Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

XPPenWin_3...29.exe

windows10-2004-x64

8

Resubmissions

07/05/2024, 17:42

240507-v99veagf7z 8

07/05/2024, 17:39

240507-v8rmfagf2w 8

Analysis

  • max time kernel
    40s
  • max time network
    39s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    07/05/2024, 17:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    XPPenWin_3.4.13.231129.exe

  • Size

    28.8MB

  • MD5

    61f1a3fc174a0c4ac9b80c15c389b7fe

  • SHA1

    1e0c613cf1c4d32dd418cc4e296c4dd66434c617

  • SHA256

    8946105827c27151e3e17f88f7c65d9db99aef1ef7f3e710bda37d2c948d7f16

  • SHA512

    8126a8dbfc85e47c659a588544877980d453ecc675e499f034df48565f93bde45bb6be251a039891e219c372b83b020d5b46ab042adcc54e0d33c61a305b99a2

  • SSDEEP

    786432:BzYs7Y0vrsRqTYMZE9FVgc5DvznZA1JDi:BY+Y5cTJZqgc5DNA1U

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 11 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 54 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 13 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XPPenWin_3.4.13.231129.exe
    "C:\Users\Admin\AppData\Local\Temp\XPPenWin_3.4.13.231129.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:788
    • C:\Users\Admin\AppData\Local\Temp\is-L5FBC.tmp\XPPenWin_3.4.13.231129.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-L5FBC.tmp\XPPenWin_3.4.13.231129.tmp" /SL5="$401D6,29570376,243200,C:\Users\Admin\AppData\Local\Temp\XPPenWin_3.4.13.231129.exe"
      2⤵
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3232
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-FL9H0.tmp\EndWintab.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1964
        • C:\Windows\system32\taskkill.exe
          taskkill /f /t /im PenTablet.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4112
        • C:\Windows\system32\taskkill.exe
          taskkill /f /t /im PentabletService.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3936
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c listdlls.exe -d wintab32.dll /accepteula
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3128
          • C:\Users\Admin\AppData\Local\Temp\is-FL9H0.tmp\Listdlls.exe
            listdlls.exe -d wintab32.dll /accepteula
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:864
            • C:\Users\Admin\AppData\Local\Temp\is-FL9H0.tmp\Listdlls64.exe
              listdlls.exe -d wintab32.dll /accepteula
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2748
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Listdlls v3.2 - Listdlls "
          4⤵
            PID:4352
          • C:\Windows\system32\find.exe
            find "pid:"
            4⤵
              PID:2228
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Copyright (C) 1997-2016 Mark Russinovich "
              4⤵
                PID:564
              • C:\Windows\system32\find.exe
                find "pid:"
                4⤵
                  PID:2984
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Sysinternals "
                  4⤵
                    PID:3688
                  • C:\Windows\system32\find.exe
                    find "pid:"
                    4⤵
                      PID:1592
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Error opening System(4): "
                      4⤵
                        PID:2624
                      • C:\Windows\system32\find.exe
                        find "pid:"
                        4⤵
                          PID:640
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /S /D /c" echo Acceso denegado. "
                          4⤵
                            PID:4820
                          • C:\Windows\system32\find.exe
                            find "pid:"
                            4⤵
                              PID:3668
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /S /D /c" echo Error opening Registry(92): "
                              4⤵
                                PID:2716
                              • C:\Windows\system32\find.exe
                                find "pid:"
                                4⤵
                                  PID:5060
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /S /D /c" echo Acceso denegado. "
                                  4⤵
                                    PID:224
                                  • C:\Windows\system32\find.exe
                                    find "pid:"
                                    4⤵
                                      PID:2992
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /S /D /c" echo Error opening smss.exe(356): "
                                      4⤵
                                        PID:2780
                                      • C:\Windows\system32\find.exe
                                        find "pid:"
                                        4⤵
                                          PID:4400
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /S /D /c" echo Acceso denegado. "
                                          4⤵
                                            PID:5108
                                          • C:\Windows\system32\find.exe
                                            find "pid:"
                                            4⤵
                                              PID:648
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /S /D /c" echo Error opening csrss.exe(444): "
                                              4⤵
                                                PID:2444
                                              • C:\Windows\system32\find.exe
                                                find "pid:"
                                                4⤵
                                                  PID:1932
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /S /D /c" echo Acceso denegado. "
                                                  4⤵
                                                    PID:8
                                                  • C:\Windows\system32\find.exe
                                                    find "pid:"
                                                    4⤵
                                                      PID:4284
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /S /D /c" echo Error opening wininit.exe(528): "
                                                      4⤵
                                                        PID:3864
                                                      • C:\Windows\system32\find.exe
                                                        find "pid:"
                                                        4⤵
                                                          PID:520
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /S /D /c" echo Acceso denegado. "
                                                          4⤵
                                                            PID:3808
                                                          • C:\Windows\system32\find.exe
                                                            find "pid:"
                                                            4⤵
                                                              PID:2412
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /S /D /c" echo Error opening csrss.exe(536): "
                                                              4⤵
                                                                PID:5080
                                                              • C:\Windows\system32\find.exe
                                                                find "pid:"
                                                                4⤵
                                                                  PID:4492
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo Acceso denegado. "
                                                                  4⤵
                                                                    PID:4136
                                                                  • C:\Windows\system32\find.exe
                                                                    find "pid:"
                                                                    4⤵
                                                                      PID:544
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /S /D /c" echo Error opening services.exe(668): "
                                                                      4⤵
                                                                        PID:784
                                                                      • C:\Windows\system32\find.exe
                                                                        find "pid:"
                                                                        4⤵
                                                                          PID:2544
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /S /D /c" echo Acceso denegado. "
                                                                          4⤵
                                                                            PID:3400
                                                                          • C:\Windows\system32\find.exe
                                                                            find "pid:"
                                                                            4⤵
                                                                              PID:3768
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /S /D /c" echo Error opening svchost.exe(2924): "
                                                                              4⤵
                                                                                PID:2820
                                                                              • C:\Windows\system32\find.exe
                                                                                find "pid:"
                                                                                4⤵
                                                                                  PID:1132
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo Acceso denegado. "
                                                                                  4⤵
                                                                                    PID:716
                                                                                  • C:\Windows\system32\find.exe
                                                                                    find "pid:"
                                                                                    4⤵
                                                                                      PID:1948
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /S /D /c" echo Error opening sppsvc.exe(4752): "
                                                                                      4⤵
                                                                                        PID:2960
                                                                                      • C:\Windows\system32\find.exe
                                                                                        find "pid:"
                                                                                        4⤵
                                                                                          PID:4572
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /S /D /c" echo Acceso denegado. "
                                                                                          4⤵
