2f9194c6897851837aa1763fcdcf47ad242eb613e8038f658c42909ee63bbf31

Analysis

max time kernel
87s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f9194c6897851837aa1763fcdcf47ad242eb613e8038f658c42909ee63bbf31.exe
Size

1.4MB
MD5

a00b4c0d25c336ab1d78eefcabdc7cb0
SHA1

09b791c68808c6030792f6595bc599d30876c9e7
SHA256

2f9194c6897851837aa1763fcdcf47ad242eb613e8038f658c42909ee63bbf31
SHA512

66f3ff4d27590687cc3b8fd930f2395992d6cb331bca307ad367c362eee97af563acac8588fce0b824799a3745529b030cd1bf5d6cbedbcb359be564142ed486
SSDEEP

12288:xqOPajQUXXP8QvLWFx6Mo5rippDC7ee1hpls4Ey+YP4BJTM6++OBlYER:xnajQEPnvg6PhWDC750YP4bje7YE

Score

8^/10

aspackv2 persistence upx

Malware Config

Signatures

ASPack v2.12-2.42 26 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0007000000005c50-57.dat	aspack_v212_v242
behavioral1/files/0x0007000000005c50-61.dat	aspack_v212_v242
behavioral1/files/0x000a000000012329-68.dat	aspack_v212_v242
behavioral1/files/0x000a000000012329-67.dat	aspack_v212_v242
behavioral1/files/0x0009000000012703-74.dat	aspack_v212_v242
behavioral1/files/0x0009000000012703-75.dat	aspack_v212_v242
behavioral1/files/0x0007000000012732-81.dat	aspack_v212_v242
behavioral1/files/0x0007000000012732-82.dat	aspack_v212_v242
behavioral1/files/0x0007000000012752-87.dat	aspack_v212_v242
behavioral1/files/0x0007000000012752-86.dat	aspack_v212_v242
behavioral1/files/0x000700000001311d-92.dat	aspack_v212_v242
behavioral1/files/0x000700000001311d-93.dat	aspack_v212_v242
behavioral1/files/0x00070000000131a9-98.dat	aspack_v212_v242
behavioral1/files/0x00070000000131a9-99.dat	aspack_v212_v242
behavioral1/files/0x00070000000132c1-104.dat	aspack_v212_v242
behavioral1/files/0x00070000000132c1-106.dat	aspack_v212_v242
behavioral1/files/0x00080000000132ee-111.dat	aspack_v212_v242
behavioral1/files/0x00080000000132ee-112.dat	aspack_v212_v242
behavioral1/files/0x0007000000013382-117.dat	aspack_v212_v242
behavioral1/files/0x0007000000013382-118.dat	aspack_v212_v242
behavioral1/files/0x00070000000133a7-123.dat	aspack_v212_v242
behavioral1/files/0x00070000000133a7-124.dat	aspack_v212_v242
behavioral1/files/0x00070000000133ab-129.dat	aspack_v212_v242
behavioral1/files/0x00070000000133ab-130.dat	aspack_v212_v242
behavioral1/files/0x0007000000013445-135.dat	aspack_v212_v242
behavioral1/files/0x0007000000013445-136.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1340	412b77d3.exe

