40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe
Size

602KB
MD5

9d090143a385773770a118f8fb21d727
SHA1

ae0d0a7c5cea8274c1d77ea5ba73e21f9f2b1b66
SHA256

40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94
SHA512

6d69d8f227b603fbde651a1008c5e9bd80adab988668cd8c56e54d01ceb398f4cc4c09c1092e0b9a6cbf4aa8b74bc06ceb2afa3862aa9c51c20ae8cf9f47d4be
SSDEEP

12288:QIny5DYTNuqVSNG2vOOwxTho5AbbzbArKTo8a9T317TbQUtLUUh:uUTrVSNLOOD6bncrKTNa9hPHtgU

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1412 installd.exe
580 nethtsrv.exe
1748 netupdsrv.exe
1672 nethtsrv.exe
1988 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe

pid	process
1412	installd.exe
580	nethtsrv.exe
1748	netupdsrv.exe
1672	nethtsrv.exe
1988	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe
1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe
1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe
1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe
1412	installd.exe
1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe
580	nethtsrv.exe
580	nethtsrv.exe
1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe
1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe
1672	nethtsrv.exe
1672	nethtsrv.exe
1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe
File created	C:\Windows\SysWOW64\installd.exe	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe

Drops file in Program Files directory 3 IoCs

Processes:

40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1672 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1672	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1688 wrote to memory of 916	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	net.exe
PID 1688 wrote to memory of 916	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	net.exe
PID 1688 wrote to memory of 916	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	net.exe
PID 1688 wrote to memory of 916	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	net.exe
PID 916 wrote to memory of 1552	916	net.exe	net1.exe
PID 916 wrote to memory of 1552	916	net.exe	net1.exe
PID 916 wrote to memory of 1552	916	net.exe	net1.exe
PID 916 wrote to memory of 1552	916	net.exe	net1.exe
PID 1688 wrote to memory of 1556	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	net.exe
PID 1688 wrote to memory of 1556	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	net.exe
PID 1688 wrote to memory of 1556	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	net.exe
PID 1688 wrote to memory of 1556	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	net.exe
PID 1556 wrote to memory of 1416	1556	net.exe	net1.exe
PID 1556 wrote to memory of 1416	1556	net.exe	net1.exe
PID 1556 wrote to memory of 1416	1556	net.exe	net1.exe
PID 1556 wrote to memory of 1416	1556	net.exe	net1.exe
PID 1688 wrote to memory of 1412	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	installd.exe
PID 1688 wrote to memory of 1412	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	installd.exe
PID 1688 wrote to memory of 1412	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	installd.exe
PID 1688 wrote to memory of 1412	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	installd.exe
PID 1688 wrote to memory of 1412	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	installd.exe
PID 1688 wrote to memory of 1412	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	installd.exe
PID 1688 wrote to memory of 1412	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	installd.exe
PID 1688 wrote to memory of 580	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	nethtsrv.exe
PID 1688 wrote to memory of 580	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	nethtsrv.exe
PID 1688 wrote to memory of 580	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	nethtsrv.exe
PID 1688 wrote to memory of 580	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	nethtsrv.exe
PID 1688 wrote to memory of 1748	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	netupdsrv.exe
PID 1688 wrote to memory of 1748	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	netupdsrv.exe
PID 1688 wrote to memory of 1748	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	netupdsrv.exe
PID 1688 wrote to memory of 1748	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	netupdsrv.exe
PID 1688 wrote to memory of 1748	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	netupdsrv.exe
PID 1688 wrote to memory of 1748	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	netupdsrv.exe
PID 1688 wrote to memory of 1748	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	netupdsrv.exe
PID 1688 wrote to memory of 1904	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	net.exe
PID 1688 wrote to memory of 1904	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	net.exe
PID 1688 wrote to memory of 1904	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	net.exe
PID 1688 wrote to memory of 1904	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	net.exe
PID 1904 wrote to memory of 540	1904	net.exe	net1.exe
PID 1904 wrote to memory of 540	1904	net.exe	net1.exe
PID 1904 wrote to memory of 540	1904	net.exe	net1.exe
PID 1904 wrote to memory of 540	1904	net.exe	net1.exe
PID 1688 wrote to memory of 1184	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	net.exe
PID 1688 wrote to memory of 1184	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	net.exe
PID 1688 wrote to memory of 1184	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	net.exe
PID 1688 wrote to memory of 1184	1688	40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe	net.exe
PID 1184 wrote to memory of 1436	1184	net.exe	net1.exe
PID 1184 wrote to memory of 1436	1184	net.exe	net1.exe
PID 1184 wrote to memory of 1436	1184	net.exe	net1.exe
PID 1184 wrote to memory of 1436	1184	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe
"C:\Users\Admin\AppData\Local\Temp\40bd428a38905e3f343028eb339ac37468a96a950389f96d603368fdaf764b94.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1552