                                                                                            PID:1992
                                                                                          • C:\Windows\system32\find.exe
                                                                                            find "pid:"
                                                                                            4⤵
                                                                                              PID:3932
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /S /D /c" echo Error opening upfc.exe(464): "
                                                                                              4⤵
                                                                                                PID:4788
                                                                                              • C:\Windows\system32\find.exe
                                                                                                find "pid:"
                                                                                                4⤵
                                                                                                  PID:2484
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo Acceso denegado. "
                                                                                                  4⤵
                                                                                                    PID:1420
                                                                                                  • C:\Windows\system32\find.exe
                                                                                                    find "pid:"
                                                                                                    4⤵
                                                                                                      PID:4992
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /S /D /c" echo Error opening svchost.exe(2884): "
                                                                                                      4⤵
                                                                                                        PID:4076
                                                                                                      • C:\Windows\system32\find.exe
                                                                                                        find "pid:"
                                                                                                        4⤵
                                                                                                          PID:4800
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /S /D /c" echo Acceso denegado. "
                                                                                                          4⤵
                                                                                                            PID:2196
                                                                                                          • C:\Windows\system32\find.exe
                                                                                                            find "pid:"
                                                                                                            4⤵
                                                                                                              PID:932
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-FL9H0.tmp\PSCC.bat""
                                                                                                            3⤵
                                                                                                              PID:4592
                                                                                                            • C:\Program Files\Pentablet\64\devcon.exe
                                                                                                              "C:\Program Files\Pentablet\64\devcon.exe" install XPPenTablet.inf XPPen\PenTablet
                                                                                                              3⤵
                                                                                                              • Drops file in System32 directory
                                                                                                              • Drops file in Windows directory
                                                                                                              • Executes dropped EXE
                                                                                                              • Checks SCSI registry key(s)
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:2792
                                                                                                            • C:\Program Files\Pentablet\driver\64\dpinst.exe
                                                                                                              "C:\Program Files\Pentablet\driver\64\dpinst.exe" /sw /se /f /lm /sa
                                                                                                              3⤵
                                                                                                              • Drops file in System32 directory
                                                                                                              • Drops file in Windows directory
                                                                                                              • Executes dropped EXE
                                                                                                              • Checks SCSI registry key(s)
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:2556
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                                                          1⤵
                                                                                                          • Drops file in Windows directory
                                                                                                          • Checks SCSI registry key(s)
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:5108
                                                                                                          • C:\Windows\system32\DrvInst.exe
                                                                                                            DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{6154b4c3-0a4e-b441-8295-dadf2dcda11c}\xppentablet.inf" "9" "4c3013c77" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "c:\program files\pentablet\64"
                                                                                                            2⤵
                                                                                                            • Drops file in System32 directory
                                                                                                            • Drops file in Windows directory
                                                                                                            • Checks SCSI registry key(s)
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            PID:220
                                                                                                          • C:\Windows\system32\DrvInst.exe
                                                                                                            DrvInst.exe "2" "211" "ROOT\HIDCLASS\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:b2fe48187df79a23:XPPenTablet.Inst.Win7:6.1.7600.16385:xppen\pentablet," "4c3013c77" "000000000000014C"
                                                                                                            2⤵
                                                                                                            • Drops file in Drivers directory
                                                                                                            • Drops file in Windows directory
                                                                                                            • Checks SCSI registry key(s)
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:1944
                                                                                                          • C:\Windows\system32\DrvInst.exe
                                                                                                            DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{8cf26207-9db7-fc4a-8a0a-cbdb869bfcd4}\hanvonugeemfilter.inf" "9" "4e3e7d867" "0000000000000174" "WinSta0\Default" "000000000000014C" "208" "c:\program files\pentablet\driver\64"
                                                                                                            2⤵
                                                                                                            • Drops file in System32 directory
                                                                                                            • Drops file in Windows directory
                                                                                                            • Checks SCSI registry key(s)
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            PID:3388
                                                                                                          • C:\Windows\system32\DrvInst.exe
                                                                                                            DrvInst.exe "2" "211" "HID\PENTABLET&COL01\1&2D595CA7&0&0000" "C:\Windows\INF\oem4.inf" "oem4.inf:ed86ca113d4f58de:hanvonugeemfilter:14.27.40.873:hid\pentablet&col01," "45f95b4db" "0000000000000164"
                                                                                                            2⤵
                                                                                                            • Drops file in Drivers directory
                                                                                                            • Drops file in System32 directory
                                                                                                            • Drops file in Windows directory
                                                                                                            • Checks SCSI registry key(s)
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:2984
                                                                                                        • C:\Program Files\Pentablet\PenTablet.exe
                                                                                                          "C:\Program Files\Pentablet\PenTablet.exe"
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Loads dropped DLL
                                                                                                          • Suspicious behavior: AddClipboardFormatListener
                                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:2764

                                                                                                        Network

                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                        Replay Monitor

                                                                                                        Loading Replay Monitor...

