4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
Size

95KB
MD5

0b79cea991e89cfd89d08763bfea1b50
SHA1

1bdcf22cbfe9d9d1da39f585a28824ea96e081d1
SHA256

4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95
SHA512

be1ec4df0fedc41e86827447b569a6ec8a057e14fe0d5610007fb2d051c2bd941c69f6174ef00207ad23e184edead59d77fdf5bccd6df83883853b75ee7c8ed6
SSDEEP

1536:34aIjDFL1Xul6OP9Vco6R579st8OJLmlgVU/KXfMsRbBxcWiwhppo6tV:IaMBYnP2bM8u1fTxcWxi6

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll"	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PCAudit\Parameters\ServiceDll = "C:\\Windows\\system32\\PCAudit.dll"	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uploadmgr\Parameters\ServiceDll = "C:\\Windows\\system32\\uploadmgr.dll"	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmdmPmSp\Parameters\ServiceDll = "C:\\Windows\\system32\\WmdmPmSp.dll"	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll"	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll"	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll"	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SRService\Parameters\ServiceDll = "C:\\Windows\\system32\\SRService.dll"	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LogonHours\Parameters\ServiceDll = "C:\\Windows\\system32\\LogonHours.dll"	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\helpsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\helpsvc.dll"	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll"	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll"	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Wmi\Parameters\ServiceDll = "C:\\Windows\\system32\\Wmi.dll"	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe

Loads dropped DLL 36 IoCs

pid	Process
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
1664	svchost.exe
1664	svchost.exe
1664	svchost.exe
1924	svchost.exe
1924	svchost.exe
1924	svchost.exe
1416	svchost.exe
1416	svchost.exe
1416	svchost.exe
3504	svchost.exe
3504	svchost.exe
3504	svchost.exe
4852	svchost.exe
4852	svchost.exe
4852	svchost.exe
4632	svchost.exe
4632	svchost.exe
4632	svchost.exe
3872	svchost.exe
3872	svchost.exe
3872	svchost.exe
4448	svchost.exe
4448	svchost.exe
4448	svchost.exe
3832	svchost.exe
3832	svchost.exe
3832	svchost.exe
4728	svchost.exe
4728	svchost.exe
4728	svchost.exe
4924	svchost.exe
4924	svchost.exe
4924	svchost.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Nla.dll	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
File opened for modification	C:\Windows\SysWOW64\SRService.dll	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
File opened for modification	C:\Windows\SysWOW64\helpsvc.dll	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
File opened for modification	C:\Windows\SysWOW64\PCAudit.dll	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
File opened for modification	C:\Windows\SysWOW64\Irmon.dll	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
File opened for modification	C:\Windows\SysWOW64\Ntmssvc.dll	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
File opened for modification	C:\Windows\SysWOW64\Nwsapagent.dll	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
File opened for modification	C:\Windows\SysWOW64\Wmi.dll	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
File opened for modification	C:\Windows\SysWOW64\LogonHours.dll	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
File opened for modification	C:\Windows\SysWOW64\NWCWorkstation.dll	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
File opened for modification	C:\Windows\SysWOW64\uploadmgr.dll	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
File opened for modification	C:\Windows\SysWOW64\Ias.dll	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
File opened for modification	C:\Windows\SysWOW64\WmdmPmSp.dll	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5028	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
5028	4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe

C:\Users\Admin\AppData\Local\Temp\4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe
"C:\Users\Admin\AppData\Local\Temp\4ac54a9b8a7012f62a993b95f52efde09864b01156e3fec8e83f89b401a6db95.exe"
1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:5028

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
1⤵
- Loads dropped DLL
PID:4644

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Irmon
1⤵
- Loads dropped DLL
PID:1664

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nla
1⤵
- Loads dropped DLL
PID:1924

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Ntmssvc
1⤵
- Loads dropped DLL
PID:1416

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation
1⤵
- Loads dropped DLL
PID:3504

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nwsapagent
1⤵
- Loads dropped DLL
PID:4852

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s SRService
1⤵
- Loads dropped DLL
PID:4632

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s WmdmPmSp
1⤵
- Loads dropped DLL
PID:3872

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s LogonHours
1⤵
- Loads dropped DLL
PID:4448

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s PCAudit
1⤵
- Loads dropped DLL
PID:3832

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
1⤵
- Loads dropped DLL
PID:4728

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
1⤵
- Loads dropped DLL
PID:4924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\Irmon.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\Irmon.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\Irmon.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\LogonHours.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\LogonHours.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\LogonHours.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\NWCWorkstation.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\NWCWorkstation.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\NWCWorkstation.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\Nla.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\Nla.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\Nla.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\Ntmssvc.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\Ntmssvc.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\Ntmssvc.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\Nwsapagent.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\Nwsapagent.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\Nwsapagent.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\PCAudit.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\PCAudit.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\PCAudit.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\SRService.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\SRService.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\SRService.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\WmdmPmSp.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\WmdmPmSp.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\WmdmPmSp.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\helpsvc.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\helpsvc.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\helpsvc.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\uploadmgr.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\uploadmgr.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
C:\Windows\SysWOW64\uploadmgr.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
\??\c:\windows\SysWOW64\helpsvc.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
\??\c:\windows\SysWOW64\irmon.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
\??\c:\windows\SysWOW64\logonhours.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
\??\c:\windows\SysWOW64\nla.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
\??\c:\windows\SysWOW64\ntmssvc.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
\??\c:\windows\SysWOW64\nwcworkstation.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
\??\c:\windows\SysWOW64\nwsapagent.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
\??\c:\windows\SysWOW64\pcaudit.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
\??\c:\windows\SysWOW64\srservice.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
\??\c:\windows\SysWOW64\uploadmgr.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
\??\c:\windows\SysWOW64\wmdmpmsp.dll

Filesize
95KB

MD5
f75bb25d9dddba66c4ab0ebe6a719e76

SHA1
2747b09a265bfe2eab0859500a2b0043fa960a0b

SHA256
0bd0e9af7ad01bd7fccdc281aa9d24966ae37dbfa45aa16095476865617b51fd

SHA512
3d1d75602e78253ad91aa6737666d9f87280a65e5ecbf109c5cd4338fad5fe000bfcf56421af1de441ca622b58fb2f41098c8729e69d1d1d01ca6ae9d5fefca2

Download Submit
memory/1664-145-0x00000000756F0000-0x0000000075714000-memory.dmp

Filesize
144KB

Download
memory/1664-155-0x00000000756F0000-0x0000000075714000-memory.dmp

Filesize
144KB

Download
memory/5028-139-0x00000000002F0000-0x0000000000314000-memory.dmp

Filesize
144KB

Download
memory/5028-140-0x0000000002870000-0x0000000006870000-memory.dmp

Filesize
64.0MB

Download
memory/5028-150-0x0000000002870000-0x0000000006870000-memory.dmp

Filesize
64.0MB

Download