3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe
Size

602KB
MD5

5d653ba83db753d15124be4fe59682e9
SHA1

a0b8ade5be432b22c7ed1188285fe39b26325404
SHA256

3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c
SHA512

78b415d402f3d2191f7088c3b2e4953ae07d2e060ed5b54e31ced0eb033a79e74d62d25d6fefa21ecb64136a07446bbe1dcc6c1b43d02419fcbded5780d391c6
SSDEEP

12288:UIny5DYTWVXh9m8vjg5V3uOI2jZAzLGIB0JSC+q7M8T:SUTWw205VJjZAzqI9JqA+

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1616 installd.exe
1560 nethtsrv.exe
1816 netupdsrv.exe
1172 nethtsrv.exe
604 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe

pid	process
1616	installd.exe
1560	nethtsrv.exe
1816	netupdsrv.exe
1172	nethtsrv.exe
604	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe
1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe
1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe
1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe
1616	installd.exe
1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe
1560	nethtsrv.exe
1560	nethtsrv.exe
1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe
1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe
1172	nethtsrv.exe
1172	nethtsrv.exe
1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe
File created	C:\Windows\SysWOW64\installd.exe	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe

Drops file in Program Files directory 3 IoCs

Processes:

3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1172 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1172	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1884 wrote to memory of 1612	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	net.exe
PID 1884 wrote to memory of 1612	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	net.exe
PID 1884 wrote to memory of 1612	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	net.exe
PID 1884 wrote to memory of 1612	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	net.exe
PID 1612 wrote to memory of 1768	1612	net.exe	net1.exe
PID 1612 wrote to memory of 1768	1612	net.exe	net1.exe
PID 1612 wrote to memory of 1768	1612	net.exe	net1.exe
PID 1612 wrote to memory of 1768	1612	net.exe	net1.exe
PID 1884 wrote to memory of 972	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	net.exe
PID 1884 wrote to memory of 972	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	net.exe
PID 1884 wrote to memory of 972	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	net.exe
PID 1884 wrote to memory of 972	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	net.exe
PID 972 wrote to memory of 1740	972	net.exe	net1.exe
PID 972 wrote to memory of 1740	972	net.exe	net1.exe
PID 972 wrote to memory of 1740	972	net.exe	net1.exe
PID 972 wrote to memory of 1740	972	net.exe	net1.exe
PID 1884 wrote to memory of 1616	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	installd.exe
PID 1884 wrote to memory of 1616	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	installd.exe
PID 1884 wrote to memory of 1616	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	installd.exe
PID 1884 wrote to memory of 1616	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	installd.exe
PID 1884 wrote to memory of 1616	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	installd.exe
PID 1884 wrote to memory of 1616	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	installd.exe
PID 1884 wrote to memory of 1616	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	installd.exe
PID 1884 wrote to memory of 1560	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	nethtsrv.exe
PID 1884 wrote to memory of 1560	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	nethtsrv.exe
PID 1884 wrote to memory of 1560	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	nethtsrv.exe
PID 1884 wrote to memory of 1560	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	nethtsrv.exe
PID 1884 wrote to memory of 1816	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	netupdsrv.exe
PID 1884 wrote to memory of 1816	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	netupdsrv.exe
PID 1884 wrote to memory of 1816	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	netupdsrv.exe
PID 1884 wrote to memory of 1816	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	netupdsrv.exe
PID 1884 wrote to memory of 1816	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	netupdsrv.exe
PID 1884 wrote to memory of 1816	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	netupdsrv.exe
PID 1884 wrote to memory of 1816	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	netupdsrv.exe
PID 1884 wrote to memory of 1068	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	net.exe
PID 1884 wrote to memory of 1068	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	net.exe
PID 1884 wrote to memory of 1068	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	net.exe
PID 1884 wrote to memory of 1068	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	net.exe
PID 1068 wrote to memory of 1348	1068	net.exe	net1.exe
PID 1068 wrote to memory of 1348	1068	net.exe	net1.exe
PID 1068 wrote to memory of 1348	1068	net.exe	net1.exe
PID 1068 wrote to memory of 1348	1068	net.exe	net1.exe
PID 1884 wrote to memory of 1892	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	net.exe
PID 1884 wrote to memory of 1892	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	net.exe
PID 1884 wrote to memory of 1892	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	net.exe
PID 1884 wrote to memory of 1892	1884	3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe	net.exe
PID 1892 wrote to memory of 884	1892	net.exe	net1.exe
PID 1892 wrote to memory of 884	1892	net.exe	net1.exe
PID 1892 wrote to memory of 884	1892	net.exe	net1.exe
PID 1892 wrote to memory of 884	1892	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe
"C:\Users\Admin\AppData\Local\Temp\3551894fd87a13c726fda6c9441469d520e96528b7e9dd48e4641c621ccda23c.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\net.exe
  net stop nethttpservice
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop nethttpservice
    3⤵
    PID:1768
- C:\Windows\SysWOW64\net.exe
  net stop serviceupdater
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:972
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop serviceupdater
    3⤵
    PID:1740
- C:\Windows\SysWOW64\installd.exe
  "C:\Windows\system32\installd.exe" nethfdrv
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1616
- C:\Windows\SysWOW64\nethtsrv.exe
  "C:\Windows\system32\nethtsrv.exe" -nfdi
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1560
- C:\Windows\SysWOW64\netupdsrv.exe
  "C:\Windows\system32\netupdsrv.exe" -nfdi
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\SysWOW64\net.exe
  net start nethttpservice
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 start nethttpservice
    3⤵
    PID:1348
- C:\Windows\SysWOW64\net.exe
  net start serviceupdater
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 start serviceupdater
    3⤵
    PID:884

