1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe
Size

603KB
MD5

00d40c14b2ae7f9ea1a29cbfa3843840
SHA1

5851f452fcae14c096478bee206baf98cd40060e
SHA256

1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e
SHA512

9d8921f2e40ccd19e118f52d81f7ba482c5787578fb1a6951dd2fbea214d3f303d6b2a42d20bf9ea3e492d2fb6b8703fa58fbe8f6e440d7ad572ef42b3dabf5f
SSDEEP

12288:TIny5DYTmI+J22sTnCU+eA09cnuKmHlWa/rkvOavOhHYAZbt0KW:7UTmxJB6nC73Ecn6lb/OFOZWK

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

624 installd.exe
1792 nethtsrv.exe
1908 netupdsrv.exe
824 nethtsrv.exe
564 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe

pid	process
624	installd.exe
1792	nethtsrv.exe
1908	netupdsrv.exe
824	nethtsrv.exe
564	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe
1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe
1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe
1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe
624	installd.exe
1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe
1792	nethtsrv.exe
1792	nethtsrv.exe
1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe
1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe
824	nethtsrv.exe
824	nethtsrv.exe
1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe
File created	C:\Windows\SysWOW64\installd.exe	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe

Drops file in Program Files directory 3 IoCs

Processes:

1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 824 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	824	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1672 wrote to memory of 1696	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	net.exe
PID 1672 wrote to memory of 1696	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	net.exe
PID 1672 wrote to memory of 1696	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	net.exe
PID 1672 wrote to memory of 1696	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	net.exe
PID 1696 wrote to memory of 1224	1696	net.exe	net1.exe
PID 1696 wrote to memory of 1224	1696	net.exe	net1.exe
PID 1696 wrote to memory of 1224	1696	net.exe	net1.exe
PID 1696 wrote to memory of 1224	1696	net.exe	net1.exe
PID 1672 wrote to memory of 956	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	net.exe
PID 1672 wrote to memory of 956	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	net.exe
PID 1672 wrote to memory of 956	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	net.exe
PID 1672 wrote to memory of 956	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	net.exe
PID 956 wrote to memory of 1644	956	net.exe	net1.exe
PID 956 wrote to memory of 1644	956	net.exe	net1.exe
PID 956 wrote to memory of 1644	956	net.exe	net1.exe
PID 956 wrote to memory of 1644	956	net.exe	net1.exe
PID 1672 wrote to memory of 624	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	installd.exe
PID 1672 wrote to memory of 624	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	installd.exe
PID 1672 wrote to memory of 624	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	installd.exe
PID 1672 wrote to memory of 624	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	installd.exe
PID 1672 wrote to memory of 624	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	installd.exe
PID 1672 wrote to memory of 624	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	installd.exe
PID 1672 wrote to memory of 624	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	installd.exe
PID 1672 wrote to memory of 1792	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	nethtsrv.exe
PID 1672 wrote to memory of 1792	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	nethtsrv.exe
PID 1672 wrote to memory of 1792	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	nethtsrv.exe
PID 1672 wrote to memory of 1792	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	nethtsrv.exe
PID 1672 wrote to memory of 1908	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	netupdsrv.exe
PID 1672 wrote to memory of 1908	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	netupdsrv.exe
PID 1672 wrote to memory of 1908	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	netupdsrv.exe
PID 1672 wrote to memory of 1908	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	netupdsrv.exe
PID 1672 wrote to memory of 1908	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	netupdsrv.exe
PID 1672 wrote to memory of 1908	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	netupdsrv.exe
PID 1672 wrote to memory of 1908	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	netupdsrv.exe
PID 1672 wrote to memory of 584	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	net.exe
PID 1672 wrote to memory of 584	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	net.exe
PID 1672 wrote to memory of 584	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	net.exe
PID 1672 wrote to memory of 584	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	net.exe
PID 584 wrote to memory of 1220	584	net.exe	net1.exe
PID 584 wrote to memory of 1220	584	net.exe	net1.exe
PID 584 wrote to memory of 1220	584	net.exe	net1.exe
PID 584 wrote to memory of 1220	584	net.exe	net1.exe
PID 1672 wrote to memory of 1344	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	net.exe
PID 1672 wrote to memory of 1344	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	net.exe
PID 1672 wrote to memory of 1344	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	net.exe
PID 1672 wrote to memory of 1344	1672	1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe	net.exe
PID 1344 wrote to memory of 1324	1344	net.exe	net1.exe
PID 1344 wrote to memory of 1324	1344	net.exe	net1.exe
PID 1344 wrote to memory of 1324	1344	net.exe	net1.exe
PID 1344 wrote to memory of 1324	1344	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe
"C:\Users\Admin\AppData\Local\Temp\1bf4ca600486280d90dd60e5a52d7aca2fbb8da9cea3cedeced80499b27d754e.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1224