Sets DLL path for service in the registry 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll"	412b77d3.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll"	412b77d3.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SRService\Parameters\ServiceDll = "C:\\Windows\\system32\\SRService.dll"	412b77d3.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PCAudit\Parameters\ServiceDll = "C:\\Windows\\system32\\PCAudit.dll"	412b77d3.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\uploadmgr\Parameters\ServiceDll = "C:\\Windows\\system32\\uploadmgr.dll"	412b77d3.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll"	412b77d3.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll"	412b77d3.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll"	412b77d3.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Wmi\Parameters\ServiceDll = "C:\\Windows\\system32\\Wmi.dll"	412b77d3.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WmdmPmSp\Parameters\ServiceDll = "C:\\Windows\\system32\\WmdmPmSp.dll"	412b77d3.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\helpsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\helpsvc.dll"	412b77d3.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	412b77d3.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll"	412b77d3.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\LogonHours\Parameters\ServiceDll = "C:\\Windows\\system32\\LogonHours.dll"	412b77d3.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/856-54-0x0000000000400000-0x000000000055F000-memory.dmp	upx
behavioral1/files/0x0007000000005c50-57.dat	upx
behavioral1/memory/1340-59-0x0000000000F60000-0x0000000000FAE000-memory.dmp	upx
behavioral1/files/0x0007000000005c50-61.dat	upx
behavioral1/memory/1340-62-0x0000000000F60000-0x0000000000FAE000-memory.dmp	upx
behavioral1/memory/1340-63-0x0000000000F60000-0x0000000000FAE000-memory.dmp	upx
behavioral1/memory/1340-64-0x0000000000260000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/1340-65-0x0000000000260000-0x00000000002AE000-memory.dmp	upx
behavioral1/files/0x000a000000012329-68.dat	upx
behavioral1/files/0x000a000000012329-67.dat	upx
behavioral1/memory/1540-70-0x0000000074930000-0x000000007497E000-memory.dmp	upx
behavioral1/memory/1540-71-0x0000000074930000-0x000000007497E000-memory.dmp	upx
behavioral1/memory/1540-72-0x0000000074930000-0x000000007497E000-memory.dmp	upx
behavioral1/memory/856-73-0x0000000000400000-0x000000000055F000-memory.dmp	upx
behavioral1/files/0x0009000000012703-74.dat	upx
behavioral1/files/0x0009000000012703-75.dat	upx
behavioral1/memory/1976-78-0x00000000743E0000-0x000000007442E000-memory.dmp	upx
behavioral1/memory/1976-77-0x00000000743E0000-0x000000007442E000-memory.dmp	upx
behavioral1/memory/1976-79-0x00000000743E0000-0x000000007442E000-memory.dmp	upx
behavioral1/files/0x0007000000012732-81.dat	upx
behavioral1/files/0x0007000000012732-82.dat	upx
behavioral1/memory/1976-83-0x0000000074390000-0x00000000743DE000-memory.dmp	upx
behavioral1/memory/1976-84-0x0000000074390000-0x00000000743DE000-memory.dmp	upx
behavioral1/memory/1976-85-0x0000000074390000-0x00000000743DE000-memory.dmp	upx
behavioral1/files/0x0007000000012752-87.dat	upx
behavioral1/files/0x0007000000012752-86.dat	upx
behavioral1/memory/744-89-0x0000000074930000-0x000000007497E000-memory.dmp	upx
behavioral1/memory/744-90-0x0000000074930000-0x000000007497E000-memory.dmp	upx
behavioral1/memory/744-91-0x0000000074930000-0x000000007497E000-memory.dmp	upx
behavioral1/files/0x000700000001311d-92.dat	upx
behavioral1/files/0x000700000001311d-93.dat	upx
behavioral1/memory/1780-96-0x0000000073AE0000-0x0000000073B2E000-memory.dmp	upx
behavioral1/memory/1780-95-0x0000000073AE0000-0x0000000073B2E000-memory.dmp	upx
behavioral1/memory/1780-97-0x0000000073AE0000-0x0000000073B2E000-memory.dmp	upx
behavioral1/files/0x00070000000131a9-98.dat	upx
behavioral1/files/0x00070000000131a9-99.dat	upx
behavioral1/memory/1756-101-0x0000000073AE0000-0x0000000073B2E000-memory.dmp	upx
behavioral1/memory/1756-102-0x0000000073AE0000-0x0000000073B2E000-memory.dmp	upx
behavioral1/memory/1756-103-0x0000000073AE0000-0x0000000073B2E000-memory.dmp	upx
behavioral1/files/0x00070000000132c1-104.dat	upx
behavioral1/memory/856-105-0x0000000000400000-0x000000000055F000-memory.dmp	upx
behavioral1/files/0x00070000000132c1-106.dat	upx
behavioral1/memory/1748-108-0x0000000074F70000-0x0000000074FBE000-memory.dmp	upx
behavioral1/memory/1748-109-0x0000000074F70000-0x0000000074FBE000-memory.dmp	upx
behavioral1/memory/1748-110-0x0000000074F70000-0x0000000074FBE000-memory.dmp	upx
behavioral1/files/0x00080000000132ee-111.dat	upx
behavioral1/files/0x00080000000132ee-112.dat	upx
behavioral1/memory/812-115-0x0000000074F70000-0x0000000074FBE000-memory.dmp	upx
behavioral1/memory/812-114-0x0000000074F70000-0x0000000074FBE000-memory.dmp	upx
behavioral1/memory/812-116-0x0000000074F70000-0x0000000074FBE000-memory.dmp	upx
behavioral1/files/0x0007000000013382-117.dat	upx
behavioral1/files/0x0007000000013382-118.dat	upx
behavioral1/memory/1064-120-0x0000000074F70000-0x0000000074FBE000-memory.dmp	upx
behavioral1/memory/1064-121-0x0000000074F70000-0x0000000074FBE000-memory.dmp	upx
behavioral1/memory/1064-122-0x0000000074F70000-0x0000000074FBE000-memory.dmp	upx
behavioral1/files/0x00070000000133a7-123.dat	upx
behavioral1/files/0x00070000000133a7-124.dat	upx
behavioral1/memory/1476-127-0x0000000074F70000-0x0000000074FBE000-memory.dmp	upx
behavioral1/memory/1476-126-0x0000000074F70000-0x0000000074FBE000-memory.dmp	upx
behavioral1/memory/1476-128-0x0000000074F70000-0x0000000074FBE000-memory.dmp	upx
behavioral1/files/0x00070000000133ab-129.dat	upx
behavioral1/files/0x00070000000133ab-130.dat	upx
behavioral1/memory/1484-132-0x0000000074F70000-0x0000000074FBE000-memory.dmp	upx
behavioral1/memory/1484-133-0x0000000074F70000-0x0000000074FBE000-memory.dmp	upx

