bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1

Analysis

max time kernel
64s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe
Size

603KB
MD5

5478b6e9a08c730f55347f00089b32c7
SHA1

6f41e2e9a39d720bb9d04b9bf8425553143c112c
SHA256

bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1
SHA512

4399f0d556fb2b9338ea931eaf27ecc56f892980c955fad7e89ee52662cce5c542fb59fa4760fd2ad241e7eeeaa91c7cf8e78132de74e89d696cf83902601c1c
SSDEEP

12288:NIny5DYTmIub17I6bu6H5/epKlUs2ACYdX4uhPNJ8d8UkJ8wNN:ZUTmZb17Iiuo52pKFrdX40FqGXJ8

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1480 installd.exe
1532 nethtsrv.exe
1528 netupdsrv.exe
1692 nethtsrv.exe
1940 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe

pid	process
1480	installd.exe
1532	nethtsrv.exe
1528	netupdsrv.exe
1692	nethtsrv.exe
1940	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe
1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe
1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe
1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe
1480	installd.exe
1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe
1532	nethtsrv.exe
1532	nethtsrv.exe
1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe
1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe
1692	nethtsrv.exe
1692	nethtsrv.exe
1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe

description	ioc	process
File created	C:\Windows\SysWOW64\netupdsrv.exe	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe
File created	C:\Windows\SysWOW64\installd.exe	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe

Drops file in Program Files directory 3 IoCs

Processes:

bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1692 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1692	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1120 wrote to memory of 1712	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	net.exe
PID 1120 wrote to memory of 1712	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	net.exe
PID 1120 wrote to memory of 1712	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	net.exe
PID 1120 wrote to memory of 1712	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	net.exe
PID 1712 wrote to memory of 1056	1712	net.exe	net1.exe
PID 1712 wrote to memory of 1056	1712	net.exe	net1.exe
PID 1712 wrote to memory of 1056	1712	net.exe	net1.exe
PID 1712 wrote to memory of 1056	1712	net.exe	net1.exe
PID 1120 wrote to memory of 1152	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	net.exe
PID 1120 wrote to memory of 1152	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	net.exe
PID 1120 wrote to memory of 1152	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	net.exe
PID 1120 wrote to memory of 1152	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	net.exe
PID 1152 wrote to memory of 524	1152	net.exe	net1.exe
PID 1152 wrote to memory of 524	1152	net.exe	net1.exe
PID 1152 wrote to memory of 524	1152	net.exe	net1.exe
PID 1152 wrote to memory of 524	1152	net.exe	net1.exe
PID 1120 wrote to memory of 1480	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	installd.exe
PID 1120 wrote to memory of 1480	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	installd.exe
PID 1120 wrote to memory of 1480	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	installd.exe
PID 1120 wrote to memory of 1480	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	installd.exe
PID 1120 wrote to memory of 1480	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	installd.exe
PID 1120 wrote to memory of 1480	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	installd.exe
PID 1120 wrote to memory of 1480	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	installd.exe
PID 1120 wrote to memory of 1532	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	nethtsrv.exe
PID 1120 wrote to memory of 1532	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	nethtsrv.exe
PID 1120 wrote to memory of 1532	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	nethtsrv.exe
PID 1120 wrote to memory of 1532	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	nethtsrv.exe
PID 1120 wrote to memory of 1528	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	netupdsrv.exe
PID 1120 wrote to memory of 1528	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	netupdsrv.exe
PID 1120 wrote to memory of 1528	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	netupdsrv.exe
PID 1120 wrote to memory of 1528	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	netupdsrv.exe
PID 1120 wrote to memory of 1528	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	netupdsrv.exe
PID 1120 wrote to memory of 1528	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	netupdsrv.exe
PID 1120 wrote to memory of 1528	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	netupdsrv.exe
PID 1120 wrote to memory of 1788	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	net.exe
PID 1120 wrote to memory of 1788	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	net.exe
PID 1120 wrote to memory of 1788	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	net.exe
PID 1120 wrote to memory of 1788	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	net.exe
PID 1788 wrote to memory of 1784	1788	net.exe	net1.exe
PID 1788 wrote to memory of 1784	1788	net.exe	net1.exe
PID 1788 wrote to memory of 1784	1788	net.exe	net1.exe
PID 1788 wrote to memory of 1784	1788	net.exe	net1.exe
PID 1120 wrote to memory of 1928	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	net.exe
PID 1120 wrote to memory of 1928	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	net.exe
PID 1120 wrote to memory of 1928	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	net.exe
PID 1120 wrote to memory of 1928	1120	bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe	net.exe
PID 1928 wrote to memory of 1060	1928	net.exe	net1.exe
PID 1928 wrote to memory of 1060	1928	net.exe	net1.exe
PID 1928 wrote to memory of 1060	1928	net.exe	net1.exe
PID 1928 wrote to memory of 1060	1928	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe
"C:\Users\Admin\AppData\Local\Temp\bcd7c10f1ff908d5bb43d106a98489dd5c50b13910ba6eef3502ff18d5eb22a1.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1120