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1644

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:624

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1908

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:584

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1220

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1324

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:824

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
7eacb79e1ffd7993a3aafbe75e26f78a

SHA1
2b2e5025d03f6d27459c7930fa7b6d244ee4620c

SHA256
0c43c1c601e19c195b6f6aba07cf7c90aa5ce47ff4e3a2676aafa8dc98b5a86d

SHA512
0c60c07ba828e357dbb8f026579ede3d42b4f3616471d8ec518f2bee3e75a78a44b4c52edc5a44b3e5b9640ab44bb57a159f1c6f0367e82e228af887e16270f8

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
554ffcd79a26adcc95abf8402afc153e

SHA1
f05bf62cea0a23a5d67ce14d74ce2ef633c67401

SHA256
56de05b1d50843ceb797e0e0c855f20b80dcfa7235858e58e0267ca265b2140c

SHA512
0047c859ecb29dab86b5bef29d9e1de66ba1ff7c2a5476817cd2b3d3eaa5ecbd98b5fd356f2d3a8d1f84cd99d419ab8d7fe025dbbba324cad4a285c6c858584c

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
b1dfd6846b7f882964b267cd16f68ad7

SHA1
3602746de739dbf3c1b834d774705fb3f9a2b66b

SHA256
498fe344a6771831be9a574a0e70e01636f84eeb7f61ffcd67b48cffaa9b1a83

SHA512
2eb6286a0f9c83ea1c3d323045e69ce7a11d53de068fef33dc71e0b2482abab0b39cd64a8a4c416925aafa3a49fef1f4e6c4f7a683e817e2f592503afd14539b

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
aeddb91e2f554ccdf508195ff1fd9526

SHA1
3094dfae74a7db94ea5dd1c2f4882b02500a824a

SHA256
28ef7a9ce37b33cb27d600a69aea074bca2ddbd9af9bf5cdf9f1f22af7d6888c

SHA512
c1d527668d95a0d213cfe141eb8c1d70589a7fb140c0837ea289360e2f35e57248253078affa57a4791e23287a95733bfd7677c20cdf356552c5fea4a0c7a5a2

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
aeddb91e2f554ccdf508195ff1fd9526

SHA1
3094dfae74a7db94ea5dd1c2f4882b02500a824a

SHA256
28ef7a9ce37b33cb27d600a69aea074bca2ddbd9af9bf5cdf9f1f22af7d6888c

SHA512
c1d527668d95a0d213cfe141eb8c1d70589a7fb140c0837ea289360e2f35e57248253078affa57a4791e23287a95733bfd7677c20cdf356552c5fea4a0c7a5a2

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
10eca07416f32cb1f417ebfc429764e8

SHA1
c84fb262ccd94868b53d28521e85e02bc84d61bf

SHA256
913b104fae3f287c1df045ecdd344817388b560658cc3c3e72544951937ed226

SHA512
1e53892d8e42f3b764ae108e06a419034f6aab48c28dad88519f544d8db87858a7cc9b2c1de5f2a1041c86e9f6562f4969d8561ac07281d39a34a6c3109cc432

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
10eca07416f32cb1f417ebfc429764e8

SHA1
c84fb262ccd94868b53d28521e85e02bc84d61bf

SHA256
913b104fae3f287c1df045ecdd344817388b560658cc3c3e72544951937ed226

SHA512
1e53892d8e42f3b764ae108e06a419034f6aab48c28dad88519f544d8db87858a7cc9b2c1de5f2a1041c86e9f6562f4969d8561ac07281d39a34a6c3109cc432

Download Submit
\Users\Admin\AppData\Local\Temp\nst16AF.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nst16AF.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst16AF.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst16AF.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst16AF.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
7eacb79e1ffd7993a3aafbe75e26f78a

SHA1
2b2e5025d03f6d27459c7930fa7b6d244ee4620c

SHA256
0c43c1c601e19c195b6f6aba07cf7c90aa5ce47ff4e3a2676aafa8dc98b5a86d

SHA512
0c60c07ba828e357dbb8f026579ede3d42b4f3616471d8ec518f2bee3e75a78a44b4c52edc5a44b3e5b9640ab44bb57a159f1c6f0367e82e228af887e16270f8

