Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

UGEEWin_3....04.exe

windows7-x64

UGEEWin_3....04.exe

windows10-2004-x64

Analysis

  • max time kernel
    53s
  • max time network
    58s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/02/2023, 13:17

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    UGEEWin_3.2.0.210804.exe

  • Size

    23.5MB

  • MD5

    b4cacf19c6ffff4c6eb568336869372e

  • SHA1

    b938668629a78d373d850f7ffd555e5ebcb8c1d9

  • SHA256

    3102d27a70c41f2e2abf9ca9465608ea5887857abc5bf5cacb7528ae90825c63

  • SHA512

    436e6211ca9ab99a166f8ea20e657c77722c79873e28601e4385e692cb95ecd2fdc2f05e728e0f88d2f9e0d1881989a3c2e86e0fd3430270a69ab094150d9043

  • SSDEEP

    393216:eAvWn7A7CaB6VvWRO4YbAvrA7CaESq4Ie1fvydH5Ua7e3W3e5XNmy+zxuaA67UnQ:47sRh7Y0vrsRESBIe1ydZUa7e35cVA69

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 11 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 54 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\UGEEWin_3.2.0.210804.exe
    "C:\Users\Admin\AppData\Local\Temp\UGEEWin_3.2.0.210804.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4936
    • C:\Users\Admin\AppData\Local\Temp\is-4DUNS.tmp\UGEEWin_3.2.0.210804.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-4DUNS.tmp\UGEEWin_3.2.0.210804.tmp" /SL5="$70116,24076297,169472,C:\Users\Admin\AppData\Local\Temp\UGEEWin_3.2.0.210804.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1920
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-PITEG.tmp\EndWintab.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4584
        • C:\Windows\system32\taskkill.exe
          taskkill /f /t /im PenTablet.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4740
        • C:\Windows\system32\taskkill.exe
          taskkill /f /t /im PentabletService.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2580
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c listdlls.exe -d wintab32.dll /accepteula
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5112
          • C:\Users\Admin\AppData\Local\Temp\is-PITEG.tmp\Listdlls.exe
            listdlls.exe -d wintab32.dll /accepteula
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3868
            • C:\Users\Admin\AppData\Local\Temp\is-PITEG.tmp\Listdlls64.exe
              listdlls.exe -d wintab32.dll /accepteula
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3580
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Listdlls v3.2 - Listdlls "
          4⤵
            PID:1172
          • C:\Windows\system32\find.exe
            find "pid:"
            4⤵
              PID:2544
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Copyright (C) 1997-2016 Mark Russinovich "
              4⤵
                PID:4508
              • C:\Windows\system32\find.exe
                find "pid:"
                4⤵
                  PID:3200
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Sysinternals "
                  4⤵
                    PID:3728
                  • C:\Windows\system32\find.exe
                    find "pid:"
                    4⤵
                      PID:3940
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Error opening System(4): "
                      4⤵
                        PID:4476
                      • C:\Windows\system32\find.exe
                        find "pid:"
                        4⤵
                          PID:2584
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                          4⤵
                            PID:1168
                          • C:\Windows\system32\find.exe
                            find "pid:"
                            4⤵
                              PID:1028
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /S /D /c" echo Error opening Registry(92): "
                              4⤵
                                PID:1760
                              • C:\Windows\system32\find.exe
                                find "pid:"
                                4⤵
                                  PID:1284
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                                  4⤵
                                    PID:3460
                                  • C:\Windows\system32\find.exe
                                    find "pid:"
                                    4⤵
                                      PID:3364
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /S /D /c" echo Error opening smss.exe(356): "
                                      4⤵
                                        PID:4640
                                      • C:\Windows\system32\find.exe
                                        find "pid:"
                                        4⤵
                                          PID:1884
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                                          4⤵
                                            PID:1880
                                          • C:\Windows\system32\find.exe
                                            find "pid:"
                                            4⤵
                                              PID:4836
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /S /D /c" echo Error opening csrss.exe(436): "
                                              4⤵
                                                PID:4172
                                              • C:\Windows\system32\find.exe
                                                find "pid:"
                                                4⤵
                                                  PID:2160
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                                                  4⤵
                                                    PID:3592
                                                  • C:\Windows\system32\find.exe
                                                    find "pid:"
                                                    4⤵
                                                      PID:2784
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /S /D /c" echo Error opening csrss.exe(512): "
                                                      4⤵
                                                        PID:2212
                                                      • C:\Windows\system32\find.exe
                                                        find "pid:"
                                                        4⤵
                                                          PID:904
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                                                          4⤵
                                                            PID:4068
                                                          • C:\Windows\system32\find.exe
                                                            find "pid:"
                                                            4⤵
                                                              PID:2300
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /S /D /c" echo Error opening wininit.exe(520): "
                                                              4⤵
                                                                PID:1236
                                                              • C:\Windows\system32\find.exe
                                                                find "pid:"
                                                                4⤵
                                                                  PID:4472
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                                                                  4⤵
                                                                    PID:2696
                                                                  • C:\Windows\system32\find.exe
                                                                    find "pid:"
                                                                    4⤵
                                                                      PID:1440
                                                                    • C:\Windows\system32\find.exe
                                                                      find "pid:"
                                                                      4⤵
                                                                        PID:2064
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /S /D /c" echo Error opening services.exe(648): "
                                                                        4⤵
                                                                          PID:2440
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                                                                          4⤵
                                                                            PID:1684
                                                                          • C:\Windows\system32\find.exe
                                                                            find "pid:"
                                                                            4⤵
                                                                              PID:1304
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /S /D /c" echo Error opening svchost.exe(2776): "
                                                                              4⤵
                                                                                PID:2936
                                                                              • C:\Windows\system32\find.exe
                                                                                find "pid:"
                                                                                4⤵
                                                                                  PID:800
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                                                                                  4⤵
                                                                                    PID:3308
                                                                                  • C:\Windows\system32\find.exe
                                                                                    find "pid:"
                                                                                    4⤵
                                                                                      PID:1140
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /S /D /c" echo Error opening sppsvc.exe(4236): "
                                                                                      4⤵
                                                                                        PID:4032
                                                                                      • C:\Windows\system32\find.exe
                                                                                        find "pid:"
                                                                                        4⤵
