Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    298s
  • max time network
    260s
  • platform
    windows10-1703_x64
  • resource
    win10-20231023-de
  • resource tags

    arch:x64arch:x86image:win10-20231023-delocale:de-deos:windows10-1703-x64systemwindows
  • submitted
    21/11/2023, 07:51

General

  • Target

    ComSoft-Basic-5.exe

  • Size

    168.7MB

  • MD5

    6aa07c314dad5828ea92d87ee23c8f5d

  • SHA1

    61a4fa0a9b66ff7cfa933f342f4f33d01cd8b47f

  • SHA256

    245c243a6b942dba31ab175991ab7adadd6b6fc2039c5f52abf518291323cec7

  • SHA512

    1e1e22b6b82b17da6c5073e8ea4370745ceb20bed9f5e9d93bc783208de70aef1a6d1c1cc4386474726cc96fb197d9088fdf1ba0edba4946f63b589e4ce31f3c

  • SSDEEP

    3145728:AhcGV6UyYWyAsohy3uQ4hx+rrna5zijvYjd+qtHXL/TfjXaVZ4A2GjwKH:6R1yYWWD4wna5mgjt7DjXaV7OKH

Score
8/10

Malware Config

Signatures

  • Manipulates Digital Signatures 1 TTPs 5 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • ACProtect 1.3x - 1.4x DLL software 8 IoCs

    Detects file using ACProtect software.

  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Blocklisted process makes network request 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ComSoft-Basic-5.exe
    "C:\Users\Admin\AppData\Local\Temp\ComSoft-Basic-5.exe"
    1⤵
    • Drops autorun.inf file
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:992
    • C:\Users\Admin\AppData\Local\Temp\testo\ComsoftBasic\TestoSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\testo\ComsoftBasic\TestoSetup.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4520
      • C:\Users\Admin\AppData\Local\Temp\testo\ComsoftBasic\csbasic64\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\testo\ComsoftBasic\csbasic64\setup.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2552
        • C:\Windows\SysWOW64\msiexec.exe
          "C:\Windows\SysWOW64\msiexec.exe" -I "C:\Users\Admin\AppData\Local\Temp\testo\ComsoftBasic\csbasic64\csbasic64.msi"
          4⤵
          • Blocklisted process makes network request
          • Enumerates connected drives
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:3096
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4012
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 4EC52126FA34F94BBC161CFC6DDDF0D6 C
      2⤵
      • Loads dropped DLL
      PID:772
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4152
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 4AA39A1E81C3260EB88CBBBFD69CBF24
        2⤵
        • Loads dropped DLL
        PID:5024
      • C:\Program Files (x86)\Testo\Comfort Software Basic 5.0\USBDriver\TiUsb\setup.exe
        "C:\Program Files (x86)\Testo\Comfort Software Basic 5.0\USBDriver\TiUsb\setup.exe" /S
        2⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:3804
        • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp
          "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp" "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp" "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1208
        • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp
          "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp" "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp" "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3464
        • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp
          "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp" "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp" "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3988
        • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp
          "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp" "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp" "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:508
        • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp
          "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp" "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp" "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4912
        • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp
          "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp" "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp" "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp"
          3⤵
          • Drops file in Windows directory
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4708
        • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp
          "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp" "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp" "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks SCSI registry key(s)
          PID:3276
        • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp
          "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp" "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp" "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks SCSI registry key(s)
          PID:4888
        • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp
          "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp" "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp" "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp"
          3⤵
          • Manipulates Digital Signatures
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system certificate store
          PID:1216
        • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp
          "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp" "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp" "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp"
          3⤵
          • Drops file in Windows directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks SCSI registry key(s)
          PID:4312
        • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp
          "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp" "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp" "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp"
          3⤵
          • Manipulates Digital Signatures
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system certificate store
          PID:4244
        • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp
          "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp" "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp" "C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1200
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 523214642B7579A9962042EBB2A47A95 E Global\MSI0000
        2⤵
        • Drops file in System32 directory
        • Loads dropped DLL
        • Checks SCSI registry key(s)
        PID:1396
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
        PID:428
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
        1⤵
        • Checks SCSI registry key(s)
        PID:4236
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious use of WriteProcessMemory
        PID:2564
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "1" "C:\Program Files\Testo\testo175176bus\testo175176bus.inf" "9" "4df1da6af" "0000000000000160" "WinSta0\Default" "000000000000017C" "208" "C:\Program Files\Testo\testo175176bus"
          2⤵
          • Manipulates Digital Signatures
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          PID:4028
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "1" "C:\Program Files (x86)\Testo\Comfort Software Basic 5.0\USBDriver\FTDIBus\ftdibus.inf" "9" "4624a7b47" "000000000000017C" "WinSta0\Default" "0000000000000178" "208" "C:\Program Files (x86)\Testo\Comfort Software Basic 5.0\USBDriver\FTDIBus"
          2⤵
          • Manipulates Digital Signatures
          • Drops file in System32 directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:2436
          • C:\Windows\system32\rundll32.exe
            rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{8f0b9a9c-2035-1743-95e1-07a00e9d47cc} Global\{ca904e62-5e97-7e42-ac03-87028c6d8732} C:\Windows\System32\DriverStore\Temp\{8cd5929a-6142-fb42-8e75-987729770692}\ftdibus.inf C:\Windows\System32\DriverStore\Temp\{8cd5929a-6142-fb42-8e75-987729770692}\ftdibus.cat
            3⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            PID:3968
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "1" "C:\Program Files (x86)\Testo\Comfort Software Basic 5.0\USBDriver\FTDIPort\ftdiport.inf" "9" "4ec18cc9b" "0000000000000198" "WinSta0\Default" "000000000000019C" "208" "C:\Program Files (x86)\Testo\Comfort Software Basic 5.0\USBDriver\FTDIPort"
          2⤵
          • Manipulates Digital Signatures
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:664
          • C:\Windows\system32\rundll32.exe
            rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{707a4e5f-b0ee-844c-866a-e60851492c5f} Global\{225faaac-f483-3f41-a413-cdd3248cc8bb} C:\Windows\System32\DriverStore\Temp\{4a154a96-7510-0345-875a-2ce6de1aaf5c}\ftdiport.inf C:\Windows\System32\DriverStore\Temp\{4a154a96-7510-0345-875a-2ce6de1aaf5c}\ftdiport.cat
            3⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            PID:3312
      • C:\Program Files (x86)\Testo\Comfort Software Basic 5.0\ComSoft.exe
        "C:\Program Files (x86)\Testo\Comfort Software Basic 5.0\ComSoft.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4580

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Config.Msi\e58ce0a.rbs

        Filesize

        1.5MB

        MD5

        c570367daf5505c6aa48dad8c5a5666c

        SHA1

        288a0ca79101e5d2f43a48de6b06a3de2f08060a

        SHA256

        befc670adf9dd86e22f34b37c7d3c9dcb08e9d32655156f21f3f027ba773930e

        SHA512

        22427a4a29039e1eae38f09f3e633a389a6f230f04dafb30784b575959b4bec894d24abcc8a86e58bb8f25f7657429ef02aaa713f545fb18b47591132603bf19

      • C:\Program Files (x86)\Testo\Comfort Software Basic 5.0\ComSoft.exe

        Filesize

        487KB

        MD5

        0cdb44aecdf02384bc74d2b6dd35c81c

        SHA1

        151366320cff49e8eabd1a40572cd3806aa12aaa

        SHA256

        95fc361295f092e772f79a4c3aef579d40ed298a680aa8a91e007e621e9c9baa

        SHA512

        2fae7415cbbfe04ff44e1a9b4cb88283cdb337286c94f9fc33ef8c6283a99bafd9edb71557e3f536cbcb38c658edb3336904cd7a7f8898e93e8898a5f5e3f43f

      • C:\Program Files (x86)\Testo\Comfort Software Basic 5.0\USBDriver\TiUsb\setup.exe

