f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24

Analysis

max time kernel
48s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe
Size

603KB
MD5

49f9e1332e05b3fd53e45971d0964031
SHA1

03157785a984ab09dc48ff1254d708ce8b7fbceb
SHA256

f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24
SHA512

590f0da893ee0a3868f24efc104c4d75d8e737bff8c69cd721ac6908c666e17ac2a9e3391241dd4f05fc00105cabf665774d16d3d679e302b1df473508da54a3
SSDEEP

12288:qIny5DYTH95RJ2AVDkIv4bEa1SnXVbPkrCOahznstzv:sUTH9cUoIQ91mu+dhzev

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1996 installd.exe
1576 nethtsrv.exe
1200 netupdsrv.exe
1676 nethtsrv.exe
1268 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe

pid	process
1996	installd.exe
1576	nethtsrv.exe
1200	netupdsrv.exe
1676	nethtsrv.exe
1268	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe
1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe
1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe
1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe
1996	installd.exe
1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe
1576	nethtsrv.exe
1576	nethtsrv.exe
1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe
1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe
1676	nethtsrv.exe
1676	nethtsrv.exe
1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe
File created	C:\Windows\SysWOW64\installd.exe	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe

Drops file in Program Files directory 3 IoCs

Processes:

f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1676 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1676	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1152 wrote to memory of 1376	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	net.exe
PID 1152 wrote to memory of 1376	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	net.exe
PID 1152 wrote to memory of 1376	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	net.exe
PID 1152 wrote to memory of 1376	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	net.exe
PID 1376 wrote to memory of 588	1376	net.exe	net1.exe
PID 1376 wrote to memory of 588	1376	net.exe	net1.exe
PID 1376 wrote to memory of 588	1376	net.exe	net1.exe
PID 1376 wrote to memory of 588	1376	net.exe	net1.exe
PID 1152 wrote to memory of 1068	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	net.exe
PID 1152 wrote to memory of 1068	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	net.exe
PID 1152 wrote to memory of 1068	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	net.exe
PID 1152 wrote to memory of 1068	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	net.exe
PID 1068 wrote to memory of 1400	1068	net.exe	net1.exe
PID 1068 wrote to memory of 1400	1068	net.exe	net1.exe
PID 1068 wrote to memory of 1400	1068	net.exe	net1.exe
PID 1068 wrote to memory of 1400	1068	net.exe	net1.exe
PID 1152 wrote to memory of 1996	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	installd.exe
PID 1152 wrote to memory of 1996	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	installd.exe
PID 1152 wrote to memory of 1996	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	installd.exe
PID 1152 wrote to memory of 1996	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	installd.exe
PID 1152 wrote to memory of 1996	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	installd.exe
PID 1152 wrote to memory of 1996	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	installd.exe
PID 1152 wrote to memory of 1996	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	installd.exe
PID 1152 wrote to memory of 1576	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	nethtsrv.exe
PID 1152 wrote to memory of 1576	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	nethtsrv.exe
PID 1152 wrote to memory of 1576	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	nethtsrv.exe
PID 1152 wrote to memory of 1576	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	nethtsrv.exe
PID 1152 wrote to memory of 1200	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	netupdsrv.exe
PID 1152 wrote to memory of 1200	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	netupdsrv.exe
PID 1152 wrote to memory of 1200	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	netupdsrv.exe
PID 1152 wrote to memory of 1200	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	netupdsrv.exe
PID 1152 wrote to memory of 1200	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	netupdsrv.exe
PID 1152 wrote to memory of 1200	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	netupdsrv.exe
PID 1152 wrote to memory of 1200	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	netupdsrv.exe
PID 1152 wrote to memory of 1956	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	net.exe
PID 1152 wrote to memory of 1956	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	net.exe
PID 1152 wrote to memory of 1956	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	net.exe
PID 1152 wrote to memory of 1956	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	net.exe
PID 1956 wrote to memory of 1208	1956	net.exe	net1.exe
PID 1956 wrote to memory of 1208	1956	net.exe	net1.exe
PID 1956 wrote to memory of 1208	1956	net.exe	net1.exe
PID 1956 wrote to memory of 1208	1956	net.exe	net1.exe
PID 1152 wrote to memory of 1588	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	net.exe
PID 1152 wrote to memory of 1588	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	net.exe
PID 1152 wrote to memory of 1588	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	net.exe
PID 1152 wrote to memory of 1588	1152	f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe	net.exe
PID 1588 wrote to memory of 1764	1588	net.exe	net1.exe
PID 1588 wrote to memory of 1764	1588	net.exe	net1.exe
PID 1588 wrote to memory of 1764	1588	net.exe	net1.exe
PID 1588 wrote to memory of 1764	1588	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe
"C:\Users\Admin\AppData\Local\Temp\f93c8aaeaec9f8325dd222e30e45e8813a093eb3e85dbbd41f476402c7950d24.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1376