                                                                                          PID:1748
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                                                                                          4⤵
                                                                                            PID:2196
                                                                                          • C:\Windows\system32\find.exe
                                                                                            find "pid:"
                                                                                            4⤵
                                                                                              PID:3008
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /S /D /c" echo Error opening svchost.exe(3396): "
                                                                                              4⤵
                                                                                                PID:3584
                                                                                              • C:\Windows\system32\find.exe
                                                                                                find "pid:"
                                                                                                4⤵
                                                                                                  PID:3032
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                                                                                                  4⤵
                                                                                                    PID:1804
                                                                                                  • C:\Windows\system32\find.exe
                                                                                                    find "pid:"
                                                                                                    4⤵
                                                                                                      PID:2664
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /S /D /c" echo Error opening upfc.exe(3252): "
                                                                                                      4⤵
                                                                                                        PID:2244
                                                                                                      • C:\Windows\system32\find.exe
                                                                                                        find "pid:"
                                                                                                        4⤵
                                                                                                          PID:2220
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                                                                                                          4⤵
                                                                                                            PID:3700
                                                                                                          • C:\Windows\system32\find.exe
                                                                                                            find "pid:"
                                                                                                            4⤵
                                                                                                              PID:4960
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /S /D /c" echo Error opening svchost.exe(3920): "
                                                                                                              4⤵
                                                                                                                PID:2312
                                                                                                              • C:\Windows\system32\find.exe
                                                                                                                find "pid:"
                                                                                                                4⤵
                                                                                                                  PID:4496
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                                                                                                                  4⤵
                                                                                                                    PID:1080
                                                                                                                  • C:\Windows\system32\find.exe
                                                                                                                    find "pid:"
                                                                                                                    4⤵
                                                                                                                      PID:1428
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-PITEG.tmp\PSCC.bat""
                                                                                                                    3⤵
                                                                                                                      PID:2416
                                                                                                                    • C:\Program Files\Pentablet\64\devcon.exe
                                                                                                                      "C:\Program Files\Pentablet\64\devcon.exe" install vmulti.inf pentablet\hid
                                                                                                                      3⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Drops file in Windows directory
                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:4432
                                                                                                                    • C:\Program Files\Pentablet\driver\64\dpinst.exe
                                                                                                                      "C:\Program Files\Pentablet\driver\64\dpinst.exe" /sw /se /f /lm /sa
                                                                                                                      3⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Drops file in Windows directory
                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:3988
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                                                                  1⤵
                                                                                                                  • Drops file in Windows directory
                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:3672
                                                                                                                  • C:\Windows\system32\DrvInst.exe
                                                                                                                    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{24ecb3ec-753f-ea42-a062-8b0d44a7e619}\vmulti.inf" "9" "4b1fe2f8b" "000000000000014C" "WinSta0\Default" "0000000000000164" "208" "c:\program files\pentablet\64"
                                                                                                                    2⤵
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    PID:2544
                                                                                                                  • C:\Windows\system32\DrvInst.exe
                                                                                                                    DrvInst.exe "2" "211" "ROOT\HIDCLASS\0000" "C:\Windows\INF\oem2.inf" "oem2.inf:b2fe4818b67bbc5d:vmulti.Inst.Win7:6.1.7600.16385:pentablet\hid," "4b1fe2f8b" "000000000000014C"
                                                                                                                    2⤵
                                                                                                                    • Drops file in Drivers directory
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:3760
                                                                                                                  • C:\Windows\system32\DrvInst.exe
                                                                                                                    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{1b664dc1-c287-144c-b7e2-1c0c7dfdd11e}\hanvonugeemfilter.inf" "9" "4e3e7d867" "0000000000000158" "WinSta0\Default" "000000000000010C" "208" "c:\program files\pentablet\driver\64"
                                                                                                                    2⤵
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    PID:3900
                                                                                                                  • C:\Windows\system32\DrvInst.exe
                                                                                                                    DrvInst.exe "2" "211" "HID\HID&COL01\1&2D595CA7&0&0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca113d4f58de:hanvonugeemfilter:14.27.40.873:hid\hid&col01," "4f79199e7" "0000000000000158"
                                                                                                                    2⤵
                                                                                                                    • Drops file in Drivers directory
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:5004
                                                                                                                • C:\Windows\system32\LogonUI.exe
                                                                                                                  "LogonUI.exe" /flags:0x4 /state0:0xa399a855 /state1:0x41c64e6d
                                                                                                                  1⤵
                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:4876

                                                                                                                Network

                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                Replay Monitor

                                                                                                                Loading Replay Monitor...