                                                                                                        Downloads

                                                                                                        • C:\Program Files\Pentablet\64\XPPenTablet.inf
                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          MD5

                                                                                                          a2ed483f0d9c9a3537464538a3cb7de5

                                                                                                          SHA1

                                                                                                          bbc57de686531dd9f7a650832a41639bae2abc1f

                                                                                                          SHA256

                                                                                                          df2ab5de04ed3fc3ec00931dadb447a011cb493b91d1ca2789bc2b70ce1e172b

                                                                                                          SHA512

                                                                                                          8535848ee0e1ba2ce827c87f3852c0477f53463a61c6bd7e521c43d7505ef5dcb19e7ea99ffe358e0cea7f155c9e59ccafedc8aece2a3aa01046b400a3cbf477

                                                                                                          Download Submit

                                                                                                        • C:\Program Files\Pentablet\64\devcon.exe
                                                                                                          Filesize

                                                                                                          88KB

                                                                                                          MD5

                                                                                                          f44245761bcf718a534974b431b8ce5c

                                                                                                          SHA1

                                                                                                          ee9ddb20529b1dad55383d9209d4d5c35c152571

                                                                                                          SHA256

                                                                                                          0a15d33b2994e5eb25ab9747e1214b078348529a735d342f3fa5fdb64b6cd312

                                                                                                          SHA512

                                                                                                          0b58cc6353d9cdb39c83c0f97444d66072eea9fdf19b835116e58cff3d195da4cf05f25fe57da0962aafa35dc6bf0fe35350b87c39c8f2e440615b766652af87

                                                                                                          Download Submit

                                                                                                        • C:\Program Files\Pentablet\PenTablet.exe
                                                                                                          Filesize

                                                                                                          1.1MB

                                                                                                          MD5

                                                                                                          9ad3744bd50c4b0fcad3fa14c41c3222

                                                                                                          SHA1

                                                                                                          4a4fd743225f9266272f69e11dfe1cccd7a10a4d

                                                                                                          SHA256

                                                                                                          1f83c5ca6e0df700c8480ab2eaba1452725d7a3f2f80169da21dc4297e3b6241

                                                                                                          SHA512

                                                                                                          ca93988cd29a4b2186cec5623946d26e8640e37b39fe13165cc5bdb60ac83cb4bcbf501e0c04812ef36df34eb6fabad04cb1a3487f3897e6264eb00cab728bed

                                                                                                          Download Submit

                                                                                                        • C:\Program Files\Pentablet\Qt5Core.dll
                                                                                                          Filesize

                                                                                                          4.6MB

                                                                                                          MD5

                                                                                                          90cf6c6da71197f649b23ca9e5e4b82e

                                                                                                          SHA1

                                                                                                          c5156c6afcddddecded540d745ff1f60ad5a6f4b

                                                                                                          SHA256

                                                                                                          8390373c6494541c26bcf675af7f7562fd470103ba9874292ad08117d7d5b07d

                                                                                                          SHA512

                                                                                                          c83edd7cea7a4cb4af074c3aa4d223b7d7ddcb1be2db25c046b1521b1270df1127549863f03ddd5aae64087abffec5a95d15e380e5fb89515b0e8236b2159991

                                                                                                          Download Submit

                                                                                                        • C:\Program Files\Pentablet\Qt5Gui.dll
                                                                                                          Filesize

                                                                                                          4.7MB

                                                                                                          MD5

                                                                                                          60d7281f7e93353e695a9f97056c8f92

                                                                                                          SHA1

                                                                                                          4d51b52529c9f8ec9cd2544372bb3b0e6d05ddc4

                                                                                                          SHA256

                                                                                                          c439af5ad0e2137bcff0d04358aefbbc97a06021d17e6f68010db77adcc8be6f

                                                                                                          SHA512

                                                                                                          d259b6c00b3907e6ffa31d5ba16482c5fdb0a9e54c3bd871a2c26be3456cb2bf7a2ebd2f4cc9240920767ccf36a88acd9a9d42ef6aed4ddcc299a44b21eccd33

                                                                                                          Download Submit

                                                                                                        • C:\Program Files\Pentablet\Qt5Network.dll
                                                                                                          Filesize

                                                                                                          908KB

                                                                                                          MD5

                                                                                                          cfb21ebd31904c906973137b0b6d874f

                                                                                                          SHA1

                                                                                                          53df05bbb6a34f85e069717cbee962ba40c5dcd3

                                                                                                          SHA256

                                                                                                          154a094904d19d65a6658b8cb4151c75838d9dfcb1a3dc15ec9b1bdeaa0d60c6

                                                                                                          SHA512

                                                                                                          ee2a19a3cc9e7e1d72812fe8a707d8f3991fd2e803a090960eaedfae2c1f8d808200466d5de7fe8922b423cc034f6747b981509b75da7099b510991b9bd028f0

                                                                                                          Download Submit

                                                                                                        • C:\Program Files\Pentablet\Qt5Widgets.dll
                                                                                                          Filesize

                                                                                                          4.3MB

                                                                                                          MD5

                                                                                                          dcee54a4e49f6f76be095a979af3f5c5

                                                                                                          SHA1

                                                                                                          94e432ea51b35dc8631792ea248d30f53f63f9fc

                                                                                                          SHA256

                                                                                                          63edc89171123e5d3057bdb3da405a460d510e3196fe33bf5cc4a920fa5b8402

                                                                                                          SHA512

                                                                                                          67f8a56d0075dc71872f1202763b297ab85b5791e2a71c3b47e139b31b6eeecf99fbe9f6a6ac92d00d75297aecb7a2b0bb05ee0d410fa8181b5ecfc97a0b6281

                                                                                                          Download Submit

                                                                                                        • C:\Program Files\Pentablet\Qt5Xml.dll
                                                                                                          Filesize

                                                                                                          146KB

                                                                                                          MD5

                                                                                                          9111a9db7182f5c4cfd6a3e457433ab7

                                                                                                          SHA1

                                                                                                          0736e2633be72ece5cc0cb1cccd4421a1487e641

                                                                                                          SHA256

                                                                                                          cd26597f149a36e9f6989ffcbd7c47a4aec1fa5fd599050b8000d96be5d93321

                                                                                                          SHA512

                                                                                                          4dcb52846bc4aa5d7545cca09c973ee056cf28c459e84a74785ec5ecba4b1eb64f564e571f444e30b49e5dc0bd533400957e1e9ecccb3abe21fd7baaad945341

                                                                                                          Download Submit

                                                                                                        • C:\Program Files\Pentablet\SSLEAY32.dll
                                                                                                          Filesize