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:588

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1068

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1400

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1200

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1208

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1588

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1764

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1676

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
c4b5152244306a677253a160482c48d3

SHA1
020228df2cdd743a7a5dc96803460f33ff57954d

SHA256
90862ddb5e899b018ec22612d837ef346ac324262e0118033106ca5e770536a0

SHA512
9318d9c393f8e5d0ca9aeb6e873eddf048cd5b860dfbcc97f93ff9d06bbd884d48271c61e31763b7047b37069839ea74db799d0e0fa8b4a82bb209698f7a24a6

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
2dfa6ba8f077f2ad016d27e46d2aa7e0

SHA1
a9334f23f18877f4c9c5b78c9c71a8919273d5c1

SHA256
c74dcd879d182f7e3838bfaf6657c69149b7dab36c9abef7824c8380f18a6f90

SHA512
712218e2259a0529fcea74cd1d392751dd1e41670f4f77d8e05b202206db29ab8ce6f49c41a7fcc8d9a8c524a1290b7c475d3d92ddfb031eeeb79b0c13fe9b11

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
b8a9864722b4d416069907f57db4e820

SHA1
59b0055450d5f2421eecf8a02680466c380811d2

SHA256
3f6450c47c8accb330ae5df7a73665e60e17cb17e0dc659ac806b4c180f6b89d

SHA512
ed52da7692d88c0c3b2e77081a82c366058e418a821bc3e72d0aade0dfe4ed92db5c915e8dd04c46829faea5c3bfbbd39abd380f293794a8a056ac531d18bde3

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
dc0fc8f167748ab2039dc8758c35a5ba

SHA1
c5e963a609dd2fd373da7319f9474345c626e576

SHA256
cad1f38ba1da418561a488ede23d6eca3ff8ecf7b4478a5d03cb77be5dfffa4e

SHA512
38ebc5018838a16864668ac50877d20fe296c61d5f1b39a987f8073d85e90eb616af041352003c41ad76587f4e9807cb82d46cff75dded8febbf203ec77aa4cb

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
dc0fc8f167748ab2039dc8758c35a5ba

SHA1
c5e963a609dd2fd373da7319f9474345c626e576

SHA256
cad1f38ba1da418561a488ede23d6eca3ff8ecf7b4478a5d03cb77be5dfffa4e

SHA512
38ebc5018838a16864668ac50877d20fe296c61d5f1b39a987f8073d85e90eb616af041352003c41ad76587f4e9807cb82d46cff75dded8febbf203ec77aa4cb

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
1594000cc5d7483ad62653564603f1f1

SHA1
f3773dbdafeb20c7f219b45b8d2e3a4d3d44deab

SHA256
663ca451d2cef4e258dd151cc97c1382e4f2ce4813041c6c51288f4b992b8412

SHA512
fccf2d4ed6a9f16fe7336c0623771acf5e8ca2e7fc786f34b10e83e0d98bf11f8f97d3c32c773f2bcaf4511dfbc24266e89dda155ea2bee2f7e56afa9236cc6f

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
1594000cc5d7483ad62653564603f1f1

SHA1
f3773dbdafeb20c7f219b45b8d2e3a4d3d44deab

SHA256
663ca451d2cef4e258dd151cc97c1382e4f2ce4813041c6c51288f4b992b8412

SHA512
fccf2d4ed6a9f16fe7336c0623771acf5e8ca2e7fc786f34b10e83e0d98bf11f8f97d3c32c773f2bcaf4511dfbc24266e89dda155ea2bee2f7e56afa9236cc6f

Download Submit
\Users\Admin\AppData\Local\Temp\nstB51F.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nstB51F.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nstB51F.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nstB51F.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nstB51F.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
c4b5152244306a677253a160482c48d3

SHA1
020228df2cdd743a7a5dc96803460f33ff57954d

SHA256
90862ddb5e899b018ec22612d837ef346ac324262e0118033106ca5e770536a0

SHA512
9318d9c393f8e5d0ca9aeb6e873eddf048cd5b860dfbcc97f93ff9d06bbd884d48271c61e31763b7047b37069839ea74db799d0e0fa8b4a82bb209698f7a24a6