                                                                                                                Downloads

                                                                                                                • C:\Program Files\Pentablet\64\devcon.exe
                                                                                                                  Filesize

                                                                                                                  88KB

                                                                                                                  MD5

                                                                                                                  f44245761bcf718a534974b431b8ce5c

                                                                                                                  SHA1

                                                                                                                  ee9ddb20529b1dad55383d9209d4d5c35c152571

                                                                                                                  SHA256

                                                                                                                  0a15d33b2994e5eb25ab9747e1214b078348529a735d342f3fa5fdb64b6cd312

                                                                                                                  SHA512

                                                                                                                  0b58cc6353d9cdb39c83c0f97444d66072eea9fdf19b835116e58cff3d195da4cf05f25fe57da0962aafa35dc6bf0fe35350b87c39c8f2e440615b766652af87

                                                                                                                  Download Submit

                                                                                                                • C:\Program Files\Pentablet\64\devcon.exe
                                                                                                                  Filesize

                                                                                                                  88KB

                                                                                                                  MD5

                                                                                                                  f44245761bcf718a534974b431b8ce5c

                                                                                                                  SHA1

                                                                                                                  ee9ddb20529b1dad55383d9209d4d5c35c152571

                                                                                                                  SHA256

                                                                                                                  0a15d33b2994e5eb25ab9747e1214b078348529a735d342f3fa5fdb64b6cd312

                                                                                                                  SHA512

                                                                                                                  0b58cc6353d9cdb39c83c0f97444d66072eea9fdf19b835116e58cff3d195da4cf05f25fe57da0962aafa35dc6bf0fe35350b87c39c8f2e440615b766652af87

                                                                                                                  Download Submit

                                                                                                                • C:\Program Files\Pentablet\64\vmulti.inf
                                                                                                                  Filesize

                                                                                                                  3KB

                                                                                                                  MD5

                                                                                                                  8caa6a96198b63517ce99095203dbe65

                                                                                                                  SHA1

                                                                                                                  666128119cf75897ff466a494d662bd3457a64c7

                                                                                                                  SHA256

                                                                                                                  72ec99a990a5d0c2c1fa7709606309bc7ba3ca850c8649bd86bc0cb639fb25b6

                                                                                                                  SHA512

                                                                                                                  2cfb684c88bff460b2fdbd6a09c0a1b859e97216114eb0472aa17a3ba7e27bd89a41a9a357efc662e5ef3809e33cf4470823421e18042cb607b6263526c9f949

                                                                                                                  Download Submit

                                                                                                                • C:\Program Files\Pentablet\driver\64\dpinst.exe
                                                                                                                  Filesize

                                                                                                                  1.0MB

                                                                                                                  MD5

                                                                                                                  be3c79033fa8302002d9d3a6752f2263

                                                                                                                  SHA1

                                                                                                                  a01147731f2e500282eca5ece149bcc5423b59d6

                                                                                                                  SHA256

                                                                                                                  181bf85d3b5900ff8abed34bc415afc37fc322d9d7702e14d144f96a908f5cab

                                                                                                                  SHA512

                                                                                                                  77097f220cc6d22112b314d3e42b6eedb9ccd72beb655b34656326c2c63fb9209977ddac20e9c53c4ec7ccc8ea6910f400f050f4b0cb98c9f42f89617965aaea

                                                                                                                  Download Submit

                                                                                                                • C:\Program Files\Pentablet\driver\64\dpinst.exe
                                                                                                                  Filesize

                                                                                                                  1.0MB

                                                                                                                  MD5

                                                                                                                  be3c79033fa8302002d9d3a6752f2263

                                                                                                                  SHA1

                                                                                                                  a01147731f2e500282eca5ece149bcc5423b59d6

                                                                                                                  SHA256

                                                                                                                  181bf85d3b5900ff8abed34bc415afc37fc322d9d7702e14d144f96a908f5cab

                                                                                                                  SHA512

                                                                                                                  77097f220cc6d22112b314d3e42b6eedb9ccd72beb655b34656326c2c63fb9209977ddac20e9c53c4ec7ccc8ea6910f400f050f4b0cb98c9f42f89617965aaea

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-4DUNS.tmp\UGEEWin_3.2.0.210804.tmp
                                                                                                                  Filesize

                                                                                                                  1.5MB

                                                                                                                  MD5

                                                                                                                  dca93f866f9a591f547ed8442841734a

                                                                                                                  SHA1

                                                                                                                  b8970ce7e09ff274fe331d7335e23087ebd71810

                                                                                                                  SHA256

                                                                                                                  a6d6e323f0fa2a630fe6fbf5d4e1d306cb8c2cb7a10e417ad105bdcef4cd6be1

                                                                                                                  SHA512

                                                                                                                  c14cea4f24d0620f65304b1b9019799e20850c3ea928ec6c119cb70171b1d3aeb71729347047e69b231f918f81b42939a6b91faddf3bbc7803278c9191b4718f

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-4DUNS.tmp\UGEEWin_3.2.0.210804.tmp
                                                                                                                  Filesize

                                                                                                                  1.5MB

                                                                                                                  MD5

                                                                                                                  dca93f866f9a591f547ed8442841734a

                                                                                                                  SHA1

                                                                                                                  b8970ce7e09ff274fe331d7335e23087ebd71810

                                                                                                                  SHA256

                                                                                                                  a6d6e323f0fa2a630fe6fbf5d4e1d306cb8c2cb7a10e417ad105bdcef4cd6be1

                                                                                                                  SHA512

                                                                                                                  c14cea4f24d0620f65304b1b9019799e20850c3ea928ec6c119cb70171b1d3aeb71729347047e69b231f918f81b42939a6b91faddf3bbc7803278c9191b4718f

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-PITEG.tmp\EndWintab.bat
                                                                                                                  Filesize

                                                                                                                  482B

                                                                                                                  MD5

                                                                                                                  aa9693d32653eaa7181228624b2dfd57

                                                                                                                  SHA1

                                                                                                                  9c9833ca082b288040ff6880471603fa90a4b64d

                                                                                                                  SHA256

                                                                                                                  d9fa3ad5a5385b7b5bdd1c314e06983ba324421bc72e595f820daa32882543ca

                                                                                                                  SHA512

                                                                                                                  63ad5c283db43fe06aac71d12fcf688002aa9fc3e6457525f9c3ac42e542d8a4d43af0035768386d722994023d5920b1796a7d448c532b75a8c52ce650b5972d

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-PITEG.tmp\Listdlls.exe
                                                                                                                  Filesize

