50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928

Analysis

max time kernel
44s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe
Size

446KB
MD5

3c1861f9499b9e26eb79cb09dfc52f7f
SHA1

107472486fbd59c67a3dc78db620ae1a39eb6f96
SHA256

50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928
SHA512

8da0197d83913d866cc7f486680a2918f86eda1fe2e79267054c443531eb13f3ce0f1e76bcdab6f0d8cdef0170ecfe33d8857097949f60abbd6b25ac95a5ef02
SSDEEP

12288:HJRXAW5iADpoUsZqL2NMitVHWtLug0UBrzlFu:HXZFDp2QLGjHVU9ZFu

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1612 installd.exe
688 nethtsrv.exe
1060 netupdsrv.exe
1748 nethtsrv.exe
2044 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe

pid	process
1612	installd.exe
688	nethtsrv.exe
1060	netupdsrv.exe
1748	nethtsrv.exe
2044	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe
1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe
1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe
1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe
1612	installd.exe
1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe
688	nethtsrv.exe
688	nethtsrv.exe
1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe
1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe
1748	nethtsrv.exe
1748	nethtsrv.exe
1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe
File created	C:\Windows\SysWOW64\installd.exe	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe

Drops file in Program Files directory 3 IoCs

Processes:

50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe
File created	C:\Program Files (x86)\Common Files\Config\data.xml	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1748 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1748	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1652 wrote to memory of 992	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	net.exe
PID 1652 wrote to memory of 992	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	net.exe
PID 1652 wrote to memory of 992	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	net.exe
PID 1652 wrote to memory of 992	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	net.exe
PID 992 wrote to memory of 1580	992	net.exe	net1.exe
PID 992 wrote to memory of 1580	992	net.exe	net1.exe
PID 992 wrote to memory of 1580	992	net.exe	net1.exe
PID 992 wrote to memory of 1580	992	net.exe	net1.exe
PID 1652 wrote to memory of 1368	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	net.exe
PID 1652 wrote to memory of 1368	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	net.exe
PID 1652 wrote to memory of 1368	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	net.exe
PID 1652 wrote to memory of 1368	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	net.exe
PID 1368 wrote to memory of 1512	1368	net.exe	net1.exe
PID 1368 wrote to memory of 1512	1368	net.exe	net1.exe
PID 1368 wrote to memory of 1512	1368	net.exe	net1.exe
PID 1368 wrote to memory of 1512	1368	net.exe	net1.exe
PID 1652 wrote to memory of 1612	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	installd.exe
PID 1652 wrote to memory of 1612	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	installd.exe
PID 1652 wrote to memory of 1612	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	installd.exe
PID 1652 wrote to memory of 1612	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	installd.exe
PID 1652 wrote to memory of 1612	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	installd.exe
PID 1652 wrote to memory of 1612	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	installd.exe
PID 1652 wrote to memory of 1612	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	installd.exe
PID 1652 wrote to memory of 688	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	nethtsrv.exe
PID 1652 wrote to memory of 688	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	nethtsrv.exe
PID 1652 wrote to memory of 688	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	nethtsrv.exe
PID 1652 wrote to memory of 688	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	nethtsrv.exe
PID 1652 wrote to memory of 1060	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	netupdsrv.exe
PID 1652 wrote to memory of 1060	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	netupdsrv.exe
PID 1652 wrote to memory of 1060	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	netupdsrv.exe
PID 1652 wrote to memory of 1060	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	netupdsrv.exe
PID 1652 wrote to memory of 1060	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	netupdsrv.exe
PID 1652 wrote to memory of 1060	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	netupdsrv.exe
PID 1652 wrote to memory of 1060	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	netupdsrv.exe
PID 1652 wrote to memory of 1320	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	net.exe
PID 1652 wrote to memory of 1320	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	net.exe
PID 1652 wrote to memory of 1320	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	net.exe
PID 1652 wrote to memory of 1320	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	net.exe
PID 1320 wrote to memory of 976	1320	net.exe	net1.exe
PID 1320 wrote to memory of 976	1320	net.exe	net1.exe
PID 1320 wrote to memory of 976	1320	net.exe	net1.exe
PID 1320 wrote to memory of 976	1320	net.exe	net1.exe
PID 1652 wrote to memory of 1124	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	net.exe
PID 1652 wrote to memory of 1124	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	net.exe
PID 1652 wrote to memory of 1124	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	net.exe
PID 1652 wrote to memory of 1124	1652	50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe	net.exe
PID 1124 wrote to memory of 960	1124	net.exe	net1.exe
PID 1124 wrote to memory of 960	1124	net.exe	net1.exe
PID 1124 wrote to memory of 960	1124	net.exe	net1.exe
PID 1124 wrote to memory of 960	1124	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe
"C:\Users\Admin\AppData\Local\Temp\50288fa5ba1a667bbaac81fe016d9b69573555ae289a4baadb5262b1d5697928.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:992

