dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e

Analysis

max time kernel
19s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe
Size

603KB
MD5

e6cfed4d0d8de1dcd10b67301c9b36f8
SHA1

e376a6e8fbc0fdcd2f6567f682428a7ed98457f4
SHA256

dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e
SHA512

67ffef06e46c6f00bb1fc663b0e6df4c7bfc4bf569ad20c46673df3cd925ab712cab003226bfeb564ca23af4bb2a0600b5bd94b98dcf572a2e25a09142d4fb64
SSDEEP

12288:lIny5DYTfIvBKE4qKTyuSNrnVuDtdPQN5i/uxOeLfEiw6:RUTf0BLKmrcRVQN5os6

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1392 installd.exe
636 nethtsrv.exe
388 netupdsrv.exe
588 nethtsrv.exe
528 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe

pid	process
1392	installd.exe
636	nethtsrv.exe
388	netupdsrv.exe
588	nethtsrv.exe
528	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe
1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe
1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe
1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe
1392	installd.exe
1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe
636	nethtsrv.exe
636	nethtsrv.exe
1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe
1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe
588	nethtsrv.exe
588	nethtsrv.exe
1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe
File created	C:\Windows\SysWOW64\installd.exe	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe

Drops file in Program Files directory 3 IoCs

Processes:

dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

468
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 588 nethtsrv.exe

pid	process
468

description	pid	process
Token: SeDebugPrivilege	588	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1956 wrote to memory of 1720	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	net.exe
PID 1956 wrote to memory of 1720	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	net.exe
PID 1956 wrote to memory of 1720	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	net.exe
PID 1956 wrote to memory of 1720	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	net.exe
PID 1720 wrote to memory of 1340	1720	net.exe	net1.exe
PID 1720 wrote to memory of 1340	1720	net.exe	net1.exe
PID 1720 wrote to memory of 1340	1720	net.exe	net1.exe
PID 1720 wrote to memory of 1340	1720	net.exe	net1.exe
PID 1956 wrote to memory of 1780	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	net.exe
PID 1956 wrote to memory of 1780	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	net.exe
PID 1956 wrote to memory of 1780	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	net.exe
PID 1956 wrote to memory of 1780	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	net.exe
PID 1780 wrote to memory of 848	1780	net.exe	net1.exe
PID 1780 wrote to memory of 848	1780	net.exe	net1.exe
PID 1780 wrote to memory of 848	1780	net.exe	net1.exe
PID 1780 wrote to memory of 848	1780	net.exe	net1.exe
PID 1956 wrote to memory of 1392	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	installd.exe
PID 1956 wrote to memory of 1392	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	installd.exe
PID 1956 wrote to memory of 1392	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	installd.exe
PID 1956 wrote to memory of 1392	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	installd.exe
PID 1956 wrote to memory of 1392	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	installd.exe
PID 1956 wrote to memory of 1392	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	installd.exe
PID 1956 wrote to memory of 1392	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	installd.exe
PID 1956 wrote to memory of 636	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	nethtsrv.exe
PID 1956 wrote to memory of 636	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	nethtsrv.exe
PID 1956 wrote to memory of 636	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	nethtsrv.exe
PID 1956 wrote to memory of 636	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	nethtsrv.exe
PID 1956 wrote to memory of 388	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	netupdsrv.exe
PID 1956 wrote to memory of 388	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	netupdsrv.exe
PID 1956 wrote to memory of 388	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	netupdsrv.exe
PID 1956 wrote to memory of 388	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	netupdsrv.exe
PID 1956 wrote to memory of 388	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	netupdsrv.exe
PID 1956 wrote to memory of 388	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	netupdsrv.exe
PID 1956 wrote to memory of 388	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	netupdsrv.exe
PID 1956 wrote to memory of 780	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	net.exe
PID 1956 wrote to memory of 780	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	net.exe
PID 1956 wrote to memory of 780	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	net.exe
PID 1956 wrote to memory of 780	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	net.exe
PID 780 wrote to memory of 1216	780	net.exe	net1.exe
PID 780 wrote to memory of 1216	780	net.exe	net1.exe
PID 780 wrote to memory of 1216	780	net.exe	net1.exe
PID 780 wrote to memory of 1216	780	net.exe	net1.exe
PID 1956 wrote to memory of 1676	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	net.exe
PID 1956 wrote to memory of 1676	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	net.exe
PID 1956 wrote to memory of 1676	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	net.exe
PID 1956 wrote to memory of 1676	1956	dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe	net.exe
PID 1676 wrote to memory of 1128	1676	net.exe	net1.exe
PID 1676 wrote to memory of 1128	1676	net.exe	net1.exe
PID 1676 wrote to memory of 1128	1676	net.exe	net1.exe
PID 1676 wrote to memory of 1128	1676	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe
"C:\Users\Admin\AppData\Local\Temp\dc5957b5b046593561bc22031d69da11f9b1f19f3044ec1f63b35a86d136a91e.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1340