                                                                                                                  414KB

                                                                                                                  MD5

                                                                                                                  60a2331a2b28968585c7c7229d2424a8

                                                                                                                  SHA1

                                                                                                                  fbac538166d61b4f10db934bd4bc1b86c81e56fb

                                                                                                                  SHA256

                                                                                                                  b0f6800b2bb4c86e091120e9087c75f9b1b3e46b89cf65744d65cf5ab01fd385

                                                                                                                  SHA512

                                                                                                                  159542a30195f58a6957d70282bd2dff79708bd2228ebebf7db48e25d80e68ea17714b518a029d2e21acf564d37982b43850249c944e99ce1b38864ffa00b009

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-PITEG.tmp\Listdlls.exe
                                                                                                                  Filesize

                                                                                                                  414KB

                                                                                                                  MD5

                                                                                                                  60a2331a2b28968585c7c7229d2424a8

                                                                                                                  SHA1

                                                                                                                  fbac538166d61b4f10db934bd4bc1b86c81e56fb

                                                                                                                  SHA256

                                                                                                                  b0f6800b2bb4c86e091120e9087c75f9b1b3e46b89cf65744d65cf5ab01fd385

                                                                                                                  SHA512

                                                                                                                  159542a30195f58a6957d70282bd2dff79708bd2228ebebf7db48e25d80e68ea17714b518a029d2e21acf564d37982b43850249c944e99ce1b38864ffa00b009

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-PITEG.tmp\Listdlls64.exe
                                                                                                                  Filesize

                                                                                                                  215KB

                                                                                                                  MD5

                                                                                                                  8336396d50dcc9d5a5f66b078a8460dc

                                                                                                                  SHA1

                                                                                                                  42bf0bb282512e4c638b8f03617dd973ee09afd9

                                                                                                                  SHA256

                                                                                                                  29d23bc492e48a5ae68444302d3430e07d08e04278d53aa70d9367d9cf8bceb7

                                                                                                                  SHA512

                                                                                                                  08f34405f8d5ebf695391f9cb1deb6eb22b318b698ce9540d37eae45d36476a96d379e9f338c64d5f2f3e9674751bdb7f3661845530605b8fb1eb14ee91702e2

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-PITEG.tmp\Listdlls64.exe
                                                                                                                  Filesize

                                                                                                                  215KB

                                                                                                                  MD5

                                                                                                                  8336396d50dcc9d5a5f66b078a8460dc

                                                                                                                  SHA1

                                                                                                                  42bf0bb282512e4c638b8f03617dd973ee09afd9

                                                                                                                  SHA256

                                                                                                                  29d23bc492e48a5ae68444302d3430e07d08e04278d53aa70d9367d9cf8bceb7

                                                                                                                  SHA512

                                                                                                                  08f34405f8d5ebf695391f9cb1deb6eb22b318b698ce9540d37eae45d36476a96d379e9f338c64d5f2f3e9674751bdb7f3661845530605b8fb1eb14ee91702e2

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-PITEG.tmp\PSCC.bat
                                                                                                                  Filesize

                                                                                                                  3KB

                                                                                                                  MD5

                                                                                                                  935934d8df9be23fd1a9ceebf0268c60

                                                                                                                  SHA1

                                                                                                                  9b1514fec943f47a3cc6f4e2086f3d4a756fab4d

                                                                                                                  SHA256

                                                                                                                  080a7566cd8bb25f32c3de59a62ad51801663695012ddb3376a2fe159078b24d

                                                                                                                  SHA512

                                                                                                                  b1bf2442b90b4118cfd09ff54862291bf8b3a29363ac83e08657badf5b506e56b0751288646bb440ca60906b75bcbd4e949fd8a5cd2e8337e95b6693f98ec019

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-PITEG.tmp\botva2.dll
                                                                                                                  Filesize

                                                                                                                  35KB

                                                                                                                  MD5

                                                                                                                  0177746573eed407f8dca8a9e441aa49

                                                                                                                  SHA1

                                                                                                                  6b462adf78059d26cbc56b3311e3b97fcb8d05f7

                                                                                                                  SHA256

                                                                                                                  a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008

                                                                                                                  SHA512

                                                                                                                  d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-PITEG.tmp\botva2.dll
                                                                                                                  Filesize

                                                                                                                  35KB

                                                                                                                  MD5

                                                                                                                  0177746573eed407f8dca8a9e441aa49

                                                                                                                  SHA1

                                                                                                                  6b462adf78059d26cbc56b3311e3b97fcb8d05f7

                                                                                                                  SHA256

                                                                                                                  a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008

                                                                                                                  SHA512

                                                                                                                  d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-PITEG.tmp\innocallback.dll
                                                                                                                  Filesize

                                                                                                                  63KB

                                                                                                                  MD5

                                                                                                                  1c55ae5ef9980e3b1028447da6105c75

                                                                                                                  SHA1

                                                                                                                  f85218e10e6aa23b2f5a3ed512895b437e41b45c

                                                                                                                  SHA256

                                                                                                                  6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

                                                                                                                  SHA512

                                                                                                                  1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-PITEG.tmp\innocallback.dll
                                                                                                                  Filesize

                                                                                                                  63KB

                                                                                                                  MD5

                                                                                                                  1c55ae5ef9980e3b1028447da6105c75

                                                                                                                  SHA1

                                                                                                                  f85218e10e6aa23b2f5a3ed512895b437e41b45c

                                                                                                                  SHA256

                                                                                                                  6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

                                                                                                                  SHA512

                                                                                                                  1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\{1B664~1\WdfCoInstaller01009.dll
                                                                                                                  Filesize

