bb64d8d7de89b8f9e7b35ae11ab4c63d2715e7bae8ee0b0e456aec3d24a31321

Analysis

max time kernel
104s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb64d8d7de89b8f9e7b35ae11ab4c63d2715e7bae8ee0b0e456aec3d24a31321.exe
Size

388KB
MD5

a156f32e8d2fe70de5b0a7d178f732e0
SHA1

02271edad943fc87e4a7f68cc89f6e21b5704018
SHA256

bb64d8d7de89b8f9e7b35ae11ab4c63d2715e7bae8ee0b0e456aec3d24a31321
SHA512

db7897946abeec59f67183821b1f15adbff652fa06bfc9b3f5e08f20069b2d1b546dd118b6e377e9f6b01d66fd9a85ea323c15a7cf67ae74cb41b5c46819b9be
SSDEEP

6144:UPeyxTH6NnPI99q7N+oRnku9TKqKpItMnddFcCd5dg5Jq90:UPbZB9yznBTKqDt4dZS5sG

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1020	63e97fec.exe

Sets DLL path for service in the registry 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll"	63e97fec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll"	63e97fec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Wmi\Parameters\ServiceDll = "C:\\Windows\\system32\\Wmi.dll"	63e97fec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PCAudit\Parameters\ServiceDll = "C:\\Windows\\system32\\PCAudit.dll"	63e97fec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\helpsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\helpsvc.dll"	63e97fec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll"	63e97fec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll"	63e97fec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SRService\Parameters\ServiceDll = "C:\\Windows\\system32\\SRService.dll"	63e97fec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WmdmPmSp\Parameters\ServiceDll = "C:\\Windows\\system32\\WmdmPmSp.dll"	63e97fec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\LogonHours\Parameters\ServiceDll = "C:\\Windows\\system32\\LogonHours.dll"	63e97fec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\uploadmgr\Parameters\ServiceDll = "C:\\Windows\\system32\\uploadmgr.dll"	63e97fec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	63e97fec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll"	63e97fec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll"	63e97fec.exe

UPX packed file 30 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00140000000054ab-55.dat	upx
behavioral1/files/0x00140000000054ab-57.dat	upx
behavioral1/memory/1020-61-0x0000000000160000-0x00000000001AD000-memory.dmp	upx
behavioral1/memory/1020-60-0x0000000000840000-0x000000000088D000-memory.dmp	upx
behavioral1/memory/1880-58-0x0000000000400000-0x0000000000461000-memory.dmp	upx
behavioral1/memory/1928-65-0x00000000742F0000-0x000000007433D000-memory.dmp	upx
behavioral1/files/0x00060000000149b7-63.dat	upx
behavioral1/files/0x00060000000149b7-62.dat	upx
behavioral1/files/0x00080000000146a2-69.dat	upx
behavioral1/files/0x00080000000146a2-68.dat	upx
behavioral1/files/0x0006000000014ab0-72.dat	upx
behavioral1/files/0x0006000000014ab0-71.dat	upx
behavioral1/memory/1880-76-0x0000000000400000-0x0000000000461000-memory.dmp	upx
behavioral1/files/0x0006000000014af2-78.dat	upx
behavioral1/files/0x0006000000014af2-77.dat	upx
behavioral1/files/0x0006000000014b6f-81.dat	upx
behavioral1/files/0x0006000000014b6f-80.dat	upx
behavioral1/files/0x0006000000014baa-84.dat	upx
behavioral1/files/0x0006000000014baa-83.dat	upx
behavioral1/files/0x0006000000014c4a-87.dat	upx
behavioral1/files/0x0006000000014c4a-86.dat	upx
behavioral1/files/0x0007000000014f7f-89.dat	upx
behavioral1/files/0x0007000000014f7f-90.dat	upx
behavioral1/files/0x000600000001504f-92.dat	upx
behavioral1/files/0x0006000000015330-94.dat	upx
behavioral1/files/0x0006000000015330-93.dat	upx
behavioral1/files/0x0006000000015473-97.dat	upx
behavioral1/files/0x0006000000015473-96.dat	upx
behavioral1/files/0x0006000000015597-100.dat	upx
behavioral1/files/0x0006000000015597-99.dat	upx