                                                                                                          272KB

                                                                                                          MD5

                                                                                                          d9ec524f30c0c319aa17ee4edc84bc8d

                                                                                                          SHA1

                                                                                                          c37dc8c4d1fcf41e0de96d5b6b6a01bd7d69a243

                                                                                                          SHA256

                                                                                                          983f795203c51170031399813e31d127ecb7f7a7896e1f6340650d2d02dc1901

                                                                                                          SHA512

                                                                                                          02781766d541a89c945af1fbf3a6abdba181d6888be4eab3b69311f79beff89eeac54aeac3ff07371f972a611ae7e96504a1cd47ff45e555e3ee1b8736254cf2

                                                                                                          Download Submit

                                                                                                        • C:\Program Files\Pentablet\VCRUNTIME140.dll
                                                                                                          Filesize

                                                                                                          81KB

                                                                                                          MD5

                                                                                                          a2523ea6950e248cbdf18c9ea1a844f6

                                                                                                          SHA1

                                                                                                          549c8c2a96605f90d79a872be73efb5d40965444

                                                                                                          SHA256

                                                                                                          6823b98c3e922490a2f97f54862d32193900077e49f0360522b19e06e6da24b4

                                                                                                          SHA512

                                                                                                          2141c041b6bdbee9ec10088b9d47df02bf72143eb3619e8652296d617efd77697f4dc8727d11998695768843b4e94a47b1aed2c6fb9f097ffc8a42ca7aaaf66a

                                                                                                          Download Submit

                                                                                                        • C:\Program Files\Pentablet\config\config.xml
                                                                                                          Filesize

                                                                                                          176KB

                                                                                                          MD5

                                                                                                          0ef9860097c00460c69b862b72b77377

                                                                                                          SHA1

                                                                                                          78f0d053855f9979a1990d677ba9428ac799611a

                                                                                                          SHA256

                                                                                                          5e9d1c3241b18e741bcb430a6ffb64cdf133decaf4ba6049a4a0750727262df1

                                                                                                          SHA512

                                                                                                          d634a7526cca0c7f251112d93b81de59cb8059506bb82842284659f929d405773a8358ece7ed94082a3ab7a961e990c70c976743374d28d9d70705121da6f562

                                                                                                          Download Submit

                                                                                                        • C:\Program Files\Pentablet\config\language.ini
                                                                                                          Filesize

                                                                                                          140KB

                                                                                                          MD5

                                                                                                          dfb4e207ec20cb65d7e3330d50fe34ab

                                                                                                          SHA1

                                                                                                          ac7585e389c289cfd7effe9f14e59724265663a9

                                                                                                          SHA256

                                                                                                          c0bb227a8b85a92de964ec1cfdaedfad54dc9d56376b6d99927e8199c17e4475

                                                                                                          SHA512

                                                                                                          396e9eb78eafa81c2c62e04179292f3b3b74c6b16623be70f62b23f3eb5b6400889f8c4f75206e8746c5efbe7ae18ad528a407fa92365696d75f4e6ff0c05c2d

                                                                                                          Download Submit

                                                                                                        • C:\Program Files\Pentablet\config\name_config.ini
                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          9fe4aa25a05e015b5d36005da3108241

                                                                                                          SHA1

                                                                                                          1837b19eef732b62d7284cf7c420140c2de50cdb

                                                                                                          SHA256

                                                                                                          6000975ac5d7f6361adb98fb1781df7bf5bdfaaf6e42b3b28b68256f27b20ea5

                                                                                                          SHA512

                                                                                                          64b62c2b99a89dfaf24e3a584280e3d5c18a847362c7b6328fb590c10859226b17307edda8e7f1a47b395bb49a809172736314f8699ea6c7c9afeb6b06024cb3

                                                                                                          Download Submit

                                                                                                        • C:\Program Files\Pentablet\driver\64\dpinst.exe
                                                                                                          Filesize

                                                                                                          1.0MB

                                                                                                          MD5

                                                                                                          be3c79033fa8302002d9d3a6752f2263

                                                                                                          SHA1

                                                                                                          a01147731f2e500282eca5ece149bcc5423b59d6

                                                                                                          SHA256

                                                                                                          181bf85d3b5900ff8abed34bc415afc37fc322d9d7702e14d144f96a908f5cab

                                                                                                          SHA512

                                                                                                          77097f220cc6d22112b314d3e42b6eedb9ccd72beb655b34656326c2c63fb9209977ddac20e9c53c4ec7ccc8ea6910f400f050f4b0cb98c9f42f89617965aaea

                                                                                                          Download Submit

                                                                                                        • C:\Program Files\Pentablet\msvcp140.dll
                                                                                                          Filesize

                                                                                                          429KB

                                                                                                          MD5

                                                                                                          d25c3ff7a4cbbffc7c9fff4f659051ce

                                                                                                          SHA1

                                                                                                          02fe8d84d7f74c2721ff47d72a6916028c8f2e8a

                                                                                                          SHA256

                                                                                                          9c1dc36d319382e1501cdeaae36bad5b820ea84393ef6149e377d2fb2fc361a5

                                                                                                          SHA512

                                                                                                          945fe55b43326c95f1eee643d46a53b69a463a88bd149f90e9e193d71b84f4875455d37fd4f06c1307bb2cdbe99c1f6e18cb33c0b8679cd11fea820d7e728065

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-FL9H0.tmp\CheckBox.png
                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          7ea47ed54747036e41a62026de56a1f8

                                                                                                          SHA1

                                                                                                          53ae143706dbdd7f93052cead30d88b6fcd67055

                                                                                                          SHA256

                                                                                                          45158a0042b2fcd325633a896256be8e94c35b852e8c671197709ab13fbd05e4

                                                                                                          SHA512

                                                                                                          3ac7bf0a96ff09a5085d763daab88e3ed274202e4baa1c15e27c925d7d5a0d0e02ed0f858eff1bc1ce0450fa79fefa96e1b8912d3d6920c2d32343fe247b666b

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-FL9H0.tmp\EndWintab.bat
                                                                                                          Filesize

