b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994

Analysis

max time kernel
103s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe
Size

603KB
MD5

f1ba655150aefee52057055b05feb016
SHA1

d164bbe997ef59e93412e4b4e1be601254160b1d
SHA256

b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994
SHA512

2e874e6a33928603c889af65e0ee13c51b3fcfb8bdabdadcaaddd17316c9ad27eaea17cd1cb8f694c3ebad4098e25614db9062f80ff1af357867bb424496a93c
SSDEEP

12288:pIny5DYTip0oVp1GdS1RRf9Q7M2KXKKGErvv8CI0xMEMrj:FUTX4adIR1Q7QXKdGcCI0xME

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

304 installd.exe
628 nethtsrv.exe
1324 netupdsrv.exe
956 nethtsrv.exe
1996 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe

pid	process
304	installd.exe
628	nethtsrv.exe
1324	netupdsrv.exe
956	nethtsrv.exe
1996	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe
908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe
908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe
908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe
304	installd.exe
908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe
628	nethtsrv.exe
628	nethtsrv.exe
908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe
908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe
956	nethtsrv.exe
956	nethtsrv.exe
908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe
File created	C:\Windows\SysWOW64\installd.exe	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe

Drops file in Program Files directory 3 IoCs

Processes:

b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 956 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	956	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 908 wrote to memory of 672	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	net.exe
PID 908 wrote to memory of 672	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	net.exe
PID 908 wrote to memory of 672	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	net.exe
PID 908 wrote to memory of 672	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	net.exe
PID 672 wrote to memory of 1920	672	net.exe	net1.exe
PID 672 wrote to memory of 1920	672	net.exe	net1.exe
PID 672 wrote to memory of 1920	672	net.exe	net1.exe
PID 672 wrote to memory of 1920	672	net.exe	net1.exe
PID 908 wrote to memory of 368	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	net.exe
PID 908 wrote to memory of 368	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	net.exe
PID 908 wrote to memory of 368	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	net.exe
PID 908 wrote to memory of 368	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	net.exe
PID 368 wrote to memory of 1960	368	net.exe	net1.exe
PID 368 wrote to memory of 1960	368	net.exe	net1.exe
PID 368 wrote to memory of 1960	368	net.exe	net1.exe
PID 368 wrote to memory of 1960	368	net.exe	net1.exe
PID 908 wrote to memory of 304	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	installd.exe
PID 908 wrote to memory of 304	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	installd.exe
PID 908 wrote to memory of 304	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	installd.exe
PID 908 wrote to memory of 304	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	installd.exe
PID 908 wrote to memory of 304	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	installd.exe
PID 908 wrote to memory of 304	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	installd.exe
PID 908 wrote to memory of 304	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	installd.exe
PID 908 wrote to memory of 628	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	nethtsrv.exe
PID 908 wrote to memory of 628	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	nethtsrv.exe
PID 908 wrote to memory of 628	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	nethtsrv.exe
PID 908 wrote to memory of 628	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	nethtsrv.exe
PID 908 wrote to memory of 1324	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	netupdsrv.exe
PID 908 wrote to memory of 1324	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	netupdsrv.exe
PID 908 wrote to memory of 1324	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	netupdsrv.exe
PID 908 wrote to memory of 1324	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	netupdsrv.exe
PID 908 wrote to memory of 1324	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	netupdsrv.exe
PID 908 wrote to memory of 1324	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	netupdsrv.exe
PID 908 wrote to memory of 1324	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	netupdsrv.exe
PID 908 wrote to memory of 1972	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	net.exe
PID 908 wrote to memory of 1972	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	net.exe
PID 908 wrote to memory of 1972	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	net.exe
PID 908 wrote to memory of 1972	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	net.exe
PID 1972 wrote to memory of 1524	1972	net.exe	net1.exe
PID 1972 wrote to memory of 1524	1972	net.exe	net1.exe
PID 1972 wrote to memory of 1524	1972	net.exe	net1.exe
PID 1972 wrote to memory of 1524	1972	net.exe	net1.exe
PID 908 wrote to memory of 1620	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	net.exe
PID 908 wrote to memory of 1620	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	net.exe
PID 908 wrote to memory of 1620	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	net.exe
PID 908 wrote to memory of 1620	908	b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe	net.exe
PID 1620 wrote to memory of 1720	1620	net.exe	net1.exe
PID 1620 wrote to memory of 1720	1620	net.exe	net1.exe
PID 1620 wrote to memory of 1720	1620	net.exe	net1.exe
PID 1620 wrote to memory of 1720	1620	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe
"C:\Users\Admin\AppData\Local\Temp\b80c8a6409add8d3b1cfdc8c7ed279e368fcba94ec7e7958aab4d87574ff1994.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:908