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1416

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1412

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1748

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:540

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1436

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1672

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
cf42bc80dd9760d8fcaad14e8a31f078

SHA1
35063d1e54fd1576535caa7c04e3aadc028d8096

SHA256
e5bd3e9ef3349b83c3beecb8ae811e600c6a27b762d3cd72b603c65e8a4bd6ee

SHA512
8d70a4f34b2b41de42b46b89bec50421d4d6fb6df4962571fe50fd6e98cdfb2a0bf8a93ff66e1dc96ace734abb1e678ec0148463b3f943fcddca99923b18a3f4

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
a7c97aeca0a082a5a060a05898c81f78

SHA1
0d1f0470960a6d657ff347349ca8ab53e3ee6b6c

SHA256
7db80e7bd0fcac9d8f0f9df03956b28ef9a3a73882a65cfa9d43f514947aa188

SHA512
10a659d334022247403b97ee604c314da3cc9cb790d63ffd4b0af21ce72dc8dff5da5c6450f067f4e3021ee413bba194c97fd21a9076f7bfb76ebdb7882b2441

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
b57c4f7ad38b832dbe25dbb1cb283e27

SHA1
c88764898e56f9a8058c487ec1774e66586c9c6e

SHA256
5674a9541c885e5740288f02642cc3414590ad1c6c56fd5ed966d82a1d7e43fe

SHA512
c3a5b0e7038b3480c3372454e0f450499864fe6695a7b83cbb39ec372048ad5540f63799aef6990f95b5368a9e6ee5c4355e9bf568d26984d111128d69e9db61

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
c5bc96c9c71ba4c12560527d5a5a5e88

SHA1
b51246d89cb51b4ee24c089e53e4c6b6f0456079

SHA256
5c863032ca6555476157b1475ae063518bdd4e60a4b5e46cd1efc64e59a129b0

SHA512
7eba90f34dc0e59ddddfdc74503691676e0c01c8b2799547768d722d19c44b160cac2da37105b73b8147b25b21fe626eac51fd5bd7352c167427a9b313ab6d69

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
c5bc96c9c71ba4c12560527d5a5a5e88

SHA1
b51246d89cb51b4ee24c089e53e4c6b6f0456079

SHA256
5c863032ca6555476157b1475ae063518bdd4e60a4b5e46cd1efc64e59a129b0

SHA512
7eba90f34dc0e59ddddfdc74503691676e0c01c8b2799547768d722d19c44b160cac2da37105b73b8147b25b21fe626eac51fd5bd7352c167427a9b313ab6d69

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
624bd633476034bce29cdf81c0714ed3

SHA1
f7ccfdff79ecd70a78efdb6e9050be50b4804580

SHA256
8492430cb5d2e34a8ac08565cfe5558b38a7d509d72e9b7d9e7bb94b6a2a328d

SHA512
cd1bd71c7ff3422b532312d864fd2e1f1cf83b812702c041da2a88a6a55972f7287185b43c655be72a5d01dfa7a94bfd57d451b18d8cabe27de2769b6be9f7dd

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
624bd633476034bce29cdf81c0714ed3

SHA1
f7ccfdff79ecd70a78efdb6e9050be50b4804580

SHA256
8492430cb5d2e34a8ac08565cfe5558b38a7d509d72e9b7d9e7bb94b6a2a328d

SHA512
cd1bd71c7ff3422b532312d864fd2e1f1cf83b812702c041da2a88a6a55972f7287185b43c655be72a5d01dfa7a94bfd57d451b18d8cabe27de2769b6be9f7dd

Download Submit
\Users\Admin\AppData\Local\Temp\nst37D.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nst37D.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst37D.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst37D.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst37D.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
cf42bc80dd9760d8fcaad14e8a31f078

SHA1
35063d1e54fd1576535caa7c04e3aadc028d8096

SHA256
e5bd3e9ef3349b83c3beecb8ae811e600c6a27b762d3cd72b603c65e8a4bd6ee

SHA512
8d70a4f34b2b41de42b46b89bec50421d4d6fb6df4962571fe50fd6e98cdfb2a0bf8a93ff66e1dc96ace734abb1e678ec0148463b3f943fcddca99923b18a3f4

