af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839

Analysis

max time kernel
47s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe
Size

602KB
MD5

8a62d17432146f2739f4558f043bfac2
SHA1

661290adc5cf61ce5011a1fd1b52a8dc99827b20
SHA256

af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839
SHA512

48e551a8dcef4bcf9c15ffe18613923563df89a144ef5f1716ad40cf328913970f147ae246977b2fbabed330fb83be9b1fd87003dec89a66d706805e82a9d66b
SSDEEP

12288:/Iny5DYTPqAuhgKOA7l2FO2hCBpNMoCkD0kE31ImtW:nUTPqAuW4l2bwfNMoPgkOE

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1296 installd.exe
1712 nethtsrv.exe
628 netupdsrv.exe
956 nethtsrv.exe
652 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe

pid	process
1296	installd.exe
1712	nethtsrv.exe
628	netupdsrv.exe
956	nethtsrv.exe
652	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe
1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe
1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe
1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe
1296	installd.exe
1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe
1712	nethtsrv.exe
1712	nethtsrv.exe
1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe
1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe
956	nethtsrv.exe
956	nethtsrv.exe
1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe
File created	C:\Windows\SysWOW64\installd.exe	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe

Drops file in Program Files directory 3 IoCs

Processes:

af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe
File created	C:\Program Files (x86)\Common Files\Config\data.xml	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 956 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	956	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1656 wrote to memory of 684	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	net.exe
PID 1656 wrote to memory of 684	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	net.exe
PID 1656 wrote to memory of 684	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	net.exe
PID 1656 wrote to memory of 684	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	net.exe
PID 684 wrote to memory of 584	684	net.exe	net1.exe
PID 684 wrote to memory of 584	684	net.exe	net1.exe
PID 684 wrote to memory of 584	684	net.exe	net1.exe
PID 684 wrote to memory of 584	684	net.exe	net1.exe
PID 1656 wrote to memory of 788	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	net.exe
PID 1656 wrote to memory of 788	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	net.exe
PID 1656 wrote to memory of 788	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	net.exe
PID 1656 wrote to memory of 788	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	net.exe
PID 788 wrote to memory of 1292	788	net.exe	net1.exe
PID 788 wrote to memory of 1292	788	net.exe	net1.exe
PID 788 wrote to memory of 1292	788	net.exe	net1.exe
PID 788 wrote to memory of 1292	788	net.exe	net1.exe
PID 1656 wrote to memory of 1296	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	installd.exe
PID 1656 wrote to memory of 1296	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	installd.exe
PID 1656 wrote to memory of 1296	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	installd.exe
PID 1656 wrote to memory of 1296	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	installd.exe
PID 1656 wrote to memory of 1296	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	installd.exe
PID 1656 wrote to memory of 1296	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	installd.exe
PID 1656 wrote to memory of 1296	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	installd.exe
PID 1656 wrote to memory of 1712	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	nethtsrv.exe
PID 1656 wrote to memory of 1712	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	nethtsrv.exe
PID 1656 wrote to memory of 1712	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	nethtsrv.exe
PID 1656 wrote to memory of 1712	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	nethtsrv.exe
PID 1656 wrote to memory of 628	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	netupdsrv.exe
PID 1656 wrote to memory of 628	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	netupdsrv.exe
PID 1656 wrote to memory of 628	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	netupdsrv.exe
PID 1656 wrote to memory of 628	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	netupdsrv.exe
PID 1656 wrote to memory of 628	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	netupdsrv.exe
PID 1656 wrote to memory of 628	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	netupdsrv.exe
PID 1656 wrote to memory of 628	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	netupdsrv.exe
PID 1656 wrote to memory of 1048	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	net.exe
PID 1656 wrote to memory of 1048	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	net.exe
PID 1656 wrote to memory of 1048	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	net.exe
PID 1656 wrote to memory of 1048	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	net.exe
PID 1048 wrote to memory of 1644	1048	net.exe	net1.exe
PID 1048 wrote to memory of 1644	1048	net.exe	net1.exe
PID 1048 wrote to memory of 1644	1048	net.exe	net1.exe
PID 1048 wrote to memory of 1644	1048	net.exe	net1.exe
PID 1656 wrote to memory of 1360	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	net.exe
PID 1656 wrote to memory of 1360	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	net.exe
PID 1656 wrote to memory of 1360	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	net.exe
PID 1656 wrote to memory of 1360	1656	af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe	net.exe
PID 1360 wrote to memory of 1008	1360	net.exe	net1.exe
PID 1360 wrote to memory of 1008	1360	net.exe	net1.exe
PID 1360 wrote to memory of 1008	1360	net.exe	net1.exe
PID 1360 wrote to memory of 1008	1360	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe
"C:\Users\Admin\AppData\Local\Temp\af9024b5c1a669c483761dfea6d33c21fb7fb4b80582c297fb80cc27c7cc4839.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:684