                                                                                                                  1.6MB

                                                                                                                  MD5

                                                                                                                  4da5da193e0e4f86f6f8fd43ef25329a

                                                                                                                  SHA1

                                                                                                                  68a44d37ff535a2c454f2440e1429833a1c6d810

                                                                                                                  SHA256

                                                                                                                  18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e

                                                                                                                  SHA512

                                                                                                                  b3d73ed5e45d6f2908b2f3086390dd28c1631e298756cee9bdf26b185f0b77d1b8c03ad55e0495dba982c5bed4a03337b130c76f7112f3e19821127d2cf36853

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\{1B664~1\hanvonugeemfilter.cat
                                                                                                                  Filesize

                                                                                                                  10KB

                                                                                                                  MD5

                                                                                                                  f161bf4c1ac6b26ee946c9a3bf916ffe

                                                                                                                  SHA1

                                                                                                                  1263f2a5975864d703afb7f15d0d2e47499dde2c

                                                                                                                  SHA256

                                                                                                                  b77c9daf31df08ff29c03b26071c282f21860a69406f6f809fbf0e7793f394fa

                                                                                                                  SHA512

                                                                                                                  85b3b617b524f20c8bff678f689232bf517faa5aa53a6611c7b07c9ca87c5f3029d82ae141c2cc00444ea1a7cd89b2fcb76cddffb97d5bb5f00946314f48cd44

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\{1B664~1\hanvonugeemfilter.sys
                                                                                                                  Filesize

                                                                                                                  9KB

                                                                                                                  MD5

                                                                                                                  065e4ba1ef63b6d6d073ce77821e0e06

                                                                                                                  SHA1

                                                                                                                  56d0b1f479a1e9a00d49a2283150456424acfc14

                                                                                                                  SHA256

                                                                                                                  5b4c234d27f71931ea1ca91355ca9834a6c0cd95c1e935bfdce03b418fbee2ea

                                                                                                                  SHA512

                                                                                                                  7dbc3a1f7d7623eb9e884d90c749a21f325341efa71320332c079770c5876458e6a83969dbe5ace9510a54eae495c4f0ca8d6ba1d40968d514a1996fa644a3ff

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\{1b664dc1-c287-144c-b7e2-1c0c7dfdd11e}\hanvonugeemfilter.inf
                                                                                                                  Filesize

                                                                                                                  6KB

                                                                                                                  MD5

                                                                                                                  559d201d203e1b86c1df3b28fd53345e

                                                                                                                  SHA1

                                                                                                                  a891f1b4db8b3128fafc67344e37b4abfcca2a07

                                                                                                                  SHA256

                                                                                                                  0ed01aafce6532ba3cd19d025bfda37f6e8a06a5ef612c423f9dfa853580900b

                                                                                                                  SHA512

                                                                                                                  5e2f0cf375665a12ee284ed27ca43b21edfd7c18c162dcd2acbd0a59022c2da31553ab0836817fa7790f102599b2e2c36142c6fa67ae2ab2ecf7ed2d20b767fe

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\{24ECB~1\WdfCoInstaller01009.dll
                                                                                                                  Filesize

                                                                                                                  1.6MB

                                                                                                                  MD5

                                                                                                                  4da5da193e0e4f86f6f8fd43ef25329a

                                                                                                                  SHA1

                                                                                                                  68a44d37ff535a2c454f2440e1429833a1c6d810

                                                                                                                  SHA256

                                                                                                                  18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e

                                                                                                                  SHA512

                                                                                                                  b3d73ed5e45d6f2908b2f3086390dd28c1631e298756cee9bdf26b185f0b77d1b8c03ad55e0495dba982c5bed4a03337b130c76f7112f3e19821127d2cf36853

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\{24ECB~1\hidkmdf.sys
                                                                                                                  Filesize

                                                                                                                  7KB

                                                                                                                  MD5

                                                                                                                  f1928f41c82ee87c3512c519b285a115

                                                                                                                  SHA1

                                                                                                                  526d137427e83138f0b31a0d18986a0caddf76b1

                                                                                                                  SHA256

                                                                                                                  40bbe73324701268c3f52551c2531552fa43421ef7db799c08200c303ddc2235

                                                                                                                  SHA512

                                                                                                                  5d85b39d6e295e3baf1dd63d515c3e18a2d165483549ef1a7a8cdc78ed9cfed10e0e5acd8a8d60762bcffebb4c4c4ef5cf404a5f1f95a16a3f7523c85fdaa230

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\{24ECB~1\pentablethid.cat
                                                                                                                  Filesize

                                                                                                                  10KB

                                                                                                                  MD5

                                                                                                                  0f8795258a7b91d17159884793e831c1

                                                                                                                  SHA1

                                                                                                                  78dc2f40f898130c8146722e93a7b5087e5f1fe1

                                                                                                                  SHA256

                                                                                                                  5e6513afbba3980b872670c0f42303ece625a5b1e3c651cdb5237e6e3ec1caf0

                                                                                                                  SHA512

                                                                                                                  fb089a539dba40dffdc85c9edcb1e49c9d9b6b0d9f13ef0c55a7fb8e7f9315f174297639f4928a20d52ef3cfbdf4316ffb221c043e63720760cb47240c078507

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\{24ECB~1\vmulti.sys
                                                                                                                  Filesize

                                                                                                                  10KB

                                                                                                                  MD5

                                                                                                                  4636facdc5d181a62d2ad34654f4a00d

                                                                                                                  SHA1

                                                                                                                  221e212e325d07895dacb419479138675031dce2

                                                                                                                  SHA256

                                                                                                                  394c002844f9f63a5999f66535ada392c932245c795c9ea9cf7c73f0e4dc43b0

                                                                                                                  SHA512

                                                                                                                  9f19751a9bbc69e96af8752784406f80c329caf45bfc3aac201c270117b5ded3c43193a5c8034135ca93514cc4cb947742c80972be50cff00100708d0126449e

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\{24ecb3ec-753f-ea42-a062-8b0d44a7e619}\vmulti.inf
                                                                                                                  Filesize

