483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8

Analysis

max time kernel
26s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe
Size

447KB
MD5

76516867adba9af06726c169512759eb
SHA1

3b21e002eb5a9ece26d0543c1c4c5714c8a450bf
SHA256

483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8
SHA512

c95a05ed281e50db8238c678472d93543c6c77c38f8d93a7315c0fdc9bf171a6f5cef49b58b510c4731b318d8d90bf591b0ab021f5f74203d4816507c7bcc933
SSDEEP

12288:FxokV33T7AstkuTgN2qUAaFj4r5RLW9KfXY:FxoaDzk7wq5RLCl

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

896 installd.exe
1384 nethtsrv.exe
980 netupdsrv.exe
1620 nethtsrv.exe
1336 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe

pid	process
896	installd.exe
1384	nethtsrv.exe
980	netupdsrv.exe
1620	nethtsrv.exe
1336	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe
996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe
996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe
996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe
896	installd.exe
996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe
1384	nethtsrv.exe
1384	nethtsrv.exe
996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe
996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe
1620	nethtsrv.exe
1620	nethtsrv.exe
996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe

description	ioc	process
File created	C:\Windows\SysWOW64\netupdsrv.exe	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe
File created	C:\Windows\SysWOW64\installd.exe	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe

Drops file in Program Files directory 3 IoCs

Processes:

483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1620 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1620	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 996 wrote to memory of 1740	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	net.exe
PID 996 wrote to memory of 1740	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	net.exe
PID 996 wrote to memory of 1740	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	net.exe
PID 996 wrote to memory of 1740	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	net.exe
PID 1740 wrote to memory of 628	1740	net.exe	net1.exe
PID 1740 wrote to memory of 628	1740	net.exe	net1.exe
PID 1740 wrote to memory of 628	1740	net.exe	net1.exe
PID 1740 wrote to memory of 628	1740	net.exe	net1.exe
PID 996 wrote to memory of 860	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	net.exe
PID 996 wrote to memory of 860	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	net.exe
PID 996 wrote to memory of 860	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	net.exe
PID 996 wrote to memory of 860	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	net.exe
PID 860 wrote to memory of 2028	860	net.exe	net1.exe
PID 860 wrote to memory of 2028	860	net.exe	net1.exe
PID 860 wrote to memory of 2028	860	net.exe	net1.exe
PID 860 wrote to memory of 2028	860	net.exe	net1.exe
PID 996 wrote to memory of 896	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	installd.exe
PID 996 wrote to memory of 896	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	installd.exe
PID 996 wrote to memory of 896	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	installd.exe
PID 996 wrote to memory of 896	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	installd.exe
PID 996 wrote to memory of 896	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	installd.exe
PID 996 wrote to memory of 896	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	installd.exe
PID 996 wrote to memory of 896	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	installd.exe
PID 996 wrote to memory of 1384	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	nethtsrv.exe
PID 996 wrote to memory of 1384	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	nethtsrv.exe
PID 996 wrote to memory of 1384	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	nethtsrv.exe
PID 996 wrote to memory of 1384	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	nethtsrv.exe
PID 996 wrote to memory of 980	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	netupdsrv.exe
PID 996 wrote to memory of 980	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	netupdsrv.exe
PID 996 wrote to memory of 980	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	netupdsrv.exe
PID 996 wrote to memory of 980	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	netupdsrv.exe
PID 996 wrote to memory of 980	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	netupdsrv.exe
PID 996 wrote to memory of 980	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	netupdsrv.exe
PID 996 wrote to memory of 980	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	netupdsrv.exe
PID 996 wrote to memory of 2008	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	net.exe
PID 996 wrote to memory of 2008	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	net.exe
PID 996 wrote to memory of 2008	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	net.exe
PID 996 wrote to memory of 2008	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	net.exe
PID 2008 wrote to memory of 1160	2008	net.exe	net1.exe
PID 2008 wrote to memory of 1160	2008	net.exe	net1.exe
PID 2008 wrote to memory of 1160	2008	net.exe	net1.exe
PID 2008 wrote to memory of 1160	2008	net.exe	net1.exe
PID 996 wrote to memory of 1632	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	net.exe
PID 996 wrote to memory of 1632	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	net.exe
PID 996 wrote to memory of 1632	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	net.exe
PID 996 wrote to memory of 1632	996	483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe	net.exe
PID 1632 wrote to memory of 1680	1632	net.exe	net1.exe
PID 1632 wrote to memory of 1680	1632	net.exe	net1.exe
PID 1632 wrote to memory of 1680	1632	net.exe	net1.exe
PID 1632 wrote to memory of 1680	1632	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe
"C:\Users\Admin\AppData\Local\Temp\483884e9e0302305078fd649be81d3a28d1050a4ebfd7d356080456b65c02ba8.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:628

