2d4f8c3c6e4ec3c2bc278fab74bfc6a739b1c22f1ab735ed94a5a1a62648a6b0

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 06:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CH341-USB-Serial-Drivers.exe
Size 2.2MB
Sample260705-g6ecfaaw8t
SHA256 2d4f8c3c6e4ec3c2bc278fab74bfc6a739b1c22f1ab735ed94a5a1a62648a6b0
MD5 07e6892a8d0056d1f3dda44b7eb9f7b1
SHA1 80a92facb6aaec7b861324ff9866a13dc931618b
SHA512 2fcdd03489b50a6b71697419340181559a0201362d7a6f10de1b5351e4631af4628ef7dc0ea33e6e9a6d89d63fd88ce2f726ca4025e295841454f5ced8eba1b5
SSDEEP 49152:IuI2hGK2ylKHGlpR1zW+W1BtXJI38IwmxkRC:I5OCV6R1zWhftSNwpRC
TLSH
T176B5D03FB28B753EE06E5A397A76E210583B766165124C1697F4C88CCF250B12E3E787
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution installer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1732	powershell.exe

Drops file in Drivers directory 13 IoCs

description	ioc	Process
File created	C:\Windows\System32\Drivers\SET99C3.tmp	DRVSETUP64.EXE
File opened for modification	C:\Windows\System32\Drivers\SET9A15.tmp	DRVSETUP64.EXE
File opened for modification	C:\Windows\System32\Drivers\SET9A56.tmp	DRVSETUP64.EXE
File created	C:\Windows\System32\Drivers\SET9A56.tmp	DRVSETUP64.EXE
File opened for modification	C:\Windows\System32\Drivers\SET98B1.tmp	DRVSETUP64.EXE
File opened for modification	C:\Windows\System32\Drivers\SET9912.tmp	DRVSETUP64.EXE
File created	C:\Windows\System32\Drivers\SET9912.tmp	DRVSETUP64.EXE
File created	C:\Windows\System32\Drivers\SET9963.tmp	DRVSETUP64.EXE
File opened for modification	C:\Windows\System32\Drivers\SET99C3.tmp	DRVSETUP64.EXE
File created	C:\Windows\System32\Drivers\SET9A15.tmp	DRVSETUP64.EXE
File created	C:\Windows\System32\Drivers\SET98B1.tmp	DRVSETUP64.EXE
File opened for modification	C:\Windows\System32\Drivers\CH341SER.SYS	DRVSETUP64.EXE
File opened for modification	C:\Windows\System32\Drivers\SET9963.tmp	DRVSETUP64.EXE