Loads dropped DLL 12 IoCs

pid	Process
1540	svchost.exe
1976	svchost.exe
1976	svchost.exe
744	svchost.exe
1780	svchost.exe
1756	svchost.exe
1748	svchost.exe
812	svchost.exe
1064	svchost.exe
1476	svchost.exe
1484	svchost.exe
748	svchost.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ias.dll	412b77d3.exe
File opened for modification	C:\Windows\SysWOW64\NWCWorkstation.dll	412b77d3.exe
File opened for modification	C:\Windows\SysWOW64\Nwsapagent.dll	412b77d3.exe
File opened for modification	C:\Windows\SysWOW64\PCAudit.dll	412b77d3.exe
File opened for modification	C:\Windows\SysWOW64\helpsvc.dll	412b77d3.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	412b77d3.exe
File opened for modification	C:\Windows\SysWOW64\uploadmgr.dll	412b77d3.exe
File opened for modification	C:\Windows\SysWOW64\Nla.dll	412b77d3.exe
File opened for modification	C:\Windows\SysWOW64\Ntmssvc.dll	412b77d3.exe
File opened for modification	C:\Windows\SysWOW64\WmdmPmSp.dll	412b77d3.exe
File opened for modification	C:\Windows\SysWOW64\Irmon.dll	412b77d3.exe
File opened for modification	C:\Windows\SysWOW64\SRService.dll	412b77d3.exe
File opened for modification	C:\Windows\SysWOW64\Wmi.dll	412b77d3.exe
File opened for modification	C:\Windows\SysWOW64\LogonHours.dll	412b77d3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1340	412b77d3.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
856	2f9194c6897851837aa1763fcdcf47ad242eb613e8038f658c42909ee63bbf31.exe
856	2f9194c6897851837aa1763fcdcf47ad242eb613e8038f658c42909ee63bbf31.exe
856	2f9194c6897851837aa1763fcdcf47ad242eb613e8038f658c42909ee63bbf31.exe
856	2f9194c6897851837aa1763fcdcf47ad242eb613e8038f658c42909ee63bbf31.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 1340	856	2f9194c6897851837aa1763fcdcf47ad242eb613e8038f658c42909ee63bbf31.exe	26
PID 856 wrote to memory of 1340	856	2f9194c6897851837aa1763fcdcf47ad242eb613e8038f658c42909ee63bbf31.exe	26
PID 856 wrote to memory of 1340	856	2f9194c6897851837aa1763fcdcf47ad242eb613e8038f658c42909ee63bbf31.exe	26
PID 856 wrote to memory of 1340	856	2f9194c6897851837aa1763fcdcf47ad242eb613e8038f658c42909ee63bbf31.exe	26
PID 856 wrote to memory of 1340	856	2f9194c6897851837aa1763fcdcf47ad242eb613e8038f658c42909ee63bbf31.exe	26
PID 856 wrote to memory of 1340	856	2f9194c6897851837aa1763fcdcf47ad242eb613e8038f658c42909ee63bbf31.exe	26
PID 856 wrote to memory of 1340	856	2f9194c6897851837aa1763fcdcf47ad242eb613e8038f658c42909ee63bbf31.exe	26

