976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb

Analysis

max time kernel
174s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
Size

298KB
MD5

7fb28a19ee289df3e6fb3140c6eaa1ba
SHA1

0d94a5163134a18f64d9afb97b940b736662b3d1
SHA256

976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb
SHA512

8d5a1dac7fcd48ed36e251a0b598346b627bf820dc8d978dc8c2eb5f5a54f101c3acb1143045b4e1e49e03e679af3475b84c8f43b445795a43ccc7c824fb699f
SSDEEP

6144:2yHzI4LhBgjCvJwPNtkdtRSO4Z0zFQrwtQHxw9sAD:R7g6J6NO4O4UFQHHxLAD

Score

8^/10

persistence upx

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll"	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SRService\Parameters\ServiceDll = "C:\\Windows\\system32\\SRService.dll"	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmdmPmSp\Parameters\ServiceDll = "C:\\Windows\\system32\\WmdmPmSp.dll"	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll"	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Wmi\Parameters\ServiceDll = "C:\\Windows\\system32\\Wmi.dll"	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LogonHours\Parameters\ServiceDll = "C:\\Windows\\system32\\LogonHours.dll"	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\helpsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\helpsvc.dll"	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll"	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll"	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll"	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PCAudit\Parameters\ServiceDll = "C:\\Windows\\system32\\PCAudit.dll"	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uploadmgr\Parameters\ServiceDll = "C:\\Windows\\system32\\uploadmgr.dll"	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll"	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/672-132-0x0000000000760000-0x00000000007AD000-memory.dmp	upx
behavioral2/files/0x0002000000022bc7-135.dat	upx
behavioral2/files/0x0002000000022bc7-136.dat	upx
behavioral2/memory/4720-137-0x0000000074D70000-0x0000000074DBD000-memory.dmp	upx
behavioral2/files/0x000a000000023185-138.dat	upx
behavioral2/files/0x000a000000023185-139.dat	upx
behavioral2/files/0x0003000000022631-140.dat	upx
behavioral2/files/0x0003000000022631-144.dat	upx
behavioral2/files/0x0003000000022633-143.dat	upx
behavioral2/files/0x0004000000022639-142.dat	upx
behavioral2/files/0x0004000000022639-146.dat	upx
behavioral2/memory/3128-145-0x0000000074CF0000-0x0000000074D3D000-memory.dmp	upx
behavioral2/files/0x0003000000022633-141.dat	upx
behavioral2/memory/672-147-0x0000000000760000-0x00000000007AD000-memory.dmp	upx
behavioral2/files/0x0005000000022636-148.dat	upx
behavioral2/files/0x0005000000022636-149.dat	upx
behavioral2/files/0x00060000000231b1-150.dat	upx
behavioral2/files/0x00060000000231b1-151.dat	upx
behavioral2/files/0x00060000000231b2-152.dat	upx
behavioral2/files/0x00060000000231b2-153.dat	upx
behavioral2/files/0x00060000000231b3-154.dat	upx
behavioral2/files/0x00060000000231b3-155.dat	upx
behavioral2/files/0x00060000000231bd-156.dat	upx
behavioral2/files/0x00060000000231bd-158.dat	upx
behavioral2/files/0x00060000000231bf-157.dat	upx
behavioral2/files/0x00060000000231bf-159.dat	upx
behavioral2/files/0x00060000000231c0-160.dat	upx
behavioral2/files/0x00060000000231c0-161.dat	upx
behavioral2/memory/3916-162-0x0000000074D70000-0x0000000074DBD000-memory.dmp	upx

Loads dropped DLL 12 IoCs

pid	Process
4720	svchost.exe
4344	svchost.exe
2856	svchost.exe
3128	svchost.exe
4836	svchost.exe
4544	svchost.exe
3172	svchost.exe
3236	svchost.exe
3164	svchost.exe
2804	svchost.exe
2520	svchost.exe
3916	svchost.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ias.dll	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
File opened for modification	C:\Windows\SysWOW64\LogonHours.dll	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
File opened for modification	C:\Windows\SysWOW64\NWCWorkstation.dll	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
File opened for modification	C:\Windows\SysWOW64\Nwsapagent.dll	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
File opened for modification	C:\Windows\SysWOW64\SRService.dll	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
File opened for modification	C:\Windows\SysWOW64\WmdmPmSp.dll	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
File opened for modification	C:\Windows\SysWOW64\PCAudit.dll	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
File opened for modification	C:\Windows\SysWOW64\Irmon.dll	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
File opened for modification	C:\Windows\SysWOW64\Nla.dll	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
File opened for modification	C:\Windows\SysWOW64\helpsvc.dll	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
File opened for modification	C:\Windows\SysWOW64\Ntmssvc.dll	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
File opened for modification	C:\Windows\SysWOW64\Wmi.dll	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
File opened for modification	C:\Windows\SysWOW64\uploadmgr.dll	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
672	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
672	976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe

C:\Users\Admin\AppData\Local\Temp\976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
"C:\Users\Admin\AppData\Local\Temp\976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe"
1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:672

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
1⤵
- Loads dropped DLL
PID:4720

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Irmon
1⤵
- Loads dropped DLL
PID:4344

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nla
1⤵
- Loads dropped DLL
PID:3128

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Ntmssvc
1⤵
- Loads dropped DLL
PID:2856

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation
1⤵
- Loads dropped DLL
PID:4836

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nwsapagent
1⤵
- Loads dropped DLL
PID:4544

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s SRService
1⤵
- Loads dropped DLL
PID:3172

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s WmdmPmSp
1⤵
- Loads dropped DLL
PID:3236

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s LogonHours
1⤵
- Loads dropped DLL
PID:3164

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s PCAudit
1⤵
- Loads dropped DLL
PID:2804

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
1⤵
- Loads dropped DLL
PID:2520

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
1⤵
- Loads dropped DLL
PID:3916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

Filesize
298KB

MD5
00210157fc12852f233498c9607c6d86

SHA1
f3e42f203043357035543897fe78de7de8af6d5f

SHA256
2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

SHA512
feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

Download Submit
C:\Windows\SysWOW64\Irmon.dll

Filesize
298KB

MD5
00210157fc12852f233498c9607c6d86

SHA1
f3e42f203043357035543897fe78de7de8af6d5f

SHA256
2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

SHA512
feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

Download Submit
C:\Windows\SysWOW64\LogonHours.dll

Filesize
298KB

MD5
00210157fc12852f233498c9607c6d86

SHA1
f3e42f203043357035543897fe78de7de8af6d5f

SHA256
2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

SHA512
feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

Download Submit
C:\Windows\SysWOW64\NWCWorkstation.dll

Filesize
298KB

MD5
00210157fc12852f233498c9607c6d86

SHA1
f3e42f203043357035543897fe78de7de8af6d5f

SHA256
2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

SHA512
feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

Download Submit
C:\Windows\SysWOW64\Nla.dll

Filesize
298KB

MD5
00210157fc12852f233498c9607c6d86

SHA1
f3e42f203043357035543897fe78de7de8af6d5f

SHA256
2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

SHA512
feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

Download Submit
C:\Windows\SysWOW64\Ntmssvc.dll

Filesize
298KB

MD5
00210157fc12852f233498c9607c6d86

SHA1
f3e42f203043357035543897fe78de7de8af6d5f

SHA256
2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

SHA512
feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

Download Submit
C:\Windows\SysWOW64\Nwsapagent.dll

Filesize
298KB

MD5
00210157fc12852f233498c9607c6d86

SHA1
f3e42f203043357035543897fe78de7de8af6d5f

SHA256
2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

SHA512
feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

Download Submit
C:\Windows\SysWOW64\PCAudit.dll

Filesize
298KB

MD5
00210157fc12852f233498c9607c6d86

SHA1
f3e42f203043357035543897fe78de7de8af6d5f

SHA256
2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

SHA512
feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

Download Submit
C:\Windows\SysWOW64\SRService.dll

Filesize
298KB

MD5
00210157fc12852f233498c9607c6d86

SHA1
f3e42f203043357035543897fe78de7de8af6d5f

SHA256
2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

SHA512
feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

Download Submit
C:\Windows\SysWOW64\WmdmPmSp.dll

Filesize
298KB

MD5
00210157fc12852f233498c9607c6d86

SHA1
f3e42f203043357035543897fe78de7de8af6d5f

SHA256
2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

SHA512
feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

Download Submit
C:\Windows\SysWOW64\helpsvc.dll

Filesize
298KB

MD5
00210157fc12852f233498c9607c6d86

SHA1
f3e42f203043357035543897fe78de7de8af6d5f

SHA256
2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

SHA512
feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

Download Submit
C:\Windows\SysWOW64\uploadmgr.dll

Filesize
298KB

MD5
00210157fc12852f233498c9607c6d86

SHA1
f3e42f203043357035543897fe78de7de8af6d5f

SHA256
2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

SHA512
feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

Download Submit
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

Filesize
298KB

MD5
00210157fc12852f233498c9607c6d86

SHA1
f3e42f203043357035543897fe78de7de8af6d5f

SHA256
2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

SHA512
feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

Download Submit
\??\c:\windows\SysWOW64\helpsvc.dll

Filesize
298KB

MD5
00210157fc12852f233498c9607c6d86

SHA1
f3e42f203043357035543897fe78de7de8af6d5f

SHA256
2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

SHA512
feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

Download Submit
\??\c:\windows\SysWOW64\irmon.dll

Filesize
298KB

MD5
00210157fc12852f233498c9607c6d86

SHA1
f3e42f203043357035543897fe78de7de8af6d5f

SHA256
2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

SHA512
feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

Download Submit
\??\c:\windows\SysWOW64\logonhours.dll

Filesize
298KB

MD5
00210157fc12852f233498c9607c6d86

SHA1
f3e42f203043357035543897fe78de7de8af6d5f

SHA256
2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

SHA512
feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

Download Submit
\??\c:\windows\SysWOW64\nla.dll

Filesize
298KB

MD5
00210157fc12852f233498c9607c6d86

SHA1
f3e42f203043357035543897fe78de7de8af6d5f

SHA256
2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

SHA512
feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

Download Submit
\??\c:\windows\SysWOW64\ntmssvc.dll

Filesize
298KB

MD5
00210157fc12852f233498c9607c6d86

SHA1
f3e42f203043357035543897fe78de7de8af6d5f

SHA256
2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

SHA512
feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

Download Submit
\??\c:\windows\SysWOW64\nwcworkstation.dll

Filesize
298KB

MD5
00210157fc12852f233498c9607c6d86

SHA1
f3e42f203043357035543897fe78de7de8af6d5f

SHA256
2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

SHA512
feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

Download Submit
\??\c:\windows\SysWOW64\nwsapagent.dll

Filesize
298KB

MD5
00210157fc12852f233498c9607c6d86

SHA1
f3e42f203043357035543897fe78de7de8af6d5f

SHA256
2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

SHA512
feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

Download Submit
\??\c:\windows\SysWOW64\pcaudit.dll

Filesize
298KB

MD5
00210157fc12852f233498c9607c6d86

SHA1
f3e42f203043357035543897fe78de7de8af6d5f

SHA256
2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

SHA512
feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

Download Submit
\??\c:\windows\SysWOW64\srservice.dll

Filesize
298KB

MD5
00210157fc12852f233498c9607c6d86

SHA1
f3e42f203043357035543897fe78de7de8af6d5f

SHA256
2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

SHA512
feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

Download Submit
\??\c:\windows\SysWOW64\uploadmgr.dll

Filesize
298KB

MD5
00210157fc12852f233498c9607c6d86

SHA1
f3e42f203043357035543897fe78de7de8af6d5f

SHA256
2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

SHA512
feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

Download Submit
\??\c:\windows\SysWOW64\wmdmpmsp.dll

Filesize
298KB

MD5
00210157fc12852f233498c9607c6d86

SHA1
f3e42f203043357035543897fe78de7de8af6d5f

SHA256
2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

SHA512
feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

Download Submit
memory/672-147-0x0000000000760000-0x00000000007AD000-memory.dmp

Filesize
308KB

Download
memory/672-133-0x0000000002730000-0x0000000006730000-memory.dmp

Filesize
64.0MB

Download
memory/672-134-0x0000000002730000-0x0000000006730000-memory.dmp

Filesize
64.0MB

Download
memory/672-132-0x0000000000760000-0x00000000007AD000-memory.dmp

Filesize
308KB

Download
memory/3128-145-0x0000000074CF0000-0x0000000074D3D000-memory.dmp

Filesize
308KB

Download
memory/3916-162-0x0000000074D70000-0x0000000074DBD000-memory.dmp

Filesize
308KB

Download
memory/4720-137-0x0000000074D70000-0x0000000074DBD000-memory.dmp

Filesize
308KB

Download