                                                                                                                  3KB

                                                                                                                  MD5

                                                                                                                  8caa6a96198b63517ce99095203dbe65

                                                                                                                  SHA1

                                                                                                                  666128119cf75897ff466a494d662bd3457a64c7

                                                                                                                  SHA256

                                                                                                                  72ec99a990a5d0c2c1fa7709606309bc7ba3ca850c8649bd86bc0cb639fb25b6

                                                                                                                  SHA512

                                                                                                                  2cfb684c88bff460b2fdbd6a09c0a1b859e97216114eb0472aa17a3ba7e27bd89a41a9a357efc662e5ef3809e33cf4470823421e18042cb607b6263526c9f949

                                                                                                                  Download Submit

                                                                                                                • C:\Windows\INF\oem2.inf
                                                                                                                  Filesize

                                                                                                                  3KB

                                                                                                                  MD5

                                                                                                                  8caa6a96198b63517ce99095203dbe65

                                                                                                                  SHA1

                                                                                                                  666128119cf75897ff466a494d662bd3457a64c7

                                                                                                                  SHA256

                                                                                                                  72ec99a990a5d0c2c1fa7709606309bc7ba3ca850c8649bd86bc0cb639fb25b6

                                                                                                                  SHA512

                                                                                                                  2cfb684c88bff460b2fdbd6a09c0a1b859e97216114eb0472aa17a3ba7e27bd89a41a9a357efc662e5ef3809e33cf4470823421e18042cb607b6263526c9f949

                                                                                                                  Download Submit

                                                                                                                • C:\Windows\INF\oem3.inf
                                                                                                                  Filesize

                                                                                                                  6KB

                                                                                                                  MD5

                                                                                                                  559d201d203e1b86c1df3b28fd53345e

                                                                                                                  SHA1

                                                                                                                  a891f1b4db8b3128fafc67344e37b4abfcca2a07

                                                                                                                  SHA256

                                                                                                                  0ed01aafce6532ba3cd19d025bfda37f6e8a06a5ef612c423f9dfa853580900b

                                                                                                                  SHA512

                                                                                                                  5e2f0cf375665a12ee284ed27ca43b21edfd7c18c162dcd2acbd0a59022c2da31553ab0836817fa7790f102599b2e2c36142c6fa67ae2ab2ecf7ed2d20b767fe

                                                                                                                  Download Submit

                                                                                                                • C:\Windows\System32\CatRoot2\dberr.txt
                                                                                                                  Filesize

                                                                                                                  148KB

                                                                                                                  MD5

                                                                                                                  378a9ce08749892d1108aca094981446

                                                                                                                  SHA1

                                                                                                                  53d05450ade08bf6f5e6b750a94cfc86ef1ce54a

                                                                                                                  SHA256

                                                                                                                  88b9f39f9aef7ff687af9fa5b56c918191002d7ef17262c80ba14ccdb6e80bc8

                                                                                                                  SHA512

                                                                                                                  f789da2368800aec325fee0d1f375e7c4a6fcc9f083597851b791168fc416bd7a0038aad0126f9921dd0d6dd6a8bbfe1d7111a3816bb5254d678899429ca75e8

                                                                                                                  Download Submit

                                                                                                                • C:\Windows\System32\CatRoot2\dberr.txt
                                                                                                                  Filesize

                                                                                                                  148KB

                                                                                                                  MD5

                                                                                                                  dd250c5d7d47bde9b9f6b07458b0aaba

                                                                                                                  SHA1

                                                                                                                  d88c4e809f014405927f53f3d5d4bd5d4a75cbf5

                                                                                                                  SHA256

                                                                                                                  f35e5016477b8564d4012fff6668f0095b53429fbc596c81ca63610eb0683e73

                                                                                                                  SHA512

                                                                                                                  d83f8a0d7e3313cea00c2c8ba1e2c8bf51d706a53db8ba74a8a74f6672d88778abc2b95a3880f2b4c8d33b5a332a519937482feb731f6f23ca5055084e2ce505

                                                                                                                  Download Submit

                                                                                                                • C:\Windows\System32\DriverStore\FileRepository\HANVON~1.INF\WdfCoInstaller01009.dll
                                                                                                                  Filesize

                                                                                                                  1.6MB

                                                                                                                  MD5

                                                                                                                  4da5da193e0e4f86f6f8fd43ef25329a

                                                                                                                  SHA1

                                                                                                                  68a44d37ff535a2c454f2440e1429833a1c6d810

                                                                                                                  SHA256

                                                                                                                  18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e

                                                                                                                  SHA512

                                                                                                                  b3d73ed5e45d6f2908b2f3086390dd28c1631e298756cee9bdf26b185f0b77d1b8c03ad55e0495dba982c5bed4a03337b130c76f7112f3e19821127d2cf36853

                                                                                                                  Download Submit

                                                                                                                • C:\Windows\System32\DriverStore\FileRepository\HANVON~1.INF\hanvonugeemfilter.sys
                                                                                                                  Filesize

                                                                                                                  9KB

                                                                                                                  MD5

                                                                                                                  065e4ba1ef63b6d6d073ce77821e0e06

                                                                                                                  SHA1

                                                                                                                  56d0b1f479a1e9a00d49a2283150456424acfc14

                                                                                                                  SHA256

                                                                                                                  5b4c234d27f71931ea1ca91355ca9834a6c0cd95c1e935bfdce03b418fbee2ea

                                                                                                                  SHA512

                                                                                                                  7dbc3a1f7d7623eb9e884d90c749a21f325341efa71320332c079770c5876458e6a83969dbe5ace9510a54eae495c4f0ca8d6ba1d40968d514a1996fa644a3ff

                                                                                                                  Download Submit

                                                                                                                • C:\Windows\System32\DriverStore\FileRepository\VMULTI~1.INF\hidkmdf.sys
                                                                                                                  Filesize