        Filesize

        1.0MB

        MD5

        bc7e137c4496cbfd6ded3851dcd9d207

        SHA1

        57bc94e649395bb0693461358e4d7f8cdec1172c

        SHA256

        b9c3b1694bb5b059eab0c5662950f1bec062c60983440dbde5c99696e93bdbf2

        SHA512

        28431b59505b69808ff394d9bb38890eb0bd891a5a9860eee878bb4b7b0d1080c9f2aafdb4a32f5469f273574371a6765388f192103a74c1c256f8c397ddea30

      • C:\Program Files (x86)\Testo\Comfort Software Basic 5.0\USBDriver\TiUsb\setup.exe

        Filesize

        1.0MB

        MD5

        bc7e137c4496cbfd6ded3851dcd9d207

        SHA1

        57bc94e649395bb0693461358e4d7f8cdec1172c

        SHA256

        b9c3b1694bb5b059eab0c5662950f1bec062c60983440dbde5c99696e93bdbf2

        SHA512

        28431b59505b69808ff394d9bb38890eb0bd891a5a9860eee878bb4b7b0d1080c9f2aafdb4a32f5469f273574371a6765388f192103a74c1c256f8c397ddea30

      • C:\Program Files (x86)\Testo\Comfort Software Basic 5.0\USBDriver\TiUsb\setup.ini

        Filesize

        1KB

        MD5

        6316af8b147b190eeff1c49ab3e952a1

        SHA1

        5df9e2b3159d2b5c6a571b4d5e6d10b11637fd3a

        SHA256

        62cad957acf347d275bc3aaf2f23d75e1c60abc6a375b2b1c4fc5331a831ba15

        SHA512

        2bb24911d1b17c3006c0585805cb0883d1a9f1b544d27a017b048e7231bb3d2adab602082b3bee63ef9b61fbbf69f26b6073cc3872f7dab170160c6d6a931cae

      • C:\Program Files (x86)\Testo\Comfort Software Basic 5.0\USBDriver\TiUsb\testo.cer

        Filesize

        1KB

        MD5

        eef52348fb73cc7fa42107f5ddfcbac7

        SHA1

        a7a6d8e35527a32cc6fdaba7c2132b6ffe488617

        SHA256

        ce06cf56028f352b441a92262ec788c595714583726c1b60be98fc7f5826a88c

        SHA512

        0eb496124162225587cc3f4a0660577d78f61785ee981e30522ac7366713f84e5846519f922d195e46e5f7d397c3d3862b14cf959c19fc41ab11b21610698d0a

      • C:\Program Files (x86)\Testo\Comfort Software Basic 5.0\USBDriver\TiUsb\testo175176bus.cat

        Filesize

        5KB

        MD5

        a6057cbb66589441a4c4a12bdfe8944c

        SHA1

        44399edd3db6469d79aea6e5b88a3a81587adc49

        SHA256

        01a80fb1194dce960f0b39f974a519704b7da3107570428fe6f4e46587e7a880

        SHA512

        c5eb7df331aef9d470dca3de90c7522a3248fbd3cf672dc52869d88db800de29c7d0a06e8e872f0aa68f51123031ebf92ee75f50fb437b25956c454ff3286b95

      • C:\Program Files (x86)\Testo\Comfort Software Basic 5.0\USBDriver\TiUsb\testo175176bus.inf

        Filesize

        2KB

        MD5

        19a6602d477c5e4d72a8a6eb8d22a6dd

        SHA1

        914067cb0c55f6cacd043d8bbceecd37bdbee16e

        SHA256

        ab4ec24f26cf1636920e3700d3dd9b5db267660ad5e3fa049818c753dd96ba6d

        SHA512

        9c6be75ec89c45524a7e767dcb3825695e3a88cc131974bd645f5b6ba48ec69b7b9f816c0208db7ff3fbcfb8f0968d289bc582515ed428590ec509cf3ff1df20

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

        Filesize

        471B

        MD5

        8c7f3d561b7f80db228e84c408e9359e

        SHA1

        2d51d533324f36bf32bb791e2d697afd6416b003

        SHA256

        4a3c58aed7c288fd0d6b6278b3f647d3982c9137c343ae7955140e369d6fd4a1

        SHA512

        7df099f69e7d4110f175a77cdaed8739be1a12449423d49e50b74a899a5035ac25feadb7f3ff588e4ad5d351d35e3708129faba91e468ab0e39ae5ac55ff5017

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_A79B45CEB3953B17FCDFD163EA459E7D

        Filesize

        727B

        MD5

        35a3a62caa8424fd00ca7cbd058e7f3f

        SHA1

        54598f23f86d23f238aefe99254617372203bb66

        SHA256

        60cd84248818c8406bc2a4b59ab3b033af949a5daf57e30acdaf5f48b83b7286

        SHA512

        cd1640dab1e59b523fbf1d93886565b72e9951a4c72029b267e063ab9355ec81c2baf10c0e65918b6610da7bb4df52a7481a03921a59c4b1cf54069b2a4c81a2

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

        Filesize

        727B

        MD5

        97c7c8b6481f18dffa7f9419c8fe4f99

        SHA1

        eb24496320676e87fb5c4a7f31a5aad7fadf8c5a

        SHA256

        4c036c26bac1ffd63250fa6e0cc1ddf7c4d514c6ad04bb8a4d64b4c1883c077b

        SHA512

        8acb03305c6070301c37867552f01281535907f0d233166ecb5d8c9eefd1b26f29bf8768c00eb5b7d5c36078c00ec860f59cade9827a713be1486ddd660d802e

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

        Filesize

        400B

        MD5

        627706f9ffe72d0e3259d9999382da10

        SHA1

        2ed6b12f8ac2c0242d2f154da3e73f7923eba775

        SHA256

        e4c740a8fed3e1b6e2b441db9d7d6308b81cfdff977c0dee87bee12a1a2981f6

        SHA512

        e3fcb9fa19303eb36fc0bf73c0d044f7917bfc9049eee4461822132186b19d8332f790b2516f452e69c0ae844373498113d2fdf77b6a7727693f2b8d7c59c7d6

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_A79B45CEB3953B17FCDFD163EA459E7D

        Filesize

        404B

        MD5

        3872956aa505fea37e467b19414467d3

        SHA1

        6207b76999dd48d0f8f83b78d6af1ffcedc17745

        SHA256

        050f98da8aa11dfdd358f2294643dc6460091731f2a1b6be99dc8bdfa47bafd2

        SHA512

        72de979688cc6c01b070c59d995d82f8268676960baa363ba34d1e762e238aa131943500ec212e6b758bb001bb66f6e26100b5797835c9f68ad3fb7e40a5b98f

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

        Filesize

        412B

        MD5

        d73400b70f7327296300b70ab8ea4339

        SHA1

        b11acb8acd9f66b9106f33c312d5c6cfa90ca806

        SHA256

        56c65e5e0f919992c0b3fde24d0f2618ec0f81462458cb92182b8361aa135e39

        SHA512

        21d4e7ddafd82bc13573ae089c3bca4d4a61e68780e5724675264950a7c288e8a10cf47c2f0f4d8e94ab78b71319b64cd5bd2d4a2babd02b41683459527263e9

      • C:\Users\Admin\AppData\Local\Temp\MSI2100.tmp

        Filesize

        202KB

        MD5

        b2052adb8202ed24034dee4cc7bb8515

        SHA1

        9cab6ba0a629f26a0031ef7aa47f7a25eb7093cb

        SHA256

        20056d3a5c6115fae1c4169cd5e236897215b340cb1feac71ec8297191db76b9

        SHA512

        f8ace80d9042f9a66c5db6f5caa4e8237b4fa88b9e3fb25845313b531e8b9e38b262f5a4c74ece0d273cdc2e0017af0b046744d620feb36c2ae81c94ea1a022b

      • C:\Users\Admin\AppData\Local\Temp\MSI5A42.tmp

        Filesize

        105KB

        MD5

        d5b5b64c74e5f40a26d1af1c23c28216

        SHA1

        8d82c7de85c5d50b4459f830da4b43934d312447

        SHA256

        f7148b04ebf94b2008a0e70f0978b1d9133a3c677889e314f462a3b09e4889ce

        SHA512

        70cb63b0e0328f3aa4d85e1f5c5059c215011522f44bd742c83906e6bf7d446c1f8ccdb0dd02a08e2199c5e24c0a478879c64459905f53db3b035dbeb53c1d2f

