Analysis
-
max time kernel
134s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 17:11
Behavioral task
behavioral1
Sample
10a3571ff372a5c33dcdef305a49ffaab9ae17e7f58790f278a53b0b9b875157.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
10a3571ff372a5c33dcdef305a49ffaab9ae17e7f58790f278a53b0b9b875157.exe
Resource
win10v2004-20220812-en
General
-
Target
10a3571ff372a5c33dcdef305a49ffaab9ae17e7f58790f278a53b0b9b875157.exe
-
Size
320KB
-
MD5
5319dc26e42296d4c9c2b9d9857ce1c0
-
SHA1
d53d99ca60cdc19b952a1609aceb7e224bd27ff5
-
SHA256
10a3571ff372a5c33dcdef305a49ffaab9ae17e7f58790f278a53b0b9b875157
-
SHA512
33989cb2bd5ef4a7e9e83f29d895133177b3edd6ff47c12deb59dc9162d3d1bb63f3baebc07a17d94765194e7db636cba2afae1be17666511b72d93303152300
-
SSDEEP
6144:WSWclRDvO4SIA1AT+UBiPVCi55bdbP9GwCUKMCux:WSzbDvJAmTs9C+hGaCk
Malware Config
Signatures
-
Processes:
resource yara_rule C:\10524ad5.exe aspack_v212_v242 C:\10524ad5.exe aspack_v212_v242 \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll aspack_v212_v242 C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll aspack_v212_v242 \??\c:\windows\SysWOW64\irmon.dll aspack_v212_v242 C:\Windows\SysWOW64\Irmon.dll aspack_v212_v242 \??\c:\windows\SysWOW64\nla.dll aspack_v212_v242 C:\Windows\SysWOW64\Nla.dll aspack_v212_v242 \??\c:\windows\SysWOW64\ntmssvc.dll aspack_v212_v242 C:\Windows\SysWOW64\Ntmssvc.dll aspack_v212_v242 \??\c:\windows\SysWOW64\nwcworkstation.dll aspack_v212_v242 C:\Windows\SysWOW64\NWCWorkstation.dll aspack_v212_v242 \??\c:\windows\SysWOW64\nwsapagent.dll aspack_v212_v242 C:\Windows\SysWOW64\Nwsapagent.dll aspack_v212_v242 \??\c:\windows\SysWOW64\srservice.dll aspack_v212_v242 C:\Windows\SysWOW64\SRService.dll aspack_v212_v242 \??\c:\windows\SysWOW64\wmdmpmsp.dll aspack_v212_v242 C:\Windows\SysWOW64\WmdmPmSp.dll aspack_v212_v242 \??\c:\windows\SysWOW64\logonhours.dll aspack_v212_v242 C:\Windows\SysWOW64\LogonHours.dll aspack_v212_v242 \??\c:\windows\SysWOW64\pcaudit.dll aspack_v212_v242 C:\Windows\SysWOW64\PCAudit.dll aspack_v212_v242 C:\Windows\SysWOW64\helpsvc.dll aspack_v212_v242 \??\c:\windows\SysWOW64\helpsvc.dll aspack_v212_v242 \??\c:\windows\SysWOW64\uploadmgr.dll aspack_v212_v242 C:\Windows\SysWOW64\uploadmgr.dll aspack_v212_v242 -
Executes dropped EXE 1 IoCs
Processes:
10524ad5.exepid process 1716 10524ad5.exe -
Sets DLL path for service in the registry 2 TTPs 14 IoCs
Processes:
10524ad5.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll" 10524ad5.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll" 10524ad5.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PCAudit\Parameters\ServiceDll = "C:\\Windows\\system32\\PCAudit.dll" 10524ad5.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uploadmgr\Parameters\ServiceDll = "C:\\Windows\\system32\\uploadmgr.dll" 10524ad5.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Wmi\Parameters\ServiceDll = "C:\\Windows\\system32\\Wmi.dll" 10524ad5.