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:584

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:788

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1292

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:628

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1644

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1360

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1008

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:956

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
0cc81b9485234038bfadb252fb49eccd

SHA1
8e8eb0b38caef798f1752d72035e6b08c98b8221

SHA256
e2997e80239dd018718057f522d510daf18d4a490b35034f5aa1ada35680806a

SHA512
512c5703095f3a37c1b8e0a7cfa1ac4d6c12fb59d97062554ab1897cda78f0e9ce7ce48f12dcdc7be77e48f0d732ee05973aa3b83a7c9ded2cf073931d37e198

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
27044caa659d606a768c4c572b712596

SHA1
6f75ca3cb7368d4d16b9485a7ae12e469b127784

SHA256
b906b8b0e1a4ad2212dfcd830b001ac9f25a2c2b25bc555abcea7c4744c600fd

SHA512
ef36ca669729485ebfb3f9fd16bb2098fa1a1ef42f67a15a57e2a9e11776da90320ec94f5ac0a6e478dc7d433d727d791c8427e13a8ba6b71af315d3eeeab682

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
978d73a1255a81ad41bd074dc581dd9b

SHA1
60ce88f59b2060d34f33fd1c9c6755ef265afe94

SHA256
53dfac53e5dde6bc3ea6c701781e0c049fab244639ebc411593be11382c1ae08

SHA512
f6ce9c7f71805b20c3b8ad88b5b46c212bf9b84103e453a92f1aeee82773af0f0f821d9fbf6bff12930ed89aebd8e67436f97d24fbbe2825d520421c0fb71206

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
00c28adf8187f2ba153cf974ec500aad

SHA1
0d77e3cc633791e49c961cca3365415538f72db7

SHA256
6f0f01791b75b6ba57880cd4a22b21ea3dc3603723eadac9667a2655445ef2dd

SHA512
f7c44144f92d8f44ba6f8d527a6ce15b3b7118e3f8b8e4a7300c5aa20217c09bd7899593e6fe4f896b40e90ed11d4c239b970fbe0263f8d00a107bba8a15645d

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
00c28adf8187f2ba153cf974ec500aad

SHA1
0d77e3cc633791e49c961cca3365415538f72db7

SHA256
6f0f01791b75b6ba57880cd4a22b21ea3dc3603723eadac9667a2655445ef2dd

SHA512
f7c44144f92d8f44ba6f8d527a6ce15b3b7118e3f8b8e4a7300c5aa20217c09bd7899593e6fe4f896b40e90ed11d4c239b970fbe0263f8d00a107bba8a15645d

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
f74382d2aa37eca12b40c3f478e1683b

SHA1
4b6526a323c591d4e36872e05d09f540de11071f

SHA256
311f6072d5bcab37bd234088cb4cb3999a53c74bb076545be1a0a0341a00ed8f

SHA512
ffdb04f719e29adda55310e3748f52a07345241008f4d2041e9ae60e9d9348b7235bd2faf1e013219631fd09949aab7fe9aebc7e08411bee77383035c915f3dc

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
f74382d2aa37eca12b40c3f478e1683b

SHA1
4b6526a323c591d4e36872e05d09f540de11071f

SHA256
311f6072d5bcab37bd234088cb4cb3999a53c74bb076545be1a0a0341a00ed8f

SHA512
ffdb04f719e29adda55310e3748f52a07345241008f4d2041e9ae60e9d9348b7235bd2faf1e013219631fd09949aab7fe9aebc7e08411bee77383035c915f3dc

Download Submit
\Users\Admin\AppData\Local\Temp\nst9DA9.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nst9DA9.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst9DA9.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst9DA9.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst9DA9.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
0cc81b9485234038bfadb252fb49eccd

SHA1
8e8eb0b38caef798f1752d72035e6b08c98b8221

SHA256
e2997e80239dd018718057f522d510daf18d4a490b35034f5aa1ada35680806a

SHA512
512c5703095f3a37c1b8e0a7cfa1ac4d6c12fb59d97062554ab1897cda78f0e9ce7ce48f12dcdc7be77e48f0d732ee05973aa3b83a7c9ded2cf073931d37e198