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:860

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:2028

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1384

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:980

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1160

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1680

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1620

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
0b62623431aca8571f2f7290a409347d

SHA1
50088996777faa62c93e16cc279a6f42517bc22f

SHA256
260d2ced6c29ceb7418dd56d1e4e8bcac9acb673016f92bba697657d040ab9fe

SHA512
4946b6dfd8ef8469e2f770e534d9bafd2c053ce8b4159f8b580506d6faa52345c586112074ad40d69834d6bdc10a8f61bec2e27325f378563d1671e3af9072d0

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
64e96465bffa879afb344c6000d75266

SHA1
b4931cdfeed78c2e35d954bdab1bba7112a6a4c8

SHA256
ac29ea69b5f48f3b50c5daff277e2aa6d7beee5077347d1fd1f825a098ffc9e9

SHA512
98a01508c4c2df4777ec2f7d58607a26bde2d00b34b5ad8fcee544bdede78277748c778b87bcc53325b4ec7288b3958d42455712251d0ae76d510d499ff89ae8

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
859e57f27302b30f4ad04b9bff5283ae

SHA1
418c39abc0dbc9963fe2d1f9f5e267fc00f98589

SHA256
579dd30667aace49b825dc22da4d5f54ef4e521873357cc22be3a642407412e8

SHA512
0d59972880a8329d7be519492364a8a05ccc322b88ce9c1f40daa853679d0e45f54795a2caa51c3ca8c6cedfe846a09d1885b6a0639b9263236143bb2fcb9533

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
0cd60042855ce720deeac96a1dbda06d

SHA1
c0b36a48e724715e7bd1a717e1a57fef40db2b61

SHA256
8c6f119f213540cfb02aa2090f2d02711b8a7af3459e333dc74015ec722abd85

SHA512
d18e655b95bd84b4ccf2958f698538878eabfbb5530e486d4e2bc55097644d49de81e2f743a402bb6e7d19336468f277bdc6c94573d7bb6b28196ef64b8caeb2

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
0cd60042855ce720deeac96a1dbda06d

SHA1
c0b36a48e724715e7bd1a717e1a57fef40db2b61

SHA256
8c6f119f213540cfb02aa2090f2d02711b8a7af3459e333dc74015ec722abd85

SHA512
d18e655b95bd84b4ccf2958f698538878eabfbb5530e486d4e2bc55097644d49de81e2f743a402bb6e7d19336468f277bdc6c94573d7bb6b28196ef64b8caeb2

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
fe4941d327ff8660ca427e0eff5d6c71

SHA1
440f7b5f1da07eed47895ee56f112d730b96d653

SHA256
dc8faf92bce6e5e9d8b95a46c3e658c2d4c24d4cf6667dcb95e5c2140726018f

SHA512
3e069bcb5812ec3638f0e3201804675e462fc8286e6acbd06898030409aa6c8f568f8753410cae67d620f8b820faea035a3d13068931d3f45d3987aec6be4b90

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
fe4941d327ff8660ca427e0eff5d6c71

SHA1
440f7b5f1da07eed47895ee56f112d730b96d653

SHA256
dc8faf92bce6e5e9d8b95a46c3e658c2d4c24d4cf6667dcb95e5c2140726018f

SHA512
3e069bcb5812ec3638f0e3201804675e462fc8286e6acbd06898030409aa6c8f568f8753410cae67d620f8b820faea035a3d13068931d3f45d3987aec6be4b90

Download Submit
\Users\Admin\AppData\Local\Temp\nsd427F.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsd427F.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd427F.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd427F.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd427F.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
0b62623431aca8571f2f7290a409347d

SHA1
50088996777faa62c93e16cc279a6f42517bc22f

SHA256
260d2ced6c29ceb7418dd56d1e4e8bcac9acb673016f92bba697657d040ab9fe

SHA512
4946b6dfd8ef8469e2f770e534d9bafd2c053ce8b4159f8b580506d6faa52345c586112074ad40d69834d6bdc10a8f61bec2e27325f378563d1671e3af9072d0