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LogonHours\Parameters\ServiceDll = "C:\\Windows\\system32\\LogonHours.dll" 10524ad5.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll" 10524ad5.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll" 10524ad5.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll" 10524ad5.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll" 10524ad5.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SRService\Parameters\ServiceDll = "C:\\Windows\\system32\\SRService.dll" 10524ad5.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmdmPmSp\Parameters\ServiceDll = "C:\\Windows\\system32\\WmdmPmSp.dll" 10524ad5.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\helpsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\helpsvc.dll" 10524ad5.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll" 10524ad5.exe -
Processes:
resource yara_rule C:\10524ad5.exe upx C:\10524ad5.exe upx behavioral2/memory/2332-135-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/1716-136-0x00000000006E0000-0x000000000072D000-memory.dmp upx behavioral2/memory/1716-137-0x00000000006E0000-0x000000000072D000-memory.dmp upx behavioral2/memory/1716-138-0x00000000006E0000-0x000000000072D000-memory.dmp upx \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll upx C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll upx behavioral2/memory/3244-141-0x0000000075100000-0x000000007514D000-memory.dmp upx behavioral2/memory/3244-142-0x0000000075100000-0x000000007514D000-memory.dmp upx behavioral2/memory/3244-143-0x0000000075100000-0x000000007514D000-memory.dmp upx \??\c:\windows\SysWOW64\irmon.dll upx behavioral2/memory/648-147-0x0000000075100000-0x000000007514D000-memory.dmp upx behavioral2/memory/648-148-0x0000000075100000-0x000000007514D000-memory.dmp upx C:\Windows\SysWOW64\Irmon.dll upx behavioral2/memory/648-149-0x0000000075100000-0x000000007514D000-memory.dmp upx \??\c:\windows\SysWOW64\nla.dll upx C:\Windows\SysWOW64\Nla.dll upx behavioral2/memory/4932-153-0x0000000075100000-0x000000007514D000-memory.dmp upx behavioral2/memory/4932-152-0x0000000075100000-0x000000007514D000-memory.dmp upx behavioral2/memory/4932-154-0x0000000075100000-0x000000007514D000-memory.dmp upx \??\c:\windows\SysWOW64\ntmssvc.dll upx behavioral2/memory/5000-158-0x0000000075100000-0x000000007514D000-memory.dmp upx behavioral2/memory/5000-159-0x0000000075100000-0x000000007514D000-memory.dmp upx C:\Windows\SysWOW64\Ntmssvc.dll upx behavioral2/memory/5000-160-0x0000000075100000-0x000000007514D000-memory.dmp upx \??\c:\windows\SysWOW64\nwcworkstation.dll upx C:\Windows\SysWOW64\NWCWorkstation.dll upx behavioral2/memory/4992-163-0x0000000075100000-0x000000007514D000-memory.dmp upx behavioral2/memory/4992-164-0x0000000075100000-0x000000007514D000-memory.dmp upx behavioral2/memory/4992-165-0x0000000075100000-0x000000007514D000-memory.dmp upx \??