66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb

Analysis

max time kernel
159s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Size

139KB
MD5

18cc754172c745277e88fdc13e96072f
SHA1

2c3b1419a4459e73a578bb2d4b4e975defa61537
SHA256

66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb
SHA512

055e8df7c01a7cde696d335efa3af9fd3662a2055e11ff538b5ed0a9ac670249490de351b85907b13539aa77d645ca203fd0dc308ca9579647fe680bbf5c0508
SSDEEP

3072:XH+Mcv5JXXieDEtKeAU1y1W7rkD+bnAIhR7aN2:XHl0ndEttogkCAaRe0

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PCAudit\Parameters\ServiceDll = "C:\\Windows\\system32\\PCAudit.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmdmPmSp\Parameters\ServiceDll = "C:\\Windows\\system32\\WmdmPmSp.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uploadmgr\Parameters\ServiceDll = "C:\\Windows\\system32\\uploadmgr.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SRService\Parameters\ServiceDll = "C:\\Windows\\system32\\SRService.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Wmi\Parameters\ServiceDll = "C:\\Windows\\system32\\Wmi.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LogonHours\Parameters\ServiceDll = "C:\\Windows\\system32\\LogonHours.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\helpsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\helpsvc.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe

Loads dropped DLL 36 IoCs

Processes:

svchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exe

pid	process
4904	svchost.exe
4904	svchost.exe
4904	svchost.exe
3728	svchost.exe
3728	svchost.exe
3728	svchost.exe
2840	svchost.exe
2840	svchost.exe
2840	svchost.exe
4676	svchost.exe
4676	svchost.exe
4676	svchost.exe
1892	svchost.exe
1892	svchost.exe
1892	svchost.exe
4172	svchost.exe
4172	svchost.exe
4172	svchost.exe
1032	svchost.exe
1032	svchost.exe
1032	svchost.exe
2164	svchost.exe
2164	svchost.exe
2164	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
1116	svchost.exe
1116	svchost.exe
1116	svchost.exe
1624	svchost.exe
1624	svchost.exe
1624	svchost.exe
4884	svchost.exe
4884	svchost.exe
4884	svchost.exe

Drops file in System32 directory 14 IoCs

Processes:

66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\Irmon.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\Nla.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\LogonHours.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\NWCWorkstation.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\Nwsapagent.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\WmdmPmSp.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\PCAudit.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\helpsvc.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\uploadmgr.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\Ias.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\Ntmssvc.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\SRService.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\Wmi.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe

pid	process
752	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
752	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe

C:\Users\Admin\AppData\Local\Temp\66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
"C:\Users\Admin\AppData\Local\Temp\66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe"
1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:752

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
1⤵
- Loads dropped DLL
PID:4904

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Irmon
1⤵
- Loads dropped DLL
PID:3728

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nla
1⤵
- Loads dropped DLL
PID:2840

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Ntmssvc
1⤵
- Loads dropped DLL
PID:4676

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation
1⤵
- Loads dropped DLL
PID:1892

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nwsapagent
1⤵
- Loads dropped DLL
PID:4172

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s SRService
1⤵
- Loads dropped DLL
PID:1032

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s WmdmPmSp
1⤵
- Loads dropped DLL
PID:2164

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s LogonHours
1⤵
- Loads dropped DLL
PID:2532

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s PCAudit
1⤵
- Loads dropped DLL
PID:1116

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
1⤵
- Loads dropped DLL
PID:1624

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
1⤵
- Loads dropped DLL
PID:4884

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\Irmon.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\Irmon.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\Irmon.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\LogonHours.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\LogonHours.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\LogonHours.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\NWCWorkstation.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\NWCWorkstation.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\NWCWorkstation.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\Nla.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\Nla.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\Nla.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\Ntmssvc.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\Ntmssvc.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\Ntmssvc.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\Nwsapagent.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\Nwsapagent.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\Nwsapagent.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\PCAudit.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\PCAudit.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\PCAudit.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\SRService.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\SRService.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\SRService.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\WmdmPmSp.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\WmdmPmSp.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\WmdmPmSp.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\helpsvc.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\helpsvc.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\helpsvc.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\uploadmgr.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\uploadmgr.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
C:\Windows\SysWOW64\uploadmgr.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\??\c:\windows\SysWOW64\helpsvc.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\??\c:\windows\SysWOW64\irmon.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\??\c:\windows\SysWOW64\logonhours.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\??\c:\windows\SysWOW64\nla.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\??\c:\windows\SysWOW64\ntmssvc.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\??\c:\windows\SysWOW64\nwcworkstation.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\??\c:\windows\SysWOW64\nwsapagent.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\??\c:\windows\SysWOW64\pcaudit.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\??\c:\windows\SysWOW64\srservice.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\??\c:\windows\SysWOW64\uploadmgr.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\??\c:\windows\SysWOW64\wmdmpmsp.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
memory/752-146-0x0000000002200000-0x0000000006200000-memory.dmp

Filesize
64.0MB

Download
memory/752-132-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/752-137-0x0000000002200000-0x0000000006200000-memory.dmp

Filesize
64.0MB

Download
memory/2164-170-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2164-169-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2164-168-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download