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1920

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:368

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1960

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:304

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:628

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1324

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1524

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1720

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:956

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
39712f7d51771f50a186f9104434d94f

SHA1
54e73c80b091635e0df215b95a311060878ba6f7

SHA256
d694f6ad20273d9cbf8b0696032e722213132bc928677c9954aabe600fdb76a1

SHA512
20f0ea91f08a096ada229320d69202a5f68834dde99fa15cd203bf36e5e6262469fddc7c4bb9a7520548e0318411f38078aeaaba013ade91081ffb35101adece

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
774bd6369b7fc1820d31add0d673f5a3

SHA1
c8e493433c48537e789e4d7304fc4b0640bfb469

SHA256
0dcaea53b0698fcb4c7d035d051de6fd137b7c5aa498c491813173f7e97e3da9

SHA512
dc6358cfa537eb5b5ceeb350047a4169aa8e7dd2432032c6606bdfe761c2992dfd930defb7f9da8e8067301e52b175688622d9fc892f0e32a004fdd4d1427512

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
3d877750f29c9ac6e8ab1b776cbd43a4

SHA1
753599dbafebc13a823f7bc79aa90826658f00b5

SHA256
ad8b0c6e9d15d635d23f6269cc789ce22ff931f5cceee18866649080c1207e19

SHA512
43bbdeffd744e8e8c68cbba563ffc05a9e16e74f1bf0cd41d91acb81d963e1608a9c728fcc0d5694c2b8318b483113bfa8bfae9e5a7fc91ac67ca3a0746c8efe

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
3e73b2de179b412e9bec57c04bfb129d

SHA1
f420cc7fe25e2a7c562c649fe07dd2dac402c076

SHA256
19e113141e417160aa071153efb88cce91e16c8785475fc3801083c65bbf4551

SHA512
174c48c6d7fb9a7901e339a24541bb9bfe5d42438f674dbee2cfee269147c75e503d93ec663e1b2dd2915639a41e203ccb9e8a30ce66498e1eea613e5f5b5a13

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
3e73b2de179b412e9bec57c04bfb129d

SHA1
f420cc7fe25e2a7c562c649fe07dd2dac402c076

SHA256
19e113141e417160aa071153efb88cce91e16c8785475fc3801083c65bbf4551

SHA512
174c48c6d7fb9a7901e339a24541bb9bfe5d42438f674dbee2cfee269147c75e503d93ec663e1b2dd2915639a41e203ccb9e8a30ce66498e1eea613e5f5b5a13

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
4d9cc1a817d7590b275237606c9dbd29

SHA1
ccf5ac3edc1cc21a1f9604931d51c27c57a36c9d

SHA256
215b13652e34f48ef73d4f5da95bfe166b9655df1aa1893db30481b2432c731c

SHA512
7b0fcf3063d3a82705f6b58d1d3afa558410125eae08947370e22b8a502db63f42bc35b1cbad96b4fc73861ccbdda53685df7a46308d3dff92d25b34056e6381

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
4d9cc1a817d7590b275237606c9dbd29

SHA1
ccf5ac3edc1cc21a1f9604931d51c27c57a36c9d

SHA256
215b13652e34f48ef73d4f5da95bfe166b9655df1aa1893db30481b2432c731c

SHA512
7b0fcf3063d3a82705f6b58d1d3afa558410125eae08947370e22b8a502db63f42bc35b1cbad96b4fc73861ccbdda53685df7a46308d3dff92d25b34056e6381

Download Submit
\Users\Admin\AppData\Local\Temp\nso3E1C.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nso3E1C.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso3E1C.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso3E1C.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso3E1C.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
39712f7d51771f50a186f9104434d94f

SHA1
54e73c80b091635e0df215b95a311060878ba6f7

SHA256
d694f6ad20273d9cbf8b0696032e722213132bc928677c9954aabe600fdb76a1

SHA512
20f0ea91f08a096ada229320d69202a5f68834dde99fa15cd203bf36e5e6262469fddc7c4bb9a7520548e0318411f38078aeaaba013ade91081ffb35101adece