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
7eacb79e1ffd7993a3aafbe75e26f78a

SHA1
2b2e5025d03f6d27459c7930fa7b6d244ee4620c

SHA256
0c43c1c601e19c195b6f6aba07cf7c90aa5ce47ff4e3a2676aafa8dc98b5a86d

SHA512
0c60c07ba828e357dbb8f026579ede3d42b4f3616471d8ec518f2bee3e75a78a44b4c52edc5a44b3e5b9640ab44bb57a159f1c6f0367e82e228af887e16270f8

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
7eacb79e1ffd7993a3aafbe75e26f78a

SHA1
2b2e5025d03f6d27459c7930fa7b6d244ee4620c

SHA256
0c43c1c601e19c195b6f6aba07cf7c90aa5ce47ff4e3a2676aafa8dc98b5a86d

SHA512
0c60c07ba828e357dbb8f026579ede3d42b4f3616471d8ec518f2bee3e75a78a44b4c52edc5a44b3e5b9640ab44bb57a159f1c6f0367e82e228af887e16270f8

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
554ffcd79a26adcc95abf8402afc153e

SHA1
f05bf62cea0a23a5d67ce14d74ce2ef633c67401

SHA256
56de05b1d50843ceb797e0e0c855f20b80dcfa7235858e58e0267ca265b2140c

SHA512
0047c859ecb29dab86b5bef29d9e1de66ba1ff7c2a5476817cd2b3d3eaa5ecbd98b5fd356f2d3a8d1f84cd99d419ab8d7fe025dbbba324cad4a285c6c858584c

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
554ffcd79a26adcc95abf8402afc153e

SHA1
f05bf62cea0a23a5d67ce14d74ce2ef633c67401

SHA256
56de05b1d50843ceb797e0e0c855f20b80dcfa7235858e58e0267ca265b2140c

SHA512
0047c859ecb29dab86b5bef29d9e1de66ba1ff7c2a5476817cd2b3d3eaa5ecbd98b5fd356f2d3a8d1f84cd99d419ab8d7fe025dbbba324cad4a285c6c858584c

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
b1dfd6846b7f882964b267cd16f68ad7

SHA1
3602746de739dbf3c1b834d774705fb3f9a2b66b

SHA256
498fe344a6771831be9a574a0e70e01636f84eeb7f61ffcd67b48cffaa9b1a83

SHA512
2eb6286a0f9c83ea1c3d323045e69ce7a11d53de068fef33dc71e0b2482abab0b39cd64a8a4c416925aafa3a49fef1f4e6c4f7a683e817e2f592503afd14539b

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
aeddb91e2f554ccdf508195ff1fd9526

SHA1
3094dfae74a7db94ea5dd1c2f4882b02500a824a

SHA256
28ef7a9ce37b33cb27d600a69aea074bca2ddbd9af9bf5cdf9f1f22af7d6888c

SHA512
c1d527668d95a0d213cfe141eb8c1d70589a7fb140c0837ea289360e2f35e57248253078affa57a4791e23287a95733bfd7677c20cdf356552c5fea4a0c7a5a2

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
10eca07416f32cb1f417ebfc429764e8

SHA1
c84fb262ccd94868b53d28521e85e02bc84d61bf

SHA256
913b104fae3f287c1df045ecdd344817388b560658cc3c3e72544951937ed226

SHA512
1e53892d8e42f3b764ae108e06a419034f6aab48c28dad88519f544d8db87858a7cc9b2c1de5f2a1041c86e9f6562f4969d8561ac07281d39a34a6c3109cc432

Download Submit
memory/584-81-0x0000000000000000-mapping.dmp

Download
memory/624-64-0x0000000000000000-mapping.dmp

Download
memory/956-61-0x0000000000000000-mapping.dmp

Download
memory/1220-82-0x0000000000000000-mapping.dmp

Download
memory/1224-59-0x0000000000000000-mapping.dmp

Download
memory/1324-88-0x0000000000000000-mapping.dmp

Download
memory/1344-87-0x0000000000000000-mapping.dmp

Download
memory/1644-62-0x0000000000000000-mapping.dmp

Download
memory/1672-58-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1672-69-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1672-54-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/1672-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1696-57-0x0000000000000000-mapping.dmp

Download
memory/1792-71-0x0000000000000000-mapping.dmp

Download
memory/1908-77-0x0000000000000000-mapping.dmp

Download