dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635

Analysis

max time kernel
35s
max time network
54s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe
Size

446KB
MD5

5c62673fbd5e077ba7f074490e9e98bb
SHA1

a8e6112d8b2ef5c877ff0a318407d57e97d9f7f7
SHA256

dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635
SHA512

ba3b9237bf93c5054ade4ad19437eab1183a05e074cab5b0b2abc8ae97a10ac82f697577adeae7af5ee6d986d1a4c7019fc115b96fedacc9650deced6707a411
SSDEEP

12288:im3JcDqTISM2liJvkevPsoqg1vCd66NSkfq:im3HISRAMoLvHaq

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1624 installd.exe
1160 nethtsrv.exe
760 netupdsrv.exe
1432 nethtsrv.exe
1656 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe

pid	process
1624	installd.exe
1160	nethtsrv.exe
760	netupdsrv.exe
1432	nethtsrv.exe
1656	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe
1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe
1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe
1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe
1624	installd.exe
1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe
1160	nethtsrv.exe
1160	nethtsrv.exe
1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe
1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe
1432	nethtsrv.exe
1432	nethtsrv.exe
1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe
File created	C:\Windows\SysWOW64\installd.exe	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe

Drops file in Program Files directory 3 IoCs

Processes:

dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1432 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1432	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1112 wrote to memory of 912	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	net.exe
PID 1112 wrote to memory of 912	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	net.exe
PID 1112 wrote to memory of 912	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	net.exe
PID 1112 wrote to memory of 912	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	net.exe
PID 912 wrote to memory of 908	912	net.exe	net1.exe
PID 912 wrote to memory of 908	912	net.exe	net1.exe
PID 912 wrote to memory of 908	912	net.exe	net1.exe
PID 912 wrote to memory of 908	912	net.exe	net1.exe
PID 1112 wrote to memory of 1768	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	net.exe
PID 1112 wrote to memory of 1768	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	net.exe
PID 1112 wrote to memory of 1768	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	net.exe
PID 1112 wrote to memory of 1768	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	net.exe
PID 1768 wrote to memory of 1664	1768	net.exe	net1.exe
PID 1768 wrote to memory of 1664	1768	net.exe	net1.exe
PID 1768 wrote to memory of 1664	1768	net.exe	net1.exe
PID 1768 wrote to memory of 1664	1768	net.exe	net1.exe
PID 1112 wrote to memory of 1624	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	installd.exe
PID 1112 wrote to memory of 1624	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	installd.exe
PID 1112 wrote to memory of 1624	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	installd.exe
PID 1112 wrote to memory of 1624	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	installd.exe
PID 1112 wrote to memory of 1624	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	installd.exe
PID 1112 wrote to memory of 1624	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	installd.exe
PID 1112 wrote to memory of 1624	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	installd.exe
PID 1112 wrote to memory of 1160	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	nethtsrv.exe
PID 1112 wrote to memory of 1160	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	nethtsrv.exe
PID 1112 wrote to memory of 1160	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	nethtsrv.exe
PID 1112 wrote to memory of 1160	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	nethtsrv.exe
PID 1112 wrote to memory of 760	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	netupdsrv.exe
PID 1112 wrote to memory of 760	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	netupdsrv.exe
PID 1112 wrote to memory of 760	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	netupdsrv.exe
PID 1112 wrote to memory of 760	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	netupdsrv.exe
PID 1112 wrote to memory of 760	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	netupdsrv.exe
PID 1112 wrote to memory of 760	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	netupdsrv.exe
PID 1112 wrote to memory of 760	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	netupdsrv.exe
PID 1112 wrote to memory of 1600	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	net.exe
PID 1112 wrote to memory of 1600	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	net.exe
PID 1112 wrote to memory of 1600	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	net.exe
PID 1112 wrote to memory of 1600	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	net.exe
PID 1600 wrote to memory of 1984	1600	net.exe	net1.exe
PID 1600 wrote to memory of 1984	1600	net.exe	net1.exe
PID 1600 wrote to memory of 1984	1600	net.exe	net1.exe
PID 1600 wrote to memory of 1984	1600	net.exe	net1.exe
PID 1112 wrote to memory of 1952	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	net.exe
PID 1112 wrote to memory of 1952	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	net.exe
PID 1112 wrote to memory of 1952	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	net.exe
PID 1112 wrote to memory of 1952	1112	dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe	net.exe
PID 1952 wrote to memory of 832	1952	net.exe	net1.exe
PID 1952 wrote to memory of 832	1952	net.exe	net1.exe
PID 1952 wrote to memory of 832	1952	net.exe	net1.exe
PID 1952 wrote to memory of 832	1952	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe
"C:\Users\Admin\AppData\Local\Temp\dacd03657c592bddb5bb36611b647662cd3b79d7a4f42b0f99ef22bb56dda635.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1112