                                                                                                                  7KB

                                                                                                                  MD5

                                                                                                                  f1928f41c82ee87c3512c519b285a115

                                                                                                                  SHA1

                                                                                                                  526d137427e83138f0b31a0d18986a0caddf76b1

                                                                                                                  SHA256

                                                                                                                  40bbe73324701268c3f52551c2531552fa43421ef7db799c08200c303ddc2235

                                                                                                                  SHA512

                                                                                                                  5d85b39d6e295e3baf1dd63d515c3e18a2d165483549ef1a7a8cdc78ed9cfed10e0e5acd8a8d60762bcffebb4c4c4ef5cf404a5f1f95a16a3f7523c85fdaa230

                                                                                                                  Download Submit

                                                                                                                • C:\Windows\System32\DriverStore\FileRepository\VMULTI~1.INF\vmulti.sys
                                                                                                                  Filesize

                                                                                                                  10KB

                                                                                                                  MD5

                                                                                                                  4636facdc5d181a62d2ad34654f4a00d

                                                                                                                  SHA1

                                                                                                                  221e212e325d07895dacb419479138675031dce2

                                                                                                                  SHA256

                                                                                                                  394c002844f9f63a5999f66535ada392c932245c795c9ea9cf7c73f0e4dc43b0

                                                                                                                  SHA512

                                                                                                                  9f19751a9bbc69e96af8752784406f80c329caf45bfc3aac201c270117b5ded3c43193a5c8034135ca93514cc4cb947742c80972be50cff00100708d0126449e

                                                                                                                  Download Submit

                                                                                                                • C:\Windows\System32\DriverStore\FileRepository\hanvonugeemfilter.inf_amd64_5e728e9b55a6391e\hanvonugeemfilter.cat
                                                                                                                  Filesize

                                                                                                                  10KB

                                                                                                                  MD5

                                                                                                                  f161bf4c1ac6b26ee946c9a3bf916ffe

                                                                                                                  SHA1

                                                                                                                  1263f2a5975864d703afb7f15d0d2e47499dde2c

                                                                                                                  SHA256

                                                                                                                  b77c9daf31df08ff29c03b26071c282f21860a69406f6f809fbf0e7793f394fa

                                                                                                                  SHA512

                                                                                                                  85b3b617b524f20c8bff678f689232bf517faa5aa53a6611c7b07c9ca87c5f3029d82ae141c2cc00444ea1a7cd89b2fcb76cddffb97d5bb5f00946314f48cd44

                                                                                                                  Download Submit

                                                                                                                • C:\Windows\System32\DriverStore\FileRepository\hanvonugeemfilter.inf_amd64_5e728e9b55a6391e\hanvonugeemfilter.inf
                                                                                                                  Filesize

                                                                                                                  6KB

                                                                                                                  MD5

                                                                                                                  559d201d203e1b86c1df3b28fd53345e

                                                                                                                  SHA1

                                                                                                                  a891f1b4db8b3128fafc67344e37b4abfcca2a07

                                                                                                                  SHA256

                                                                                                                  0ed01aafce6532ba3cd19d025bfda37f6e8a06a5ef612c423f9dfa853580900b

                                                                                                                  SHA512

                                                                                                                  5e2f0cf375665a12ee284ed27ca43b21edfd7c18c162dcd2acbd0a59022c2da31553ab0836817fa7790f102599b2e2c36142c6fa67ae2ab2ecf7ed2d20b767fe

                                                                                                                  Download Submit

                                                                                                                • C:\Windows\System32\DriverStore\FileRepository\vmulti.inf_amd64_7c4a709680e8796d\vmulti.inf
                                                                                                                  Filesize

                                                                                                                  3KB

                                                                                                                  MD5

                                                                                                                  8caa6a96198b63517ce99095203dbe65

                                                                                                                  SHA1

                                                                                                                  666128119cf75897ff466a494d662bd3457a64c7

                                                                                                                  SHA256

                                                                                                                  72ec99a990a5d0c2c1fa7709606309bc7ba3ca850c8649bd86bc0cb639fb25b6

                                                                                                                  SHA512

                                                                                                                  2cfb684c88bff460b2fdbd6a09c0a1b859e97216114eb0472aa17a3ba7e27bd89a41a9a357efc662e5ef3809e33cf4470823421e18042cb607b6263526c9f949

                                                                                                                  Download Submit

                                                                                                                • \??\c:\PROGRA~1\PENTAB~1\64\WDFCOI~1.DLL
                                                                                                                  Filesize

                                                                                                                  1.6MB

                                                                                                                  MD5

                                                                                                                  4da5da193e0e4f86f6f8fd43ef25329a

                                                                                                                  SHA1

                                                                                                                  68a44d37ff535a2c454f2440e1429833a1c6d810

                                                                                                                  SHA256

                                                                                                                  18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e

                                                                                                                  SHA512

                                                                                                                  b3d73ed5e45d6f2908b2f3086390dd28c1631e298756cee9bdf26b185f0b77d1b8c03ad55e0495dba982c5bed4a03337b130c76f7112f3e19821127d2cf36853

                                                                                                                  Download Submit

                                                                                                                • \??\c:\PROGRA~1\PENTAB~1\64\hidkmdf.sys
                                                                                                                  Filesize

                                                                                                                  7KB

                                                                                                                  MD5

                                                                                                                  f1928f41c82ee87c3512c519b285a115

                                                                                                                  SHA1

                                                                                                                  526d137427e83138f0b31a0d18986a0caddf76b1

                                                                                                                  SHA256

                                                                                                                  40bbe73324701268c3f52551c2531552fa43421ef7db799c08200c303ddc2235

                                                                                                                  SHA512

                                                                                                                  5d85b39d6e295e3baf1dd63d515c3e18a2d165483549ef1a7a8cdc78ed9cfed10e0e5acd8a8d60762bcffebb4c4c4ef5cf404a5f1f95a16a3f7523c85fdaa230

