aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd

Analysis

max time kernel
28s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe
Size

603KB
MD5

d6571024fa19008406bd56839f06a9be
SHA1

0376972f02d28665a9baaeaf23581169087088ef
SHA256

aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd
SHA512

1bab29762be9bc9493ab442d58177ebaff10f5d172aaeef0a6371ed7b5e7922942694d99f8574cbd950c717d04a5357d732a27e087a46c9cc7354173e56507f0
SSDEEP

12288:sIny5DYTMIaN9jks7qP1wLjDVxt5K7sct6to9xxSdVoyd7:qUTMRN/EGj5xvP66to9Zy

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

2020 installd.exe
668 nethtsrv.exe
1320 netupdsrv.exe
1496 nethtsrv.exe
1512 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe

pid	process
2020	installd.exe
668	nethtsrv.exe
1320	netupdsrv.exe
1496	nethtsrv.exe
1512	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe
1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe
1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe
1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe
2020	installd.exe
1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe
668	nethtsrv.exe
668	nethtsrv.exe
1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe
1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe
1496	nethtsrv.exe
1496	nethtsrv.exe
1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe

description	ioc	process
File created	C:\Windows\SysWOW64\installd.exe	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe

Drops file in Program Files directory 3 IoCs

Processes:

aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe
File created	C:\Program Files (x86)\Common Files\Config\data.xml	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

468
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1496 nethtsrv.exe

pid	process
468

description	pid	process
Token: SeDebugPrivilege	1496	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1788 wrote to memory of 1000	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	net.exe
PID 1788 wrote to memory of 1000	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	net.exe
PID 1788 wrote to memory of 1000	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	net.exe
PID 1788 wrote to memory of 1000	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	net.exe
PID 1000 wrote to memory of 1244	1000	net.exe	net1.exe
PID 1000 wrote to memory of 1244	1000	net.exe	net1.exe
PID 1000 wrote to memory of 1244	1000	net.exe	net1.exe
PID 1000 wrote to memory of 1244	1000	net.exe	net1.exe
PID 1788 wrote to memory of 2028	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	net.exe
PID 1788 wrote to memory of 2028	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	net.exe
PID 1788 wrote to memory of 2028	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	net.exe
PID 1788 wrote to memory of 2028	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	net.exe
PID 2028 wrote to memory of 1772	2028	net.exe	net1.exe
PID 2028 wrote to memory of 1772	2028	net.exe	net1.exe
PID 2028 wrote to memory of 1772	2028	net.exe	net1.exe
PID 2028 wrote to memory of 1772	2028	net.exe	net1.exe
PID 1788 wrote to memory of 2020	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	installd.exe
PID 1788 wrote to memory of 2020	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	installd.exe
PID 1788 wrote to memory of 2020	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	installd.exe
PID 1788 wrote to memory of 2020	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	installd.exe
PID 1788 wrote to memory of 2020	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	installd.exe
PID 1788 wrote to memory of 2020	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	installd.exe
PID 1788 wrote to memory of 2020	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	installd.exe
PID 1788 wrote to memory of 668	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	nethtsrv.exe
PID 1788 wrote to memory of 668	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	nethtsrv.exe
PID 1788 wrote to memory of 668	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	nethtsrv.exe
PID 1788 wrote to memory of 668	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	nethtsrv.exe
PID 1788 wrote to memory of 1320	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	netupdsrv.exe
PID 1788 wrote to memory of 1320	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	netupdsrv.exe
PID 1788 wrote to memory of 1320	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	netupdsrv.exe
PID 1788 wrote to memory of 1320	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	netupdsrv.exe
PID 1788 wrote to memory of 1320	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	netupdsrv.exe
PID 1788 wrote to memory of 1320	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	netupdsrv.exe
PID 1788 wrote to memory of 1320	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	netupdsrv.exe
PID 1788 wrote to memory of 1932	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	net.exe
PID 1788 wrote to memory of 1932	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	net.exe
PID 1788 wrote to memory of 1932	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	net.exe
PID 1788 wrote to memory of 1932	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	net.exe
PID 1932 wrote to memory of 1980	1932	net.exe	net1.exe
PID 1932 wrote to memory of 1980	1932	net.exe	net1.exe
PID 1932 wrote to memory of 1980	1932	net.exe	net1.exe
PID 1932 wrote to memory of 1980	1932	net.exe	net1.exe
PID 1788 wrote to memory of 1864	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	net.exe
PID 1788 wrote to memory of 1864	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	net.exe
PID 1788 wrote to memory of 1864	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	net.exe
PID 1788 wrote to memory of 1864	1788	aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe	net.exe
PID 1864 wrote to memory of 972	1864	net.exe	net1.exe
PID 1864 wrote to memory of 972	1864	net.exe	net1.exe
PID 1864 wrote to memory of 972	1864	net.exe	net1.exe
PID 1864 wrote to memory of 972	1864	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe
"C:\Users\Admin\AppData\Local\Temp\aaa61569b98601851c75d27aa39f63404efcf5bcb63482e312a55282b29340cd.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1244