                                                                                                          482B

                                                                                                          MD5

                                                                                                          aa9693d32653eaa7181228624b2dfd57

                                                                                                          SHA1

                                                                                                          9c9833ca082b288040ff6880471603fa90a4b64d

                                                                                                          SHA256

                                                                                                          d9fa3ad5a5385b7b5bdd1c314e06983ba324421bc72e595f820daa32882543ca

                                                                                                          SHA512

                                                                                                          63ad5c283db43fe06aac71d12fcf688002aa9fc3e6457525f9c3ac42e542d8a4d43af0035768386d722994023d5920b1796a7d448c532b75a8c52ce650b5972d

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-FL9H0.tmp\Listdlls.exe
                                                                                                          Filesize

                                                                                                          414KB

                                                                                                          MD5

                                                                                                          60a2331a2b28968585c7c7229d2424a8

                                                                                                          SHA1

                                                                                                          fbac538166d61b4f10db934bd4bc1b86c81e56fb

                                                                                                          SHA256

                                                                                                          b0f6800b2bb4c86e091120e9087c75f9b1b3e46b89cf65744d65cf5ab01fd385

                                                                                                          SHA512

                                                                                                          159542a30195f58a6957d70282bd2dff79708bd2228ebebf7db48e25d80e68ea17714b518a029d2e21acf564d37982b43850249c944e99ce1b38864ffa00b009

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-FL9H0.tmp\Listdlls64.exe
                                                                                                          Filesize

                                                                                                          215KB

                                                                                                          MD5

                                                                                                          8336396d50dcc9d5a5f66b078a8460dc

                                                                                                          SHA1

                                                                                                          42bf0bb282512e4c638b8f03617dd973ee09afd9

                                                                                                          SHA256

                                                                                                          29d23bc492e48a5ae68444302d3430e07d08e04278d53aa70d9367d9cf8bceb7

                                                                                                          SHA512

                                                                                                          08f34405f8d5ebf695391f9cb1deb6eb22b318b698ce9540d37eae45d36476a96d379e9f338c64d5f2f3e9674751bdb7f3661845530605b8fb1eb14ee91702e2

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-FL9H0.tmp\PSCC.bat
                                                                                                          Filesize

                                                                                                          5KB

                                                                                                          MD5

                                                                                                          9f58c6d0c2df352780fc4960e5a4be68

                                                                                                          SHA1

                                                                                                          01849dbb5c2481634da0591bd3b5afced38fd741

                                                                                                          SHA256

                                                                                                          25c48326d60c85f597ffff9b3a372dc2f1abf6d2b0e2c6f1e56a661d56783fe5

                                                                                                          SHA512

                                                                                                          439eced46752714fe85ca5b9b933204a2fe3bfb4582c1d2945f36524b967efae7949e7ac124285fff65173d379b4d16df148422093c6da23f6fb3b90fd24fa3b

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-FL9H0.tmp\bg-0.png
                                                                                                          Filesize

                                                                                                          20KB

                                                                                                          MD5

                                                                                                          20e203c37ee4bcf269482351ba932161

                                                                                                          SHA1

                                                                                                          e5d38f4b243802ed3666874508836ce1cdef7b48

                                                                                                          SHA256

                                                                                                          603153d8a66c6856a754bb193e6913b2b17b204ad95bef7b377254d58e0badbd

                                                                                                          SHA512

                                                                                                          84e13d72fc08cf7f310f36b3496445efe84c93e4e3ef41cf7bab63d3dd26edb0f8a7da6a475b304a4e68a8fd7d852fe85b55d023fef34f6cc20bd8b63392ad3b

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-FL9H0.tmp\bg-1.png
                                                                                                          Filesize

                                                                                                          100KB

                                                                                                          MD5

                                                                                                          10796dd63de1d7fe06822f172d0ed018

                                                                                                          SHA1

                                                                                                          6a9030bcf1498a64451da741ef35410f126ba49e

                                                                                                          SHA256

                                                                                                          07194a18039307426562a91524a1cd87a6bda93e7f2479d73e648d6217dbac25

                                                                                                          SHA512

                                                                                                          a2f13f5bdb11fd3fc334d3149aec232fa0737aef0daddecbc2fcc6353ffe3e2a5a4d35a77bba777c1ee5cf7642afc38a09614f4e8f5dfed0e819de4862844334

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-FL9H0.tmp\botva2.dll
                                                                                                          Filesize

                                                                                                          35KB

                                                                                                          MD5

                                                                                                          0177746573eed407f8dca8a9e441aa49

                                                                                                          SHA1

                                                                                                          6b462adf78059d26cbc56b3311e3b97fcb8d05f7

                                                                                                          SHA256

                                                                                                          a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008

                                                                                                          SHA512

                                                                                                          d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-FL9H0.tmp\cancel.png
                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          534089c776bc92e993af7e368aae385c

                                                                                                          SHA1

                                                                                                          e4f22f7f2d42426fccc374095f527df253e8f223

                                                                                                          SHA256

                                                                                                          10e841f828b1f7f431b2ddb365a7f3bbf2eeeab31ea1055cded0a4313b7599f8

                                                                                                          SHA512

                                                                                                          5d87bde5bd52b5d0f3323f67568820edd2ffdef607bf8996ee7656e03bd8be8ade6243e13cfd0a9e6c729089166bb6966dba132552160e374844e26d948329d6

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-FL9H0.tmp\close.png
                                                                                                          Filesize

                                                                                                          3KB

                                                                                                          MD5

                                                                                                          174b07ef2ae13cd5a5ab5c98614b103d

                                                                                                          SHA1

                                                                                                          5f306f5f76dc716d0ddb0cbdfe16d3095b414f3e

                                                                                                          SHA256

                                                                                                          b28e0f0c69ebfce0aa58855f4025bfbfb5d5b9db28d3827540aee6b15fe35ec5

                                                                                                          SHA512

                                                                                                          d77dc378c0842935a84cd7bbb87f6e7f1d6ef72611406391039026efbdff560690a6f1462c1119c0622e0c7024131229ffbea7385bccb3bf5c18f9d709d4a2c0

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-FL9H0.tmp\close1.png
                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          d1e3352e50f72bad50fd132916ced4d1