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
39712f7d51771f50a186f9104434d94f

SHA1
54e73c80b091635e0df215b95a311060878ba6f7

SHA256
d694f6ad20273d9cbf8b0696032e722213132bc928677c9954aabe600fdb76a1

SHA512
20f0ea91f08a096ada229320d69202a5f68834dde99fa15cd203bf36e5e6262469fddc7c4bb9a7520548e0318411f38078aeaaba013ade91081ffb35101adece

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
39712f7d51771f50a186f9104434d94f

SHA1
54e73c80b091635e0df215b95a311060878ba6f7

SHA256
d694f6ad20273d9cbf8b0696032e722213132bc928677c9954aabe600fdb76a1

SHA512
20f0ea91f08a096ada229320d69202a5f68834dde99fa15cd203bf36e5e6262469fddc7c4bb9a7520548e0318411f38078aeaaba013ade91081ffb35101adece

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
774bd6369b7fc1820d31add0d673f5a3

SHA1
c8e493433c48537e789e4d7304fc4b0640bfb469

SHA256
0dcaea53b0698fcb4c7d035d051de6fd137b7c5aa498c491813173f7e97e3da9

SHA512
dc6358cfa537eb5b5ceeb350047a4169aa8e7dd2432032c6606bdfe761c2992dfd930defb7f9da8e8067301e52b175688622d9fc892f0e32a004fdd4d1427512

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
774bd6369b7fc1820d31add0d673f5a3

SHA1
c8e493433c48537e789e4d7304fc4b0640bfb469

SHA256
0dcaea53b0698fcb4c7d035d051de6fd137b7c5aa498c491813173f7e97e3da9

SHA512
dc6358cfa537eb5b5ceeb350047a4169aa8e7dd2432032c6606bdfe761c2992dfd930defb7f9da8e8067301e52b175688622d9fc892f0e32a004fdd4d1427512

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
3d877750f29c9ac6e8ab1b776cbd43a4

SHA1
753599dbafebc13a823f7bc79aa90826658f00b5

SHA256
ad8b0c6e9d15d635d23f6269cc789ce22ff931f5cceee18866649080c1207e19

SHA512
43bbdeffd744e8e8c68cbba563ffc05a9e16e74f1bf0cd41d91acb81d963e1608a9c728fcc0d5694c2b8318b483113bfa8bfae9e5a7fc91ac67ca3a0746c8efe

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
3e73b2de179b412e9bec57c04bfb129d

SHA1
f420cc7fe25e2a7c562c649fe07dd2dac402c076

SHA256
19e113141e417160aa071153efb88cce91e16c8785475fc3801083c65bbf4551

SHA512
174c48c6d7fb9a7901e339a24541bb9bfe5d42438f674dbee2cfee269147c75e503d93ec663e1b2dd2915639a41e203ccb9e8a30ce66498e1eea613e5f5b5a13

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
4d9cc1a817d7590b275237606c9dbd29

SHA1
ccf5ac3edc1cc21a1f9604931d51c27c57a36c9d

SHA256
215b13652e34f48ef73d4f5da95bfe166b9655df1aa1893db30481b2432c731c

SHA512
7b0fcf3063d3a82705f6b58d1d3afa558410125eae08947370e22b8a502db63f42bc35b1cbad96b4fc73861ccbdda53685df7a46308d3dff92d25b34056e6381

Download Submit
memory/304-64-0x0000000000000000-mapping.dmp

Download
memory/368-61-0x0000000000000000-mapping.dmp

Download
memory/628-70-0x0000000000000000-mapping.dmp

Download
memory/672-58-0x0000000000000000-mapping.dmp

Download
memory/908-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/908-75-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/908-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/908-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1324-77-0x0000000000000000-mapping.dmp

Download
memory/1524-82-0x0000000000000000-mapping.dmp

Download
memory/1620-87-0x0000000000000000-mapping.dmp

Download
memory/1720-88-0x0000000000000000-mapping.dmp

Download
memory/1920-59-0x0000000000000000-mapping.dmp

Download
memory/1960-62-0x0000000000000000-mapping.dmp

Download
memory/1972-81-0x0000000000000000-mapping.dmp

Download