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1772

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:668

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1320

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1980

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1864

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:972

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1496

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1512

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
3a0e3c1b9937781e688085979d812bc0

SHA1
4fd8fdcc9f5f4d87a055cdc328d402ea82ec6086

SHA256
1c717361d822d95db24019c8a500a67864ab04f319f9e069f58503b485b5ab8a

SHA512
ad1a0378338f0bd4579fb4fd4b61f957aa7bd8d386bb7228445c5bb8691934ffe316904a9b106471da2a622c28a4644a5a95ef5c46711de8aabef90eec038958

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
fa0657de4e23e8006f184c6077263afd

SHA1
24c6a57691861d62eee9ace77794915013cf2ceb

SHA256
c1878b384bbbac62fe7fd2e5f027cd289d387bacc159712343cff8a5f0d11f01

SHA512
8faa40761151783a0b314e8ddbadb28225c95993e0042446be741990e8fde78250e7c793422637c60c6389b010cac752d0eab54f1a5947293594877a3c74e28b

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
b6ec9ea13ce80e181e93a518c0dba0c8

SHA1
ec9ecd02c9c5cbb57c650cad36dde7c9d248c902

SHA256
ce4839b0fcb03816ae423684a61466a3b6036115af5e00658f2548816d80583c

SHA512
f318ca83866f38cf32f2937e9430fdd7fa14864a0749df87466c8bb56a24c0c0002bf7f73af156f833a53690c562e24a7dd7dfd7f254fd4c3dc803e9c6888397

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
a4c6eddea88f01871a5b4484610d6ed5

SHA1
36221db01ead1cbe6a03f5319c8d1846f535d963

SHA256
1d5a3d85f48324d4f6819a2335b619d3217675956972ca37f384b5755a55bd5f

SHA512
c724f047abd6b3e63a3f5bf23d358fd4c2e1672b56146035cb1acec84c262c58ea26a564b74e2fd10d5208659d1da1d1eded4003ad03834f46c65036b321607e

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
a4c6eddea88f01871a5b4484610d6ed5

SHA1
36221db01ead1cbe6a03f5319c8d1846f535d963

SHA256
1d5a3d85f48324d4f6819a2335b619d3217675956972ca37f384b5755a55bd5f

SHA512
c724f047abd6b3e63a3f5bf23d358fd4c2e1672b56146035cb1acec84c262c58ea26a564b74e2fd10d5208659d1da1d1eded4003ad03834f46c65036b321607e

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
6968bdd9c207b7535e890fd821509c2b

SHA1
2479c44fadad6a79ef879c2fadf91ac065b717fd

SHA256
8a78da2d955f5971e728e611608cd12cf10dcfe93ebb66fa56a60a34540ea246

SHA512
41775b98490b826c6382bd9bf4561b4a661165909c7fb1969acb09d9ace9e3be7b480902e2e379970f02dfeb2e89c9983d45772f40f98c3f2e063c26f00ef654

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
6968bdd9c207b7535e890fd821509c2b

SHA1
2479c44fadad6a79ef879c2fadf91ac065b717fd

SHA256
8a78da2d955f5971e728e611608cd12cf10dcfe93ebb66fa56a60a34540ea246

SHA512
41775b98490b826c6382bd9bf4561b4a661165909c7fb1969acb09d9ace9e3be7b480902e2e379970f02dfeb2e89c9983d45772f40f98c3f2e063c26f00ef654

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2149.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2149.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2149.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2149.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2149.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
3a0e3c1b9937781e688085979d812bc0