                                                                                                          SHA1

                                                                                                          41003a5584567af79e026a1151de6b3bfbc6846a

                                                                                                          SHA256

                                                                                                          e41b99177ec33b2f792e0e62e7c16d697bfb2c48e11355145bfc861f17c7285c

                                                                                                          SHA512

                                                                                                          7d1a90c24e24443f6b68ba5e1cdd1eedc788d421d98dcded50857add8c12ef4d512b2a3e28c41f870807c0133d5eeb9f75a5ff04b4d6c98282ef1b0d07960a2a

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-FL9H0.tmp\innocallback.dll
                                                                                                          Filesize

                                                                                                          63KB

                                                                                                          MD5

                                                                                                          1c55ae5ef9980e3b1028447da6105c75

                                                                                                          SHA1

                                                                                                          f85218e10e6aa23b2f5a3ed512895b437e41b45c

                                                                                                          SHA256

                                                                                                          6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

                                                                                                          SHA512

                                                                                                          1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-FL9H0.tmp\loading.png
                                                                                                          Filesize

                                                                                                          3KB

                                                                                                          MD5

                                                                                                          13bc4cf9f38031e6411f8b99abc3a97b

                                                                                                          SHA1

                                                                                                          09e83215fa4bd8d454ad7ad0e1ac26fe9aa2a7d2

                                                                                                          SHA256

                                                                                                          1dec34489e9c0ff777aacd3903bbccafca5ff2d90217de33d4461765c98e322b

                                                                                                          SHA512

                                                                                                          962c1cf40f2c7ce57b7df432b3bd431c69a79b575395c6c6868c7fdb9dc3d78c8050c17e55dd84dd2c41ee0d3e830e4d4446e5c672260617484b812ae41f5695

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-FL9H0.tmp\loading2.png
                                                                                                          Filesize

                                                                                                          580B

                                                                                                          MD5

                                                                                                          c7fcf667cc9ab8db58bc5414abea6c43

                                                                                                          SHA1

                                                                                                          c360b4368e448323b2fc08c8e9e6ff7dbaa67a1c

                                                                                                          SHA256

                                                                                                          9e2d7b0221c314d4e6a57a95c18a36a812dbfe69699135195425c76f585e0cf2

                                                                                                          SHA512

                                                                                                          79bbf5c3c432e7007c3d4a339f5650dc0b24793ce94e6ad637ef3fa4e1b865c05e0fcba49274c19b5cd5d62a0ef5ecac839f5cd38c27202463f21e0faeac972a

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-FL9H0.tmp\min.png
                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          078b75c0a8fa8985e3f53ae93f47e1ad

                                                                                                          SHA1

                                                                                                          43c1764265a799159086d8b65bacc89bc8c09db0

                                                                                                          SHA256

                                                                                                          c3c8d47b23ed1f1c83f127fdddb0d5eceed49b0093519a8d380a584f2d56766b

                                                                                                          SHA512

                                                                                                          0335de5fd69067976816f0aa1e56c66659cd9e0af7bcbd1bc68fb24ca556bb0a68cb8480b1e98675dade0cdd6099ed3bfb70325a98e672420a976c58e618e436

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-FL9H0.tmp\min1.png
                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          8f2e387abeb395e9c522fc6335cc5260

                                                                                                          SHA1

                                                                                                          fd8ca1e505fb7f19ba82ef37991d8736b2250e12

                                                                                                          SHA256

                                                                                                          a4acc8052a83451c134f3aac53c2e127e688cb0a79e40103ce5d30df6c3b5b32

                                                                                                          SHA512

                                                                                                          d8e6e8dfc761d6b40fbab1c38519167da14cacf2ba6f98460c1fa528768648b3094532a12302b2522b4f1512c659278241074647dd2e1292d9a2d52185d09a99

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-FL9H0.tmp\sure.png
                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          913fa36eeb162a71a7e67b67ee961cb6

                                                                                                          SHA1

                                                                                                          1cb8236a13f50dff258952e9247abbd25d338a27

                                                                                                          SHA256

                                                                                                          de87b27d9791ddcb9e17c0fee10b5e0183c056e9d9f5688f26d067869a91dfe3

                                                                                                          SHA512

                                                                                                          1656fd8b653baa1e85063f12f01b31d4ce37bb6dcb44b677957f8e747eb266a3687fa229ad0c244a30032474da5451dc8494f2739df5825f75a820c71638e265

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-FL9H0.tmp\y3.png
                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          783830fae37797be4cc7da458f4743ef

                                                                                                          SHA1

                                                                                                          299d5e6c6dd37d1896093a08ce8848000e45262c

                                                                                                          SHA256

                                                                                                          faea15d0bd60f1f03aaed420b0ddeee81d63aa5106d1f21f735a949673137772

                                                                                                          SHA512

                                                                                                          d0e3dcaa63ab7ea8e7696f36ec21aa339a95197db7f777b4310e3c21f0703b64d22c0864139c68a3707043d252577b3aca9453bdf69967923d34d8da227ba245

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-L5FBC.tmp\XPPenWin_3.4.13.231129.tmp
                                                                                                          Filesize

                                                                                                          1.6MB

                                                                                                          MD5

                                                                                                          68776ba968510663851ac80597e0e7a1

                                                                                                          SHA1

                                                                                                          8d7f075507dcf7009b4b5fbddf26961698a66bf0

                                                                                                          SHA256

                                                                                                          60b1768fe5b088637619a1856e85bb4ce82cd7b7d25c3446c7d0fd92842e9076

                                                                                                          SHA512

                                                                                                          7c391541ad9dc0e8f329ee90ff51f1e9d3216171ec71aa0304460f6f071b8fcbdf67062bff09987e453c5518226c1f150930d01b360ad7a60f5ed22aa0acb6ae

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\{8CF26~1\WdfCoInstaller01009.dll
                                                                                                          Filesize