Loads dropped DLL 12 IoCs

pid	Process
1928	svchost.exe
776	svchost.exe
1944	svchost.exe
1100	svchost.exe
1672	svchost.exe
1004	svchost.exe
1712	svchost.exe
1596	svchost.exe
764	svchost.exe
1928	svchost.exe
1648	svchost.exe
960	svchost.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Wmi.dll	63e97fec.exe
File opened for modification	C:\Windows\SysWOW64\uploadmgr.dll	63e97fec.exe
File opened for modification	C:\Windows\SysWOW64\NWCWorkstation.dll	63e97fec.exe
File opened for modification	C:\Windows\SysWOW64\SRService.dll	63e97fec.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	63e97fec.exe
File opened for modification	C:\Windows\SysWOW64\Nla.dll	63e97fec.exe
File opened for modification	C:\Windows\SysWOW64\Ntmssvc.dll	63e97fec.exe
File opened for modification	C:\Windows\SysWOW64\LogonHours.dll	63e97fec.exe
File opened for modification	C:\Windows\SysWOW64\helpsvc.dll	63e97fec.exe
File opened for modification	C:\Windows\SysWOW64\Ias.dll	63e97fec.exe
File opened for modification	C:\Windows\SysWOW64\Irmon.dll	63e97fec.exe
File opened for modification	C:\Windows\SysWOW64\PCAudit.dll	63e97fec.exe
File opened for modification	C:\Windows\SysWOW64\Nwsapagent.dll	63e97fec.exe
File opened for modification	C:\Windows\SysWOW64\WmdmPmSp.dll	63e97fec.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1020	63e97fec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1880	bb64d8d7de89b8f9e7b35ae11ab4c63d2715e7bae8ee0b0e456aec3d24a31321.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1880	bb64d8d7de89b8f9e7b35ae11ab4c63d2715e7bae8ee0b0e456aec3d24a31321.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1020	1880	bb64d8d7de89b8f9e7b35ae11ab4c63d2715e7bae8ee0b0e456aec3d24a31321.exe	16
PID 1880 wrote to memory of 1020	1880	bb64d8d7de89b8f9e7b35ae11ab4c63d2715e7bae8ee0b0e456aec3d24a31321.exe	16
PID 1880 wrote to memory of 1020	1880	bb64d8d7de89b8f9e7b35ae11ab4c63d2715e7bae8ee0b0e456aec3d24a31321.exe	16
PID 1880 wrote to memory of 1020	1880	bb64d8d7de89b8f9e7b35ae11ab4c63d2715e7bae8ee0b0e456aec3d24a31321.exe	16
PID 1880 wrote to memory of 1020	1880	bb64d8d7de89b8f9e7b35ae11ab4c63d2715e7bae8ee0b0e456aec3d24a31321.exe	16
PID 1880 wrote to memory of 1020	1880	bb64d8d7de89b8f9e7b35ae11ab4c63d2715e7bae8ee0b0e456aec3d24a31321.exe	16
PID 1880 wrote to memory of 1020	1880	bb64d8d7de89b8f9e7b35ae11ab4c63d2715e7bae8ee0b0e456aec3d24a31321.exe	16

C:\Users\Admin\AppData\Local\Temp\bb64d8d7de89b8f9e7b35ae11ab4c63d2715e7bae8ee0b0e456aec3d24a31321.exe
"C:\Users\Admin\AppData\Local\Temp\bb64d8d7de89b8f9e7b35ae11ab4c63d2715e7bae8ee0b0e456aec3d24a31321.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1880
- C:\63e97fec.exe
  C:\63e97fec.exe
  2⤵
  - Executes dropped EXE
  - Sets DLL path for service in the registry
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1020