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
cf42bc80dd9760d8fcaad14e8a31f078

SHA1
35063d1e54fd1576535caa7c04e3aadc028d8096

SHA256
e5bd3e9ef3349b83c3beecb8ae811e600c6a27b762d3cd72b603c65e8a4bd6ee

SHA512
8d70a4f34b2b41de42b46b89bec50421d4d6fb6df4962571fe50fd6e98cdfb2a0bf8a93ff66e1dc96ace734abb1e678ec0148463b3f943fcddca99923b18a3f4

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
cf42bc80dd9760d8fcaad14e8a31f078

SHA1
35063d1e54fd1576535caa7c04e3aadc028d8096

SHA256
e5bd3e9ef3349b83c3beecb8ae811e600c6a27b762d3cd72b603c65e8a4bd6ee

SHA512
8d70a4f34b2b41de42b46b89bec50421d4d6fb6df4962571fe50fd6e98cdfb2a0bf8a93ff66e1dc96ace734abb1e678ec0148463b3f943fcddca99923b18a3f4

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
a7c97aeca0a082a5a060a05898c81f78

SHA1
0d1f0470960a6d657ff347349ca8ab53e3ee6b6c

SHA256
7db80e7bd0fcac9d8f0f9df03956b28ef9a3a73882a65cfa9d43f514947aa188

SHA512
10a659d334022247403b97ee604c314da3cc9cb790d63ffd4b0af21ce72dc8dff5da5c6450f067f4e3021ee413bba194c97fd21a9076f7bfb76ebdb7882b2441

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
a7c97aeca0a082a5a060a05898c81f78

SHA1
0d1f0470960a6d657ff347349ca8ab53e3ee6b6c

SHA256
7db80e7bd0fcac9d8f0f9df03956b28ef9a3a73882a65cfa9d43f514947aa188

SHA512
10a659d334022247403b97ee604c314da3cc9cb790d63ffd4b0af21ce72dc8dff5da5c6450f067f4e3021ee413bba194c97fd21a9076f7bfb76ebdb7882b2441

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
b57c4f7ad38b832dbe25dbb1cb283e27

SHA1
c88764898e56f9a8058c487ec1774e66586c9c6e

SHA256
5674a9541c885e5740288f02642cc3414590ad1c6c56fd5ed966d82a1d7e43fe

SHA512
c3a5b0e7038b3480c3372454e0f450499864fe6695a7b83cbb39ec372048ad5540f63799aef6990f95b5368a9e6ee5c4355e9bf568d26984d111128d69e9db61

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
c5bc96c9c71ba4c12560527d5a5a5e88

SHA1
b51246d89cb51b4ee24c089e53e4c6b6f0456079

SHA256
5c863032ca6555476157b1475ae063518bdd4e60a4b5e46cd1efc64e59a129b0

SHA512
7eba90f34dc0e59ddddfdc74503691676e0c01c8b2799547768d722d19c44b160cac2da37105b73b8147b25b21fe626eac51fd5bd7352c167427a9b313ab6d69

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
624bd633476034bce29cdf81c0714ed3

SHA1
f7ccfdff79ecd70a78efdb6e9050be50b4804580

SHA256
8492430cb5d2e34a8ac08565cfe5558b38a7d509d72e9b7d9e7bb94b6a2a328d

SHA512
cd1bd71c7ff3422b532312d864fd2e1f1cf83b812702c041da2a88a6a55972f7287185b43c655be72a5d01dfa7a94bfd57d451b18d8cabe27de2769b6be9f7dd

Download Submit
memory/540-82-0x0000000000000000-mapping.dmp

Download
memory/580-70-0x0000000000000000-mapping.dmp

Download
memory/916-57-0x0000000000000000-mapping.dmp

Download
memory/1184-87-0x0000000000000000-mapping.dmp

Download
memory/1412-64-0x0000000000000000-mapping.dmp

Download
memory/1416-62-0x0000000000000000-mapping.dmp

Download
memory/1436-88-0x0000000000000000-mapping.dmp

Download
memory/1552-58-0x0000000000000000-mapping.dmp

Download
memory/1556-61-0x0000000000000000-mapping.dmp

Download
memory/1688-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1688-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1688-79-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1688-59-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1748-76-0x0000000000000000-mapping.dmp

Download
memory/1904-81-0x0000000000000000-mapping.dmp

Download