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:912

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:908

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1768

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1664

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1160

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:760

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1600

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1984

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:832

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1432

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
2e5fb676769be1426144e451f7c63288

SHA1
1f36f5c491e5a4cb7c3f5452c663a376b0e778fc

SHA256
09daddde90e36b3cabdd0c06bce6ed0d326fc73afaaaa12ca1998f56af24f505

SHA512
84833c72ce9b1cdf62c7cd3d6fe5827a8e5b2067e99883cbbab66418d5e0dbee2f7ea368f537a36ba3f5ff7e9d6637aac57f9cfbabd6be807b8b2f088446b9a0

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
4688404e376c5b8a555e89487130cdf7

SHA1
0e3113576552f304dc4191de313c958d5ad079fc

SHA256
7b7275ac6b4fdb5b40f6a2144a2b7bc44e37095a67330098adb7c7bc0d3a7d77

SHA512
ecc88b8af893349648ca70ed76ef36ae49fd42fb30ff15cbee9dce94aa171340c9b321d54e3f1d721c31e34bfb7f28871abc70cc7b30b6b00d4a5798ef7a7b0f

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
d162274e9f3079be38f6e6cba3f9afe9

SHA1
8c92bf453302a3e74722fe8e405499e98e8cbac9

SHA256
8056b627e152aec71f4b05b0dd8490971f6fa27855f9fb15cae8f399d8e5e40d

SHA512
6ed9def85a488246ae056c1d0c3907aa100cfa33f0af836cbcb63e84646392f2688e988f3f266c9134acfe56da112e8e43f715372d86f4432db6ac0c728496c4

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
64bbde32cdb78ce36f0628434dca0979

SHA1
555d0cc6f1f6e98fab610a51595eb44ed3fe3493

SHA256
8e88cd21b1a5e2dcc6d6afb1f2319a57cad969100b1dec97f66537c2db1aec31

SHA512
a8e61d1de0a5705a4900e2622e48181bc8c5fece0f61e61992d2dc6c5104485aded898f89c663db5ba5ee4d5f0779859f68ef050b5b1d74cd6652d491fc23081

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
64bbde32cdb78ce36f0628434dca0979

SHA1
555d0cc6f1f6e98fab610a51595eb44ed3fe3493

SHA256
8e88cd21b1a5e2dcc6d6afb1f2319a57cad969100b1dec97f66537c2db1aec31

SHA512
a8e61d1de0a5705a4900e2622e48181bc8c5fece0f61e61992d2dc6c5104485aded898f89c663db5ba5ee4d5f0779859f68ef050b5b1d74cd6652d491fc23081

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
159KB

MD5
0a66c72edae3b24bf4a12e43a000f719

SHA1
4b495fa9199c7930c2e8e5cfbe49665dbc24e496

SHA256
7bc14b1483453c7aed13c71f8a26df1d0edf4fe93bcdba4c431fce67014e6979

SHA512
b6c1cfd3b6455db806eac25cd703d8248751abd4c12bd380c62273afbbf63a5fa759db36f3f948890bc012110dd1534f5656831a4644272afede835bc7ff430a

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
159KB

MD5
0a66c72edae3b24bf4a12e43a000f719

SHA1
4b495fa9199c7930c2e8e5cfbe49665dbc24e496

SHA256
7bc14b1483453c7aed13c71f8a26df1d0edf4fe93bcdba4c431fce67014e6979

SHA512
b6c1cfd3b6455db806eac25cd703d8248751abd4c12bd380c62273afbbf63a5fa759db36f3f948890bc012110dd1534f5656831a4644272afede835bc7ff430a

Download Submit
\Users\Admin\AppData\Local\Temp\nsd7FBD.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsd7FBD.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd7FBD.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd7FBD.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd7FBD.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
2e5fb676769be1426144e451f7c63288

SHA1
1f36f5c491e5a4cb7c3f5452c663a376b0e778fc

SHA256
09daddde90e36b3cabdd0c06bce6ed0d326fc73afaaaa12ca1998f56af24f505

SHA512
84833c72ce9b1cdf62c7cd3d6fe5827a8e5b2067e99883cbbab66418d5e0dbee2f7ea368f537a36ba3f5ff7e9d6637aac57f9cfbabd6be807b8b2f088446b9a0