      • C:\Users\Admin\AppData\Local\Temp\PnP Driver Installer.log

        Filesize

        732B

        MD5

        f7985be8ac0aaa5f3aefb143c75a53b2

        SHA1

        6f55ca74761a50b9b9c401536a8e9431927be821

        SHA256

        ca6827a120af6ae47aa8c46558b7846337153659d123674430188ff2802eea12

        SHA512

        2ad7d65323ae9b838b0a18aba5d552957e883aadcfc2f7240e12acc42a115dc2735c16520d3dbeeaadc35d414fe13aa89ab0322c6d326b7f3b7231633409a756

      • C:\Users\Admin\AppData\Local\Temp\PnP Driver Installer.log

        Filesize

        880B

        MD5

        cb6564af649728af8f75664bbbda4ef7

        SHA1

        44a153c0869c3fb70dec4af4e993bef18b705c51

        SHA256

        d4249b32d79485ff47c8c215936b9bbabddceb1ef8b62bd0f140fc93b60d8953

        SHA512

        d65420815fc8887f7a9fc2a3ca32982b0550783887f442251a2eeb00ad96f7206907c84c65c75bb1dbadc2634a020d30f41a88f7fecbb5203bbdd03355d4d7d5

      • C:\Users\Admin\AppData\Local\Temp\PnP Driver Installer.log

        Filesize

        3KB

        MD5

        414942dc5a800fc7c1b785d2f8f72705

        SHA1

        2345fc14e1a89b24847a8351f119becbd4be38f2

        SHA256

        4f1644eddbdde2e29739936943602727836103133096fca43581c84d6a6d0e6f

        SHA512

        3242e9de0fdb1c7027e865739cb9507c29bc6b1109058b7792e668d74d396e4568ddcdffdde49640705a9c7cd2361359991a447a218d507014ed666006e76c97

      • C:\Users\Admin\AppData\Local\Temp\PnP Driver Installer.log

        Filesize

        4KB

        MD5

        1d7c8d2d85cb953304dc321bd082c978

        SHA1

        70d47d599cf1aa203c73fd4e8a74018111a31aa1

        SHA256

        dfb6343f623b0f642c30746238db05aad36297e2283134b2b1d2a2445c7bee97

        SHA512

        feeb798e03db21d8429a865ddd99948ba9330b4fabfbdae620a7e92473be652be346a70e7c7d98389df279a70f11b97389f3d89195bb74327f7fa30a4e02c963

      • C:\Users\Admin\AppData\Local\Temp\PnP Driver Installer.log

        Filesize

        4KB

        MD5

        108357398617ccf7e7dd0a98c8d7ec84

        SHA1

        8eef27b8a80d13bc607d75ab9181182391dc4b5f

        SHA256

        6712e4a2896252bc26e98c5b749a3c69b7dd1bf6d7b2c3fd343943bf337e5450

        SHA512

        ee4fa81a92512b453efb26d5eb986ed4d144a213911b7bfdbcf9b77490c8609f7c51d81f0935514ca1cb9bd4446e819af889482bc9893e6ba2596c66d452b872

      • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp

        Filesize

        215KB

        MD5

        c8070535966e5def8e5c879bf64fd08a

        SHA1

        93e2b105c6d15be77eaf4d5ccafb7f61d4499d48

        SHA256

        16534121f235c69ab988622128991b99f54128019cf808ed9f4acb5f86d809a6

        SHA512

        a0377f9480cf17950236396cbf0e3ae96e2968803ad82ef629346f37c53e5f4accc489cb6550bd45c2e9831ade6975f8b9626b0ebcb6528c4d94c20cdfc398c0

      • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp

        Filesize

        215KB

        MD5

        c8070535966e5def8e5c879bf64fd08a

        SHA1

        93e2b105c6d15be77eaf4d5ccafb7f61d4499d48

        SHA256

        16534121f235c69ab988622128991b99f54128019cf808ed9f4acb5f86d809a6

        SHA512

        a0377f9480cf17950236396cbf0e3ae96e2968803ad82ef629346f37c53e5f4accc489cb6550bd45c2e9831ade6975f8b9626b0ebcb6528c4d94c20cdfc398c0

      • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp

        Filesize

        215KB

        MD5

        c8070535966e5def8e5c879bf64fd08a

        SHA1

        93e2b105c6d15be77eaf4d5ccafb7f61d4499d48

        SHA256

        16534121f235c69ab988622128991b99f54128019cf808ed9f4acb5f86d809a6

        SHA512

        a0377f9480cf17950236396cbf0e3ae96e2968803ad82ef629346f37c53e5f4accc489cb6550bd45c2e9831ade6975f8b9626b0ebcb6528c4d94c20cdfc398c0

      • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp

        Filesize

        215KB

        MD5

        c8070535966e5def8e5c879bf64fd08a

        SHA1

        93e2b105c6d15be77eaf4d5ccafb7f61d4499d48

        SHA256

        16534121f235c69ab988622128991b99f54128019cf808ed9f4acb5f86d809a6

        SHA512

        a0377f9480cf17950236396cbf0e3ae96e2968803ad82ef629346f37c53e5f4accc489cb6550bd45c2e9831ade6975f8b9626b0ebcb6528c4d94c20cdfc398c0

      • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D4.tmp

        Filesize

        215KB

        MD5

        c8070535966e5def8e5c879bf64fd08a

        SHA1

        93e2b105c6d15be77eaf4d5ccafb7f61d4499d48

        SHA256

        16534121f235c69ab988622128991b99f54128019cf808ed9f4acb5f86d809a6

        SHA512

        a0377f9480cf17950236396cbf0e3ae96e2968803ad82ef629346f37c53e5f4accc489cb6550bd45c2e9831ade6975f8b9626b0ebcb6528c4d94c20cdfc398c0

      • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp

        Filesize

        35B

        MD5

        e7a4229b292dc7356ebeef99d7012748

        SHA1

        eab3d5f5a35d9e782e53fef2edb40620cf13a133

        SHA256

        f21ed17b37e926370c163b254c860a564c508b5de9f003c179e5a7cb1461536a

        SHA512

        0f1d3869bb8dd053c647062f9329124bcecb7ee9d266e8feda75e9f49607bff3d403fefc9a14ea60ef1f75c37fbba069469eab2d0b81a1d0b48210a1035b79ed

      • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp

        Filesize

        125B

        MD5

        2f7e83c2cbe907096d8236236d5ce730

        SHA1

        bd44173e3782a5c00cd86fd472a75c4da8807b43

        SHA256

        589e8ebe4946bb5a4a0d9ae62dad6a7954076587df127525c8f76f50a8ecb3e2

        SHA512

        5b32f4537c10153f883dbc6b15f55ec102b234339f551d96eba3a0d4f77c3c500e10ee6dd9e23a2e4f7da6e03dcbcba28b78b2c2b661fba0900fd0e69a9dcb32

      • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp

        Filesize

        40B

        MD5

        e559fc1b89d0fc49ef681e5927c9356b

        SHA1

        f2b5dc7d756d3f06b413aad534fd6516d92f1733

        SHA256

        cd7051eef2effb019a656c260e345dbe3ddee9b695a50af2d246862678fb54ad

        SHA512

        c8c64630df4271f5e85299e49d2777378f051183eddeb469f674bfb7ef39dc0f3c4411a2abe087677a66e5f183ba3c1d694a894dc0eeb0e65df4d788b3043c9f

      • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp

        Filesize

        69B

        MD5

        6eaa58dfabe29b01f3e38d91c583c4dc

        SHA1

        843c8655969256447d7ad7cba628211633ca098e

        SHA256

        78dee87f3878281ad9dfd0cc2362747d83cec88c398f81b8520ca81223b8147c

        SHA512

        cb6816ae0b684a892d091bcf0a191061c4d7028a8f8c27b363b415031e62e2ed6fb93bc97339a6239414f767e01592548b7c53bde8f24471bccfcbb4d9420a34

      • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp

        Filesize

        69B

        MD5

        6eaa58dfabe29b01f3e38d91c583c4dc

        SHA1

        843c8655969256447d7ad7cba628211633ca098e

        SHA256

        78dee87f3878281ad9dfd0cc2362747d83cec88c398f81b8520ca81223b8147c

        SHA512

        cb6816ae0b684a892d091bcf0a191061c4d7028a8f8c27b363b415031e62e2ed6fb93bc97339a6239414f767e01592548b7c53bde8f24471bccfcbb4d9420a34

      • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp

        Filesize

        302B

        MD5

        f18697ae982da09dd469a88bd25cd7a5

        SHA1

        1b5a19411ceefd38b86e8085f72bf9d3fa4edd6b

        SHA256

        eefa58913ed96891345b4811c54b73e714aca5471b11c2d8fbc200fe07838321

        SHA512

        ad291b3a6c5a01a54b91b7027a83bfba8aa461e1f51d8fdbfbc327b4dd9d63d6d1b53befc70b796e11b9f03346344accffc17a4bbe684d89dcb0307b823cd8b8

      • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp

        Filesize

        302B

        MD5

        f18697ae982da09dd469a88bd25cd7a5

        SHA1

        1b5a19411ceefd38b86e8085f72bf9d3fa4edd6b

        SHA256

        eefa58913ed96891345b4811c54b73e714aca5471b11c2d8fbc200fe07838321

        SHA512

        ad291b3a6c5a01a54b91b7027a83bfba8aa461e1f51d8fdbfbc327b4dd9d63d6d1b53befc70b796e11b9f03346344accffc17a4bbe684d89dcb0307b823cd8b8

      • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp

        Filesize

        35B

        MD5

        e7a4229b292dc7356ebeef99d7012748

        SHA1

        eab3d5f5a35d9e782e53fef2edb40620cf13a133

        SHA256

        f21ed17b37e926370c163b254c860a564c508b5de9f003c179e5a7cb1461536a

        SHA512

        0f1d3869bb8dd053c647062f9329124bcecb7ee9d266e8feda75e9f49607bff3d403fefc9a14ea60ef1f75c37fbba069469eab2d0b81a1d0b48210a1035b79ed

      • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp

        Filesize

        154B

        MD5

        f86f5873b3dd9b2f478eba7941feb295

        SHA1

        d87da809914736e2778ce5f92551a72183fe2c4d

        SHA256

        9264d263f6548fb4123a62f61ab212e80a24477377e6b882331b8458b9fa2770

        SHA512

        31640bb0a40a142eb0edae2e596ae3856748c5a74d7c8a5a9060fa331837ef7872b7bfca58830ba4776f02c868de6e280cfe9bef45b2641d63bce84114c82a02

      • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D5.tmp

        Filesize

        51B

        MD5

        94cc07b25c37551e44688ae5b8359c97

        SHA1

        00a4e6769c2e47a6cb576485dfe3ca718b03d128

        SHA256

        ed2a37ee583d57d21234e86cde8c9b11a8941ad8fe9670e91af0e8ded8fb9f61

        SHA512

        8b00a20fc7a4bd8d2094a7d7933ff99061285e1736cb25dc7c012225600591b53345f7d321fe3853a6f0bd6bd51714ca276e72d7b83f10244a82ca39e45cc7e0

      • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D6.cfg

        Filesize

        1KB

        MD5

        a6af541830d79c480afe358779f1987c

        SHA1

        d02ec728a48d9968515b9f5feb7ff7656632a7f0

        SHA256

        1e309f62f9cb9dcf12053ef5f1b0b2e2fad40b7f97656a3ae2dc088a48471ddb

        SHA512

        9799df336cc960b74b072d52ab6bcd2c7a6c6eafa064a6dfc81b13b21b2839ffc916381d4be142cd1864b7d54de89797815ece81d47a9bd90a6867a9d3db5e38

      • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D6.cfg

        Filesize

        1KB

        MD5

        c77065db8ac95de9d24c89aaa1357058

        SHA1

        4b68e5d1e36169ac9cc41f999a4eec42a24fbfc2

        SHA256

        4218779750dd078c6573c03082635692f4b51575ad58fb6da10db6397f10db3f

        SHA512

        c9d255f613ec7c62b9f540f92c60a565133b52cb61eddc19029fad7556a32dc67f246ad9b4a70df3f71c383c27c9b09b136cbaa4d6e30a87f1286007a0eeade0

      • C:\Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D6.tmp

        Filesize

        388KB

        MD5

        53aab3a6b32b5ae5e78f89c1073e3841

        SHA1

        fefd8f6add5b68741e6892380b442db15858549f

        SHA256

        78e6f6a45a83fa27a7fa596b50a9740f1d45dfa632e0af4024e187ca96f0e1b9

        SHA512

        7c6a04be5a16dbb1051c6b26a4068bb9aba7c81c293e6233e3006d24e53ccd770830d89297d15f1753b3848c2b855a1e3ba81155c3eba38df508b6b41073aa70

      • C:\Users\Admin\AppData\Local\Temp\nstE626.tmp\System.dll

        Filesize

        11KB

        MD5

        00a0194c20ee912257df53bfe258ee4a

        SHA1

        d7b4e319bc5119024690dc8230b9cc919b1b86b2

        SHA256

        dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

        SHA512

        3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

      • C:\Users\Admin\AppData\Local\Temp\nstE626.tmp\md5dll.dll

        Filesize

        6KB

        MD5

        0745ff646f5af1f1cdd784c06f40fce9

        SHA1

        bf7eba06020d7154ce4e35f696bec6e6c966287f

        SHA256

        fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70

        SHA512

        8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da

      • C:\Users\Admin\AppData\Local\Temp\nstE626.tmp\nsExec.dll

        Filesize

        6KB

        MD5

        e54eb27fb5048964e8d1ec7a1f72334b

        SHA1

        2b76d7aedafd724de96532b00fbc6c7c370e4609

        SHA256

        ff00f5f7b8d6ca6a79aebd08f9625a5579affcd09f3a25fdf728a7942527a824

        SHA512

        c9ddd19484a6218f926295a88f8776aff6c0a98565714290485f9b3b53e7b673724946defed0207064d6ab0b1baa7cb3477952f61dbe22947238d3f5802fa4f4

      • C:\Users\Admin\AppData\Local\Temp\nstE626.tmp\registry.dll

        Filesize

        16KB

        MD5

        ad0c39f7ff92b650511117ffa94d2a65

        SHA1

        f99d3932d09b3a883ee7c16465e681e2d0a90bce

        SHA256

        45e8054f0ac9b39a187efc0365ab871ed3fbd16868721ad3bc9fbbf4f83a64d2

        SHA512

        3210047bc5827535d0059a2acce84b86b96ea93d29d0829fb2a2d8057fd5245e172258778e2b3c0cf1134f89699e9b83c048656e42eb07b9dac29f20eb53528a

      • C:\Users\Admin\AppData\Local\Temp\testo\ComsoftBasic\TestoSetup.exe

        Filesize

        280KB

        MD5

        2b5fd42b17cd898bf79400533cc8b638

        SHA1

        36c4baffe3ff541c234bca0cc5a36e8808c486fd

        SHA256

        05bd5038584f1f8a07697bc098b286a04c49b3183b079a2c37e00d696cf84ccb

        SHA512

        75b68cd4e901c04bb91b100570ba3804e52a0d05693d62ce4af4313539a361431be55d473fd1f8dab4200ac357d54be5c1f45dd5f454cbf91ac176a1759f432e

      • C:\Users\Admin\AppData\Local\Temp\testo\ComsoftBasic\TestoSetup.exe

        Filesize

        280KB

        MD5

        2b5fd42b17cd898bf79400533cc8b638

        SHA1

        36c4baffe3ff541c234bca0cc5a36e8808c486fd

        SHA256

        05bd5038584f1f8a07697bc098b286a04c49b3183b079a2c37e00d696cf84ccb

        SHA512

        75b68cd4e901c04bb91b100570ba3804e52a0d05693d62ce4af4313539a361431be55d473fd1f8dab4200ac357d54be5c1f45dd5f454cbf91ac176a1759f432e