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1928

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
PID:2016

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:776

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1944

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1100

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1672

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1004

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1712

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
PID:1312

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1596

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:764

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1928

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1648

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\63e97fec.exe

Filesize
296KB

MD5
f5b81e9400a7b4257461303eaa26c47c

SHA1
8ddd39618d7e828d01b89d48b5e47c8709a5cc93

SHA256
6c985052f9a05821a48f93abef2693dfaafa7c2c670e207685049da0a3c8e0f1

SHA512
3b8c5130254685c6ff79446df8a69a142659dd43c5aad3b3d7bf305e5b0b5bb80c02e4ecb3f5433093f1395875dbe04f27b23102ddf011f234a76ce1c247027e

Download Submit
C:\63e97fec.exe

Filesize
296KB

MD5
f5b81e9400a7b4257461303eaa26c47c

SHA1
8ddd39618d7e828d01b89d48b5e47c8709a5cc93

SHA256
6c985052f9a05821a48f93abef2693dfaafa7c2c670e207685049da0a3c8e0f1

SHA512
3b8c5130254685c6ff79446df8a69a142659dd43c5aad3b3d7bf305e5b0b5bb80c02e4ecb3f5433093f1395875dbe04f27b23102ddf011f234a76ce1c247027e

Download Submit
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

Filesize
296KB

MD5
49c612f96fd5999b6e6966ff1bc457f4

SHA1
ec44d215bf188c5ab17f5982a40a1c9f11c330ea

SHA256
d29db27bdf6e0b9d1b0652dc447f4d2e098e8d18e5bbc770f36639bf34e0c140

SHA512
c6432f206476fc372ed085fd658c0c2007599a0c1d8c58482dff68d8130c1c7890573fbf7083ad39be0344d7bd73e7bd852f725a694fd181d3746f277a46a15d

Download Submit
\??\c:\windows\SysWOW64\helpsvc.dll

Filesize
296KB

MD5
49c612f96fd5999b6e6966ff1bc457f4

SHA1
ec44d215bf188c5ab17f5982a40a1c9f11c330ea

SHA256
d29db27bdf6e0b9d1b0652dc447f4d2e098e8d18e5bbc770f36639bf34e0c140

SHA512
c6432f206476fc372ed085fd658c0c2007599a0c1d8c58482dff68d8130c1c7890573fbf7083ad39be0344d7bd73e7bd852f725a694fd181d3746f277a46a15d

Download Submit
\??\c:\windows\SysWOW64\irmon.dll

Filesize
296KB

MD5
49c612f96fd5999b6e6966ff1bc457f4

SHA1
ec44d215bf188c5ab17f5982a40a1c9f11c330ea

SHA256
d29db27bdf6e0b9d1b0652dc447f4d2e098e8d18e5bbc770f36639bf34e0c140

SHA512
c6432f206476fc372ed085fd658c0c2007599a0c1d8c58482dff68d8130c1c7890573fbf7083ad39be0344d7bd73e7bd852f725a694fd181d3746f277a46a15d

Download Submit
\??\c:\windows\SysWOW64\nla.dll

Filesize
296KB

MD5
49c612f96fd5999b6e6966ff1bc457f4

SHA1
ec44d215bf188c5ab17f5982a40a1c9f11c330ea

SHA256
d29db27bdf6e0b9d1b0652dc447f4d2e098e8d18e5bbc770f36639bf34e0c140

SHA512
c6432f206476fc372ed085fd658c0c2007599a0c1d8c58482dff68d8130c1c7890573fbf7083ad39be0344d7bd73e7bd852f725a694fd181d3746f277a46a15d