C:\Users\Admin\AppData\Local\Temp\2f9194c6897851837aa1763fcdcf47ad242eb613e8038f658c42909ee63bbf31.exe
"C:\Users\Admin\AppData\Local\Temp\2f9194c6897851837aa1763fcdcf47ad242eb613e8038f658c42909ee63bbf31.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856
- C:\412b77d3.exe
  C:\412b77d3.exe
  2⤵
  - Executes dropped EXE
  - Sets DLL path for service in the registry
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1340

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1540

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1976

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:744

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1780

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1756

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1748

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
PID:1724

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:812

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1064

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1476

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1484

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\412b77d3.exe

Filesize
256KB

MD5
2a110ade80eccf67af27bbc62a790dc1

SHA1
6fbac32890ba2b8e092ff712118b05e0f4ab3fc9

SHA256
4f70ef38f7a921781387c51f69860075b32fe3409ca3fed7b525aa42ebc210eb

SHA512
cec7fa8b0722eeca587539337e0fb0ecd500ff2f93dbdb8ed7e90465cd03b74e1b35304ce33b442b2c99c046250ebcbac1f5c63179bedbf2a2a1e832e9d0cce1

Download Submit
C:\412b77d3.exe

Filesize
256KB

MD5
2a110ade80eccf67af27bbc62a790dc1

SHA1
6fbac32890ba2b8e092ff712118b05e0f4ab3fc9

SHA256
4f70ef38f7a921781387c51f69860075b32fe3409ca3fed7b525aa42ebc210eb

SHA512
cec7fa8b0722eeca587539337e0fb0ecd500ff2f93dbdb8ed7e90465cd03b74e1b35304ce33b442b2c99c046250ebcbac1f5c63179bedbf2a2a1e832e9d0cce1

Download Submit
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

Filesize
256KB

MD5
38deed5f89401fae19f23b708578f9bb

SHA1
6f855fb8435d18fd50a934682d487796aa0dc8a2

SHA256
0e37ab44cf9631a26e03ced8bd72983911db4ccbc52d248ca567c43211ca6cee

SHA512
dc23b186c1901d2fa31ec5fd79bff4e8e7ffe64f2b3d75e5f67d91adaf86b29e0860189ab158e7daea8c83e346cd289399e5a6999215ef0f563915d2225460ef

Download Submit
\??\c:\windows\SysWOW64\helpsvc.dll

Filesize
256KB

MD5
38deed5f89401fae19f23b708578f9bb

SHA1
6f855fb8435d18fd50a934682d487796aa0dc8a2

SHA256
0e37ab44cf9631a26e03ced8bd72983911db4ccbc52d248ca567c43211ca6cee

SHA512
dc23b186c1901d2fa31ec5fd79bff4e8e7ffe64f2b3d75e5f67d91adaf86b29e0860189ab158e7daea8c83e346cd289399e5a6999215ef0f563915d2225460ef

Download Submit
\??\c:\windows\SysWOW64\irmon.dll

Filesize
256KB

MD5
38deed5f89401fae19f23b708578f9bb

SHA1
6f855fb8435d18fd50a934682d487796aa0dc8a2

SHA256
0e37ab44cf9631a26e03ced8bd72983911db4ccbc52d248ca567c43211ca6cee

SHA512
dc23b186c1901d2fa31ec5fd79bff4e8e7ffe64f2b3d75e5f67d91adaf86b29e0860189ab158e7daea8c83e346cd289399e5a6999215ef0f563915d2225460ef

Download Submit
\??\c:\windows\SysWOW64\logonhours.dll

Filesize
256KB

MD5
38deed5f89401fae19f23b708578f9bb

SHA1
6f855fb8435d18fd50a934682d487796aa0dc8a2

SHA256
0e37ab44cf9631a26e03ced8bd72983911db4ccbc52d248ca567c43211ca6cee

SHA512
dc23b186c1901d2fa31ec5fd79bff4e8e7ffe64f2b3d75e5f67d91adaf86b29e0860189ab158e7daea8c83e346cd289399e5a6999215ef0f563915d2225460ef

