a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d

Analysis

max time kernel
34s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe
Size

602KB
MD5

6a3fb968e3e6f751bf18836bda686bdc
SHA1

189e94b120c942c073a1fb4e3f1619338617bf05
SHA256

a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d
SHA512

3c04d5bf1df8102cef893070cf53bf4724b43e28e05a4813426ffeb735017d9e27394450ce60e89bc895217148ebb7667dda11a908a39cb539f943bab94b27d8
SSDEEP

12288:tIny5DYTcIG69KcmphdVdKgUjWGulyORd3ZwAnCy0J:5UTcZARmphd3iqGuNvZw

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1104 installd.exe
1788 nethtsrv.exe
1144 netupdsrv.exe
1928 nethtsrv.exe
1628 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe

pid	process
1104	installd.exe
1788	nethtsrv.exe
1144	netupdsrv.exe
1928	nethtsrv.exe
1628	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe
1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe
1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe
1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe
1104	installd.exe
1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe
1788	nethtsrv.exe
1788	nethtsrv.exe
1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe
1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe
1928	nethtsrv.exe
1928	nethtsrv.exe
1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe

description	ioc	process
File created	C:\Windows\SysWOW64\nethtsrv.exe	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe
File created	C:\Windows\SysWOW64\installd.exe	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe

Drops file in Program Files directory 3 IoCs

Processes:

a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1928 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1928	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1708 wrote to memory of 1640	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	net.exe
PID 1708 wrote to memory of 1640	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	net.exe
PID 1708 wrote to memory of 1640	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	net.exe
PID 1708 wrote to memory of 1640	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	net.exe
PID 1640 wrote to memory of 1980	1640	net.exe	net1.exe
PID 1640 wrote to memory of 1980	1640	net.exe	net1.exe
PID 1640 wrote to memory of 1980	1640	net.exe	net1.exe
PID 1640 wrote to memory of 1980	1640	net.exe	net1.exe
PID 1708 wrote to memory of 1976	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	net.exe
PID 1708 wrote to memory of 1976	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	net.exe
PID 1708 wrote to memory of 1976	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	net.exe
PID 1708 wrote to memory of 1976	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	net.exe
PID 1976 wrote to memory of 940	1976	net.exe	net1.exe
PID 1976 wrote to memory of 940	1976	net.exe	net1.exe
PID 1976 wrote to memory of 940	1976	net.exe	net1.exe
PID 1976 wrote to memory of 940	1976	net.exe	net1.exe
PID 1708 wrote to memory of 1104	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	installd.exe
PID 1708 wrote to memory of 1104	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	installd.exe
PID 1708 wrote to memory of 1104	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	installd.exe
PID 1708 wrote to memory of 1104	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	installd.exe
PID 1708 wrote to memory of 1104	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	installd.exe
PID 1708 wrote to memory of 1104	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	installd.exe
PID 1708 wrote to memory of 1104	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	installd.exe
PID 1708 wrote to memory of 1788	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	nethtsrv.exe
PID 1708 wrote to memory of 1788	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	nethtsrv.exe
PID 1708 wrote to memory of 1788	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	nethtsrv.exe
PID 1708 wrote to memory of 1788	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	nethtsrv.exe
PID 1708 wrote to memory of 1144	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	netupdsrv.exe
PID 1708 wrote to memory of 1144	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	netupdsrv.exe
PID 1708 wrote to memory of 1144	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	netupdsrv.exe
PID 1708 wrote to memory of 1144	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	netupdsrv.exe
PID 1708 wrote to memory of 1144	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	netupdsrv.exe
PID 1708 wrote to memory of 1144	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	netupdsrv.exe
PID 1708 wrote to memory of 1144	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	netupdsrv.exe
PID 1708 wrote to memory of 520	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	net.exe
PID 1708 wrote to memory of 520	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	net.exe
PID 1708 wrote to memory of 520	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	net.exe
PID 1708 wrote to memory of 520	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	net.exe
PID 520 wrote to memory of 2032	520	net.exe	net1.exe
PID 520 wrote to memory of 2032	520	net.exe	net1.exe
PID 520 wrote to memory of 2032	520	net.exe	net1.exe
PID 520 wrote to memory of 2032	520	net.exe	net1.exe
PID 1708 wrote to memory of 664	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	net.exe
PID 1708 wrote to memory of 664	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	net.exe
PID 1708 wrote to memory of 664	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	net.exe
PID 1708 wrote to memory of 664	1708	a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe	net.exe
PID 664 wrote to memory of 524	664	net.exe	net1.exe
PID 664 wrote to memory of 524	664	net.exe	net1.exe
PID 664 wrote to memory of 524	664	net.exe	net1.exe
PID 664 wrote to memory of 524	664	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe
"C:\Users\Admin\AppData\Local\Temp\a78d8f69b1d0bd351e195f4d1bd58bac489ccb624c95b3fdec2d04a224acc32d.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1980