Download Submit
\??\c:\windows\SysWOW64\ntmssvc.dll

Filesize
296KB

MD5
49c612f96fd5999b6e6966ff1bc457f4

SHA1
ec44d215bf188c5ab17f5982a40a1c9f11c330ea

SHA256
d29db27bdf6e0b9d1b0652dc447f4d2e098e8d18e5bbc770f36639bf34e0c140

SHA512
c6432f206476fc372ed085fd658c0c2007599a0c1d8c58482dff68d8130c1c7890573fbf7083ad39be0344d7bd73e7bd852f725a694fd181d3746f277a46a15d

Download Submit
\??\c:\windows\SysWOW64\nwcworkstation.dll

Filesize
296KB

MD5
49c612f96fd5999b6e6966ff1bc457f4

SHA1
ec44d215bf188c5ab17f5982a40a1c9f11c330ea

SHA256
d29db27bdf6e0b9d1b0652dc447f4d2e098e8d18e5bbc770f36639bf34e0c140

SHA512
c6432f206476fc372ed085fd658c0c2007599a0c1d8c58482dff68d8130c1c7890573fbf7083ad39be0344d7bd73e7bd852f725a694fd181d3746f277a46a15d

Download Submit
\??\c:\windows\SysWOW64\nwsapagent.dll

Filesize
296KB

MD5
49c612f96fd5999b6e6966ff1bc457f4

SHA1
ec44d215bf188c5ab17f5982a40a1c9f11c330ea

SHA256
d29db27bdf6e0b9d1b0652dc447f4d2e098e8d18e5bbc770f36639bf34e0c140

SHA512
c6432f206476fc372ed085fd658c0c2007599a0c1d8c58482dff68d8130c1c7890573fbf7083ad39be0344d7bd73e7bd852f725a694fd181d3746f277a46a15d

Download Submit
\??\c:\windows\SysWOW64\pcaudit.dll

Filesize
296KB

MD5
49c612f96fd5999b6e6966ff1bc457f4

SHA1
ec44d215bf188c5ab17f5982a40a1c9f11c330ea

SHA256
d29db27bdf6e0b9d1b0652dc447f4d2e098e8d18e5bbc770f36639bf34e0c140

SHA512
c6432f206476fc372ed085fd658c0c2007599a0c1d8c58482dff68d8130c1c7890573fbf7083ad39be0344d7bd73e7bd852f725a694fd181d3746f277a46a15d

Download Submit
\??\c:\windows\SysWOW64\srservice.dll

Filesize
296KB

MD5
49c612f96fd5999b6e6966ff1bc457f4

SHA1
ec44d215bf188c5ab17f5982a40a1c9f11c330ea

SHA256
d29db27bdf6e0b9d1b0652dc447f4d2e098e8d18e5bbc770f36639bf34e0c140

SHA512
c6432f206476fc372ed085fd658c0c2007599a0c1d8c58482dff68d8130c1c7890573fbf7083ad39be0344d7bd73e7bd852f725a694fd181d3746f277a46a15d

Download Submit
\??\c:\windows\SysWOW64\uploadmgr.dll

Filesize
296KB

MD5
49c612f96fd5999b6e6966ff1bc457f4

SHA1
ec44d215bf188c5ab17f5982a40a1c9f11c330ea

SHA256
d29db27bdf6e0b9d1b0652dc447f4d2e098e8d18e5bbc770f36639bf34e0c140

SHA512
c6432f206476fc372ed085fd658c0c2007599a0c1d8c58482dff68d8130c1c7890573fbf7083ad39be0344d7bd73e7bd852f725a694fd181d3746f277a46a15d

Download Submit
\??\c:\windows\SysWOW64\wmdmpmsp.dll

Filesize
296KB

MD5
49c612f96fd5999b6e6966ff1bc457f4

SHA1
ec44d215bf188c5ab17f5982a40a1c9f11c330ea

SHA256
d29db27bdf6e0b9d1b0652dc447f4d2e098e8d18e5bbc770f36639bf34e0c140

SHA512
c6432f206476fc372ed085fd658c0c2007599a0c1d8c58482dff68d8130c1c7890573fbf7083ad39be0344d7bd73e7bd852f725a694fd181d3746f277a46a15d