Download Submit
\??\c:\windows\SysWOW64\nla.dll

Filesize
256KB

MD5
38deed5f89401fae19f23b708578f9bb

SHA1
6f855fb8435d18fd50a934682d487796aa0dc8a2

SHA256
0e37ab44cf9631a26e03ced8bd72983911db4ccbc52d248ca567c43211ca6cee

SHA512
dc23b186c1901d2fa31ec5fd79bff4e8e7ffe64f2b3d75e5f67d91adaf86b29e0860189ab158e7daea8c83e346cd289399e5a6999215ef0f563915d2225460ef

Download Submit
\??\c:\windows\SysWOW64\ntmssvc.dll

Filesize
256KB

MD5
38deed5f89401fae19f23b708578f9bb

SHA1
6f855fb8435d18fd50a934682d487796aa0dc8a2

SHA256
0e37ab44cf9631a26e03ced8bd72983911db4ccbc52d248ca567c43211ca6cee

SHA512
dc23b186c1901d2fa31ec5fd79bff4e8e7ffe64f2b3d75e5f67d91adaf86b29e0860189ab158e7daea8c83e346cd289399e5a6999215ef0f563915d2225460ef

Download Submit
\??\c:\windows\SysWOW64\nwcworkstation.dll

Filesize
256KB

MD5
38deed5f89401fae19f23b708578f9bb

SHA1
6f855fb8435d18fd50a934682d487796aa0dc8a2

SHA256
0e37ab44cf9631a26e03ced8bd72983911db4ccbc52d248ca567c43211ca6cee

SHA512
dc23b186c1901d2fa31ec5fd79bff4e8e7ffe64f2b3d75e5f67d91adaf86b29e0860189ab158e7daea8c83e346cd289399e5a6999215ef0f563915d2225460ef

Download Submit
\??\c:\windows\SysWOW64\nwsapagent.dll

Filesize
256KB

MD5
38deed5f89401fae19f23b708578f9bb

SHA1
6f855fb8435d18fd50a934682d487796aa0dc8a2

SHA256
0e37ab44cf9631a26e03ced8bd72983911db4ccbc52d248ca567c43211ca6cee

SHA512
dc23b186c1901d2fa31ec5fd79bff4e8e7ffe64f2b3d75e5f67d91adaf86b29e0860189ab158e7daea8c83e346cd289399e5a6999215ef0f563915d2225460ef

Download Submit
\??\c:\windows\SysWOW64\pcaudit.dll

Filesize
256KB

MD5
38deed5f89401fae19f23b708578f9bb

SHA1
6f855fb8435d18fd50a934682d487796aa0dc8a2

SHA256
0e37ab44cf9631a26e03ced8bd72983911db4ccbc52d248ca567c43211ca6cee

SHA512
dc23b186c1901d2fa31ec5fd79bff4e8e7ffe64f2b3d75e5f67d91adaf86b29e0860189ab158e7daea8c83e346cd289399e5a6999215ef0f563915d2225460ef

Download Submit
\??\c:\windows\SysWOW64\srservice.dll

Filesize
256KB

MD5
38deed5f89401fae19f23b708578f9bb

SHA1
6f855fb8435d18fd50a934682d487796aa0dc8a2

SHA256
0e37ab44cf9631a26e03ced8bd72983911db4ccbc52d248ca567c43211ca6cee

SHA512
dc23b186c1901d2fa31ec5fd79bff4e8e7ffe64f2b3d75e5f67d91adaf86b29e0860189ab158e7daea8c83e346cd289399e5a6999215ef0f563915d2225460ef

Download Submit
\??\c:\windows\SysWOW64\uploadmgr.dll

Filesize
256KB

MD5
38deed5f89401fae19f23b708578f9bb

SHA1
6f855fb8435d18fd50a934682d487796aa0dc8a2

SHA256
0e37ab44cf9631a26e03ced8bd72983911db4ccbc52d248ca567c43211ca6cee

SHA512
dc23b186c1901d2fa31ec5fd79bff4e8e7ffe64f2b3d75e5f67d91adaf86b29e0860189ab158e7daea8c83e346cd289399e5a6999215ef0f563915d2225460ef

