b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2

Analysis

max time kernel
33s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe
Size

603KB
MD5

6a7b7fe728721a40de31e73a26868d9d
SHA1

89ac5395fb9c2077474c5e38989b9806f0d39692
SHA256

b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2
SHA512

2c5ea281d4870265688cf9a58ce65660cb3cf2a2f90105f6e174bccad7e8eb9be2df30d9db8b5e1f64ee730891cbdba30e5bb13163f239e1e1c60e1519bfdb92
SSDEEP

12288:IIny5DYTfIujfy3Iv+s5OJDuamc48gAA8psRZlT98Utd:GUTfF7KIv+e+xKZ98Utd

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1424 installd.exe
580 nethtsrv.exe
1704 netupdsrv.exe
1772 nethtsrv.exe
1436 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe

pid	process
1424	installd.exe
580	nethtsrv.exe
1704	netupdsrv.exe
1772	nethtsrv.exe
1436	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe
1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe
1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe
1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe
1424	installd.exe
1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe
580	nethtsrv.exe
580	nethtsrv.exe
1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe
1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe
1772	nethtsrv.exe
1772	nethtsrv.exe
1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfpapi.dll	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe
File created	C:\Windows\SysWOW64\installd.exe	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe

Drops file in Program Files directory 3 IoCs

Processes:

b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1772 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1772	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1940 wrote to memory of 2028	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	net.exe
PID 1940 wrote to memory of 2028	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	net.exe
PID 1940 wrote to memory of 2028	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	net.exe
PID 1940 wrote to memory of 2028	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	net.exe
PID 2028 wrote to memory of 1544	2028	net.exe	net1.exe
PID 2028 wrote to memory of 1544	2028	net.exe	net1.exe
PID 2028 wrote to memory of 1544	2028	net.exe	net1.exe
PID 2028 wrote to memory of 1544	2028	net.exe	net1.exe
PID 1940 wrote to memory of 1560	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	net.exe
PID 1940 wrote to memory of 1560	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	net.exe
PID 1940 wrote to memory of 1560	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	net.exe
PID 1940 wrote to memory of 1560	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	net.exe
PID 1560 wrote to memory of 1200	1560	net.exe	net1.exe
PID 1560 wrote to memory of 1200	1560	net.exe	net1.exe
PID 1560 wrote to memory of 1200	1560	net.exe	net1.exe
PID 1560 wrote to memory of 1200	1560	net.exe	net1.exe
PID 1940 wrote to memory of 1424	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	installd.exe
PID 1940 wrote to memory of 1424	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	installd.exe
PID 1940 wrote to memory of 1424	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	installd.exe
PID 1940 wrote to memory of 1424	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	installd.exe
PID 1940 wrote to memory of 1424	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	installd.exe
PID 1940 wrote to memory of 1424	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	installd.exe
PID 1940 wrote to memory of 1424	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	installd.exe
PID 1940 wrote to memory of 580	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	nethtsrv.exe
PID 1940 wrote to memory of 580	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	nethtsrv.exe
PID 1940 wrote to memory of 580	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	nethtsrv.exe
PID 1940 wrote to memory of 580	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	nethtsrv.exe
PID 1940 wrote to memory of 1704	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	netupdsrv.exe
PID 1940 wrote to memory of 1704	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	netupdsrv.exe
PID 1940 wrote to memory of 1704	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	netupdsrv.exe
PID 1940 wrote to memory of 1704	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	netupdsrv.exe
PID 1940 wrote to memory of 1704	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	netupdsrv.exe
PID 1940 wrote to memory of 1704	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	netupdsrv.exe
PID 1940 wrote to memory of 1704	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	netupdsrv.exe
PID 1940 wrote to memory of 1196	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	net.exe
PID 1940 wrote to memory of 1196	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	net.exe
PID 1940 wrote to memory of 1196	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	net.exe
PID 1940 wrote to memory of 1196	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	net.exe
PID 1196 wrote to memory of 908	1196	net.exe	net1.exe
PID 1196 wrote to memory of 908	1196	net.exe	net1.exe
PID 1196 wrote to memory of 908	1196	net.exe	net1.exe
PID 1196 wrote to memory of 908	1196	net.exe	net1.exe
PID 1940 wrote to memory of 316	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	net.exe
PID 1940 wrote to memory of 316	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	net.exe
PID 1940 wrote to memory of 316	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	net.exe
PID 1940 wrote to memory of 316	1940	b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe	net.exe
PID 316 wrote to memory of 1300	316	net.exe	net1.exe
PID 316 wrote to memory of 1300	316	net.exe	net1.exe
PID 316 wrote to memory of 1300	316	net.exe	net1.exe
PID 316 wrote to memory of 1300	316	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe
"C:\Users\Admin\AppData\Local\Temp\b48d6ad517ae0be206fee982db5736e878a6ec204d1d0a5838b59a6987277ce2.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1544

