bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924

Analysis

max time kernel
48s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe
Size

602KB
MD5

e99707d19eebc66231247a759c07036f
SHA1

c51875bbd964547286350be12a3613d923f99005
SHA256

bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924
SHA512

8da6a7a9cede2f8ee2a6b3234bdbe6a90ad43ebe12f82c25284a08ab6145f32054cd5fac808facf5197280097b43ce3555f2b01c75bcabb9f5e54b68e3c65668
SSDEEP

12288:1Iny5DYTuUBxnuIlYrHs1g8/1QvKnuMXEVhX7:BUTuiqH58XGr

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1220 installd.exe
1652 nethtsrv.exe
1604 netupdsrv.exe
2008 nethtsrv.exe
1300 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe

pid	process
1220	installd.exe
1652	nethtsrv.exe
1604	netupdsrv.exe
2008	nethtsrv.exe
1300	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe
1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe
1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe
1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe
1220	installd.exe
1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe
1652	nethtsrv.exe
1652	nethtsrv.exe
1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe
1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe
2008	nethtsrv.exe
2008	nethtsrv.exe
1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe
File created	C:\Windows\SysWOW64\installd.exe	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe

Drops file in Program Files directory 3 IoCs

Processes:

bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe
File created	C:\Program Files (x86)\Common Files\Config\data.xml	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 2008 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	2008	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1364 wrote to memory of 1932	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	net.exe
PID 1364 wrote to memory of 1932	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	net.exe
PID 1364 wrote to memory of 1932	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	net.exe
PID 1364 wrote to memory of 1932	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	net.exe
PID 1932 wrote to memory of 988	1932	net.exe	net1.exe
PID 1932 wrote to memory of 988	1932	net.exe	net1.exe
PID 1932 wrote to memory of 988	1932	net.exe	net1.exe
PID 1932 wrote to memory of 988	1932	net.exe	net1.exe
PID 1364 wrote to memory of 1248	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	net.exe
PID 1364 wrote to memory of 1248	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	net.exe
PID 1364 wrote to memory of 1248	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	net.exe
PID 1364 wrote to memory of 1248	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	net.exe
PID 1248 wrote to memory of 472	1248	net.exe	net1.exe
PID 1248 wrote to memory of 472	1248	net.exe	net1.exe
PID 1248 wrote to memory of 472	1248	net.exe	net1.exe
PID 1248 wrote to memory of 472	1248	net.exe	net1.exe
PID 1364 wrote to memory of 1220	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	installd.exe
PID 1364 wrote to memory of 1220	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	installd.exe
PID 1364 wrote to memory of 1220	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	installd.exe
PID 1364 wrote to memory of 1220	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	installd.exe
PID 1364 wrote to memory of 1220	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	installd.exe
PID 1364 wrote to memory of 1220	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	installd.exe
PID 1364 wrote to memory of 1220	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	installd.exe
PID 1364 wrote to memory of 1652	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	nethtsrv.exe
PID 1364 wrote to memory of 1652	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	nethtsrv.exe
PID 1364 wrote to memory of 1652	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	nethtsrv.exe
PID 1364 wrote to memory of 1652	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	nethtsrv.exe
PID 1364 wrote to memory of 1604	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	netupdsrv.exe
PID 1364 wrote to memory of 1604	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	netupdsrv.exe
PID 1364 wrote to memory of 1604	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	netupdsrv.exe
PID 1364 wrote to memory of 1604	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	netupdsrv.exe
PID 1364 wrote to memory of 1604	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	netupdsrv.exe
PID 1364 wrote to memory of 1604	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	netupdsrv.exe
PID 1364 wrote to memory of 1604	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	netupdsrv.exe
PID 1364 wrote to memory of 1640	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	net.exe
PID 1364 wrote to memory of 1640	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	net.exe
PID 1364 wrote to memory of 1640	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	net.exe
PID 1364 wrote to memory of 1640	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	net.exe
PID 1640 wrote to memory of 2028	1640	net.exe	net1.exe
PID 1640 wrote to memory of 2028	1640	net.exe	net1.exe
PID 1640 wrote to memory of 2028	1640	net.exe	net1.exe
PID 1640 wrote to memory of 2028	1640	net.exe	net1.exe
PID 1364 wrote to memory of 1688	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	net.exe
PID 1364 wrote to memory of 1688	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	net.exe
PID 1364 wrote to memory of 1688	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	net.exe
PID 1364 wrote to memory of 1688	1364	bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe	net.exe
PID 1688 wrote to memory of 1908	1688	net.exe	net1.exe
PID 1688 wrote to memory of 1908	1688	net.exe	net1.exe
PID 1688 wrote to memory of 1908	1688	net.exe	net1.exe
PID 1688 wrote to memory of 1908	1688	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe
"C:\Users\Admin\AppData\Local\Temp\bf11f43611f8219a2b3d5b4528818a12b023652812bb2e25d194945be5151924.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1364