Download Submit
\??\c:\windows\SysWOW64\wmdmpmsp.dll

Filesize
256KB

MD5
38deed5f89401fae19f23b708578f9bb

SHA1
6f855fb8435d18fd50a934682d487796aa0dc8a2

SHA256
0e37ab44cf9631a26e03ced8bd72983911db4ccbc52d248ca567c43211ca6cee

SHA512
dc23b186c1901d2fa31ec5fd79bff4e8e7ffe64f2b3d75e5f67d91adaf86b29e0860189ab158e7daea8c83e346cd289399e5a6999215ef0f563915d2225460ef

Download Submit
\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

Filesize
256KB

MD5
38deed5f89401fae19f23b708578f9bb

SHA1
6f855fb8435d18fd50a934682d487796aa0dc8a2

SHA256
0e37ab44cf9631a26e03ced8bd72983911db4ccbc52d248ca567c43211ca6cee

SHA512
dc23b186c1901d2fa31ec5fd79bff4e8e7ffe64f2b3d75e5f67d91adaf86b29e0860189ab158e7daea8c83e346cd289399e5a6999215ef0f563915d2225460ef

Download Submit
\Windows\SysWOW64\Irmon.dll

Filesize
256KB

MD5
38deed5f89401fae19f23b708578f9bb

SHA1
6f855fb8435d18fd50a934682d487796aa0dc8a2

SHA256
0e37ab44cf9631a26e03ced8bd72983911db4ccbc52d248ca567c43211ca6cee

SHA512
dc23b186c1901d2fa31ec5fd79bff4e8e7ffe64f2b3d75e5f67d91adaf86b29e0860189ab158e7daea8c83e346cd289399e5a6999215ef0f563915d2225460ef

Download Submit
\Windows\SysWOW64\LogonHours.dll

Filesize
256KB

MD5
38deed5f89401fae19f23b708578f9bb

SHA1
6f855fb8435d18fd50a934682d487796aa0dc8a2

SHA256
0e37ab44cf9631a26e03ced8bd72983911db4ccbc52d248ca567c43211ca6cee

SHA512
dc23b186c1901d2fa31ec5fd79bff4e8e7ffe64f2b3d75e5f67d91adaf86b29e0860189ab158e7daea8c83e346cd289399e5a6999215ef0f563915d2225460ef

Download Submit
\Windows\SysWOW64\NWCWorkstation.dll

Filesize
256KB

MD5
38deed5f89401fae19f23b708578f9bb

SHA1
6f855fb8435d18fd50a934682d487796aa0dc8a2

SHA256
0e37ab44cf9631a26e03ced8bd72983911db4ccbc52d248ca567c43211ca6cee

SHA512
dc23b186c1901d2fa31ec5fd79bff4e8e7ffe64f2b3d75e5f67d91adaf86b29e0860189ab158e7daea8c83e346cd289399e5a6999215ef0f563915d2225460ef

Download Submit
\Windows\SysWOW64\Nla.dll

Filesize
256KB

MD5
38deed5f89401fae19f23b708578f9bb

SHA1
6f855fb8435d18fd50a934682d487796aa0dc8a2

SHA256
0e37ab44cf9631a26e03ced8bd72983911db4ccbc52d248ca567c43211ca6cee

SHA512
dc23b186c1901d2fa31ec5fd79bff4e8e7ffe64f2b3d75e5f67d91adaf86b29e0860189ab158e7daea8c83e346cd289399e5a6999215ef0f563915d2225460ef

Download Submit
\Windows\SysWOW64\Ntmssvc.dll

Filesize
256KB

MD5
38deed5f89401fae19f23b708578f9bb

SHA1
6f855fb8435d18fd50a934682d487796aa0dc8a2

SHA256
0e37ab44cf9631a26e03ced8bd72983911db4ccbc52d248ca567c43211ca6cee

SHA512
dc23b186c1901d2fa31ec5fd79bff4e8e7ffe64f2b3d75e5f67d91adaf86b29e0860189ab158e7daea8c83e346cd289399e5a6999215ef0f563915d2225460ef

Download Submit
\Windows\SysWOW64\Nwsapagent.dll

Filesize
256KB

MD5
38deed5f89401fae19f23b708578f9bb

SHA1
6f855fb8435d18fd50a934682d487796aa0dc8a2

SHA256
0e37ab44cf9631a26e03ced8bd72983911db4ccbc52d248ca567c43211ca6cee

SHA512
dc23b186c1901d2fa31ec5fd79bff4e8e7ffe64f2b3d75e5f67d91adaf86b29e0860189ab158e7daea8c83e346cd289399e5a6999215ef0f563915d2225460ef