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1560

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1200

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1704

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1196

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:908

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:316

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1300

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1772

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
84fa011a3e8058dd1ffb7319858730fb

SHA1
1e5388e1790140e59469ed6bb94007ca40d4de4f

SHA256
a581460def5da2489a05b106d3338d584d266610557045553fc48c9095ad1ddd

SHA512
6b3b2064272bbc78f313f114aa9b755e957e205cfb479ebe127e16b9ddd1abd643e8508ff070a0af52a8b012f9d88cafa4a7ad4f38b1ebfaf2d51cb5df0c3489

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
243KB

MD5
edeb76b4b7cc9e5fd04dea4d446f05c2

SHA1
11de1342d2bab01ac7e5fc84306da616d43949d5

SHA256
49494898d35bd562a10c2b5828666dde821b6d9bdc291c04c2598cd1c9ef0180

SHA512
9cc1bb05dc35c4eedc3cb8e913bf29e632c9b80b131386c35567e1cf3669255d0c21b4eb654abe54d55ec68efb30251c3c3ab4ebedc12841e768cd47445e5bf4

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
a878b16b67e5fa6849b86fa53b5c8f93

SHA1
1dc4e82eb3d6d15a465e0b87d3fc6e27c2c46612

SHA256
1d1495588dce18e233161aaa1c4e7a53b67d32916d1897d73359dbab9b739b81

SHA512
a2a20e1bec22af5f51046342c624192fe788c8ec644c8c6df5ec703faadd45581218d24440cbb0f70299c393420f0d58ca96f33967afc0b5106d249e7df4d86d

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
34038ae9c7074bfd6a9775ac0064a1ac

SHA1
de7324c841da174def41d3ec09aaf31bdfe3bccc

SHA256
b46920c0dc21aeb47fc770aa473626fc23a322fa3d20ab66d821ec1856bc4174

SHA512
a0198b1471a2344f4f16f0cbe1280108ef86519aa8b08eccaa049e90051a8edc5d5a1abe4a6e9141782972b576f9c158c215a47c79b2af9b373cdb28f61acb6d

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
34038ae9c7074bfd6a9775ac0064a1ac

SHA1
de7324c841da174def41d3ec09aaf31bdfe3bccc

SHA256
b46920c0dc21aeb47fc770aa473626fc23a322fa3d20ab66d821ec1856bc4174

SHA512
a0198b1471a2344f4f16f0cbe1280108ef86519aa8b08eccaa049e90051a8edc5d5a1abe4a6e9141782972b576f9c158c215a47c79b2af9b373cdb28f61acb6d

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
a0214de05ba4a2d5b6a06f694c7aa849

SHA1
04bc14a7e2b175cb885e5fdb882dfd84108b777b

SHA256
f84c2ae1e37ac765d30c03aa922736ff2f36c4d91c3bdf784d36bd1350f149da

SHA512
dbd626f3bd042355097c0b45b1f1d79344979fc95d1edd2985629f1c3e494785cfa27a57ba60cd40a85cc3e59ad487d925c23a6ada5ddb8edb6d732d77c92b65

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
a0214de05ba4a2d5b6a06f694c7aa849

SHA1
04bc14a7e2b175cb885e5fdb882dfd84108b777b

SHA256
f84c2ae1e37ac765d30c03aa922736ff2f36c4d91c3bdf784d36bd1350f149da

SHA512
dbd626f3bd042355097c0b45b1f1d79344979fc95d1edd2985629f1c3e494785cfa27a57ba60cd40a85cc3e59ad487d925c23a6ada5ddb8edb6d732d77c92b65

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2BD4.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2BD4.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2BD4.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2BD4.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2BD4.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
84fa011a3e8058dd1ffb7319858730fb

SHA1
1e5388e1790140e59469ed6bb94007ca40d4de4f

SHA256
a581460def5da2489a05b106d3338d584d266610557045553fc48c9095ad1ddd

SHA512
6b3b2064272bbc78f313f114aa9b755e957e205cfb479ebe127e16b9ddd1abd643e8508ff070a0af52a8b012f9d88cafa4a7ad4f38b1ebfaf2d51cb5df0c3489