Download Submit
\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

Filesize
296KB

MD5
49c612f96fd5999b6e6966ff1bc457f4

SHA1
ec44d215bf188c5ab17f5982a40a1c9f11c330ea

SHA256
d29db27bdf6e0b9d1b0652dc447f4d2e098e8d18e5bbc770f36639bf34e0c140

SHA512
c6432f206476fc372ed085fd658c0c2007599a0c1d8c58482dff68d8130c1c7890573fbf7083ad39be0344d7bd73e7bd852f725a694fd181d3746f277a46a15d

Download Submit
\Windows\SysWOW64\Irmon.dll

Filesize
296KB

MD5
49c612f96fd5999b6e6966ff1bc457f4

SHA1
ec44d215bf188c5ab17f5982a40a1c9f11c330ea

SHA256
d29db27bdf6e0b9d1b0652dc447f4d2e098e8d18e5bbc770f36639bf34e0c140

SHA512
c6432f206476fc372ed085fd658c0c2007599a0c1d8c58482dff68d8130c1c7890573fbf7083ad39be0344d7bd73e7bd852f725a694fd181d3746f277a46a15d

Download Submit
\Windows\SysWOW64\LogonHours.dll

Filesize
296KB

MD5
49c612f96fd5999b6e6966ff1bc457f4

SHA1
ec44d215bf188c5ab17f5982a40a1c9f11c330ea

SHA256
d29db27bdf6e0b9d1b0652dc447f4d2e098e8d18e5bbc770f36639bf34e0c140

SHA512
c6432f206476fc372ed085fd658c0c2007599a0c1d8c58482dff68d8130c1c7890573fbf7083ad39be0344d7bd73e7bd852f725a694fd181d3746f277a46a15d

Download Submit
\Windows\SysWOW64\NWCWorkstation.dll

Filesize
296KB

MD5
49c612f96fd5999b6e6966ff1bc457f4

SHA1
ec44d215bf188c5ab17f5982a40a1c9f11c330ea

SHA256
d29db27bdf6e0b9d1b0652dc447f4d2e098e8d18e5bbc770f36639bf34e0c140

SHA512
c6432f206476fc372ed085fd658c0c2007599a0c1d8c58482dff68d8130c1c7890573fbf7083ad39be0344d7bd73e7bd852f725a694fd181d3746f277a46a15d

Download Submit
\Windows\SysWOW64\Nla.dll

Filesize
296KB

MD5
49c612f96fd5999b6e6966ff1bc457f4

SHA1
ec44d215bf188c5ab17f5982a40a1c9f11c330ea

SHA256
d29db27bdf6e0b9d1b0652dc447f4d2e098e8d18e5bbc770f36639bf34e0c140

SHA512
c6432f206476fc372ed085fd658c0c2007599a0c1d8c58482dff68d8130c1c7890573fbf7083ad39be0344d7bd73e7bd852f725a694fd181d3746f277a46a15d

Download Submit
\Windows\SysWOW64\Ntmssvc.dll

Filesize
296KB

MD5
49c612f96fd5999b6e6966ff1bc457f4

SHA1
ec44d215bf188c5ab17f5982a40a1c9f11c330ea

SHA256
d29db27bdf6e0b9d1b0652dc447f4d2e098e8d18e5bbc770f36639bf34e0c140

SHA512
c6432f206476fc372ed085fd658c0c2007599a0c1d8c58482dff68d8130c1c7890573fbf7083ad39be0344d7bd73e7bd852f725a694fd181d3746f277a46a15d

Download Submit
\Windows\SysWOW64\Nwsapagent.dll

Filesize
296KB

MD5
49c612f96fd5999b6e6966ff1bc457f4

SHA1
ec44d215bf188c5ab17f5982a40a1c9f11c330ea

SHA256
d29db27bdf6e0b9d1b0652dc447f4d2e098e8d18e5bbc770f36639bf34e0c140

SHA512
c6432f206476fc372ed085fd658c0c2007599a0c1d8c58482dff68d8130c1c7890573fbf7083ad39be0344d7bd73e7bd852f725a694fd181d3746f277a46a15d