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
0cc81b9485234038bfadb252fb49eccd

SHA1
8e8eb0b38caef798f1752d72035e6b08c98b8221

SHA256
e2997e80239dd018718057f522d510daf18d4a490b35034f5aa1ada35680806a

SHA512
512c5703095f3a37c1b8e0a7cfa1ac4d6c12fb59d97062554ab1897cda78f0e9ce7ce48f12dcdc7be77e48f0d732ee05973aa3b83a7c9ded2cf073931d37e198

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
0cc81b9485234038bfadb252fb49eccd

SHA1
8e8eb0b38caef798f1752d72035e6b08c98b8221

SHA256
e2997e80239dd018718057f522d510daf18d4a490b35034f5aa1ada35680806a

SHA512
512c5703095f3a37c1b8e0a7cfa1ac4d6c12fb59d97062554ab1897cda78f0e9ce7ce48f12dcdc7be77e48f0d732ee05973aa3b83a7c9ded2cf073931d37e198

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
27044caa659d606a768c4c572b712596

SHA1
6f75ca3cb7368d4d16b9485a7ae12e469b127784

SHA256
b906b8b0e1a4ad2212dfcd830b001ac9f25a2c2b25bc555abcea7c4744c600fd

SHA512
ef36ca669729485ebfb3f9fd16bb2098fa1a1ef42f67a15a57e2a9e11776da90320ec94f5ac0a6e478dc7d433d727d791c8427e13a8ba6b71af315d3eeeab682

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
27044caa659d606a768c4c572b712596

SHA1
6f75ca3cb7368d4d16b9485a7ae12e469b127784

SHA256
b906b8b0e1a4ad2212dfcd830b001ac9f25a2c2b25bc555abcea7c4744c600fd

SHA512
ef36ca669729485ebfb3f9fd16bb2098fa1a1ef42f67a15a57e2a9e11776da90320ec94f5ac0a6e478dc7d433d727d791c8427e13a8ba6b71af315d3eeeab682

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
978d73a1255a81ad41bd074dc581dd9b

SHA1
60ce88f59b2060d34f33fd1c9c6755ef265afe94

SHA256
53dfac53e5dde6bc3ea6c701781e0c049fab244639ebc411593be11382c1ae08

SHA512
f6ce9c7f71805b20c3b8ad88b5b46c212bf9b84103e453a92f1aeee82773af0f0f821d9fbf6bff12930ed89aebd8e67436f97d24fbbe2825d520421c0fb71206

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
00c28adf8187f2ba153cf974ec500aad

SHA1
0d77e3cc633791e49c961cca3365415538f72db7

SHA256
6f0f01791b75b6ba57880cd4a22b21ea3dc3603723eadac9667a2655445ef2dd

SHA512
f7c44144f92d8f44ba6f8d527a6ce15b3b7118e3f8b8e4a7300c5aa20217c09bd7899593e6fe4f896b40e90ed11d4c239b970fbe0263f8d00a107bba8a15645d

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
f74382d2aa37eca12b40c3f478e1683b

SHA1
4b6526a323c591d4e36872e05d09f540de11071f

SHA256
311f6072d5bcab37bd234088cb4cb3999a53c74bb076545be1a0a0341a00ed8f

SHA512
ffdb04f719e29adda55310e3748f52a07345241008f4d2041e9ae60e9d9348b7235bd2faf1e013219631fd09949aab7fe9aebc7e08411bee77383035c915f3dc

Download Submit
memory/584-59-0x0000000000000000-mapping.dmp

Download
memory/628-76-0x0000000000000000-mapping.dmp

Download
memory/684-58-0x0000000000000000-mapping.dmp

Download
memory/788-61-0x0000000000000000-mapping.dmp

Download
memory/1008-87-0x0000000000000000-mapping.dmp

Download
memory/1048-80-0x0000000000000000-mapping.dmp

Download
memory/1292-62-0x0000000000000000-mapping.dmp

Download
memory/1296-64-0x0000000000000000-mapping.dmp

Download
memory/1360-86-0x0000000000000000-mapping.dmp

Download
memory/1644-81-0x0000000000000000-mapping.dmp

Download
memory/1656-54-0x0000000075F61000-0x0000000075F63000-memory.dmp

Filesize
8KB

Download
memory/1656-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1656-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1712-70-0x0000000000000000-mapping.dmp

Download