exe
5108	svchost.exe
5108	svchost.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Nla.dll	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
File opened for modification	C:\Windows\SysWOW64\WmdmPmSp.dll	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
File opened for modification	C:\Windows\SysWOW64\uploadmgr.dll	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
File opened for modification	C:\Windows\SysWOW64\Ias.dll	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
File opened for modification	C:\Windows\SysWOW64\LogonHours.dll	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
File opened for modification	C:\Windows\SysWOW64\PCAudit.dll	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
File opened for modification	C:\Windows\SysWOW64\helpsvc.dll	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
File opened for modification	C:\Windows\SysWOW64\Nwsapagent.dll	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
File opened for modification	C:\Windows\SysWOW64\Wmi.dll	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
File opened for modification	C:\Windows\SysWOW64\Irmon.dll	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
File opened for modification	C:\Windows\SysWOW64\Ntmssvc.dll	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
File opened for modification	C:\Windows\SysWOW64\NWCWorkstation.dll	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
File opened for modification	C:\Windows\SysWOW64\SRService.dll	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4736	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
4736	2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe

C:\Users\Admin\AppData\Local\Temp\2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe
"C:\Users\Admin\AppData\Local\Temp\2b4a3155873f2cf873b34de1d48de5aae36202d433bfc28c609bf5a0e5c81957.exe"
1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4736

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
1⤵
- Loads dropped DLL
PID:1088

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Irmon
1⤵
- Loads dropped DLL
PID:1444

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nla
1⤵
- Loads dropped DLL
PID:3568

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Ntmssvc
1⤵
- Loads dropped DLL
PID:1812

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation
1⤵
- Loads dropped DLL
PID:2844

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nwsapagent
1⤵
- Loads dropped DLL
PID:1556

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s SRService
1⤵
- Loads dropped DLL
PID:3880

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s WmdmPmSp
1⤵
- Loads dropped DLL
PID:3696

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s LogonHours
1⤵
- Loads dropped DLL
PID:3624

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s PCAudit
1⤵
- Loads dropped DLL
PID:1404

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
1⤵
- Loads dropped DLL
PID:2952

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
1⤵
- Loads dropped DLL
PID:5108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\Irmon.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\Irmon.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\Irmon.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\LogonHours.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\LogonHours.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\LogonHours.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\NWCWorkstation.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\NWCWorkstation.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\NWCWorkstation.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\Nla.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\Nla.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\Nla.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\Ntmssvc.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\Ntmssvc.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\Ntmssvc.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\Nwsapagent.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\Nwsapagent.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\Nwsapagent.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\PCAudit.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\PCAudit.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\PCAudit.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\SRService.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\SRService.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\SRService.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\WmdmPmSp.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\WmdmPmSp.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\WmdmPmSp.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\helpsvc.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\helpsvc.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\helpsvc.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\uploadmgr.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\uploadmgr.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
C:\Windows\SysWOW64\uploadmgr.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
\??\c:\windows\SysWOW64\helpsvc.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
\??\c:\windows\SysWOW64\irmon.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
\??\c:\windows\SysWOW64\logonhours.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
\??\c:\windows\SysWOW64\nla.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
\??\c:\windows\SysWOW64\ntmssvc.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
\??\c:\windows\SysWOW64\nwcworkstation.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
\??\c:\windows\SysWOW64\nwsapagent.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
\??\c:\windows\SysWOW64\pcaudit.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
\??\c:\windows\SysWOW64\srservice.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
\??\c:\windows\SysWOW64\uploadmgr.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
\??\c:\windows\SysWOW64\wmdmpmsp.dll

Filesize
88KB

MD5
8d5181eef04165a26c78a593632c2e18

SHA1
269a7b622d94ef66ec603bafc7bf74c19cc5b26c

SHA256
d1bf5f01297c7c2a17acb2b82cc5a810917d79fb7d58958a57583d3dce4fdb7a

SHA512
f4b21f1024d15fda2a00e92096ad1245121087ce875706c256103eb8912d49064efe61bbe88cbe0ba70e444d4550d9de14a4f40d8b8545d44d60f79a680e3894

Download Submit
memory/4736-136-0x00000000004E0000-0x0000000000502000-memory.dmp

Filesize
136KB

Download
memory/4736-146-0x0000000002C50000-0x0000000006C50000-memory.dmp

Filesize
64.0MB

Download
memory/4736-137-0x0000000002C50000-0x0000000006C50000-memory.dmp

Filesize
64.0MB

Download