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1172

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
daa1d038cc23efae942f98621f190256

SHA1
c55f5319d4809e2818923dcd1f044acd6bbbd4ac

SHA256
20bd624400a0ed50c491dab830afbe1b4ddb355fbcb06589e41250f55cf51c24

SHA512
ef17c0825d763f19642a1e79d6c4d776b267bf9cf762222cbd72639f2d64a23b860eacddce7698400e102412cc2ca5eed77d74b1bbb9108a2fde678b3df4064d

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
413ccfedf1bd5c885dc5562c961a87f6

SHA1
56861ad29f237766cefe26301f414ceec837a564

SHA256
e84da571dba8b569ed24ee58a72e3e68b4117ac493a443cba4f591478ab68fca

SHA512
009356269042a719308b2151b989b927d182e09fe1cd4eedf53a2b45b2847399fd05d97c81ec04e97b7422e936695c9f4e2d70ed518d915e3d94c5a9aa6cfd85

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
abe2d8bda9226deb478467d54c576e99

SHA1
6962674c765a8f09cbbdff08c3a8648bba060dd9

SHA256
8f8ebe4ed88c0d7882e47a72c20d87523101b2f71f44cbd5ec29c5d7e208923a

SHA512
03aa84862831f64476c03c7274594b868c10ae0c980011b2daa1b9970e8cf99c836b544b9b59b52f06bd01e8732ba636260cefcf573a1e39d2c59bd3cac24211

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
797430e73af3b6bc528190a4abfcc2a2

SHA1
b9bda6728808038d9ccdc7d00ca69526c8a9d253

SHA256
6322ecfb13f80dddaafd1e9aba1f4eed2c0d5f0b43a1536d512122dbafba8a32

SHA512
a4d7c93969de86a9739ee2f0620db62897734c771dce01e42e235f54bcfb874eefb0cf99164a18ec1180e2201b37d6d5cdb18676d794c92818d124a6c93d9d1f

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
797430e73af3b6bc528190a4abfcc2a2

SHA1
b9bda6728808038d9ccdc7d00ca69526c8a9d253

SHA256
6322ecfb13f80dddaafd1e9aba1f4eed2c0d5f0b43a1536d512122dbafba8a32

SHA512
a4d7c93969de86a9739ee2f0620db62897734c771dce01e42e235f54bcfb874eefb0cf99164a18ec1180e2201b37d6d5cdb18676d794c92818d124a6c93d9d1f

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
2a7baa8793b1f632db66fa41ba2ebeec

SHA1
09f3aa835f87195f32d7eff65d1c0377a0a7d87c

SHA256
9710ca8868337c7c4c268f26baa4acfd89e16bd9cc5f84474b02c2b04b920c4c

SHA512
3c6a368faed67920df7b2e3a9a55bb6d42d4db8777f9c04b590746df22f62bfb6ec8d13a0bbc31e9394fdb267b0ec6a32eed35c7bd71c6a3cafaef75ab87a17b

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
2a7baa8793b1f632db66fa41ba2ebeec

SHA1
09f3aa835f87195f32d7eff65d1c0377a0a7d87c

SHA256
9710ca8868337c7c4c268f26baa4acfd89e16bd9cc5f84474b02c2b04b920c4c

SHA512
3c6a368faed67920df7b2e3a9a55bb6d42d4db8777f9c04b590746df22f62bfb6ec8d13a0bbc31e9394fdb267b0ec6a32eed35c7bd71c6a3cafaef75ab87a17b

Download Submit
\Users\Admin\AppData\Local\Temp\nso1900.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nso1900.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso1900.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso1900.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso1900.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
daa1d038cc23efae942f98621f190256