SHA1
4fd8fdcc9f5f4d87a055cdc328d402ea82ec6086

SHA256
1c717361d822d95db24019c8a500a67864ab04f319f9e069f58503b485b5ab8a

SHA512
ad1a0378338f0bd4579fb4fd4b61f957aa7bd8d386bb7228445c5bb8691934ffe316904a9b106471da2a622c28a4644a5a95ef5c46711de8aabef90eec038958

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
3a0e3c1b9937781e688085979d812bc0

SHA1
4fd8fdcc9f5f4d87a055cdc328d402ea82ec6086

SHA256
1c717361d822d95db24019c8a500a67864ab04f319f9e069f58503b485b5ab8a

SHA512
ad1a0378338f0bd4579fb4fd4b61f957aa7bd8d386bb7228445c5bb8691934ffe316904a9b106471da2a622c28a4644a5a95ef5c46711de8aabef90eec038958

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
3a0e3c1b9937781e688085979d812bc0

SHA1
4fd8fdcc9f5f4d87a055cdc328d402ea82ec6086

SHA256
1c717361d822d95db24019c8a500a67864ab04f319f9e069f58503b485b5ab8a

SHA512
ad1a0378338f0bd4579fb4fd4b61f957aa7bd8d386bb7228445c5bb8691934ffe316904a9b106471da2a622c28a4644a5a95ef5c46711de8aabef90eec038958

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
fa0657de4e23e8006f184c6077263afd

SHA1
24c6a57691861d62eee9ace77794915013cf2ceb

SHA256
c1878b384bbbac62fe7fd2e5f027cd289d387bacc159712343cff8a5f0d11f01

SHA512
8faa40761151783a0b314e8ddbadb28225c95993e0042446be741990e8fde78250e7c793422637c60c6389b010cac752d0eab54f1a5947293594877a3c74e28b

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
fa0657de4e23e8006f184c6077263afd

SHA1
24c6a57691861d62eee9ace77794915013cf2ceb

SHA256
c1878b384bbbac62fe7fd2e5f027cd289d387bacc159712343cff8a5f0d11f01

SHA512
8faa40761151783a0b314e8ddbadb28225c95993e0042446be741990e8fde78250e7c793422637c60c6389b010cac752d0eab54f1a5947293594877a3c74e28b

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
b6ec9ea13ce80e181e93a518c0dba0c8

SHA1
ec9ecd02c9c5cbb57c650cad36dde7c9d248c902

SHA256
ce4839b0fcb03816ae423684a61466a3b6036115af5e00658f2548816d80583c

SHA512
f318ca83866f38cf32f2937e9430fdd7fa14864a0749df87466c8bb56a24c0c0002bf7f73af156f833a53690c562e24a7dd7dfd7f254fd4c3dc803e9c6888397

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
a4c6eddea88f01871a5b4484610d6ed5

SHA1
36221db01ead1cbe6a03f5319c8d1846f535d963

SHA256
1d5a3d85f48324d4f6819a2335b619d3217675956972ca37f384b5755a55bd5f

SHA512
c724f047abd6b3e63a3f5bf23d358fd4c2e1672b56146035cb1acec84c262c58ea26a564b74e2fd10d5208659d1da1d1eded4003ad03834f46c65036b321607e

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
6968bdd9c207b7535e890fd821509c2b

SHA1
2479c44fadad6a79ef879c2fadf91ac065b717fd

SHA256
8a78da2d955f5971e728e611608cd12cf10dcfe93ebb66fa56a60a34540ea246

SHA512
41775b98490b826c6382bd9bf4561b4a661165909c7fb1969acb09d9ace9e3be7b480902e2e379970f02dfeb2e89c9983d45772f40f98c3f2e063c26f00ef654

Download Submit
memory/668-70-0x0000000000000000-mapping.dmp

Download
memory/972-87-0x0000000000000000-mapping.dmp

Download
memory/1000-57-0x0000000000000000-mapping.dmp

Download
memory/1244-58-0x0000000000000000-mapping.dmp

Download
memory/1320-76-0x0000000000000000-mapping.dmp

Download
memory/1772-62-0x0000000000000000-mapping.dmp

Download
memory/1788-54-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download
memory/1788-59-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1788-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1864-86-0x0000000000000000-mapping.dmp

Download
memory/1932-80-0x0000000000000000-mapping.dmp

Download
memory/1980-81-0x0000000000000000-mapping.dmp

Download
memory/2020-64-0x0000000000000000-mapping.dmp

Download
memory/2028-61-0x0000000000000000-mapping.dmp

Download