\c:\windows\SysWOW64\nwsapagent.dll upx C:\Windows\SysWOW64\Nwsapagent.dll upx behavioral2/memory/1760-168-0x0000000075100000-0x000000007514D000-memory.dmp upx behavioral2/memory/1760-169-0x0000000075100000-0x000000007514D000-memory.dmp upx behavioral2/memory/1760-170-0x0000000075100000-0x000000007514D000-memory.dmp upx \??\c:\windows\SysWOW64\srservice.dll upx behavioral2/memory/5008-173-0x0000000075100000-0x000000007514D000-memory.dmp upx C:\Windows\SysWOW64\SRService.dll upx behavioral2/memory/5008-174-0x0000000075100000-0x000000007514D000-memory.dmp upx behavioral2/memory/5008-175-0x0000000075100000-0x000000007514D000-memory.dmp upx behavioral2/memory/2332-176-0x0000000000400000-0x0000000000455000-memory.dmp upx \??\c:\windows\SysWOW64\wmdmpmsp.dll upx C:\Windows\SysWOW64\WmdmPmSp.dll upx behavioral2/memory/1392-180-0x00000000752D0000-0x000000007531D000-memory.dmp upx behavioral2/memory/1392-179-0x00000000752D0000-0x000000007531D000-memory.dmp upx behavioral2/memory/1392-181-0x00000000752D0000-0x000000007531D000-memory.dmp upx \??\c:\windows\SysWOW64\logonhours.dll upx C:\Windows\SysWOW64\LogonHours.dll upx behavioral2/memory/4084-186-0x00000000752D0000-0x000000007531D000-memory.dmp upx behavioral2/memory/4084-185-0x00000000752D0000-0x000000007531D000-memory.dmp upx behavioral2/memory/4084-184-0x00000000752D0000-0x000000007531D000-memory.dmp upx \??\c:\windows\SysWOW64\pcaudit.dll upx C:\Windows\SysWOW64\PCAudit.dll upx behavioral2/memory/1304-189-0x00000000752D0000-0x000000007531D000-memory.dmp upx behavioral2/memory/1304-190-0x00000000752D0000-0x000000007531D000-memory.dmp upx behavioral2/memory/1304-191-0x00000000752D0000-0x000000007531D000-memory.dmp upx C:\Windows\SysWOW64\helpsvc.dll upx \??\c:\windows\SysWOW64\helpsvc.dll upx behavioral2/memory/1504-194-0x00000000752D0000-0x000000007531D000-memory.dmp upx behavioral2/memory/1504-195-0x00000000752D0000-0x000000007531D000-memory.dmp upx behavioral2/memory/1504-196-0x00000000752D0000-0x000000007531D000-memory.dmp upx behavioral2/memory/1716-198-0x00000000006E0000-0x000000000072D000-memory.dmp upx \??\c:\windows\SysWOW64\uploadmgr.dll upx -
Loads dropped DLL 12 IoCs
Processes:
svchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exepid process 3244 svchost.exe 648 svchost.exe 4932 svchost.exe 5000 svchost.exe 4992 svchost.exe 1760 svchost.exe 5008 svchost.exe 1392 svchost.exe 4084 svchost.exe 1304 svchost.exe 1504 svchost.exe 3536 svchost.exe -
Drops file in System32 directory 14 IoCs
Processes:
10524ad5.exedescription ioc process File opened for modification C:\Windows\SysWOW64\WmdmPmSp.dll 10524ad5.exe File opened for modification C:\Windows\SysWOW64\LogonHours.dll 10524ad5.exe File opened for modification C:\Windows\SysWOW64\PCAudit.dll 10524ad5.exe File opened for modification C:\Windows\SysWOW64\helpsvc.dll 10524ad5.exe File opened for modification C:\Windows\SysWOW64\Irmon.dll 10524ad5.exe File opened for modification C:\Windows\SysWOW64\Nla.dll 10524ad5.exe File opened for modification C:\Windows\SysWOW64\SRService.dll 10524ad5.exe File opened for modification C:\Windows\SysWOW64\NWCWorkstation.dll 10524ad5.exe File opened for modification C:\Windows\SysWOW64\uploadmgr.dll 10524ad5.exe File opened for modification C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll 10524ad5.exe File opened for modification C:\Windows\SysWOW64\Ntmssvc.dll 10524ad5.exe File opened for modification C:\Windows\SysWOW64\Nwsapagent.dll 10524ad5.exe File opened for modification C:\Windows\SysWOW64\Ias.dll 10524ad5.exe File opened for modification C:\Windows\SysWOW64\Wmi.dll 10524ad5.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
10524ad5.exepid process 1716 10524ad5.exe 1716 10524ad5.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
10a3571ff372a5c33dcdef305a49ffaab9ae17e7f58790f278a53b0b9b875157.exedescription pid process target process PID 2332 wrote to memory of 1716 2332 10a3571ff372a5c33dcdef305a49ffaab9ae17e7f58790f278a53b0b9b875157.exe 10524ad5.exe PID 2332 wrote to memory of 1716 2332 10a3571ff372a5c33dcdef305a49ffaab9ae17e7f58790f278a53b0b9b875157.exe 10524ad5.exe PID 2332 wrote to memory of 1716 2332 10a3571ff372a5c33dcdef305a49ffaab9ae17e7f58790f278a53b0b9b875157.exe 10524ad5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\10a3571ff372a5c33dcdef305a49ffaab9ae17e7f58790f278a53b0b9b875157.exe"C:\Users\Admin\AppData\Local\Temp\10a3571ff372a5c33dcdef305a49ffaab9ae17e7f58790f278a53b0b9b875157.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\10524ad5.exeC:\10524ad5.exe2⤵
- Executes dropped EXE
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Irmon1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nla1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Ntmssvc1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nwsapagent1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s SRService1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s WmdmPmSp1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s LogonHours1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s PCAudit1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\10524ad5.exeFilesize
237KB
MD52f85e77cf24aeccc9b45fbb8111e8281
SHA1733527ebc2cd96d8959687f82981ee53edba06be
SHA25691d4ded63ae059c700b3f914fa8f3d801f64de851541ef3c8b94092bba9a5049
SHA5124ccfaea2354e1d8058585ee56f886a6d337c297443a92a8e016c0978984b0690b73386b220dd82f29f8446d05160ed30f06d35f75914f5608296a31ae35e4378
-
C:\10524ad5.exeFilesize
237KB
MD52f85e77cf24aeccc9b45fbb8111e8281
SHA1733527ebc2cd96d8959687f82981ee53edba06be
SHA25691d4ded63ae059c700b3f914fa8f3d801f64de851541ef3c8b94092bba9a5049
SHA5124ccfaea2354e1d8058585ee56f886a6d337c297443a92a8e016c0978984b0690b73386b220dd82f29f8446d05160ed30f06d35f75914f5608296a31ae35e4378
-
C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dllFilesize
237KB