Download Submit
\Windows\SysWOW64\PCAudit.dll

Filesize
296KB

MD5
49c612f96fd5999b6e6966ff1bc457f4

SHA1
ec44d215bf188c5ab17f5982a40a1c9f11c330ea

SHA256
d29db27bdf6e0b9d1b0652dc447f4d2e098e8d18e5bbc770f36639bf34e0c140

SHA512
c6432f206476fc372ed085fd658c0c2007599a0c1d8c58482dff68d8130c1c7890573fbf7083ad39be0344d7bd73e7bd852f725a694fd181d3746f277a46a15d

Download Submit
\Windows\SysWOW64\SRService.dll

Filesize
296KB

MD5
49c612f96fd5999b6e6966ff1bc457f4

SHA1
ec44d215bf188c5ab17f5982a40a1c9f11c330ea

SHA256
d29db27bdf6e0b9d1b0652dc447f4d2e098e8d18e5bbc770f36639bf34e0c140

SHA512
c6432f206476fc372ed085fd658c0c2007599a0c1d8c58482dff68d8130c1c7890573fbf7083ad39be0344d7bd73e7bd852f725a694fd181d3746f277a46a15d

Download Submit
\Windows\SysWOW64\WmdmPmSp.dll

Filesize
296KB

MD5
49c612f96fd5999b6e6966ff1bc457f4

SHA1
ec44d215bf188c5ab17f5982a40a1c9f11c330ea

SHA256
d29db27bdf6e0b9d1b0652dc447f4d2e098e8d18e5bbc770f36639bf34e0c140

SHA512
c6432f206476fc372ed085fd658c0c2007599a0c1d8c58482dff68d8130c1c7890573fbf7083ad39be0344d7bd73e7bd852f725a694fd181d3746f277a46a15d

Download Submit
\Windows\SysWOW64\helpsvc.dll

Filesize
296KB

MD5
49c612f96fd5999b6e6966ff1bc457f4

SHA1
ec44d215bf188c5ab17f5982a40a1c9f11c330ea

SHA256
d29db27bdf6e0b9d1b0652dc447f4d2e098e8d18e5bbc770f36639bf34e0c140

SHA512
c6432f206476fc372ed085fd658c0c2007599a0c1d8c58482dff68d8130c1c7890573fbf7083ad39be0344d7bd73e7bd852f725a694fd181d3746f277a46a15d

Download Submit
\Windows\SysWOW64\uploadmgr.dll

Filesize
296KB

MD5
49c612f96fd5999b6e6966ff1bc457f4

SHA1
ec44d215bf188c5ab17f5982a40a1c9f11c330ea

SHA256
d29db27bdf6e0b9d1b0652dc447f4d2e098e8d18e5bbc770f36639bf34e0c140

SHA512
c6432f206476fc372ed085fd658c0c2007599a0c1d8c58482dff68d8130c1c7890573fbf7083ad39be0344d7bd73e7bd852f725a694fd181d3746f277a46a15d

Download Submit
memory/1020-60-0x0000000000840000-0x000000000088D000-memory.dmp

Filesize
308KB

Download
memory/1020-61-0x0000000000160000-0x00000000001AD000-memory.dmp

Filesize
308KB

Download
memory/1020-66-0x0000000002030000-0x0000000006030000-memory.dmp

Filesize
64.0MB

Download
memory/1020-67-0x0000000002030000-0x0000000006030000-memory.dmp

Filesize
64.0MB

Download
memory/1020-56-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/1880-58-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1880-76-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1880-59-0x0000000000160000-0x00000000001AD000-memory.dmp

Filesize
308KB

Download
memory/1928-65-0x00000000742F0000-0x000000007433D000-memory.dmp

Filesize
308KB

Download