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1056

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:524

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1528

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1784

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1060

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1692

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
1a637a048b832b6a86d15f553cb7de5f

SHA1
169573860fb75b20848907cc88aee78860aa0f02

SHA256
d8c8e59c35d88dc754a3433407b0cfe12f49370468dd0fa6706ae56481f4cd70

SHA512
c7013e990fb7c3c61a9ffd5dc06f4d61d22ae2b1cba76bdc0f773dc24fcf01409dded34d17ccfcfcb6b19a0e6eadfc6847b799056aba40394a52ef1e4e2e0d0b

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
f9a00710bf796bcbf4a0354495515ccf

SHA1
934e8e4fa41e27a2663f383f9d9b667ad1c7fa3c

SHA256
423bf4b2ee9a1dc040d7ad84c10d8691b1505d9eaa3e0db439afdda2e7309231

SHA512
7c1fbe0e257d274820ae0e109a34144f19f48eac1581d04cc6b6a63f606e9f9016a53146876d3286f55d90f34e1d4001c51db096e969977603a48167ffae147f

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
b34e3946038feb6131b4e21af629f805

SHA1
c10dcc432b3f7f7f7ddcbc26f26e8739bcb25e33

SHA256
ac7c07f2bcdee7159fb29ceae0ebca415cb2e4051c46fba9abfddd436f02148c

SHA512
ebe73858a9135d7fb9616d5d29aafd4ed68dae1f5d2a65c967d1977071116382431947bd5b390d9b06d8ba300916e43497c785c8d5f96d5ceb2cf0dc04eb56c4

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
4351dea40a4a197fb964f7dadc68bb3d

SHA1
890933464a92bf757a1d5501501d8dcc45cdf855

SHA256
7b1275f3e723867e5316fec1f2367717663a81add9befd1107e38a276abd1647

SHA512
48bbe9e4ab19b1b0800124b47c26e8832fc162b2faea4d4490d911885d3e6994f56857a7ca315505022871b00a7efb6a27c4a5b6a2be4a51efcc19de747207fd

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
4351dea40a4a197fb964f7dadc68bb3d

SHA1
890933464a92bf757a1d5501501d8dcc45cdf855

SHA256
7b1275f3e723867e5316fec1f2367717663a81add9befd1107e38a276abd1647

SHA512
48bbe9e4ab19b1b0800124b47c26e8832fc162b2faea4d4490d911885d3e6994f56857a7ca315505022871b00a7efb6a27c4a5b6a2be4a51efcc19de747207fd

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
c518d9f5c6e0069fd0e1e252a95f7893

SHA1
65bb2dae2f926504a983646021610a67c6bc672e

SHA256
a520b234b5764c14897f5003d35dc7bb5d429432548023c9f805e24e66709bc8

SHA512
19a0f735dbfdded394e388c64ad93fab8bd9ad48fb774edfe540a5fde097dd591efc680d1990a46a37c306e8b35bda91255e1f92cb58186b91a422b28a7532eb

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
c518d9f5c6e0069fd0e1e252a95f7893

SHA1
65bb2dae2f926504a983646021610a67c6bc672e

SHA256
a520b234b5764c14897f5003d35dc7bb5d429432548023c9f805e24e66709bc8

SHA512
19a0f735dbfdded394e388c64ad93fab8bd9ad48fb774edfe540a5fde097dd591efc680d1990a46a37c306e8b35bda91255e1f92cb58186b91a422b28a7532eb

Download Submit
\Users\Admin\AppData\Local\Temp\nse4270.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nse4270.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nse4270.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nse4270.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nse4270.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
1a637a048b832b6a86d15f553cb7de5f

SHA1
169573860fb75b20848907cc88aee78860aa0f02

SHA256
d8c8e59c35d88dc754a3433407b0cfe12f49370468dd0fa6706ae56481f4cd70

SHA512
c7013e990fb7c3c61a9ffd5dc06f4d61d22ae2b1cba76bdc0f773dc24fcf01409dded34d17ccfcfcb6b19a0e6eadfc6847b799056aba40394a52ef1e4e2e0d0b