MD59998f3c081fe4f1868a46f19ba376b45
SHA1cc945a970dd893abeb80996ea748eeec907db5ae
SHA2562793e4b88b0c946f4874e2feb0b2cbf0b8c48627b867f12efdcb4697993476be
SHA51207d5249eccf7b27c3c0e980fcb27d6397e4c50a17d0cd02bf663b263b56858a51ba39068b649b6354bba130c27fa881ef8adc95b42e242f0a6afe6388d363f22
-
C:\Windows\SysWOW64\Irmon.dllFilesize
237KB
MD59998f3c081fe4f1868a46f19ba376b45
SHA1cc945a970dd893abeb80996ea748eeec907db5ae
SHA2562793e4b88b0c946f4874e2feb0b2cbf0b8c48627b867f12efdcb4697993476be
SHA51207d5249eccf7b27c3c0e980fcb27d6397e4c50a17d0cd02bf663b263b56858a51ba39068b649b6354bba130c27fa881ef8adc95b42e242f0a6afe6388d363f22
-
C:\Windows\SysWOW64\LogonHours.dllFilesize
237KB
MD59998f3c081fe4f1868a46f19ba376b45
SHA1cc945a970dd893abeb80996ea748eeec907db5ae
SHA2562793e4b88b0c946f4874e2feb0b2cbf0b8c48627b867f12efdcb4697993476be
SHA51207d5249eccf7b27c3c0e980fcb27d6397e4c50a17d0cd02bf663b263b56858a51ba39068b649b6354bba130c27fa881ef8adc95b42e242f0a6afe6388d363f22
-
C:\Windows\SysWOW64\NWCWorkstation.dllFilesize
237KB
MD59998f3c081fe4f1868a46f19ba376b45
SHA1cc945a970dd893abeb80996ea748eeec907db5ae
SHA2562793e4b88b0c946f4874e2feb0b2cbf0b8c48627b867f12efdcb4697993476be
SHA51207d5249eccf7b27c3c0e980fcb27d6397e4c50a17d0cd02bf663b263b56858a51ba39068b649b6354bba130c27fa881ef8adc95b42e242f0a6afe6388d363f22
-
C:\Windows\SysWOW64\Nla.dllFilesize
237KB
MD59998f3c081fe4f1868a46f19ba376b45
SHA1cc945a970dd893abeb80996ea748eeec907db5ae
SHA2562793e4b88b0c946f4874e2feb0b2cbf0b8c48627b867f12efdcb4697993476be
SHA51207d5249eccf7b27c3c0e980fcb27d6397e4c50a17d0cd02bf663b263b56858a51ba39068b649b6354bba130c27fa881ef8adc95b42e242f0a6afe6388d363f22
-
C:\Windows\SysWOW64\Ntmssvc.dllFilesize
237KB
MD59998f3c081fe4f1868a46f19ba376b45
SHA1cc945a970dd893abeb80996ea748eeec907db5ae
SHA2562793e4b88b0c946f4874e2feb0b2cbf0b8c48627b867f12efdcb4697993476be
SHA51207d5249eccf7b27c3c0e980fcb27d6397e4c50a17d0cd02bf663b263b56858a51ba39068b649b6354bba130c27fa881ef8adc95b42e242f0a6afe6388d363f22
-
C:\Windows\SysWOW64\Nwsapagent.dllFilesize
237KB
MD59998f3c081fe4f1868a46f19ba376b45
SHA1cc945a970dd893abeb80996ea748eeec907db5ae
SHA2562793e4b88b0c946f4874e2feb0b2cbf0b8c48627b867f12efdcb4697993476be
SHA51207d5249eccf7b27c3c0e980fcb27d6397e4c50a17d0cd02bf663b263b56858a51ba39068b649b6354bba130c27fa881ef8adc95b42e242f0a6afe6388d363f22
-
C:\Windows\SysWOW64\PCAudit.dllFilesize
237KB
MD59998f3c081fe4f1868a46f19ba376b45
SHA1cc945a970dd893abeb80996ea748eeec907db5ae
SHA2562793e4b88b0c946f4874e2feb0b2cbf0b8c48627b867f12efdcb4697993476be
SHA51207d5249eccf7b27c3c0e980fcb27d6397e4c50a17d0cd02bf663b263b56858a51ba39068b649b6354bba130c27fa881ef8adc95b42e242f0a6afe6388d363f22
-
C:\Windows\SysWOW64\SRService.dllFilesize
237KB
MD59998f3c081fe4f1868a46f19ba376b45
SHA1cc945a970dd893abeb80996ea748eeec907db5ae
SHA2562793e4b88b0c946f4874e2feb0b2cbf0b8c48627b867f12efdcb4697993476be
SHA51207d5249eccf7b27c3c0e980fcb27d6397e4c50a17d0cd02bf663b263b56858a51ba39068b649b6354bba130c27fa881ef8adc95b42e242f0a6afe6388d363f22