Download Submit
\Windows\SysWOW64\PCAudit.dll

Filesize
256KB

MD5
38deed5f89401fae19f23b708578f9bb

SHA1
6f855fb8435d18fd50a934682d487796aa0dc8a2

SHA256
0e37ab44cf9631a26e03ced8bd72983911db4ccbc52d248ca567c43211ca6cee

SHA512
dc23b186c1901d2fa31ec5fd79bff4e8e7ffe64f2b3d75e5f67d91adaf86b29e0860189ab158e7daea8c83e346cd289399e5a6999215ef0f563915d2225460ef

Download Submit
\Windows\SysWOW64\SRService.dll

Filesize
256KB

MD5
38deed5f89401fae19f23b708578f9bb

SHA1
6f855fb8435d18fd50a934682d487796aa0dc8a2

SHA256
0e37ab44cf9631a26e03ced8bd72983911db4ccbc52d248ca567c43211ca6cee

SHA512
dc23b186c1901d2fa31ec5fd79bff4e8e7ffe64f2b3d75e5f67d91adaf86b29e0860189ab158e7daea8c83e346cd289399e5a6999215ef0f563915d2225460ef

Download Submit
\Windows\SysWOW64\WmdmPmSp.dll

Filesize
256KB

MD5
38deed5f89401fae19f23b708578f9bb

SHA1
6f855fb8435d18fd50a934682d487796aa0dc8a2

SHA256
0e37ab44cf9631a26e03ced8bd72983911db4ccbc52d248ca567c43211ca6cee

SHA512
dc23b186c1901d2fa31ec5fd79bff4e8e7ffe64f2b3d75e5f67d91adaf86b29e0860189ab158e7daea8c83e346cd289399e5a6999215ef0f563915d2225460ef

Download Submit
\Windows\SysWOW64\helpsvc.dll

Filesize
256KB

MD5
38deed5f89401fae19f23b708578f9bb

SHA1
6f855fb8435d18fd50a934682d487796aa0dc8a2

SHA256
0e37ab44cf9631a26e03ced8bd72983911db4ccbc52d248ca567c43211ca6cee

SHA512
dc23b186c1901d2fa31ec5fd79bff4e8e7ffe64f2b3d75e5f67d91adaf86b29e0860189ab158e7daea8c83e346cd289399e5a6999215ef0f563915d2225460ef

Download Submit
\Windows\SysWOW64\uploadmgr.dll

Filesize
256KB

MD5
38deed5f89401fae19f23b708578f9bb

SHA1
6f855fb8435d18fd50a934682d487796aa0dc8a2

SHA256
0e37ab44cf9631a26e03ced8bd72983911db4ccbc52d248ca567c43211ca6cee

SHA512
dc23b186c1901d2fa31ec5fd79bff4e8e7ffe64f2b3d75e5f67d91adaf86b29e0860189ab158e7daea8c83e346cd289399e5a6999215ef0f563915d2225460ef

Download Submit
memory/744-90-0x0000000074930000-0x000000007497E000-memory.dmp

Filesize
312KB

Download
memory/744-89-0x0000000074930000-0x000000007497E000-memory.dmp

Filesize
312KB

Download
memory/744-91-0x0000000074930000-0x000000007497E000-memory.dmp

Filesize
312KB

Download
memory/748-138-0x0000000074F70000-0x0000000074FBE000-memory.dmp

Filesize
312KB

Download
memory/748-139-0x0000000074F70000-0x0000000074FBE000-memory.dmp

Filesize
312KB

Download
memory/748-140-0x0000000074F70000-0x0000000074FBE000-memory.dmp

Filesize
312KB

Download
memory/812-115-0x0000000074F70000-0x0000000074FBE000-memory.dmp

Filesize
312KB

Download
memory/812-114-0x0000000074F70000-0x0000000074FBE000-memory.dmp

Filesize
312KB

Download
memory/812-116-0x0000000074F70000-0x0000000074FBE000-memory.dmp

Filesize
312KB

Download
memory/856-73-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/856-58-0x0000000000320000-0x000000000036E000-memory.dmp