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1780

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:848

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1392

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:636

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:388

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:780

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1216

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1128

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:588

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
5080939b6131ee8b7b467973e3385a06

SHA1
965106ec45cf0fe29cea6d2d447f7d0d6706744a

SHA256
9c329090b8f31a11cf671494188c4db86fb69133f9c59fd815dbee93dcc51cc2

SHA512
1a35891397dcebb862e15aad541c55d70441e09e18967b3dd71aaca0538133b3cafc09708361748040e9b7a4607a5563806cf0f5ec02d2e9eeabb4d81da1ea39

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
4e73f3130b18b86f9497057e43f1472b

SHA1
fa3530e9bb6d1878ad1a17bc83a16498de7cdc95

SHA256
7078fc1e732a886e5b0200818f6f57cb01affe8dcc55cf32e37cab848c8948e1

SHA512
cfa51c1617c4201b648997a55a96a997e2c6355de58cde26e63036034ce867267278a98abf9b287ec4b6f730f2de05edc55148574abb43f9c901953bb97ee12e

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
8cd269349bb9e4708d8e7450587edf7d

SHA1
7bd3bc0e1484ffc30160c4f77ba71d0975e406cb

SHA256
f28ba215e96a9d224219a8c5b4e06d02420522acaa6859fd4a1e9c9685eb2919

SHA512
09558af102b04a6f6aa5411d8506e8c343df05096dc6a6387a275b1407b51947fddc6c50cbbb2b93fb19ccdb5e332b4fa3cde437f50386a684849e16eb4072ab

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
64b0829fd7248fcc2560e71222931f89

SHA1
5fdaf615cc352df1ae2de8796f931136f06b02dc

SHA256
6d904c9e4250a5350531592cb02b0bb042230dad14ea794ef108f0cd7569040b

SHA512
a2722ab3a232d39a38ab47522eb4533e99fa51be43bbb2cad8b23098dabb5884c0c19e3798ea540cfd3bfec4c29d83a1ef08cc98b67550702090e68207cd8021

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
64b0829fd7248fcc2560e71222931f89

SHA1
5fdaf615cc352df1ae2de8796f931136f06b02dc

SHA256
6d904c9e4250a5350531592cb02b0bb042230dad14ea794ef108f0cd7569040b

SHA512
a2722ab3a232d39a38ab47522eb4533e99fa51be43bbb2cad8b23098dabb5884c0c19e3798ea540cfd3bfec4c29d83a1ef08cc98b67550702090e68207cd8021

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
159KB

MD5
1eeefd85eaa89336287034740d77476a

SHA1
93d1d5a74c90af81b67f1e83923d8a9d3337d027

SHA256
def15b253817f6bdb593577865da2f2a7ad13e0a89fe9ee10e69f932fe7a7224

SHA512
2f98541bde3ec2fae9f4f6d23949263d23dec5ccfb4f7f437f69c751fe8da9570c724d1cd5ea0692192c246307b0468740e3be49d4afdcc43bb18264ea287c57

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
159KB

MD5
1eeefd85eaa89336287034740d77476a

SHA1
93d1d5a74c90af81b67f1e83923d8a9d3337d027

SHA256
def15b253817f6bdb593577865da2f2a7ad13e0a89fe9ee10e69f932fe7a7224

SHA512
2f98541bde3ec2fae9f4f6d23949263d23dec5ccfb4f7f437f69c751fe8da9570c724d1cd5ea0692192c246307b0468740e3be49d4afdcc43bb18264ea287c57

Download Submit
\Users\Admin\AppData\Local\Temp\nso4924.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nso4924.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso4924.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso4924.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso4924.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
5080939b6131ee8b7b467973e3385a06