-
C:\Windows\SysWOW64\WmdmPmSp.dllFilesize
237KB
MD59998f3c081fe4f1868a46f19ba376b45
SHA1cc945a970dd893abeb80996ea748eeec907db5ae
SHA2562793e4b88b0c946f4874e2feb0b2cbf0b8c48627b867f12efdcb4697993476be
SHA51207d5249eccf7b27c3c0e980fcb27d6397e4c50a17d0cd02bf663b263b56858a51ba39068b649b6354bba130c27fa881ef8adc95b42e242f0a6afe6388d363f22
-
C:\Windows\SysWOW64\helpsvc.dllFilesize
237KB
MD59998f3c081fe4f1868a46f19ba376b45
SHA1cc945a970dd893abeb80996ea748eeec907db5ae
SHA2562793e4b88b0c946f4874e2feb0b2cbf0b8c48627b867f12efdcb4697993476be
SHA51207d5249eccf7b27c3c0e980fcb27d6397e4c50a17d0cd02bf663b263b56858a51ba39068b649b6354bba130c27fa881ef8adc95b42e242f0a6afe6388d363f22
-
C:\Windows\SysWOW64\uploadmgr.dllFilesize
237KB
MD59998f3c081fe4f1868a46f19ba376b45
SHA1cc945a970dd893abeb80996ea748eeec907db5ae
SHA2562793e4b88b0c946f4874e2feb0b2cbf0b8c48627b867f12efdcb4697993476be
SHA51207d5249eccf7b27c3c0e980fcb27d6397e4c50a17d0cd02bf663b263b56858a51ba39068b649b6354bba130c27fa881ef8adc95b42e242f0a6afe6388d363f22
-
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dllFilesize
237KB
MD59998f3c081fe4f1868a46f19ba376b45
SHA1cc945a970dd893abeb80996ea748eeec907db5ae
SHA2562793e4b88b0c946f4874e2feb0b2cbf0b8c48627b867f12efdcb4697993476be
SHA51207d5249eccf7b27c3c0e980fcb27d6397e4c50a17d0cd02bf663b263b56858a51ba39068b649b6354bba130c27fa881ef8adc95b42e242f0a6afe6388d363f22
-
\??\c:\windows\SysWOW64\helpsvc.dllFilesize
237KB
MD59998f3c081fe4f1868a46f19ba376b45
SHA1cc945a970dd893abeb80996ea748eeec907db5ae
SHA2562793e4b88b0c946f4874e2feb0b2cbf0b8c48627b867f12efdcb4697993476be
SHA51207d5249eccf7b27c3c0e980fcb27d6397e4c50a17d0cd02bf663b263b56858a51ba39068b649b6354bba130c27fa881ef8adc95b42e242f0a6afe6388d363f22
-
\??\c:\windows\SysWOW64\irmon.dllFilesize
237KB
MD59998f3c081fe4f1868a46f19ba376b45
SHA1cc945a970dd893abeb80996ea748eeec907db5ae
SHA2562793e4b88b0c946f4874e2feb0b2cbf0b8c48627b867f12efdcb4697993476be
SHA51207d5249eccf7b27c3c0e980fcb27d6397e4c50a17d0cd02bf663b263b56858a51ba39068b649b6354bba130c27fa881ef8adc95b42e242f0a6afe6388d363f22
-
\??\c:\windows\SysWOW64\logonhours.dllFilesize
237KB
MD59998f3c081fe4f1868a46f19ba376b45
SHA1cc945a970dd893abeb80996ea748eeec907db5ae
SHA2562793e4b88b0c946f4874e2feb0b2cbf0b8c48627b867f12efdcb4697993476be
SHA51207d5249eccf7b27c3c0e980fcb27d6397e4c50a17d0cd02bf663b263b56858a51ba39068b649b6354bba130c27fa881ef8adc95b42e242f0a6afe6388d363f22
-
\??\c:\windows\SysWOW64\nla.dllFilesize
237KB
MD59998f3c081fe4f1868a46f19ba376b45
SHA1cc945a970dd893abeb80996ea748eeec907db5ae
SHA2562793e4b88b0c946f4874e2feb0b2cbf0b8c48627b867f12efdcb4697993476be
SHA51207d5249eccf7b27c3c0e980fcb27d6397e4c50a17d0cd02bf663b263b56858a51ba39068b649b6354bba130c27fa881ef8adc95b42e242f0a6afe6388d363f22
-
\??\c:\windows\SysWOW64\ntmssvc.dllFilesize
237KB
MD59998f3c081fe4f1868a46f19ba376b45
SHA1cc945a970dd893abeb80996ea748eeec907db5ae