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
1a637a048b832b6a86d15f553cb7de5f

SHA1
169573860fb75b20848907cc88aee78860aa0f02

SHA256
d8c8e59c35d88dc754a3433407b0cfe12f49370468dd0fa6706ae56481f4cd70

SHA512
c7013e990fb7c3c61a9ffd5dc06f4d61d22ae2b1cba76bdc0f773dc24fcf01409dded34d17ccfcfcb6b19a0e6eadfc6847b799056aba40394a52ef1e4e2e0d0b

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
1a637a048b832b6a86d15f553cb7de5f

SHA1
169573860fb75b20848907cc88aee78860aa0f02

SHA256
d8c8e59c35d88dc754a3433407b0cfe12f49370468dd0fa6706ae56481f4cd70

SHA512
c7013e990fb7c3c61a9ffd5dc06f4d61d22ae2b1cba76bdc0f773dc24fcf01409dded34d17ccfcfcb6b19a0e6eadfc6847b799056aba40394a52ef1e4e2e0d0b

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
f9a00710bf796bcbf4a0354495515ccf

SHA1
934e8e4fa41e27a2663f383f9d9b667ad1c7fa3c

SHA256
423bf4b2ee9a1dc040d7ad84c10d8691b1505d9eaa3e0db439afdda2e7309231

SHA512
7c1fbe0e257d274820ae0e109a34144f19f48eac1581d04cc6b6a63f606e9f9016a53146876d3286f55d90f34e1d4001c51db096e969977603a48167ffae147f

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
f9a00710bf796bcbf4a0354495515ccf

SHA1
934e8e4fa41e27a2663f383f9d9b667ad1c7fa3c

SHA256
423bf4b2ee9a1dc040d7ad84c10d8691b1505d9eaa3e0db439afdda2e7309231

SHA512
7c1fbe0e257d274820ae0e109a34144f19f48eac1581d04cc6b6a63f606e9f9016a53146876d3286f55d90f34e1d4001c51db096e969977603a48167ffae147f

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
b34e3946038feb6131b4e21af629f805

SHA1
c10dcc432b3f7f7f7ddcbc26f26e8739bcb25e33

SHA256
ac7c07f2bcdee7159fb29ceae0ebca415cb2e4051c46fba9abfddd436f02148c

SHA512
ebe73858a9135d7fb9616d5d29aafd4ed68dae1f5d2a65c967d1977071116382431947bd5b390d9b06d8ba300916e43497c785c8d5f96d5ceb2cf0dc04eb56c4

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
4351dea40a4a197fb964f7dadc68bb3d

SHA1
890933464a92bf757a1d5501501d8dcc45cdf855

SHA256
7b1275f3e723867e5316fec1f2367717663a81add9befd1107e38a276abd1647

SHA512
48bbe9e4ab19b1b0800124b47c26e8832fc162b2faea4d4490d911885d3e6994f56857a7ca315505022871b00a7efb6a27c4a5b6a2be4a51efcc19de747207fd

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
c518d9f5c6e0069fd0e1e252a95f7893

SHA1
65bb2dae2f926504a983646021610a67c6bc672e

SHA256
a520b234b5764c14897f5003d35dc7bb5d429432548023c9f805e24e66709bc8

SHA512
19a0f735dbfdded394e388c64ad93fab8bd9ad48fb774edfe540a5fde097dd591efc680d1990a46a37c306e8b35bda91255e1f92cb58186b91a422b28a7532eb

Download Submit
memory/524-62-0x0000000000000000-mapping.dmp

Download
memory/1056-59-0x0000000000000000-mapping.dmp

Download
memory/1060-88-0x0000000000000000-mapping.dmp

Download
memory/1120-54-0x0000000075291000-0x0000000075293000-memory.dmp

Filesize
8KB

Download
memory/1120-79-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1120-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1120-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1152-61-0x0000000000000000-mapping.dmp

Download
memory/1480-64-0x0000000000000000-mapping.dmp

Download
memory/1528-76-0x0000000000000000-mapping.dmp

Download
memory/1532-70-0x0000000000000000-mapping.dmp

Download
memory/1712-58-0x0000000000000000-mapping.dmp

Download
memory/1784-82-0x0000000000000000-mapping.dmp

Download
memory/1788-81-0x0000000000000000-mapping.dmp

Download
memory/1928-87-0x0000000000000000-mapping.dmp

Download