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:940

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1104

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1144

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:520

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:2032

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:664

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:524

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1928

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
e4edd0abf38a996e1d8e254a9b0915fd

SHA1
56e6670da3ae4d683e4704db52aedccdd3f10abe

SHA256
0760e05000386b61424d8ca8c835a27ecbe17f4d6ee7474391cb326dd2954b25

SHA512
28c7dac539ef5c253009f8aba8f92c5d55eb82135dc51312521e2f5abd9a7efadf8d878c4fda0a38fe6f5a7638f7e3e4836890fb74e7d60b678ca6bac32d37c0

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
92eb30bdb9ff4d293405b2d7cac9de2c

SHA1
db84e55c75a57dc0ca482917e38a54a95d6075cc

SHA256
71938e844d0a7e61df25f5ce4074b93b2bc00bca13da2240ec7e349f3f3ffaff

SHA512
e523b449e83f121f24f2abb2326d220a4b0be15d063a668e972809ff856c37a01f04f10947e76672418626dd012f62bf4c3fbb306dd84117f71fd00987d5a710

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
90d4ee75ecf40c00487ca454e2800f5c

SHA1
d8aef75c59bd523323daf94388acfa34f5466b81

SHA256
1b2f28700d6f8966c089022b9278723b5108d54299402fbdd49c09d24736940d

SHA512
b1352847509dc14f035f933ce80e53869f193e5353df7b08f7231c809b5282688b38fdd64db46d1693fb469218865767f461b360d2dfd5bfdb304894362d11b6

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
7ec253f18624f3629b5564b19ff7bf9c

SHA1
6f54c40762d81d9a90e73647c5ee72ec175913b8

SHA256
c745dc27540f64f4cee8a3a84854ed68ebf26c64c069049ac5034ed7f55c6b2c

SHA512
83493a0be2eabe5a461d17f7d87c8587b608ed05380114e8e805f92b9240d58fd710a69d69d1430a301777f48773a2e3f9ab652d7b8ffd319a0a2ce5b57ef5d4

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
7ec253f18624f3629b5564b19ff7bf9c

SHA1
6f54c40762d81d9a90e73647c5ee72ec175913b8

SHA256
c745dc27540f64f4cee8a3a84854ed68ebf26c64c069049ac5034ed7f55c6b2c

SHA512
83493a0be2eabe5a461d17f7d87c8587b608ed05380114e8e805f92b9240d58fd710a69d69d1430a301777f48773a2e3f9ab652d7b8ffd319a0a2ce5b57ef5d4

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
bb2cdf95339ab6eb9e880576ac5d440a

SHA1
00b0b83c412192cbe0e272df6129a9f4059c153b

SHA256
576ec8b4b5f51473e17e443988f3b6eaa9c32164f6c83c6ca7eabcd1249deae7

SHA512
32e3929385d22b78e7f5fa07dd630365cb90399ef03a83180f92f1e55d17aaa61f62ad8bfee2df93a64254cb4b83d40566853de695ae0fa11723bbd1bc9760cb

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
bb2cdf95339ab6eb9e880576ac5d440a

SHA1
00b0b83c412192cbe0e272df6129a9f4059c153b

SHA256
576ec8b4b5f51473e17e443988f3b6eaa9c32164f6c83c6ca7eabcd1249deae7

SHA512
32e3929385d22b78e7f5fa07dd630365cb90399ef03a83180f92f1e55d17aaa61f62ad8bfee2df93a64254cb4b83d40566853de695ae0fa11723bbd1bc9760cb

Download Submit
\Users\Admin\AppData\Local\Temp\nsd7ED3.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsd7ED3.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd7ED3.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd7ED3.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd7ED3.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
e4edd0abf38a996e1d8e254a9b0915fd

SHA1
56e6670da3ae4d683e4704db52aedccdd3f10abe

SHA256
0760e05000386b61424d8ca8c835a27ecbe17f4d6ee7474391cb326dd2954b25

SHA512
28c7dac539ef5c253009f8aba8f92c5d55eb82135dc51312521e2f5abd9a7efadf8d878c4fda0a38fe6f5a7638f7e3e4836890fb74e7d60b678ca6bac32d37c0