      • C:\Users\Admin\AppData\Local\Temp\testo\ComsoftBasic\csbasic64\csbasic64.msi

        Filesize

        37.7MB

        MD5

        b40b873d7e0f59282c3509d2048b5cdf

        SHA1

        6cfa5939acf846b560ade7dfc116502e0f6fafee

        SHA256

        6a29a64b484f8878b2d9aa2d0ad496b9240cdca386663f1fcf5e2389d7eca6ae

        SHA512

        738abb5415e12312b04c4c15ea36cffc76c8d522fe1c292a896a98be7d852258b382895b3da20325e1a2921afbb59d30fc41b9e414224486778380ccb31ccc1b

      • C:\Users\Admin\AppData\Local\Temp\testo\ComsoftBasic\csbasic64\setup.exe

        Filesize

        420KB

        MD5

        dcd407eb388df372d2954e25420a8946

        SHA1

        12ce9437fb788e821404f664ccb5b11e61be1e1f

        SHA256

        596f8c3db9f4af71fb9a27941474e2f1251a67ca5994015478fe43fa0f657d04

        SHA512

        a5aa6f8e394547ff51ac1790793e96df56781523e276617a7b29ff872240f8d8cc8a620b3716012636f74041df485221ff1f6a459addbeba1e7c0cd7b3c9bc75

      • C:\Users\Admin\AppData\Local\Temp\testo\ComsoftBasic\csbasic64\setup.exe

        Filesize

        420KB

        MD5

        dcd407eb388df372d2954e25420a8946

        SHA1

        12ce9437fb788e821404f664ccb5b11e61be1e1f

        SHA256

        596f8c3db9f4af71fb9a27941474e2f1251a67ca5994015478fe43fa0f657d04

        SHA512

        a5aa6f8e394547ff51ac1790793e96df56781523e276617a7b29ff872240f8d8cc8a620b3716012636f74041df485221ff1f6a459addbeba1e7c0cd7b3c9bc75

      • C:\Windows\Installer\MSIDABD.tmp

        Filesize

        149KB

        MD5

        418322f7be2b68e88a93a048ac75a757

        SHA1

        09739792ff1c30f73dacafbe503630615922b561

        SHA256

        ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

        SHA512

        253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

      • C:\Windows\Installer\e58ce09.msi

        Filesize

        37.7MB

        MD5

        b40b873d7e0f59282c3509d2048b5cdf

        SHA1

        6cfa5939acf846b560ade7dfc116502e0f6fafee

        SHA256

        6a29a64b484f8878b2d9aa2d0ad496b9240cdca386663f1fcf5e2389d7eca6ae

        SHA512

        738abb5415e12312b04c4c15ea36cffc76c8d522fe1c292a896a98be7d852258b382895b3da20325e1a2921afbb59d30fc41b9e414224486778380ccb31ccc1b

      • C:\Windows\System32\DriverStore\Temp\{2dcc62df-49ed-9a48-b452-79980e3f66d4}\SET2EC7.tmp

        Filesize

        5KB

        MD5

        a6057cbb66589441a4c4a12bdfe8944c

        SHA1

        44399edd3db6469d79aea6e5b88a3a81587adc49

        SHA256

        01a80fb1194dce960f0b39f974a519704b7da3107570428fe6f4e46587e7a880

        SHA512

        c5eb7df331aef9d470dca3de90c7522a3248fbd3cf672dc52869d88db800de29c7d0a06e8e872f0aa68f51123031ebf92ee75f50fb437b25956c454ff3286b95

      • C:\Windows\System32\DriverStore\Temp\{2dcc62df-49ed-9a48-b452-79980e3f66d4}\SET2EC8.tmp

        Filesize

        2KB

        MD5

        19a6602d477c5e4d72a8a6eb8d22a6dd

        SHA1

        914067cb0c55f6cacd043d8bbceecd37bdbee16e

        SHA256

        ab4ec24f26cf1636920e3700d3dd9b5db267660ad5e3fa049818c753dd96ba6d

        SHA512

        9c6be75ec89c45524a7e767dcb3825695e3a88cc131974bd645f5b6ba48ec69b7b9f816c0208db7ff3fbcfb8f0968d289bc582515ed428590ec509cf3ff1df20

      • C:\Windows\System32\DriverStore\Temp\{4a154a96-7510-0345-875a-2ce6de1aaf5c}\amd64\ftcserco.dll

        Filesize

        73KB

        MD5

        39e2638af413c84609bc851d942cca8c

        SHA1

        87b813a8edcb6acc10397978d2846c451d81db6f

        SHA256

        50da92af5be9be519a4648b2c1109a30e3d2341e85c928a58c1af8b4b830d4f3

        SHA512

        511bbfea7078b62687f64ed8e4f25bffc59529abf1e24e93de9414aa777629efc9576e890c474dc14758679a76e77783ee440bee747ec340fd40004c02172f48

      • C:\Windows\System32\DriverStore\Temp\{4a154a96-7510-0345-875a-2ce6de1aaf5c}\amd64\ftser2k.sys

        Filesize

        87KB

        MD5

        fbd982a8b9b94fc17d37edeba40b71e9

        SHA1

        6176b008b952b4c7aaaf3c14bbb45e3955c01d43

        SHA256

        2d07f14812af8d0796a2056808c092a71275df3138378aeb2c22a396bec67051

        SHA512

        f0c7a5b27e0b42462493ed3a39ec4e23c603851f54e427a1c792afd38ed7e8ac3a290ec60922d12f58a7a51705944ff84fc5edc8c0651125b97897fb3061e871

      • C:\Windows\System32\DriverStore\Temp\{4a154a96-7510-0345-875a-2ce6de1aaf5c}\amd64\ftserui2.dll

        Filesize

        63KB

        MD5

        6eec15bfcb7b375632aea62530c6777f

        SHA1

        be85e9df866ca2e3a278bdc4b70f15a996d14c23

        SHA256

        f716f94e4e31bd72d06152aaef53c8437093e5135430c488ea9f7c4426dd8227

        SHA512

        b697902e21784b8b724f241b374efd9748cda5d5cb06fe12e65aa96e411e930c0399ec4efe335634b3a2beba7ee4e4fc0fab527925d9ede4754989a74efffda1

      • C:\Windows\System32\DriverStore\Temp\{4a154a96-7510-0345-875a-2ce6de1aaf5c}\ftdiport.cat

        Filesize

        19KB

        MD5

        cccea8e9b70b6b1d14d7ea5261741d5a

        SHA1

        53d0c5b4bf4c66e14038dc9f2ca53b7dc812022e

        SHA256

        135efa10b6608fae3ff89b839835550511e487bff0c6b9794bb83f715ec75520

        SHA512

        975d782f90185a05c08206a1180ef15e6527c98b9f1a68a0befddd15163b767f1ad3e1cb92ef7edb7d3afac6c2a24019b1a836daded969d3c39a3aea69f5b9ca

      • C:\Windows\System32\DriverStore\Temp\{4a154a96-7510-0345-875a-2ce6de1aaf5c}\ftdiport.inf

        Filesize

        14KB

        MD5

        de9907b3fc04b30112e26009f3584ef6

        SHA1

        6bde23b7f46b131c7369ebae25d2d5d23fd81e81

        SHA256

        da1482b786817380e9d68360b8517b4e5364888d080f644da4e639c5a4d0006b

        SHA512

        4471a36870ae914ee02eac4dff3e8fb2d97ac188c32b57f905874c958b751cf1bcb5aecda12d4bdc393dac27e95b1110bac3cf271e29671f7a3fa45b8edcad61

      • C:\Windows\System32\DriverStore\Temp\{8cd5929a-6142-fb42-8e75-987729770692}\amd64\FTLang.dll

        Filesize

        268KB

        MD5

        8bb75f1ed68c88d6b32c67e86bbb66e4

        SHA1

        a74b385571c39f6a603149655efbcb13e04c3c40

        SHA256

        84b22f61827d448946977b259ce06b0a8e83bc1dc7b9d8a208d3e32525f08507

        SHA512

        3f36043e71dd96e6c4f18e1e439aad56c77a3738d728b29a8c4f79d27f59378a96d689ebb7dfc870ed6ad6ec5b254c39cebc0521ccaa0ff421463a75adcbb25b

      • C:\Windows\System32\DriverStore\Temp\{8cd5929a-6142-fb42-8e75-987729770692}\amd64\ftbusui.dll