                                                                                                          1.6MB

                                                                                                          MD5

                                                                                                          4da5da193e0e4f86f6f8fd43ef25329a

                                                                                                          SHA1

                                                                                                          68a44d37ff535a2c454f2440e1429833a1c6d810

                                                                                                          SHA256

                                                                                                          18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e

                                                                                                          SHA512

                                                                                                          b3d73ed5e45d6f2908b2f3086390dd28c1631e298756cee9bdf26b185f0b77d1b8c03ad55e0495dba982c5bed4a03337b130c76f7112f3e19821127d2cf36853

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\{8cf26207-9db7-fc4a-8a0a-cbdb869bfcd4}\hanvonugeemfilter.cat
                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          f161bf4c1ac6b26ee946c9a3bf916ffe

                                                                                                          SHA1

                                                                                                          1263f2a5975864d703afb7f15d0d2e47499dde2c

                                                                                                          SHA256

                                                                                                          b77c9daf31df08ff29c03b26071c282f21860a69406f6f809fbf0e7793f394fa

                                                                                                          SHA512

                                                                                                          85b3b617b524f20c8bff678f689232bf517faa5aa53a6611c7b07c9ca87c5f3029d82ae141c2cc00444ea1a7cd89b2fcb76cddffb97d5bb5f00946314f48cd44

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\{8cf26207-9db7-fc4a-8a0a-cbdb869bfcd4}\hanvonugeemfilter.sys
                                                                                                          Filesize

                                                                                                          9KB

                                                                                                          MD5

                                                                                                          065e4ba1ef63b6d6d073ce77821e0e06

                                                                                                          SHA1

                                                                                                          56d0b1f479a1e9a00d49a2283150456424acfc14

                                                                                                          SHA256

                                                                                                          5b4c234d27f71931ea1ca91355ca9834a6c0cd95c1e935bfdce03b418fbee2ea

                                                                                                          SHA512

                                                                                                          7dbc3a1f7d7623eb9e884d90c749a21f325341efa71320332c079770c5876458e6a83969dbe5ace9510a54eae495c4f0ca8d6ba1d40968d514a1996fa644a3ff

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Roaming\Adobe\Adobe Photoshop 2020\Adobe Photoshop 2020 Settings\PSUserConfig.txt
                                                                                                          Filesize

                                                                                                          40B

                                                                                                          MD5

                                                                                                          f964a6935fd7d756d0748478ce379a48

                                                                                                          SHA1

                                                                                                          f1fc5974d11b865a618877320bf550a02c6ba395

                                                                                                          SHA256

                                                                                                          d9554821d24574b452300af92bc6ef720fa76d8b0b632423c44d8741697e60c9

                                                                                                          SHA512

                                                                                                          2c05647c46623b7810db735ab807cc34490a3b3421c13620dabbb49cabbe0d817ac1d9e635b01e9e780d96dce8c9cfca745c08d07a21f7a667b7c9392f71635e

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Roaming\Adobe\Adobe Photoshop 2022\Adobe Photoshop 2022 Settings\PSUserConfig.txt
                                                                                                          Filesize

                                                                                                          20B

                                                                                                          MD5

                                                                                                          e6c449d0fc7f55bb10968af88cbc7698

                                                                                                          SHA1

                                                                                                          a24d8af137487ee7a981da80e0238a99d81d681b

                                                                                                          SHA256

                                                                                                          39d07398585b012560a9d88c43388ae9c972c309167aa621d7714c3775559968

                                                                                                          SHA512

                                                                                                          4e1897f596c7abada75843dcf27c59a9fc499529b1bba9d63f8734b5309bedcad58f2f196aaaba281a7d31fa2e87cba0f17bc80d0229a7d47d845b9e989974de

                                                                                                          Download Submit

                                                                                                        • C:\Windows\System32\CatRoot2\dberr.txt
                                                                                                          Filesize

                                                                                                          22KB

                                                                                                          MD5

                                                                                                          3850aff62a8fe5565503ef6059a60e0b

                                                                                                          SHA1

                                                                                                          4bf2b9bc8a5f3adec33819bfceebf9648caba034

                                                                                                          SHA256

                                                                                                          826d8aa70bbb0ad3e3179b7007f15406aaea5bad86f32e8569e48a7d53a0d4d0

                                                                                                          SHA512

                                                                                                          322eac6e686659251ddce8a140a82bf6c268ad92e050f39ab6237b7eb85fba83ad920d5b09504348224664d2044083b59866edc0bc7dae7402e9694c2ea2e62d

                                                                                                          Download Submit

                                                                                                        • C:\Windows\System32\CatRoot2\dberr.txt
                                                                                                          Filesize

                                                                                                          22KB

                                                                                                          MD5

                                                                                                          1956338489936b1b522d25f6c1d13154

                                                                                                          SHA1

                                                                                                          4ec0b84a3cc853f74bda97d05578c763588f481e

                                                                                                          SHA256

                                                                                                          29f2fcf59d2c9f24bed4001516203221d1667aec45044bf6b00cfdb044effc19

                                                                                                          SHA512

                                                                                                          3cd77721dae0e4d21ae92c48da88bb5c67b19c12b888985ab4d4f68ddcbfba498b87e60a88a6f5b88ccd2a777b1220fe64c12523967dd743a20bf404f321e779

                                                                                                          Download Submit

                                                                                                        • C:\Windows\System32\WinTab32.dll
                                                                                                          Filesize

                                                                                                          143KB

                                                                                                          MD5

                                                                                                          8e20fea7d14df7bb6254d5c4a149b0d9

                                                                                                          SHA1

                                                                                                          73f44e7c4e09d510da13c53e7b98d9dcb42cfa12

                                                                                                          SHA256

                                                                                                          e1dd90ba8fd6885f41e427168bd3c4c52c41246993aa707429ded2763ac2c782

                                                                                                          SHA512

                                                                                                          6876ae0efeeb2fa34a95d8e19da291cb812ba24aa11cd4345dbc825711671b267e4b1feaa5854fe4b83e1258e454fb076e9d7560bf651d26a0172847a72630e6

                                                                                                          Download Submit

                                                                                                        • \??\c:\PROGRA~1\PENTAB~1\64\WDFCOI~1.DLL
                                                                                                          Filesize