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
2e5fb676769be1426144e451f7c63288

SHA1
1f36f5c491e5a4cb7c3f5452c663a376b0e778fc

SHA256
09daddde90e36b3cabdd0c06bce6ed0d326fc73afaaaa12ca1998f56af24f505

SHA512
84833c72ce9b1cdf62c7cd3d6fe5827a8e5b2067e99883cbbab66418d5e0dbee2f7ea368f537a36ba3f5ff7e9d6637aac57f9cfbabd6be807b8b2f088446b9a0

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
2e5fb676769be1426144e451f7c63288

SHA1
1f36f5c491e5a4cb7c3f5452c663a376b0e778fc

SHA256
09daddde90e36b3cabdd0c06bce6ed0d326fc73afaaaa12ca1998f56af24f505

SHA512
84833c72ce9b1cdf62c7cd3d6fe5827a8e5b2067e99883cbbab66418d5e0dbee2f7ea368f537a36ba3f5ff7e9d6637aac57f9cfbabd6be807b8b2f088446b9a0

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
4688404e376c5b8a555e89487130cdf7

SHA1
0e3113576552f304dc4191de313c958d5ad079fc

SHA256
7b7275ac6b4fdb5b40f6a2144a2b7bc44e37095a67330098adb7c7bc0d3a7d77

SHA512
ecc88b8af893349648ca70ed76ef36ae49fd42fb30ff15cbee9dce94aa171340c9b321d54e3f1d721c31e34bfb7f28871abc70cc7b30b6b00d4a5798ef7a7b0f

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
4688404e376c5b8a555e89487130cdf7

SHA1
0e3113576552f304dc4191de313c958d5ad079fc

SHA256
7b7275ac6b4fdb5b40f6a2144a2b7bc44e37095a67330098adb7c7bc0d3a7d77

SHA512
ecc88b8af893349648ca70ed76ef36ae49fd42fb30ff15cbee9dce94aa171340c9b321d54e3f1d721c31e34bfb7f28871abc70cc7b30b6b00d4a5798ef7a7b0f

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
d162274e9f3079be38f6e6cba3f9afe9

SHA1
8c92bf453302a3e74722fe8e405499e98e8cbac9

SHA256
8056b627e152aec71f4b05b0dd8490971f6fa27855f9fb15cae8f399d8e5e40d

SHA512
6ed9def85a488246ae056c1d0c3907aa100cfa33f0af836cbcb63e84646392f2688e988f3f266c9134acfe56da112e8e43f715372d86f4432db6ac0c728496c4

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
64bbde32cdb78ce36f0628434dca0979

SHA1
555d0cc6f1f6e98fab610a51595eb44ed3fe3493

SHA256
8e88cd21b1a5e2dcc6d6afb1f2319a57cad969100b1dec97f66537c2db1aec31

SHA512
a8e61d1de0a5705a4900e2622e48181bc8c5fece0f61e61992d2dc6c5104485aded898f89c663db5ba5ee4d5f0779859f68ef050b5b1d74cd6652d491fc23081

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
159KB

MD5
0a66c72edae3b24bf4a12e43a000f719

SHA1
4b495fa9199c7930c2e8e5cfbe49665dbc24e496

SHA256
7bc14b1483453c7aed13c71f8a26df1d0edf4fe93bcdba4c431fce67014e6979

SHA512
b6c1cfd3b6455db806eac25cd703d8248751abd4c12bd380c62273afbbf63a5fa759db36f3f948890bc012110dd1534f5656831a4644272afede835bc7ff430a

Download Submit
memory/760-75-0x0000000000000000-mapping.dmp

Download
memory/832-86-0x0000000000000000-mapping.dmp

Download
memory/908-58-0x0000000000000000-mapping.dmp

Download
memory/912-57-0x0000000000000000-mapping.dmp

Download
memory/1112-54-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/1160-69-0x0000000000000000-mapping.dmp

Download
memory/1600-79-0x0000000000000000-mapping.dmp

Download
memory/1624-63-0x0000000000000000-mapping.dmp

Download
memory/1664-61-0x0000000000000000-mapping.dmp

Download
memory/1768-60-0x0000000000000000-mapping.dmp

Download
memory/1952-85-0x0000000000000000-mapping.dmp

Download
memory/1984-80-0x0000000000000000-mapping.dmp

Download