SHA2562793e4b88b0c946f4874e2feb0b2cbf0b8c48627b867f12efdcb4697993476be
SHA51207d5249eccf7b27c3c0e980fcb27d6397e4c50a17d0cd02bf663b263b56858a51ba39068b649b6354bba130c27fa881ef8adc95b42e242f0a6afe6388d363f22
-
\??\c:\windows\SysWOW64\nwcworkstation.dllFilesize
237KB
MD59998f3c081fe4f1868a46f19ba376b45
SHA1cc945a970dd893abeb80996ea748eeec907db5ae
SHA2562793e4b88b0c946f4874e2feb0b2cbf0b8c48627b867f12efdcb4697993476be
SHA51207d5249eccf7b27c3c0e980fcb27d6397e4c50a17d0cd02bf663b263b56858a51ba39068b649b6354bba130c27fa881ef8adc95b42e242f0a6afe6388d363f22
-
\??\c:\windows\SysWOW64\nwsapagent.dllFilesize
237KB
MD59998f3c081fe4f1868a46f19ba376b45
SHA1cc945a970dd893abeb80996ea748eeec907db5ae
SHA2562793e4b88b0c946f4874e2feb0b2cbf0b8c48627b867f12efdcb4697993476be
SHA51207d5249eccf7b27c3c0e980fcb27d6397e4c50a17d0cd02bf663b263b56858a51ba39068b649b6354bba130c27fa881ef8adc95b42e242f0a6afe6388d363f22
-
\??\c:\windows\SysWOW64\pcaudit.dllFilesize
237KB
MD59998f3c081fe4f1868a46f19ba376b45
SHA1cc945a970dd893abeb80996ea748eeec907db5ae
SHA2562793e4b88b0c946f4874e2feb0b2cbf0b8c48627b867f12efdcb4697993476be
SHA51207d5249eccf7b27c3c0e980fcb27d6397e4c50a17d0cd02bf663b263b56858a51ba39068b649b6354bba130c27fa881ef8adc95b42e242f0a6afe6388d363f22
-
\??\c:\windows\SysWOW64\srservice.dllFilesize
237KB
MD59998f3c081fe4f1868a46f19ba376b45
SHA1cc945a970dd893abeb80996ea748eeec907db5ae
SHA2562793e4b88b0c946f4874e2feb0b2cbf0b8c48627b867f12efdcb4697993476be
SHA51207d5249eccf7b27c3c0e980fcb27d6397e4c50a17d0cd02bf663b263b56858a51ba39068b649b6354bba130c27fa881ef8adc95b42e242f0a6afe6388d363f22
-
\??\c:\windows\SysWOW64\uploadmgr.dllFilesize
237KB
MD59998f3c081fe4f1868a46f19ba376b45
SHA1cc945a970dd893abeb80996ea748eeec907db5ae
SHA2562793e4b88b0c946f4874e2feb0b2cbf0b8c48627b867f12efdcb4697993476be
SHA51207d5249eccf7b27c3c0e980fcb27d6397e4c50a17d0cd02bf663b263b56858a51ba39068b649b6354bba130c27fa881ef8adc95b42e242f0a6afe6388d363f22
-
\??\c:\windows\SysWOW64\wmdmpmsp.dllFilesize
237KB
MD59998f3c081fe4f1868a46f19ba376b45
SHA1cc945a970dd893abeb80996ea748eeec907db5ae
SHA2562793e4b88b0c946f4874e2feb0b2cbf0b8c48627b867f12efdcb4697993476be
SHA51207d5249eccf7b27c3c0e980fcb27d6397e4c50a17d0cd02bf663b263b56858a51ba39068b649b6354bba130c27fa881ef8adc95b42e242f0a6afe6388d363f22
-
memory/648-149-0x0000000075100000-0x000000007514D000-memory.dmpFilesize
308KB
-
memory/648-148-0x0000000075100000-0x000000007514D000-memory.dmpFilesize
308KB
-
memory/648-147-0x0000000075100000-0x000000007514D000-memory.dmpFilesize
308KB
-
memory/1304-189-0x00000000752D0000-0x000000007531D000-memory.dmpFilesize
308KB
-
memory/1304-191-0x00000000752D0000-0x000000007531D000-memory.dmpFilesize
308KB
-
memory/1304-190-0x00000000752D0000-0x000000007531D000-memory.dmpFilesize
308KB
-
memory/1392-180-0x00000000752D0000-0x000000007531D000-memory.dmpFilesize
308KB
-
memory/1392-181-0x00000000752D0000-0x000000007531D000-memory.dmpFilesize
308KB
-