                                                                                                          1.7MB

                                                                                                          MD5

                                                                                                          d2cc9c7825874f874597e740a6581b66

                                                                                                          SHA1

                                                                                                          4503b24a8fae7aa0e14ebb7b138e5df1732c90d0

                                                                                                          SHA256

                                                                                                          399c80fd3eea9fc4365c4596012ac5adfcb786a190dd177e13d3dc9d83b95140

                                                                                                          SHA512

                                                                                                          b14b4b58ff4d9d72eb52b3d381afd20c3a61b5e08e6bfbbb746a7fe41d9c45e7ecd5a003064609e93f4dc963a6a45691a7e95ad7319b8e79fe7d8b9d260671f7

                                                                                                          Download Submit

                                                                                                        • \??\c:\PROGRA~1\PENTAB~1\64\XPPENT~1.SYS
                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          1636eb21da0a645ed8753ac17a4abdd2

                                                                                                          SHA1

                                                                                                          7abadaa5a94cb9ce03becc1f5217f33b6b8be786

                                                                                                          SHA256

                                                                                                          91808a385ff816dc06fe14a0465fdf1669e61f530c11525b3783071b7fd0a85d

                                                                                                          SHA512

                                                                                                          c75dc0a466f17f8716f32b22938b6bb43d33ba50715f959504c783c9c1edff7622e97942311e20d19f270b23dc9c1e4111c34e68e454451d45bee1638c6697c4

                                                                                                          Download Submit

                                                                                                        • \??\c:\PROGRA~1\PENTAB~1\64\hidkmdf.sys
                                                                                                          Filesize

                                                                                                          7KB

                                                                                                          MD5

                                                                                                          f1928f41c82ee87c3512c519b285a115

                                                                                                          SHA1

                                                                                                          526d137427e83138f0b31a0d18986a0caddf76b1

                                                                                                          SHA256

                                                                                                          40bbe73324701268c3f52551c2531552fa43421ef7db799c08200c303ddc2235

                                                                                                          SHA512

                                                                                                          5d85b39d6e295e3baf1dd63d515c3e18a2d165483549ef1a7a8cdc78ed9cfed10e0e5acd8a8d60762bcffebb4c4c4ef5cf404a5f1f95a16a3f7523c85fdaa230

                                                                                                          Download Submit

                                                                                                        • \??\c:\program files\pentablet\64\XPPenTablet.cat
                                                                                                          Filesize

                                                                                                          11KB

                                                                                                          MD5

                                                                                                          44b7925009566ff6541bd00f155fbbea

                                                                                                          SHA1

                                                                                                          f20c7672ce6bdec1fbf341e6322e9c6acd81df90

                                                                                                          SHA256

                                                                                                          b833ea98aaa46b359b1e8ab9ecdcedccc921b93d48dfd36521b68017d0445921

                                                                                                          SHA512

                                                                                                          05ec165b870162288f64133b78edde9fec7af91637c283c7cbbf1a6d5a8f99ebb5ffa1e4b4a78d6f00f1ed444d4023d4e208cffcad6a4e4a1e83394a099390f3

                                                                                                          Download Submit

                                                                                                        • \??\c:\program files\pentablet\driver\64\hanvonugeemfilter.inf
                                                                                                          Filesize

                                                                                                          6KB

                                                                                                          MD5

                                                                                                          559d201d203e1b86c1df3b28fd53345e

                                                                                                          SHA1

                                                                                                          a891f1b4db8b3128fafc67344e37b4abfcca2a07

                                                                                                          SHA256

                                                                                                          0ed01aafce6532ba3cd19d025bfda37f6e8a06a5ef612c423f9dfa853580900b

                                                                                                          SHA512

                                                                                                          5e2f0cf375665a12ee284ed27ca43b21edfd7c18c162dcd2acbd0a59022c2da31553ab0836817fa7790f102599b2e2c36142c6fa67ae2ab2ecf7ed2d20b767fe

                                                                                                          Download Submit

                                                                                                        • memory/788-543-0x0000000000400000-0x0000000000446000-memory.dmp

                                                                                                          Filesize

                                                                                                          280KB

                                                                                                          Download

                                                                                                        • memory/788-2-0x0000000000401000-0x0000000000417000-memory.dmp

                                                                                                          Filesize

                                                                                                          88KB

                                                                                                          Download

                                                                                                        • memory/788-445-0x0000000000400000-0x0000000000446000-memory.dmp

                                                                                                          Filesize

                                                                                                          280KB

                                                                                                          Download

                                                                                                        • memory/788-1-0x0000000000400000-0x0000000000446000-memory.dmp

                                                                                                          Filesize

                                                                                                          280KB

                                                                                                          Download

                                                                                                        • memory/3232-448-0x0000000003530000-0x0000000003545000-memory.dmp

                                                                                                          Filesize

                                                                                                          84KB

                                                                                                          Download

                                                                                                        • memory/3232-542-0x0000000000400000-0x00000000005AC000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.7MB

                                                                                                          Download

                                                                                                        • memory/3232-512-0x0000000000400000-0x00000000005AC000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.7MB

                                                                                                          Download

                                                                                                        • memory/3232-447-0x0000000003520000-0x000000000352E000-memory.dmp

                                                                                                          Filesize

                                                                                                          56KB

                                                                                                          Download

                                                                                                        • memory/3232-488-0x0000000000400000-0x00000000005AC000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.7MB

                                                                                                          Download

                                                                                                        • memory/3232-168-0x0000000000400000-0x00000000005AC000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.7MB

                                                                                                          Download

                                                                                                        • memory/3232-25-0x0000000003530000-0x0000000003545000-memory.dmp

                                                                                                          Filesize

                                                                                                          84KB

                                                                                                          Download

                                                                                                        • memory/3232-17-0x0000000003520000-0x000000000352E000-memory.dmp

                                                                                                          Filesize

                                                                                                          56KB

                                                                                                          Download

                                                                                                        • memory/3232-7-0x0000000000400000-0x00000000005AC000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.7MB

                                                                                                          Download

                                                                                                        • memory/3232-446-0x0000000000400000-0x00000000005AC000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.7MB

                                                                                                          Download