SHA1
c55f5319d4809e2818923dcd1f044acd6bbbd4ac

SHA256
20bd624400a0ed50c491dab830afbe1b4ddb355fbcb06589e41250f55cf51c24

SHA512
ef17c0825d763f19642a1e79d6c4d776b267bf9cf762222cbd72639f2d64a23b860eacddce7698400e102412cc2ca5eed77d74b1bbb9108a2fde678b3df4064d

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
daa1d038cc23efae942f98621f190256

SHA1
c55f5319d4809e2818923dcd1f044acd6bbbd4ac

SHA256
20bd624400a0ed50c491dab830afbe1b4ddb355fbcb06589e41250f55cf51c24

SHA512
ef17c0825d763f19642a1e79d6c4d776b267bf9cf762222cbd72639f2d64a23b860eacddce7698400e102412cc2ca5eed77d74b1bbb9108a2fde678b3df4064d

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
daa1d038cc23efae942f98621f190256

SHA1
c55f5319d4809e2818923dcd1f044acd6bbbd4ac

SHA256
20bd624400a0ed50c491dab830afbe1b4ddb355fbcb06589e41250f55cf51c24

SHA512
ef17c0825d763f19642a1e79d6c4d776b267bf9cf762222cbd72639f2d64a23b860eacddce7698400e102412cc2ca5eed77d74b1bbb9108a2fde678b3df4064d

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
413ccfedf1bd5c885dc5562c961a87f6

SHA1
56861ad29f237766cefe26301f414ceec837a564

SHA256
e84da571dba8b569ed24ee58a72e3e68b4117ac493a443cba4f591478ab68fca

SHA512
009356269042a719308b2151b989b927d182e09fe1cd4eedf53a2b45b2847399fd05d97c81ec04e97b7422e936695c9f4e2d70ed518d915e3d94c5a9aa6cfd85

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
413ccfedf1bd5c885dc5562c961a87f6

SHA1
56861ad29f237766cefe26301f414ceec837a564

SHA256
e84da571dba8b569ed24ee58a72e3e68b4117ac493a443cba4f591478ab68fca

SHA512
009356269042a719308b2151b989b927d182e09fe1cd4eedf53a2b45b2847399fd05d97c81ec04e97b7422e936695c9f4e2d70ed518d915e3d94c5a9aa6cfd85

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
abe2d8bda9226deb478467d54c576e99

SHA1
6962674c765a8f09cbbdff08c3a8648bba060dd9

SHA256
8f8ebe4ed88c0d7882e47a72c20d87523101b2f71f44cbd5ec29c5d7e208923a

SHA512
03aa84862831f64476c03c7274594b868c10ae0c980011b2daa1b9970e8cf99c836b544b9b59b52f06bd01e8732ba636260cefcf573a1e39d2c59bd3cac24211

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
797430e73af3b6bc528190a4abfcc2a2

SHA1
b9bda6728808038d9ccdc7d00ca69526c8a9d253

SHA256
6322ecfb13f80dddaafd1e9aba1f4eed2c0d5f0b43a1536d512122dbafba8a32

SHA512
a4d7c93969de86a9739ee2f0620db62897734c771dce01e42e235f54bcfb874eefb0cf99164a18ec1180e2201b37d6d5cdb18676d794c92818d124a6c93d9d1f

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
2a7baa8793b1f632db66fa41ba2ebeec

SHA1
09f3aa835f87195f32d7eff65d1c0377a0a7d87c

SHA256
9710ca8868337c7c4c268f26baa4acfd89e16bd9cc5f84474b02c2b04b920c4c

SHA512
3c6a368faed67920df7b2e3a9a55bb6d42d4db8777f9c04b590746df22f62bfb6ec8d13a0bbc31e9394fdb267b0ec6a32eed35c7bd71c6a3cafaef75ab87a17b

Download Submit
memory/884-88-0x0000000000000000-mapping.dmp

Download
memory/972-61-0x0000000000000000-mapping.dmp

Download
memory/1068-81-0x0000000000000000-mapping.dmp

Download
memory/1348-82-0x0000000000000000-mapping.dmp

Download
memory/1560-71-0x0000000000000000-mapping.dmp

Download
memory/1612-58-0x0000000000000000-mapping.dmp

Download
memory/1616-64-0x0000000000000000-mapping.dmp

Download
memory/1740-62-0x0000000000000000-mapping.dmp

Download
memory/1768-59-0x0000000000000000-mapping.dmp

Download
memory/1816-77-0x0000000000000000-mapping.dmp

Download
memory/1884-54-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/1884-69-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1884-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1884-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1892-87-0x0000000000000000-mapping.dmp

Download