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
0b62623431aca8571f2f7290a409347d

SHA1
50088996777faa62c93e16cc279a6f42517bc22f

SHA256
260d2ced6c29ceb7418dd56d1e4e8bcac9acb673016f92bba697657d040ab9fe

SHA512
4946b6dfd8ef8469e2f770e534d9bafd2c053ce8b4159f8b580506d6faa52345c586112074ad40d69834d6bdc10a8f61bec2e27325f378563d1671e3af9072d0

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
0b62623431aca8571f2f7290a409347d

SHA1
50088996777faa62c93e16cc279a6f42517bc22f

SHA256
260d2ced6c29ceb7418dd56d1e4e8bcac9acb673016f92bba697657d040ab9fe

SHA512
4946b6dfd8ef8469e2f770e534d9bafd2c053ce8b4159f8b580506d6faa52345c586112074ad40d69834d6bdc10a8f61bec2e27325f378563d1671e3af9072d0

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
64e96465bffa879afb344c6000d75266

SHA1
b4931cdfeed78c2e35d954bdab1bba7112a6a4c8

SHA256
ac29ea69b5f48f3b50c5daff277e2aa6d7beee5077347d1fd1f825a098ffc9e9

SHA512
98a01508c4c2df4777ec2f7d58607a26bde2d00b34b5ad8fcee544bdede78277748c778b87bcc53325b4ec7288b3958d42455712251d0ae76d510d499ff89ae8

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
64e96465bffa879afb344c6000d75266

SHA1
b4931cdfeed78c2e35d954bdab1bba7112a6a4c8

SHA256
ac29ea69b5f48f3b50c5daff277e2aa6d7beee5077347d1fd1f825a098ffc9e9

SHA512
98a01508c4c2df4777ec2f7d58607a26bde2d00b34b5ad8fcee544bdede78277748c778b87bcc53325b4ec7288b3958d42455712251d0ae76d510d499ff89ae8

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
859e57f27302b30f4ad04b9bff5283ae

SHA1
418c39abc0dbc9963fe2d1f9f5e267fc00f98589

SHA256
579dd30667aace49b825dc22da4d5f54ef4e521873357cc22be3a642407412e8

SHA512
0d59972880a8329d7be519492364a8a05ccc322b88ce9c1f40daa853679d0e45f54795a2caa51c3ca8c6cedfe846a09d1885b6a0639b9263236143bb2fcb9533

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
0cd60042855ce720deeac96a1dbda06d

SHA1
c0b36a48e724715e7bd1a717e1a57fef40db2b61

SHA256
8c6f119f213540cfb02aa2090f2d02711b8a7af3459e333dc74015ec722abd85

SHA512
d18e655b95bd84b4ccf2958f698538878eabfbb5530e486d4e2bc55097644d49de81e2f743a402bb6e7d19336468f277bdc6c94573d7bb6b28196ef64b8caeb2

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
fe4941d327ff8660ca427e0eff5d6c71

SHA1
440f7b5f1da07eed47895ee56f112d730b96d653

SHA256
dc8faf92bce6e5e9d8b95a46c3e658c2d4c24d4cf6667dcb95e5c2140726018f

SHA512
3e069bcb5812ec3638f0e3201804675e462fc8286e6acbd06898030409aa6c8f568f8753410cae67d620f8b820faea035a3d13068931d3f45d3987aec6be4b90

Download Submit
memory/628-58-0x0000000000000000-mapping.dmp

Download
memory/860-60-0x0000000000000000-mapping.dmp

Download
memory/896-63-0x0000000000000000-mapping.dmp

Download
memory/980-75-0x0000000000000000-mapping.dmp

Download
memory/996-54-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download
memory/1160-80-0x0000000000000000-mapping.dmp

Download
memory/1384-69-0x0000000000000000-mapping.dmp

Download
memory/1632-85-0x0000000000000000-mapping.dmp

Download
memory/1680-86-0x0000000000000000-mapping.dmp

Download
memory/1740-57-0x0000000000000000-mapping.dmp

Download
memory/2008-79-0x0000000000000000-mapping.dmp

Download
memory/2028-61-0x0000000000000000-mapping.dmp

Download