        Filesize

        164KB

        MD5

        284c4c51734ac901df4e00bab3d7c628

        SHA1

        e9616a6d0b7b9982a2cf741b5ae2b7b55f33f50f

        SHA256

        368c42008ecdc511b1c95c67236ba11c69d69e708e00490e014be958952043e1

        SHA512

        17795545db5d670c2345811dff410323d6bf01b0db97ff48119e90129656ca843ecc906f4553306b1e542ff14fb8e25f0385c99a3569361209953480ddac8eb3

      • C:\Windows\System32\DriverStore\Temp\{8cd5929a-6142-fb42-8e75-987729770692}\amd64\ftd2xx64.dll

        Filesize

        307KB

        MD5

        7832f9df38bf967e60ee067a780d0201

        SHA1

        ed7a81137f109d504899c8e4a6b1e9e3ba108fe2

        SHA256

        9c282c4580aac9388adadf8c2d9794cca2f953af36331aedf814e936cfed97ad

        SHA512

        a278ff53ca44cbe471bffa38fe00e86c01b776cdb199a3cbf809162716f6f5bd3db143fd92bedcaa48c0c99e56eddcdde93be2ab40e08713ce32f021a5e20ad3

      • C:\Windows\System32\DriverStore\Temp\{8cd5929a-6142-fb42-8e75-987729770692}\amd64\ftdibus.sys

        Filesize

        126KB

        MD5

        d5f53afcd0d6e0a2925bfff9e2605552

        SHA1

        e9d81358cecfeac1f58234a40ff52e6282c80039

        SHA256

        8c494a63b270d8605ab9a4ad7d5ae074f7d466d64adba36f5e559210ecb35617

        SHA512

        e54bfc393837693fa39c0e95e9c1335f917317d06725c54139f2bb013a6da13826b88c2e9612e2cd0ec530f5f8be2089e32a7d6bff12e3ecb67f09287470bf91

      • C:\Windows\System32\DriverStore\Temp\{8cd5929a-6142-fb42-8e75-987729770692}\ftdibus.cat

        Filesize

        15KB

        MD5

        e81c2220d3b35c4d004c3b140764557c

        SHA1

        d7eec221ba8adbb44f6b7ef03b180561d139d6b5

        SHA256

        7e8458cad469c5b89e25ad288bf46ef46c93eeafdea42c9d2aa59a86fb1e1c34

        SHA512

        ad07efaf844169b6017b8d2df0fee2db91b8930eb711a22444b0e7423dcdfa0193b85926a4f2d93c63c9233418e0866e73ce3322ef45eb4a6ffa2d410e421d8a

      • C:\Windows\System32\DriverStore\Temp\{8cd5929a-6142-fb42-8e75-987729770692}\ftdibus.inf

        Filesize

        15KB

        MD5

        81dc3265d62ecb5f4f863e49356eb995

        SHA1

        f96aeecdb6e1a6c5f03c1619e681d5eff89cae4f

        SHA256

        ca0c22005e73462ec5a47d1391607a92b9c8c6e5748b5b46e78417ab30c9fa31

        SHA512

        772d04b46c434f378c0b5d97c7d4fb87477eda5e5fdc0aa50bf9ff5465bb097edeadac5e2dab2febd7f8114bd7a02b98df2949461d705c02b30231e869a1d1bc

      • C:\Windows\System32\DriverStore\Temp\{8cd5929a-6142-fb42-8e75-987729770692}\i386\ftd2xx.dll

        Filesize

        265KB

        MD5

        2f1e187ff00944e337121064c7bd3f2e

        SHA1

        f315dcc6154427f06aa0a16e44c149527d61d918

        SHA256

        f133f056b866d3c1d05db3a52c3457ed2326623a823fc48b724f6cada351224f

        SHA512

        81e3226ef4fbe8a4604d73eb9489798fed596acbfaf5d4fc7821f502012a4cc90e217387b10d476895446d9b67e789f7c926ddeafd98bb5046807e9dfbad1729

      • C:\Windows\System32\catroot2\dberr.txt

        Filesize

        188KB

        MD5

        a3629ab6a75f30d28c650263ce50b044

        SHA1

        a0bfc67038cc51e82cd384987257a19357755560

        SHA256

        01cdf57235226f6173aafb5e032a0c474749762854d70c7a4958b6dd68356b2b

        SHA512

        aeaf3ada476b5fd34a5b5baf1b830cc25cbc692137a01f31d636b528bb3b5e25065704bb4ab4ef6a6d7f88d73e521238430fee3f031e5fc077ea535609e98f18

      • \Users\Admin\AppData\Local\Temp\MSI2100.tmp

        Filesize

        202KB

        MD5

        b2052adb8202ed24034dee4cc7bb8515

        SHA1

        9cab6ba0a629f26a0031ef7aa47f7a25eb7093cb

        SHA256

        20056d3a5c6115fae1c4169cd5e236897215b340cb1feac71ec8297191db76b9

        SHA512

        f8ace80d9042f9a66c5db6f5caa4e8237b4fa88b9e3fb25845313b531e8b9e38b262f5a4c74ece0d273cdc2e0017af0b046744d620feb36c2ae81c94ea1a022b

      • \Users\Admin\AppData\Local\Temp\MSI5A42.tmp

        Filesize

        105KB

        MD5

        d5b5b64c74e5f40a26d1af1c23c28216

        SHA1

        8d82c7de85c5d50b4459f830da4b43934d312447

        SHA256

        f7148b04ebf94b2008a0e70f0978b1d9133a3c677889e314f462a3b09e4889ce

        SHA512

        70cb63b0e0328f3aa4d85e1f5c5059c215011522f44bd742c83906e6bf7d446c1f8ccdb0dd02a08e2199c5e24c0a478879c64459905f53db3b035dbeb53c1d2f

      • \Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D6.tmp

        Filesize

        388KB

        MD5

        53aab3a6b32b5ae5e78f89c1073e3841

        SHA1

        fefd8f6add5b68741e6892380b442db15858549f

        SHA256

        78e6f6a45a83fa27a7fa596b50a9740f1d45dfa632e0af4024e187ca96f0e1b9

        SHA512

        7c6a04be5a16dbb1051c6b26a4068bb9aba7c81c293e6233e3006d24e53ccd770830d89297d15f1753b3848c2b855a1e3ba81155c3eba38df508b6b41073aa70

      • \Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D6.tmp

        Filesize

        388KB

        MD5

        53aab3a6b32b5ae5e78f89c1073e3841

        SHA1

        fefd8f6add5b68741e6892380b442db15858549f

        SHA256

        78e6f6a45a83fa27a7fa596b50a9740f1d45dfa632e0af4024e187ca96f0e1b9

        SHA512

        7c6a04be5a16dbb1051c6b26a4068bb9aba7c81c293e6233e3006d24e53ccd770830d89297d15f1753b3848c2b855a1e3ba81155c3eba38df508b6b41073aa70

      • \Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D6.tmp

        Filesize

        388KB

        MD5

        53aab3a6b32b5ae5e78f89c1073e3841

        SHA1

        fefd8f6add5b68741e6892380b442db15858549f

        SHA256

        78e6f6a45a83fa27a7fa596b50a9740f1d45dfa632e0af4024e187ca96f0e1b9

        SHA512

        7c6a04be5a16dbb1051c6b26a4068bb9aba7c81c293e6233e3006d24e53ccd770830d89297d15f1753b3848c2b855a1e3ba81155c3eba38df508b6b41073aa70

      • \Users\Admin\AppData\Local\Temp\nsdE665.tmp\nsjE6D6.tmp

        Filesize

        388KB

        MD5

        53aab3a6b32b5ae5e78f89c1073e3841

        SHA1

        fefd8f6add5b68741e6892380b442db15858549f

        SHA256

        78e6f6a45a83fa27a7fa596b50a9740f1d45dfa632e0af4024e187ca96f0e1b9

        SHA512

        7c6a04be5a16dbb1051c6b26a4068bb9aba7c81c293e6233e3006d24e53ccd770830d89297d15f1753b3848c2b855a1e3ba81155c3eba38df508b6b41073aa70