SHA1
965106ec45cf0fe29cea6d2d447f7d0d6706744a

SHA256
9c329090b8f31a11cf671494188c4db86fb69133f9c59fd815dbee93dcc51cc2

SHA512
1a35891397dcebb862e15aad541c55d70441e09e18967b3dd71aaca0538133b3cafc09708361748040e9b7a4607a5563806cf0f5ec02d2e9eeabb4d81da1ea39

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
5080939b6131ee8b7b467973e3385a06

SHA1
965106ec45cf0fe29cea6d2d447f7d0d6706744a

SHA256
9c329090b8f31a11cf671494188c4db86fb69133f9c59fd815dbee93dcc51cc2

SHA512
1a35891397dcebb862e15aad541c55d70441e09e18967b3dd71aaca0538133b3cafc09708361748040e9b7a4607a5563806cf0f5ec02d2e9eeabb4d81da1ea39

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
5080939b6131ee8b7b467973e3385a06

SHA1
965106ec45cf0fe29cea6d2d447f7d0d6706744a

SHA256
9c329090b8f31a11cf671494188c4db86fb69133f9c59fd815dbee93dcc51cc2

SHA512
1a35891397dcebb862e15aad541c55d70441e09e18967b3dd71aaca0538133b3cafc09708361748040e9b7a4607a5563806cf0f5ec02d2e9eeabb4d81da1ea39

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
4e73f3130b18b86f9497057e43f1472b

SHA1
fa3530e9bb6d1878ad1a17bc83a16498de7cdc95

SHA256
7078fc1e732a886e5b0200818f6f57cb01affe8dcc55cf32e37cab848c8948e1

SHA512
cfa51c1617c4201b648997a55a96a997e2c6355de58cde26e63036034ce867267278a98abf9b287ec4b6f730f2de05edc55148574abb43f9c901953bb97ee12e

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
4e73f3130b18b86f9497057e43f1472b

SHA1
fa3530e9bb6d1878ad1a17bc83a16498de7cdc95

SHA256
7078fc1e732a886e5b0200818f6f57cb01affe8dcc55cf32e37cab848c8948e1

SHA512
cfa51c1617c4201b648997a55a96a997e2c6355de58cde26e63036034ce867267278a98abf9b287ec4b6f730f2de05edc55148574abb43f9c901953bb97ee12e

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
8cd269349bb9e4708d8e7450587edf7d

SHA1
7bd3bc0e1484ffc30160c4f77ba71d0975e406cb

SHA256
f28ba215e96a9d224219a8c5b4e06d02420522acaa6859fd4a1e9c9685eb2919

SHA512
09558af102b04a6f6aa5411d8506e8c343df05096dc6a6387a275b1407b51947fddc6c50cbbb2b93fb19ccdb5e332b4fa3cde437f50386a684849e16eb4072ab

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
64b0829fd7248fcc2560e71222931f89

SHA1
5fdaf615cc352df1ae2de8796f931136f06b02dc

SHA256
6d904c9e4250a5350531592cb02b0bb042230dad14ea794ef108f0cd7569040b

SHA512
a2722ab3a232d39a38ab47522eb4533e99fa51be43bbb2cad8b23098dabb5884c0c19e3798ea540cfd3bfec4c29d83a1ef08cc98b67550702090e68207cd8021

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
159KB

MD5
1eeefd85eaa89336287034740d77476a

SHA1
93d1d5a74c90af81b67f1e83923d8a9d3337d027

SHA256
def15b253817f6bdb593577865da2f2a7ad13e0a89fe9ee10e69f932fe7a7224

SHA512
2f98541bde3ec2fae9f4f6d23949263d23dec5ccfb4f7f437f69c751fe8da9570c724d1cd5ea0692192c246307b0468740e3be49d4afdcc43bb18264ea287c57

Download Submit
memory/388-76-0x0000000000000000-mapping.dmp

Download
memory/636-70-0x0000000000000000-mapping.dmp

Download
memory/780-80-0x0000000000000000-mapping.dmp

Download
memory/848-62-0x0000000000000000-mapping.dmp

Download
memory/1128-87-0x0000000000000000-mapping.dmp

Download
memory/1216-81-0x0000000000000000-mapping.dmp

Download
memory/1340-58-0x0000000000000000-mapping.dmp

Download
memory/1392-64-0x0000000000000000-mapping.dmp

Download
memory/1676-86-0x0000000000000000-mapping.dmp

Download
memory/1720-57-0x0000000000000000-mapping.dmp

Download
memory/1780-61-0x0000000000000000-mapping.dmp

Download
memory/1956-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1956-59-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1956-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download