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
84fa011a3e8058dd1ffb7319858730fb

SHA1
1e5388e1790140e59469ed6bb94007ca40d4de4f

SHA256
a581460def5da2489a05b106d3338d584d266610557045553fc48c9095ad1ddd

SHA512
6b3b2064272bbc78f313f114aa9b755e957e205cfb479ebe127e16b9ddd1abd643e8508ff070a0af52a8b012f9d88cafa4a7ad4f38b1ebfaf2d51cb5df0c3489

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
84fa011a3e8058dd1ffb7319858730fb

SHA1
1e5388e1790140e59469ed6bb94007ca40d4de4f

SHA256
a581460def5da2489a05b106d3338d584d266610557045553fc48c9095ad1ddd

SHA512
6b3b2064272bbc78f313f114aa9b755e957e205cfb479ebe127e16b9ddd1abd643e8508ff070a0af52a8b012f9d88cafa4a7ad4f38b1ebfaf2d51cb5df0c3489

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
243KB

MD5
edeb76b4b7cc9e5fd04dea4d446f05c2

SHA1
11de1342d2bab01ac7e5fc84306da616d43949d5

SHA256
49494898d35bd562a10c2b5828666dde821b6d9bdc291c04c2598cd1c9ef0180

SHA512
9cc1bb05dc35c4eedc3cb8e913bf29e632c9b80b131386c35567e1cf3669255d0c21b4eb654abe54d55ec68efb30251c3c3ab4ebedc12841e768cd47445e5bf4

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
243KB

MD5
edeb76b4b7cc9e5fd04dea4d446f05c2

SHA1
11de1342d2bab01ac7e5fc84306da616d43949d5

SHA256
49494898d35bd562a10c2b5828666dde821b6d9bdc291c04c2598cd1c9ef0180

SHA512
9cc1bb05dc35c4eedc3cb8e913bf29e632c9b80b131386c35567e1cf3669255d0c21b4eb654abe54d55ec68efb30251c3c3ab4ebedc12841e768cd47445e5bf4

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
a878b16b67e5fa6849b86fa53b5c8f93

SHA1
1dc4e82eb3d6d15a465e0b87d3fc6e27c2c46612

SHA256
1d1495588dce18e233161aaa1c4e7a53b67d32916d1897d73359dbab9b739b81

SHA512
a2a20e1bec22af5f51046342c624192fe788c8ec644c8c6df5ec703faadd45581218d24440cbb0f70299c393420f0d58ca96f33967afc0b5106d249e7df4d86d

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
34038ae9c7074bfd6a9775ac0064a1ac

SHA1
de7324c841da174def41d3ec09aaf31bdfe3bccc

SHA256
b46920c0dc21aeb47fc770aa473626fc23a322fa3d20ab66d821ec1856bc4174

SHA512
a0198b1471a2344f4f16f0cbe1280108ef86519aa8b08eccaa049e90051a8edc5d5a1abe4a6e9141782972b576f9c158c215a47c79b2af9b373cdb28f61acb6d

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
a0214de05ba4a2d5b6a06f694c7aa849

SHA1
04bc14a7e2b175cb885e5fdb882dfd84108b777b

SHA256
f84c2ae1e37ac765d30c03aa922736ff2f36c4d91c3bdf784d36bd1350f149da

SHA512
dbd626f3bd042355097c0b45b1f1d79344979fc95d1edd2985629f1c3e494785cfa27a57ba60cd40a85cc3e59ad487d925c23a6ada5ddb8edb6d732d77c92b65

Download Submit
memory/316-86-0x0000000000000000-mapping.dmp

Download
memory/580-70-0x0000000000000000-mapping.dmp

Download
memory/908-81-0x0000000000000000-mapping.dmp

Download
memory/1196-80-0x0000000000000000-mapping.dmp

Download
memory/1200-62-0x0000000000000000-mapping.dmp

Download
memory/1300-87-0x0000000000000000-mapping.dmp

Download
memory/1424-64-0x0000000000000000-mapping.dmp

Download
memory/1544-59-0x0000000000000000-mapping.dmp

Download
memory/1560-61-0x0000000000000000-mapping.dmp

Download
memory/1704-76-0x0000000000000000-mapping.dmp

Download
memory/1940-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1940-58-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1940-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/2028-57-0x0000000000000000-mapping.dmp

Download