      • \Users\Admin\AppData\Local\Temp\nstE626.tmp\System.dll

        Filesize

        11KB

        MD5

        00a0194c20ee912257df53bfe258ee4a

        SHA1

        d7b4e319bc5119024690dc8230b9cc919b1b86b2

        SHA256

        dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

        SHA512

        3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

      • \Users\Admin\AppData\Local\Temp\nstE626.tmp\md5dll.dll

        Filesize

        6KB

        MD5

        0745ff646f5af1f1cdd784c06f40fce9

        SHA1

        bf7eba06020d7154ce4e35f696bec6e6c966287f

        SHA256

        fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70

        SHA512

        8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da

      • \Users\Admin\AppData\Local\Temp\nstE626.tmp\md5dll.dll

        Filesize

        6KB

        MD5

        0745ff646f5af1f1cdd784c06f40fce9

        SHA1

        bf7eba06020d7154ce4e35f696bec6e6c966287f

        SHA256

        fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70

        SHA512

        8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da

      • \Users\Admin\AppData\Local\Temp\nstE626.tmp\md5dll.dll

        Filesize

        6KB

        MD5

        0745ff646f5af1f1cdd784c06f40fce9

        SHA1

        bf7eba06020d7154ce4e35f696bec6e6c966287f

        SHA256

        fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70

        SHA512

        8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da

      • \Users\Admin\AppData\Local\Temp\nstE626.tmp\md5dll.dll

        Filesize

        6KB

        MD5

        0745ff646f5af1f1cdd784c06f40fce9

        SHA1

        bf7eba06020d7154ce4e35f696bec6e6c966287f

        SHA256

        fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70

        SHA512

        8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da

      • \Users\Admin\AppData\Local\Temp\nstE626.tmp\md5dll.dll

        Filesize

        6KB

        MD5

        0745ff646f5af1f1cdd784c06f40fce9

        SHA1

        bf7eba06020d7154ce4e35f696bec6e6c966287f

        SHA256

        fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70

        SHA512

        8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da

      • \Users\Admin\AppData\Local\Temp\nstE626.tmp\md5dll.dll

        Filesize

        6KB

        MD5

        0745ff646f5af1f1cdd784c06f40fce9

        SHA1

        bf7eba06020d7154ce4e35f696bec6e6c966287f

        SHA256

        fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70

        SHA512

        8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da

      • \Users\Admin\AppData\Local\Temp\nstE626.tmp\nsExec.dll

        Filesize

        6KB

        MD5

        e54eb27fb5048964e8d1ec7a1f72334b

        SHA1

        2b76d7aedafd724de96532b00fbc6c7c370e4609

        SHA256

        ff00f5f7b8d6ca6a79aebd08f9625a5579affcd09f3a25fdf728a7942527a824

        SHA512

        c9ddd19484a6218f926295a88f8776aff6c0a98565714290485f9b3b53e7b673724946defed0207064d6ab0b1baa7cb3477952f61dbe22947238d3f5802fa4f4

      • \Users\Admin\AppData\Local\Temp\nstE626.tmp\nsExec.dll

        Filesize

        6KB

        MD5

        e54eb27fb5048964e8d1ec7a1f72334b

        SHA1

        2b76d7aedafd724de96532b00fbc6c7c370e4609

        SHA256

        ff00f5f7b8d6ca6a79aebd08f9625a5579affcd09f3a25fdf728a7942527a824

        SHA512

        c9ddd19484a6218f926295a88f8776aff6c0a98565714290485f9b3b53e7b673724946defed0207064d6ab0b1baa7cb3477952f61dbe22947238d3f5802fa4f4

      • \Users\Admin\AppData\Local\Temp\nstE626.tmp\nsExec.dll

        Filesize

        6KB

        MD5

        e54eb27fb5048964e8d1ec7a1f72334b

        SHA1

        2b76d7aedafd724de96532b00fbc6c7c370e4609

        SHA256

        ff00f5f7b8d6ca6a79aebd08f9625a5579affcd09f3a25fdf728a7942527a824

        SHA512

        c9ddd19484a6218f926295a88f8776aff6c0a98565714290485f9b3b53e7b673724946defed0207064d6ab0b1baa7cb3477952f61dbe22947238d3f5802fa4f4

      • \Users\Admin\AppData\Local\Temp\nstE626.tmp\nsExec.dll

        Filesize

        6KB

        MD5

        e54eb27fb5048964e8d1ec7a1f72334b

        SHA1

        2b76d7aedafd724de96532b00fbc6c7c370e4609

        SHA256

        ff00f5f7b8d6ca6a79aebd08f9625a5579affcd09f3a25fdf728a7942527a824

        SHA512

        c9ddd19484a6218f926295a88f8776aff6c0a98565714290485f9b3b53e7b673724946defed0207064d6ab0b1baa7cb3477952f61dbe22947238d3f5802fa4f4

      • \Users\Admin\AppData\Local\Temp\nstE626.tmp\nsExec.dll

        Filesize

        6KB

        MD5

        e54eb27fb5048964e8d1ec7a1f72334b

        SHA1

        2b76d7aedafd724de96532b00fbc6c7c370e4609

        SHA256

        ff00f5f7b8d6ca6a79aebd08f9625a5579affcd09f3a25fdf728a7942527a824

        SHA512

        c9ddd19484a6218f926295a88f8776aff6c0a98565714290485f9b3b53e7b673724946defed0207064d6ab0b1baa7cb3477952f61dbe22947238d3f5802fa4f4

      • \Users\Admin\AppData\Local\Temp\nstE626.tmp\nsExec.dll

        Filesize

        6KB

        MD5

        e54eb27fb5048964e8d1ec7a1f72334b

        SHA1

        2b76d7aedafd724de96532b00fbc6c7c370e4609

        SHA256

        ff00f5f7b8d6ca6a79aebd08f9625a5579affcd09f3a25fdf728a7942527a824

        SHA512

        c9ddd19484a6218f926295a88f8776aff6c0a98565714290485f9b3b53e7b673724946defed0207064d6ab0b1baa7cb3477952f61dbe22947238d3f5802fa4f4

      • \Users\Admin\AppData\Local\Temp\nstE626.tmp\nsExec.dll

        Filesize

        6KB

        MD5

        e54eb27fb5048964e8d1ec7a1f72334b

        SHA1

        2b76d7aedafd724de96532b00fbc6c7c370e4609

        SHA256

        ff00f5f7b8d6ca6a79aebd08f9625a5579affcd09f3a25fdf728a7942527a824

        SHA512

        c9ddd19484a6218f926295a88f8776aff6c0a98565714290485f9b3b53e7b673724946defed0207064d6ab0b1baa7cb3477952f61dbe22947238d3f5802fa4f4

      • \Users\Admin\AppData\Local\Temp\nstE626.tmp\nsExec.dll

        Filesize

        6KB

        MD5

        e54eb27fb5048964e8d1ec7a1f72334b

        SHA1

        2b76d7aedafd724de96532b00fbc6c7c370e4609

        SHA256

        ff00f5f7b8d6ca6a79aebd08f9625a5579affcd09f3a25fdf728a7942527a824

        SHA512

        c9ddd19484a6218f926295a88f8776aff6c0a98565714290485f9b3b53e7b673724946defed0207064d6ab0b1baa7cb3477952f61dbe22947238d3f5802fa4f4

      • \Users\Admin\AppData\Local\Temp\nstE626.tmp\registry.dll

        Filesize

        16KB

        MD5

        ad0c39f7ff92b650511117ffa94d2a65

        SHA1

        f99d3932d09b3a883ee7c16465e681e2d0a90bce

        SHA256

        45e8054f0ac9b39a187efc0365ab871ed3fbd16868721ad3bc9fbbf4f83a64d2

        SHA512

        3210047bc5827535d0059a2acce84b86b96ea93d29d0829fb2a2d8057fd5245e172258778e2b3c0cf1134f89699e9b83c048656e42eb07b9dac29f20eb53528a