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:988

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1248

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:472

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1220

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1604

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1908

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
1⤵
PID:2028

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2008

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1300

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
5eef2796c4385152ef0de4093a139b9f

SHA1
fa903b4405aad1cf94a057b728139c9fc8ffe27d

SHA256
fb325c84cc7d0d04a5723afd417560fa549c445b92bec34ba39051147efb276b

SHA512
99b136d94d15ae2f1d3a5261b720bce17e2e7bc600af9a94cc29d9d7db2d806bf59c3e767a893e3404d3a52de67570995c714f76975eac2c3199d7b780cb9aeb

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
5b3078350e1590e84989cd447d36946d

SHA1
8d8e1d3668d84ee28d0eaadfca11276a67ee67a3

SHA256
3dec47ca6ed1a9a0e78f16d904a96fc3962b46e4ade1e850d1bfa0b5adde24b7

SHA512
513a29cdea826e2fa50df3e076d0f306c84e58b91052dca37a80f764bac090db63aa0978ed9bf12df560399e4585cbb6986a95099f1d65cb52e4e0621fbdedce

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
33417f4420c43c61f216e79942f4c72a

SHA1
2c4690f2df97db04e2c255ba0d12cc03ec3e287e

SHA256
820fbc285a20eeb39d891707920061a0cb20dc7b04336668d6e7179df0b3feff

SHA512
95c206ad5a490b95d2b576d42b6a6a4d9aaa6b0bcd5c52686939a06ff13ff331e108031f7b6ae926f0734390c5e90e1793c8d217a5b02d2091e4f34bf1459587

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
96c73bbcf81a1054b42a56aed10592de

SHA1
d7998003ef34986a9f4899a2e6858e5fefe95bf1

SHA256
11544ec3d093cc8b7eabe644a7aae2f18255b6b3460428e391f10b6bd0b4b639

SHA512
4a1aa0f1240c82558141cbf62cf1cbd1593855546a286da9586120cd8e25201e0a64fdfd027c44b7cd52fe543c7ca122d885a8af5b9ca97bc188b9e2d7d48137

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
96c73bbcf81a1054b42a56aed10592de

SHA1
d7998003ef34986a9f4899a2e6858e5fefe95bf1

SHA256
11544ec3d093cc8b7eabe644a7aae2f18255b6b3460428e391f10b6bd0b4b639

SHA512
4a1aa0f1240c82558141cbf62cf1cbd1593855546a286da9586120cd8e25201e0a64fdfd027c44b7cd52fe543c7ca122d885a8af5b9ca97bc188b9e2d7d48137

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
159KB

MD5
9be52bc963017e8b8fb9c854b1803883

SHA1
9094ee54afb42a3c1e6fb992c021cb316a6e4b4c

SHA256
88631b3294a9751cbd47f5d04602338763e7b526b8c4bb7b1187b62179c00f55

SHA512
611d8b3f2d3f5764430b06072e87339d0ef47825b3c6e02523481bfabe0ebc169855560d46549b10c494ce46324347473bce32ebb8554f5f54b85fd612d4f5ee

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
159KB

MD5
9be52bc963017e8b8fb9c854b1803883

SHA1
9094ee54afb42a3c1e6fb992c021cb316a6e4b4c

SHA256
88631b3294a9751cbd47f5d04602338763e7b526b8c4bb7b1187b62179c00f55

SHA512
611d8b3f2d3f5764430b06072e87339d0ef47825b3c6e02523481bfabe0ebc169855560d46549b10c494ce46324347473bce32ebb8554f5f54b85fd612d4f5ee

Download Submit
\Users\Admin\AppData\Local\Temp\nsj366F.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsj366F.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj366F.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj366F.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj366F.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
5eef2796c4385152ef0de4093a139b9f

SHA1
fa903b4405aad1cf94a057b728139c9fc8ffe27d

SHA256
fb325c84cc7d0d04a5723afd417560fa549c445b92bec34ba39051147efb276b

SHA512
99b136d94d15ae2f1d3a5261b720bce17e2e7bc600af9a94cc29d9d7db2d806bf59c3e767a893e3404d3a52de67570995c714f76975eac2c3199d7b780cb9aeb