memory/1392-179-0x00000000752D0000-0x000000007531D000-memory.dmpFilesize
308KB
-
memory/1504-196-0x00000000752D0000-0x000000007531D000-memory.dmpFilesize
308KB
-
memory/1504-195-0x00000000752D0000-0x000000007531D000-memory.dmpFilesize
308KB
-
memory/1504-194-0x00000000752D0000-0x000000007531D000-memory.dmpFilesize
308KB
-
memory/1716-155-0x00000000022C0000-0x00000000062C0000-memory.dmpFilesize
64.0MB
-
memory/1716-137-0x00000000006E0000-0x000000000072D000-memory.dmpFilesize
308KB
-
memory/1716-138-0x00000000006E0000-0x000000000072D000-memory.dmpFilesize
308KB
-
memory/1716-198-0x00000000006E0000-0x000000000072D000-memory.dmpFilesize
308KB
-
memory/1716-132-0x0000000000000000-mapping.dmp
-
memory/1716-144-0x00000000022C0000-0x00000000062C0000-memory.dmpFilesize
64.0MB
-
memory/1716-136-0x00000000006E0000-0x000000000072D000-memory.dmpFilesize
308KB
-
memory/1760-170-0x0000000075100000-0x000000007514D000-memory.dmpFilesize
308KB
-
memory/1760-169-0x0000000075100000-0x000000007514D000-memory.dmpFilesize
308KB
-
memory/1760-168-0x0000000075100000-0x000000007514D000-memory.dmpFilesize
308KB
-
memory/2332-176-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2332-135-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/3244-143-0x0000000075100000-0x000000007514D000-memory.dmpFilesize
308KB
-
memory/3244-141-0x0000000075100000-0x000000007514D000-memory.dmpFilesize
308KB
-
memory/3244-142-0x0000000075100000-0x000000007514D000-memory.dmpFilesize
308KB
-
memory/3536-202-0x0000000075380000-0x00000000753CD000-memory.dmpFilesize
308KB
-
memory/3536-201-0x0000000075380000-0x00000000753CD000-memory.dmpFilesize
308KB
-
memory/3536-200-0x0000000075380000-0x00000000753CD000-memory.dmpFilesize
308KB
-
memory/4084-186-0x00000000752D0000-0x000000007531D000-memory.dmpFilesize
308KB
-
memory/4084-184-0x00000000752D0000-0x000000007531D000-memory.dmpFilesize
308KB
-
memory/4084-185-0x00000000752D0000-0x000000007531D000-memory.dmpFilesize
308KB
-
memory/4932-153-0x0000000075100000-0x000000007514D000-memory.dmpFilesize
308KB
-
memory/4932-152-0x0000000075100000-0x000000007514D000-memory.dmpFilesize
308KB
-
memory/4932-154-0x0000000075100000-0x000000007514D000-memory.dmpFilesize
308KB
-
memory/4992-164-0x0000000075100000-0x000000007514D000-memory.dmpFilesize
308KB
-
memory/4992-163-0x0000000075100000-0x000000007514D000-memory.dmpFilesize
308KB
-
memory/4992-165-0x0000000075100000-0x000000007514D000-memory.dmpFilesize
308KB
-
memory/5000-159-0x0000000075100000-0x000000007514D000-memory.dmpFilesize
308KB
-
memory/5000-158-0x0000000075100000-0x000000007514D000-memory.dmpFilesize
308KB
-
memory/5000-160-0x0000000075100000-0x000000007514D000-memory.dmpFilesize
308KB
-
memory/5008-173-0x0000000075100000-0x000000007514D000-memory.dmpFilesize
308KB
-
memory/5008-174-0x0000000075100000-0x000000007514D000-memory.dmpFilesize
308KB
-
memory/5008-175-0x0000000075100000-0x000000007514D000-memory.dmpFilesize
308KB