                                                                                                                  Download Submit

                                                                                                                • \??\c:\PROGRA~1\PENTAB~1\64\vmulti.sys
                                                                                                                  Filesize

                                                                                                                  10KB

                                                                                                                  MD5

                                                                                                                  4636facdc5d181a62d2ad34654f4a00d

                                                                                                                  SHA1

                                                                                                                  221e212e325d07895dacb419479138675031dce2

                                                                                                                  SHA256

                                                                                                                  394c002844f9f63a5999f66535ada392c932245c795c9ea9cf7c73f0e4dc43b0

                                                                                                                  SHA512

                                                                                                                  9f19751a9bbc69e96af8752784406f80c329caf45bfc3aac201c270117b5ded3c43193a5c8034135ca93514cc4cb947742c80972be50cff00100708d0126449e

                                                                                                                  Download Submit

                                                                                                                • \??\c:\PROGRA~1\PENTAB~1\driver\64\HANVON~1.CAT
                                                                                                                  Filesize

                                                                                                                  10KB

                                                                                                                  MD5

                                                                                                                  f161bf4c1ac6b26ee946c9a3bf916ffe

                                                                                                                  SHA1

                                                                                                                  1263f2a5975864d703afb7f15d0d2e47499dde2c

                                                                                                                  SHA256

                                                                                                                  b77c9daf31df08ff29c03b26071c282f21860a69406f6f809fbf0e7793f394fa

                                                                                                                  SHA512

                                                                                                                  85b3b617b524f20c8bff678f689232bf517faa5aa53a6611c7b07c9ca87c5f3029d82ae141c2cc00444ea1a7cd89b2fcb76cddffb97d5bb5f00946314f48cd44

                                                                                                                  Download Submit

                                                                                                                • \??\c:\PROGRA~1\PENTAB~1\driver\64\HANVON~1.SYS
                                                                                                                  Filesize

                                                                                                                  9KB

                                                                                                                  MD5

                                                                                                                  065e4ba1ef63b6d6d073ce77821e0e06

                                                                                                                  SHA1

                                                                                                                  56d0b1f479a1e9a00d49a2283150456424acfc14

                                                                                                                  SHA256

                                                                                                                  5b4c234d27f71931ea1ca91355ca9834a6c0cd95c1e935bfdce03b418fbee2ea

                                                                                                                  SHA512

                                                                                                                  7dbc3a1f7d7623eb9e884d90c749a21f325341efa71320332c079770c5876458e6a83969dbe5ace9510a54eae495c4f0ca8d6ba1d40968d514a1996fa644a3ff

                                                                                                                  Download Submit

                                                                                                                • \??\c:\PROGRA~1\PENTAB~1\driver\64\WDFCOI~1.DLL
                                                                                                                  Filesize

                                                                                                                  1.6MB

                                                                                                                  MD5

                                                                                                                  4da5da193e0e4f86f6f8fd43ef25329a

                                                                                                                  SHA1

                                                                                                                  68a44d37ff535a2c454f2440e1429833a1c6d810

                                                                                                                  SHA256

                                                                                                                  18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e

                                                                                                                  SHA512

                                                                                                                  b3d73ed5e45d6f2908b2f3086390dd28c1631e298756cee9bdf26b185f0b77d1b8c03ad55e0495dba982c5bed4a03337b130c76f7112f3e19821127d2cf36853

                                                                                                                  Download Submit

                                                                                                                • \??\c:\program files\pentablet\64\pentablethid.cat
                                                                                                                  Filesize

                                                                                                                  10KB

                                                                                                                  MD5

                                                                                                                  0f8795258a7b91d17159884793e831c1

                                                                                                                  SHA1

                                                                                                                  78dc2f40f898130c8146722e93a7b5087e5f1fe1

                                                                                                                  SHA256

                                                                                                                  5e6513afbba3980b872670c0f42303ece625a5b1e3c651cdb5237e6e3ec1caf0

                                                                                                                  SHA512

                                                                                                                  fb089a539dba40dffdc85c9edcb1e49c9d9b6b0d9f13ef0c55a7fb8e7f9315f174297639f4928a20d52ef3cfbdf4316ffb221c043e63720760cb47240c078507

                                                                                                                  Download Submit

                                                                                                                • \??\c:\program files\pentablet\driver\64\hanvonugeemfilter.inf
                                                                                                                  Filesize

                                                                                                                  6KB

                                                                                                                  MD5

                                                                                                                  559d201d203e1b86c1df3b28fd53345e

                                                                                                                  SHA1

                                                                                                                  a891f1b4db8b3128fafc67344e37b4abfcca2a07

                                                                                                                  SHA256

                                                                                                                  0ed01aafce6532ba3cd19d025bfda37f6e8a06a5ef612c423f9dfa853580900b

                                                                                                                  SHA512

                                                                                                                  5e2f0cf375665a12ee284ed27ca43b21edfd7c18c162dcd2acbd0a59022c2da31553ab0836817fa7790f102599b2e2c36142c6fa67ae2ab2ecf7ed2d20b767fe

                                                                                                                  Download Submit

                                                                                                                • memory/1920-140-0x0000000003350000-0x000000000335E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  56KB

                                                                                                                  Download

                                                                                                                • memory/4936-223-0x0000000000400000-0x0000000000434000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  208KB

                                                                                                                  Download

                                                                                                                • memory/4936-137-0x0000000000400000-0x0000000000434000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  208KB

                                                                                                                  Download

                                                                                                                • memory/4936-132-0x0000000000400000-0x0000000000434000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  208KB

                                                                                                                  Download

                                                                                                                • memory/4936-260-0x0000000000400000-0x0000000000434000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  208KB

                                                                                                                  Download