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
e4edd0abf38a996e1d8e254a9b0915fd

SHA1
56e6670da3ae4d683e4704db52aedccdd3f10abe

SHA256
0760e05000386b61424d8ca8c835a27ecbe17f4d6ee7474391cb326dd2954b25

SHA512
28c7dac539ef5c253009f8aba8f92c5d55eb82135dc51312521e2f5abd9a7efadf8d878c4fda0a38fe6f5a7638f7e3e4836890fb74e7d60b678ca6bac32d37c0

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
e4edd0abf38a996e1d8e254a9b0915fd

SHA1
56e6670da3ae4d683e4704db52aedccdd3f10abe

SHA256
0760e05000386b61424d8ca8c835a27ecbe17f4d6ee7474391cb326dd2954b25

SHA512
28c7dac539ef5c253009f8aba8f92c5d55eb82135dc51312521e2f5abd9a7efadf8d878c4fda0a38fe6f5a7638f7e3e4836890fb74e7d60b678ca6bac32d37c0

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
92eb30bdb9ff4d293405b2d7cac9de2c

SHA1
db84e55c75a57dc0ca482917e38a54a95d6075cc

SHA256
71938e844d0a7e61df25f5ce4074b93b2bc00bca13da2240ec7e349f3f3ffaff

SHA512
e523b449e83f121f24f2abb2326d220a4b0be15d063a668e972809ff856c37a01f04f10947e76672418626dd012f62bf4c3fbb306dd84117f71fd00987d5a710

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
92eb30bdb9ff4d293405b2d7cac9de2c

SHA1
db84e55c75a57dc0ca482917e38a54a95d6075cc

SHA256
71938e844d0a7e61df25f5ce4074b93b2bc00bca13da2240ec7e349f3f3ffaff

SHA512
e523b449e83f121f24f2abb2326d220a4b0be15d063a668e972809ff856c37a01f04f10947e76672418626dd012f62bf4c3fbb306dd84117f71fd00987d5a710

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
90d4ee75ecf40c00487ca454e2800f5c

SHA1
d8aef75c59bd523323daf94388acfa34f5466b81

SHA256
1b2f28700d6f8966c089022b9278723b5108d54299402fbdd49c09d24736940d

SHA512
b1352847509dc14f035f933ce80e53869f193e5353df7b08f7231c809b5282688b38fdd64db46d1693fb469218865767f461b360d2dfd5bfdb304894362d11b6

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
7ec253f18624f3629b5564b19ff7bf9c

SHA1
6f54c40762d81d9a90e73647c5ee72ec175913b8

SHA256
c745dc27540f64f4cee8a3a84854ed68ebf26c64c069049ac5034ed7f55c6b2c

SHA512
83493a0be2eabe5a461d17f7d87c8587b608ed05380114e8e805f92b9240d58fd710a69d69d1430a301777f48773a2e3f9ab652d7b8ffd319a0a2ce5b57ef5d4

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
bb2cdf95339ab6eb9e880576ac5d440a

SHA1
00b0b83c412192cbe0e272df6129a9f4059c153b

SHA256
576ec8b4b5f51473e17e443988f3b6eaa9c32164f6c83c6ca7eabcd1249deae7

SHA512
32e3929385d22b78e7f5fa07dd630365cb90399ef03a83180f92f1e55d17aaa61f62ad8bfee2df93a64254cb4b83d40566853de695ae0fa11723bbd1bc9760cb

Download Submit
memory/520-80-0x0000000000000000-mapping.dmp

Download
memory/524-87-0x0000000000000000-mapping.dmp

Download
memory/664-86-0x0000000000000000-mapping.dmp

Download
memory/940-62-0x0000000000000000-mapping.dmp

Download
memory/1104-64-0x0000000000000000-mapping.dmp

Download
memory/1144-76-0x0000000000000000-mapping.dmp

Download
memory/1640-58-0x0000000000000000-mapping.dmp

Download
memory/1708-54-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/1708-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1708-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1788-70-0x0000000000000000-mapping.dmp

Download
memory/1976-61-0x0000000000000000-mapping.dmp

Download
memory/1980-59-0x0000000000000000-mapping.dmp

Download
memory/2032-81-0x0000000000000000-mapping.dmp

Download