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1580

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1512

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:688

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1060

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1320

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:976

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1124

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:960

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1748

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
0e5d381067a72edb362981ecd31d860e

SHA1
3d42599a97d55768f74bafcc8ecec2b79735207c

SHA256
731280164c5ab3dae4059d63a55d1b5e68fe9f1d0b231212c22a088751cf80dc

SHA512
69c6bbad3c5426e5f335ecdbe1996a51ccfae5b61561e08cae051e405216247f37c1b0824011a5a098c68d0f4fc1c8e9cb93e9d722e59b926b865a870375fd14

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
791fd5161ebdacf6c35f5708139ec525

SHA1
9e9f649c6e3636dd0efe1624ea91f1e99266c71e

SHA256
46c8812a9f85d4d3352108046a80b8a43212ddd03fe45e25fec240b309b9be5f

SHA512
790bc1e5a25879a6071cc56d16ec7a96b7f08509870951eba179f99ab66b10e54387197b43706e82abf605366a4a1d809b48e7490a3d213b663560b5ca84f45d

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
08bf12670d7bf42f084198765a32ac6b

SHA1
4fd8393ffe54565ae382aedbee36f8d6195fad21

SHA256
0d5258bc2706c2bdab4457b38f3ad8c4d9703d506509e13c82dc3730ea19335c

SHA512
1ffc9fc784ebd1c1178f22fa37382fc2bfeac7c974beb69f86492b908a3a5540e3668b7fa7636c43ab806455b8cc13882af297305f877c7a0894f84a34da7526

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
dcf86987c3d54195732472da0b119f65

SHA1
61d05049d4299cd2c9d51a93b52d678096420918

SHA256
121b39794916a9f8128f48088f636358ea0348018347a46567e55b6b0ef3c59d

SHA512
e77588c04e5a4a00dc3e51d2683fb14b5be8f820d3e02b5d89f310a25518d8312f21e139e42b4ab27e67f3aeb531672151a03145d2d9becbf6a5a8f163e63590

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
dcf86987c3d54195732472da0b119f65

SHA1
61d05049d4299cd2c9d51a93b52d678096420918

SHA256
121b39794916a9f8128f48088f636358ea0348018347a46567e55b6b0ef3c59d

SHA512
e77588c04e5a4a00dc3e51d2683fb14b5be8f820d3e02b5d89f310a25518d8312f21e139e42b4ab27e67f3aeb531672151a03145d2d9becbf6a5a8f163e63590

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
6dd976b4d313c927b98b670f53932fc9

SHA1
8add28bb9024356dc563562499d27557b9563780

SHA256
a1033406f590e9f45879c83e4346798d9912eba7138778af78c1b7e0f868ff10

SHA512
0617e4305bf337fbdd3a9a6ebe8bc91dda253794993898f71bae9009737ea0054c66fdfa61587588914ad8926c0ad12dbe279432fca2e29e234345079e3b859b

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
6dd976b4d313c927b98b670f53932fc9

SHA1
8add28bb9024356dc563562499d27557b9563780

SHA256
a1033406f590e9f45879c83e4346798d9912eba7138778af78c1b7e0f868ff10

SHA512
0617e4305bf337fbdd3a9a6ebe8bc91dda253794993898f71bae9009737ea0054c66fdfa61587588914ad8926c0ad12dbe279432fca2e29e234345079e3b859b

Download Submit
\Users\Admin\AppData\Local\Temp\nsdFC6B.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsdFC6B.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsdFC6B.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsdFC6B.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsdFC6B.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
0e5d381067a72edb362981ecd31d860e