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
5eef2796c4385152ef0de4093a139b9f

SHA1
fa903b4405aad1cf94a057b728139c9fc8ffe27d

SHA256
fb325c84cc7d0d04a5723afd417560fa549c445b92bec34ba39051147efb276b

SHA512
99b136d94d15ae2f1d3a5261b720bce17e2e7bc600af9a94cc29d9d7db2d806bf59c3e767a893e3404d3a52de67570995c714f76975eac2c3199d7b780cb9aeb

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
5eef2796c4385152ef0de4093a139b9f

SHA1
fa903b4405aad1cf94a057b728139c9fc8ffe27d

SHA256
fb325c84cc7d0d04a5723afd417560fa549c445b92bec34ba39051147efb276b

SHA512
99b136d94d15ae2f1d3a5261b720bce17e2e7bc600af9a94cc29d9d7db2d806bf59c3e767a893e3404d3a52de67570995c714f76975eac2c3199d7b780cb9aeb

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
5b3078350e1590e84989cd447d36946d

SHA1
8d8e1d3668d84ee28d0eaadfca11276a67ee67a3

SHA256
3dec47ca6ed1a9a0e78f16d904a96fc3962b46e4ade1e850d1bfa0b5adde24b7

SHA512
513a29cdea826e2fa50df3e076d0f306c84e58b91052dca37a80f764bac090db63aa0978ed9bf12df560399e4585cbb6986a95099f1d65cb52e4e0621fbdedce

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
5b3078350e1590e84989cd447d36946d

SHA1
8d8e1d3668d84ee28d0eaadfca11276a67ee67a3

SHA256
3dec47ca6ed1a9a0e78f16d904a96fc3962b46e4ade1e850d1bfa0b5adde24b7

SHA512
513a29cdea826e2fa50df3e076d0f306c84e58b91052dca37a80f764bac090db63aa0978ed9bf12df560399e4585cbb6986a95099f1d65cb52e4e0621fbdedce

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
33417f4420c43c61f216e79942f4c72a

SHA1
2c4690f2df97db04e2c255ba0d12cc03ec3e287e

SHA256
820fbc285a20eeb39d891707920061a0cb20dc7b04336668d6e7179df0b3feff

SHA512
95c206ad5a490b95d2b576d42b6a6a4d9aaa6b0bcd5c52686939a06ff13ff331e108031f7b6ae926f0734390c5e90e1793c8d217a5b02d2091e4f34bf1459587

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
96c73bbcf81a1054b42a56aed10592de

SHA1
d7998003ef34986a9f4899a2e6858e5fefe95bf1

SHA256
11544ec3d093cc8b7eabe644a7aae2f18255b6b3460428e391f10b6bd0b4b639

SHA512
4a1aa0f1240c82558141cbf62cf1cbd1593855546a286da9586120cd8e25201e0a64fdfd027c44b7cd52fe543c7ca122d885a8af5b9ca97bc188b9e2d7d48137

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
159KB

MD5
9be52bc963017e8b8fb9c854b1803883

SHA1
9094ee54afb42a3c1e6fb992c021cb316a6e4b4c

SHA256
88631b3294a9751cbd47f5d04602338763e7b526b8c4bb7b1187b62179c00f55

SHA512
611d8b3f2d3f5764430b06072e87339d0ef47825b3c6e02523481bfabe0ebc169855560d46549b10c494ce46324347473bce32ebb8554f5f54b85fd612d4f5ee

Download Submit
memory/472-62-0x0000000000000000-mapping.dmp

Download
memory/988-59-0x0000000000000000-mapping.dmp

Download
memory/1220-64-0x0000000000000000-mapping.dmp

Download
memory/1248-61-0x0000000000000000-mapping.dmp

Download
memory/1364-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1364-58-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1364-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1604-76-0x0000000000000000-mapping.dmp

Download
memory/1640-80-0x0000000000000000-mapping.dmp

Download
memory/1652-70-0x0000000000000000-mapping.dmp

Download
memory/1688-86-0x0000000000000000-mapping.dmp

Download
memory/1908-87-0x0000000000000000-mapping.dmp

Download
memory/1932-57-0x0000000000000000-mapping.dmp

Download
memory/2028-81-0x0000000000000000-mapping.dmp

Download