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
c4b5152244306a677253a160482c48d3

SHA1
020228df2cdd743a7a5dc96803460f33ff57954d

SHA256
90862ddb5e899b018ec22612d837ef346ac324262e0118033106ca5e770536a0

SHA512
9318d9c393f8e5d0ca9aeb6e873eddf048cd5b860dfbcc97f93ff9d06bbd884d48271c61e31763b7047b37069839ea74db799d0e0fa8b4a82bb209698f7a24a6

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
c4b5152244306a677253a160482c48d3

SHA1
020228df2cdd743a7a5dc96803460f33ff57954d

SHA256
90862ddb5e899b018ec22612d837ef346ac324262e0118033106ca5e770536a0

SHA512
9318d9c393f8e5d0ca9aeb6e873eddf048cd5b860dfbcc97f93ff9d06bbd884d48271c61e31763b7047b37069839ea74db799d0e0fa8b4a82bb209698f7a24a6

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
2dfa6ba8f077f2ad016d27e46d2aa7e0

SHA1
a9334f23f18877f4c9c5b78c9c71a8919273d5c1

SHA256
c74dcd879d182f7e3838bfaf6657c69149b7dab36c9abef7824c8380f18a6f90

SHA512
712218e2259a0529fcea74cd1d392751dd1e41670f4f77d8e05b202206db29ab8ce6f49c41a7fcc8d9a8c524a1290b7c475d3d92ddfb031eeeb79b0c13fe9b11

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
2dfa6ba8f077f2ad016d27e46d2aa7e0

SHA1
a9334f23f18877f4c9c5b78c9c71a8919273d5c1

SHA256
c74dcd879d182f7e3838bfaf6657c69149b7dab36c9abef7824c8380f18a6f90

SHA512
712218e2259a0529fcea74cd1d392751dd1e41670f4f77d8e05b202206db29ab8ce6f49c41a7fcc8d9a8c524a1290b7c475d3d92ddfb031eeeb79b0c13fe9b11

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
b8a9864722b4d416069907f57db4e820

SHA1
59b0055450d5f2421eecf8a02680466c380811d2

SHA256
3f6450c47c8accb330ae5df7a73665e60e17cb17e0dc659ac806b4c180f6b89d

SHA512
ed52da7692d88c0c3b2e77081a82c366058e418a821bc3e72d0aade0dfe4ed92db5c915e8dd04c46829faea5c3bfbbd39abd380f293794a8a056ac531d18bde3

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
dc0fc8f167748ab2039dc8758c35a5ba

SHA1
c5e963a609dd2fd373da7319f9474345c626e576

SHA256
cad1f38ba1da418561a488ede23d6eca3ff8ecf7b4478a5d03cb77be5dfffa4e

SHA512
38ebc5018838a16864668ac50877d20fe296c61d5f1b39a987f8073d85e90eb616af041352003c41ad76587f4e9807cb82d46cff75dded8febbf203ec77aa4cb

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
1594000cc5d7483ad62653564603f1f1

SHA1
f3773dbdafeb20c7f219b45b8d2e3a4d3d44deab

SHA256
663ca451d2cef4e258dd151cc97c1382e4f2ce4813041c6c51288f4b992b8412

SHA512
fccf2d4ed6a9f16fe7336c0623771acf5e8ca2e7fc786f34b10e83e0d98bf11f8f97d3c32c773f2bcaf4511dfbc24266e89dda155ea2bee2f7e56afa9236cc6f

Download Submit
memory/588-59-0x0000000000000000-mapping.dmp

Download
memory/1068-62-0x0000000000000000-mapping.dmp

Download
memory/1152-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1152-54-0x0000000075881000-0x0000000075883000-memory.dmp

Filesize
8KB

Download
memory/1152-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1152-60-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1200-77-0x0000000000000000-mapping.dmp

Download
memory/1208-82-0x0000000000000000-mapping.dmp

Download
memory/1376-58-0x0000000000000000-mapping.dmp

Download
memory/1400-63-0x0000000000000000-mapping.dmp

Download
memory/1576-71-0x0000000000000000-mapping.dmp

Download
memory/1588-87-0x0000000000000000-mapping.dmp

Download
memory/1764-88-0x0000000000000000-mapping.dmp

Download
memory/1956-81-0x0000000000000000-mapping.dmp

Download
memory/1996-65-0x0000000000000000-mapping.dmp

Download