SHA1
3d42599a97d55768f74bafcc8ecec2b79735207c

SHA256
731280164c5ab3dae4059d63a55d1b5e68fe9f1d0b231212c22a088751cf80dc

SHA512
69c6bbad3c5426e5f335ecdbe1996a51ccfae5b61561e08cae051e405216247f37c1b0824011a5a098c68d0f4fc1c8e9cb93e9d722e59b926b865a870375fd14

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
0e5d381067a72edb362981ecd31d860e

SHA1
3d42599a97d55768f74bafcc8ecec2b79735207c

SHA256
731280164c5ab3dae4059d63a55d1b5e68fe9f1d0b231212c22a088751cf80dc

SHA512
69c6bbad3c5426e5f335ecdbe1996a51ccfae5b61561e08cae051e405216247f37c1b0824011a5a098c68d0f4fc1c8e9cb93e9d722e59b926b865a870375fd14

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
0e5d381067a72edb362981ecd31d860e

SHA1
3d42599a97d55768f74bafcc8ecec2b79735207c

SHA256
731280164c5ab3dae4059d63a55d1b5e68fe9f1d0b231212c22a088751cf80dc

SHA512
69c6bbad3c5426e5f335ecdbe1996a51ccfae5b61561e08cae051e405216247f37c1b0824011a5a098c68d0f4fc1c8e9cb93e9d722e59b926b865a870375fd14

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
791fd5161ebdacf6c35f5708139ec525

SHA1
9e9f649c6e3636dd0efe1624ea91f1e99266c71e

SHA256
46c8812a9f85d4d3352108046a80b8a43212ddd03fe45e25fec240b309b9be5f

SHA512
790bc1e5a25879a6071cc56d16ec7a96b7f08509870951eba179f99ab66b10e54387197b43706e82abf605366a4a1d809b48e7490a3d213b663560b5ca84f45d

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
791fd5161ebdacf6c35f5708139ec525

SHA1
9e9f649c6e3636dd0efe1624ea91f1e99266c71e

SHA256
46c8812a9f85d4d3352108046a80b8a43212ddd03fe45e25fec240b309b9be5f

SHA512
790bc1e5a25879a6071cc56d16ec7a96b7f08509870951eba179f99ab66b10e54387197b43706e82abf605366a4a1d809b48e7490a3d213b663560b5ca84f45d

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
08bf12670d7bf42f084198765a32ac6b

SHA1
4fd8393ffe54565ae382aedbee36f8d6195fad21

SHA256
0d5258bc2706c2bdab4457b38f3ad8c4d9703d506509e13c82dc3730ea19335c

SHA512
1ffc9fc784ebd1c1178f22fa37382fc2bfeac7c974beb69f86492b908a3a5540e3668b7fa7636c43ab806455b8cc13882af297305f877c7a0894f84a34da7526

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
dcf86987c3d54195732472da0b119f65

SHA1
61d05049d4299cd2c9d51a93b52d678096420918

SHA256
121b39794916a9f8128f48088f636358ea0348018347a46567e55b6b0ef3c59d

SHA512
e77588c04e5a4a00dc3e51d2683fb14b5be8f820d3e02b5d89f310a25518d8312f21e139e42b4ab27e67f3aeb531672151a03145d2d9becbf6a5a8f163e63590

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
6dd976b4d313c927b98b670f53932fc9

SHA1
8add28bb9024356dc563562499d27557b9563780

SHA256
a1033406f590e9f45879c83e4346798d9912eba7138778af78c1b7e0f868ff10

SHA512
0617e4305bf337fbdd3a9a6ebe8bc91dda253794993898f71bae9009737ea0054c66fdfa61587588914ad8926c0ad12dbe279432fca2e29e234345079e3b859b

Download Submit
memory/688-69-0x0000000000000000-mapping.dmp

Download
memory/960-86-0x0000000000000000-mapping.dmp

Download
memory/976-80-0x0000000000000000-mapping.dmp

Download
memory/992-57-0x0000000000000000-mapping.dmp

Download
memory/1060-75-0x0000000000000000-mapping.dmp

Download
memory/1124-85-0x0000000000000000-mapping.dmp

Download
memory/1320-79-0x0000000000000000-mapping.dmp

Download
memory/1368-60-0x0000000000000000-mapping.dmp

Download
memory/1512-61-0x0000000000000000-mapping.dmp

Download
memory/1580-58-0x0000000000000000-mapping.dmp

Download
memory/1612-63-0x0000000000000000-mapping.dmp

Download
memory/1652-54-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download