      • \Users\Admin\AppData\Local\Temp\nstE626.tmp\registry.dll

        Filesize

        16KB

        MD5

        ad0c39f7ff92b650511117ffa94d2a65

        SHA1

        f99d3932d09b3a883ee7c16465e681e2d0a90bce

        SHA256

        45e8054f0ac9b39a187efc0365ab871ed3fbd16868721ad3bc9fbbf4f83a64d2

        SHA512

        3210047bc5827535d0059a2acce84b86b96ea93d29d0829fb2a2d8057fd5245e172258778e2b3c0cf1134f89699e9b83c048656e42eb07b9dac29f20eb53528a

      • \Windows\Installer\MSIDABD.tmp

        Filesize

        149KB

        MD5

        418322f7be2b68e88a93a048ac75a757

        SHA1

        09739792ff1c30f73dacafbe503630615922b561

        SHA256

        ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

        SHA512

        253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

      • memory/3804-459-0x00000000008F0000-0x00000000008F9000-memory.dmp

        Filesize

        36KB

      • memory/3804-824-0x0000000000400000-0x00000000006FF000-memory.dmp

        Filesize

        3.0MB

      • memory/3804-483-0x00000000008F0000-0x00000000008F9000-memory.dmp

        Filesize

        36KB

      • memory/3804-1144-0x0000000000400000-0x00000000006FF000-memory.dmp

        Filesize

        3.0MB

      • memory/3804-482-0x00000000008F0000-0x00000000008F9000-memory.dmp

        Filesize

        36KB

      • memory/3804-481-0x00000000008F0000-0x00000000008F9000-memory.dmp

        Filesize

        36KB

      • memory/3804-469-0x00000000008F0000-0x00000000008F9000-memory.dmp

        Filesize

        36KB

      • memory/3804-468-0x00000000008F0000-0x00000000008F9000-memory.dmp

        Filesize

        36KB

      • memory/3804-465-0x00000000008F0000-0x00000000008F9000-memory.dmp

        Filesize

        36KB

      • memory/3804-464-0x00000000008F0000-0x00000000008F9000-memory.dmp

        Filesize

        36KB

      • memory/3804-463-0x00000000008F0000-0x00000000008F9000-memory.dmp

        Filesize

        36KB

      • memory/3804-462-0x00000000008F0000-0x00000000008F9000-memory.dmp

        Filesize

        36KB

      • memory/3804-461-0x00000000008F0000-0x00000000008F9000-memory.dmp

        Filesize

        36KB

      • memory/3804-460-0x00000000008F0000-0x00000000008F9000-memory.dmp

        Filesize

        36KB

      • memory/3804-458-0x00000000008F0000-0x00000000008F9000-memory.dmp

        Filesize

        36KB

      • memory/3804-457-0x00000000008F0000-0x00000000008F9000-memory.dmp

        Filesize

        36KB

      • memory/3804-451-0x00000000008F0000-0x00000000008F9000-memory.dmp

        Filesize

        36KB

      • memory/3804-429-0x00000000008F0000-0x00000000008F9000-memory.dmp

        Filesize

        36KB

      • memory/3804-282-0x0000000000400000-0x00000000006FF000-memory.dmp

        Filesize

        3.0MB

      • memory/4580-1325-0x0000000000A00000-0x0000000000A80000-memory.dmp

        Filesize

        512KB

      • memory/4580-1326-0x0000000073F10000-0x00000000745FE000-memory.dmp

        Filesize

        6.9MB

      • memory/4580-1327-0x0000000002DE0000-0x0000000002E24000-memory.dmp

        Filesize

        272KB

      • memory/4580-1328-0x0000000005830000-0x00000000058D4000-memory.dmp

        Filesize

        656KB

      • memory/4580-1329-0x0000000002E30000-0x0000000002E3A000-memory.dmp

        Filesize

        40KB

      • memory/4580-1330-0x0000000002E40000-0x0000000002E48000-memory.dmp

        Filesize

        32KB

      • memory/4580-1331-0x0000000005AC0000-0x0000000005AD0000-memory.dmp

        Filesize

        64KB

      • memory/4580-1332-0x00000000058E0000-0x0000000005966000-memory.dmp

        Filesize

        536KB

      • memory/4580-1333-0x0000000005B70000-0x0000000005C02000-memory.dmp

        Filesize

        584KB

      • memory/4580-1334-0x0000000005AC0000-0x0000000005AD0000-memory.dmp

        Filesize

        64KB

      • memory/4580-1335-0x0000000005EE0000-0x0000000005FE4000-memory.dmp

        Filesize

        1.0MB

      • memory/4580-1336-0x0000000005E60000-0x0000000005EAA000-memory.dmp

        Filesize

        296KB

      • memory/4580-1337-0x0000000008A20000-0x0000000008B70000-memory.dmp

        Filesize

        1.3MB

      • memory/4580-1338-0x0000000008EF0000-0x0000000008F10000-memory.dmp

        Filesize

        128KB

      • memory/4580-1339-0x0000000008F40000-0x0000000008F64000-memory.dmp

        Filesize

        144KB

      • memory/4580-1340-0x00000000094B0000-0x000000000956A000-memory.dmp

        Filesize

        744KB

      • memory/4580-1341-0x00000000096D0000-0x0000000009830000-memory.dmp

        Filesize

        1.4MB

      • memory/4580-1343-0x000000000B570000-0x000000000C70E000-memory.dmp

        Filesize

        17.6MB

      • memory/4580-1342-0x00000000093F0000-0x0000000009428000-memory.dmp

        Filesize

        224KB

      • memory/4580-1344-0x0000000008FC0000-0x0000000008FDE000-memory.dmp

        Filesize

        120KB

      • memory/4580-1345-0x0000000009450000-0x0000000009464000-memory.dmp

        Filesize

        80KB

      • memory/4580-1346-0x0000000009440000-0x000000000944C000-memory.dmp

        Filesize

        48KB

      • memory/4580-1347-0x00000000096B0000-0x00000000096BA000-memory.dmp

        Filesize

        40KB

      • memory/4580-1348-0x000000000A660000-0x000000000A672000-memory.dmp

        Filesize

        72KB

      • memory/4580-1349-0x000000000A680000-0x000000000A702000-memory.dmp

        Filesize

        520KB

      • memory/4580-1350-0x000000000A8D0000-0x000000000A9D8000-memory.dmp

        Filesize

        1.0MB

      • memory/4580-1351-0x000000000A9E0000-0x000000000AB14000-memory.dmp

        Filesize

        1.2MB

      • memory/4580-1352-0x000000000AB20000-0x000000000ACE0000-memory.dmp

        Filesize

        1.8MB

      • memory/4580-1353-0x000000000C710000-0x000000000CC0E000-memory.dmp

        Filesize

        5.0MB

      • memory/4580-1354-0x000000000B040000-0x000000000B39C000-memory.dmp

        Filesize

        3.4MB

      • memory/4580-1355-0x00000000096C0000-0x00000000096C8000-memory.dmp

        Filesize

        32KB

      • memory/4580-1356-0x000000000A800000-0x000000000A848000-memory.dmp

        Filesize

        288KB

      • memory/4580-1357-0x000000000ACE0000-0x000000000AD56000-memory.dmp

        Filesize

        472KB

      • memory/4580-1358-0x000000000A1B0000-0x000000000A1B8000-memory.dmp

        Filesize

        32KB

      • memory/4580-1359-0x000000000AE60000-0x000000000AEA2000-memory.dmp

        Filesize

        264KB

      • memory/4580-1360-0x000000000AF50000-0x000000000AFC0000-memory.dmp

        Filesize

        448KB

      • memory/4580-1361-0x000000000A5C0000-0x000000000A5CA000-memory.dmp

        Filesize

        40KB

      • memory/4580-1362-0x000000000A630000-0x000000000A648000-memory.dmp

        Filesize

        96KB

      • memory/4580-1365-0x0000000005AC0000-0x0000000005AD0000-memory.dmp

        Filesize

        64KB

      • memory/4580-1366-0x0000000073F10000-0x00000000745FE000-memory.dmp

        Filesize

        6.9MB

      • memory/4580-1367-0x0000000005AC0000-0x0000000005AD0000-memory.dmp

        Filesize

        64KB

      • memory/4580-1368-0x0000000005AC0000-0x0000000005AD0000-memory.dmp

        Filesize

        64KB