Filesize
312KB

Download
memory/856-54-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/856-105-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/856-55-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/1064-120-0x0000000074F70000-0x0000000074FBE000-memory.dmp

Filesize
312KB

Download
memory/1064-121-0x0000000074F70000-0x0000000074FBE000-memory.dmp

Filesize
312KB

Download
memory/1064-122-0x0000000074F70000-0x0000000074FBE000-memory.dmp

Filesize
312KB

Download
memory/1340-80-0x00000000023B0000-0x00000000063B0000-memory.dmp

Filesize
64.0MB

Download
memory/1340-62-0x0000000000F60000-0x0000000000FAE000-memory.dmp

Filesize
312KB

Download
memory/1340-63-0x0000000000F60000-0x0000000000FAE000-memory.dmp

Filesize
312KB

Download
memory/1340-64-0x0000000000260000-0x00000000002AE000-memory.dmp

Filesize
312KB

Download
memory/1340-141-0x0000000000F60000-0x0000000000FAE000-memory.dmp

Filesize
312KB

Download
memory/1340-59-0x0000000000F60000-0x0000000000FAE000-memory.dmp

Filesize
312KB

Download
memory/1340-66-0x00000000023B0000-0x00000000063B0000-memory.dmp

Filesize
64.0MB

Download
memory/1340-65-0x0000000000260000-0x00000000002AE000-memory.dmp

Filesize
312KB

Download
memory/1476-128-0x0000000074F70000-0x0000000074FBE000-memory.dmp

Filesize
312KB

Download
memory/1476-126-0x0000000074F70000-0x0000000074FBE000-memory.dmp

Filesize
312KB

Download
memory/1476-127-0x0000000074F70000-0x0000000074FBE000-memory.dmp

Filesize
312KB

Download
memory/1484-132-0x0000000074F70000-0x0000000074FBE000-memory.dmp

Filesize
312KB

Download
memory/1484-133-0x0000000074F70000-0x0000000074FBE000-memory.dmp

Filesize
312KB

Download
memory/1484-134-0x0000000074F70000-0x0000000074FBE000-memory.dmp

Filesize
312KB

Download
memory/1540-72-0x0000000074930000-0x000000007497E000-memory.dmp

Filesize
312KB

Download
memory/1540-71-0x0000000074930000-0x000000007497E000-memory.dmp

Filesize
312KB

Download
memory/1540-70-0x0000000074930000-0x000000007497E000-memory.dmp

Filesize
312KB

Download
memory/1748-108-0x0000000074F70000-0x0000000074FBE000-memory.dmp

Filesize
312KB

Download
memory/1748-110-0x0000000074F70000-0x0000000074FBE000-memory.dmp

Filesize
312KB

Download
memory/1748-109-0x0000000074F70000-0x0000000074FBE000-memory.dmp

Filesize
312KB

Download
memory/1756-102-0x0000000073AE0000-0x0000000073B2E000-memory.dmp

Filesize
312KB

Download
memory/1756-101-0x0000000073AE0000-0x0000000073B2E000-memory.dmp

Filesize
312KB

Download
memory/1756-103-0x0000000073AE0000-0x0000000073B2E000-memory.dmp

Filesize
312KB

Download
memory/1780-97-0x0000000073AE0000-0x0000000073B2E000-memory.dmp

Filesize
312KB

Download
memory/1780-95-0x0000000073AE0000-0x0000000073B2E000-memory.dmp

Filesize
312KB

Download
memory/1780-96-0x0000000073AE0000-0x0000000073B2E000-memory.dmp

Filesize
312KB

Download
memory/1976-77-0x00000000743E0000-0x000000007442E000-memory.dmp

Filesize
312KB

Download
memory/1976-85-0x0000000074390000-0x00000000743DE000-memory.dmp

Filesize
312KB

Download
memory/1976-84-0x0000000074390000-0x00000000743DE000-memory.dmp

Filesize
312KB

Download
memory/1976-83-0x0000000074390000-0x00000000743DE000-memory.dmp

Filesize
312KB

Download
memory/1976-79-0x00000000743E0000-0x000000007442E000-memory.dmp

Filesize
312KB

Download
memory/1976-78-0x00000000743E0000-0x000000007442E000-memory.dmp

Filesize
312KB

Download