Executes dropped EXE 3 IoCs

pid	Process
5896	CH341-USB-Serial-Drivers.tmp
4444	SETUP.EXE
1300	DRVSETUP64.EXE

Drops file in System32 directory 54 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ch341ser.inf_amd64_34a3206305b40d57\CH341PTA64.DLL	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ed02b1bf-337c-624f-8140-624731b018e8}	DrvInst.exe
File created	C:\Windows\system32\SET98B2.tmp	DRVSETUP64.EXE
File created	C:\Windows\system32\SET9913.tmp	DRVSETUP64.EXE
File created	C:\Windows\system32\SET99D5.tmp	DRVSETUP64.EXE
File created	C:\Windows\system32\SET9A25.tmp	DRVSETUP64.EXE
File opened for modification	C:\Windows\system32\CH341PORTS.DLL	DRVSETUP64.EXE
File opened for modification	C:\Windows\system32\SET9974.tmp	DRVSETUP64.EXE
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ed02b1bf-337c-624f-8140-624731b018e8}\SET9759.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ed02b1bf-337c-624f-8140-624731b018e8}\CH341SER.CAT	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ed02b1bf-337c-624f-8140-624731b018e8}\SET976C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ed02b1bf-337c-624f-8140-624731b018e8}\CH341PORTSA64.DLL	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ch341ser.inf_amd64_34a3206305b40d57\CH341SER.CAT	DrvInst.exe
File opened for modification	C:\Windows\system32\SET98B2.tmp	DRVSETUP64.EXE
File opened for modification	C:\Windows\system32\CH341PT.DLL	DRVSETUP64.EXE
File opened for modification	C:\Windows\system32\SET98B3.tmp	DRVSETUP64.EXE
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ed02b1bf-337c-624f-8140-624731b018e8}\SET976A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ed02b1bf-337c-624f-8140-624731b018e8}\CH341PT.DLL	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ed02b1bf-337c-624f-8140-624731b018e8}\SET977D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ch341ser.inf_amd64_34a3206305b40d57\CH341S64.SYS	DrvInst.exe
File opened for modification	C:\Windows\system32\SET9913.tmp	DRVSETUP64.EXE
File opened for modification	C:\Windows\system32\SET9923.tmp	DRVSETUP64.EXE
File created	C:\Windows\system32\SET9923.tmp	DRVSETUP64.EXE
File created	C:\Windows\system32\SET9964.tmp	DRVSETUP64.EXE
File created	C:\Windows\System32\DriverStore\Temp\{ed02b1bf-337c-624f-8140-624731b018e8}\SET976A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ch341ser.inf_amd64_34a3206305b40d57\CH341SER.INF	DrvInst.exe
File created	C:\Windows\system32\SET98B3.tmp	DRVSETUP64.EXE
File created	C:\Windows\system32\SET9974.tmp	DRVSETUP64.EXE
File opened for modification	C:\Windows\system32\SET99D4.tmp	DRVSETUP64.EXE
File opened for modification	C:\Windows\system32\SET99D5.tmp	DRVSETUP64.EXE
File created	C:\Windows\system32\SET9A26.tmp	DRVSETUP64.EXE
File opened for modification	C:\Windows\system32\SET9A68.tmp	DRVSETUP64.EXE
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ed02b1bf-337c-624f-8140-624731b018e8}\CH341SER.INF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ed02b1bf-337c-624f-8140-624731b018e8}\CH341PTA64.DLL	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{ed02b1bf-337c-624f-8140-624731b018e8}\SET977C.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\system32\SET99D4.tmp	DRVSETUP64.EXE
File opened for modification	C:\Windows\system32\SET9A25.tmp	DRVSETUP64.EXE
File opened for modification	C:\Windows\system32\SET9A57.tmp	DRVSETUP64.EXE
File created	C:\Windows\system32\SET9A68.tmp	DRVSETUP64.EXE
File created	C:\Windows\System32\DriverStore\Temp\{ed02b1bf-337c-624f-8140-624731b018e8}\SET9759.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ed02b1bf-337c-624f-8140-624731b018e8}\SET976B.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{ed02b1bf-337c-624f-8140-624731b018e8}\SET976C.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{ed02b1bf-337c-624f-8140-624731b018e8}\SET977D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ch341ser.inf_amd64_34a3206305b40d57.ini	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ch341ser.inf_amd64_34a3206305b40d57\CH341PT.DLL	DrvInst.exe
File opened for modification	C:\Windows\system32\SET9964.tmp	DRVSETUP64.EXE
File opened for modification	C:\Windows\system32\SET9A26.tmp	DRVSETUP64.EXE
File created	C:\Windows\System32\DriverStore\Temp\{ed02b1bf-337c-624f-8140-624731b018e8}\SET976B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ed02b1bf-337c-624f-8140-624731b018e8}\SET977C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ed02b1bf-337c-624f-8140-624731b018e8}\CH341S64.SYS	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ch341ser.inf_amd64_34a3206305b40d57\CH341PORTSA64.DLL	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\system32\SET9A57.tmp	DRVSETUP64.EXE

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem1.inf	DrvInst.exe
File created	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DRVSETUP64.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CH341-USB-Serial-Drivers.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SETUP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CH341-USB-Serial-Drivers.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/2512-0-0x0000000000810000-0x00000000008EC000-memory.dmp	innosetup
behavioral2/memory/2512-88-0x0000000000810000-0x00000000008EC000-memory.dmp	innosetup
behavioral2/memory/2512-148-0x0000000000810000-0x00000000008EC000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 32 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DRVSETUP64.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	DRVSETUP64.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DRVSETUP64.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DRVSETUP64.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DRVSETUP64.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DRVSETUP64.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DRVSETUP64.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DRVSETUP64.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DRVSETUP64.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	DRVSETUP64.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DRVSETUP64.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DRVSETUP64.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DRVSETUP64.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DRVSETUP64.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DRVSETUP64.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DRVSETUP64.EXE

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1732	powershell.exe
1732	powershell.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	powershell.exe
Token: SeIncreaseQuotaPrivilege	1732	powershell.exe
Token: SeSecurityPrivilege	1732	powershell.exe
Token: SeTakeOwnershipPrivilege	1732	powershell.exe
Token: SeLoadDriverPrivilege	1732	powershell.exe
Token: SeSystemProfilePrivilege	1732	powershell.exe
Token: SeSystemtimePrivilege	1732	powershell.exe
Token: SeProfSingleProcessPrivilege	1732	powershell.exe
Token: SeIncBasePriorityPrivilege	1732	powershell.exe
Token: SeCreatePagefilePrivilege	1732	powershell.exe
Token: SeBackupPrivilege	1732	powershell.exe
Token: SeRestorePrivilege	1732	powershell.exe
Token: SeShutdownPrivilege	1732	powershell.exe
Token: SeDebugPrivilege	1732	powershell.exe
Token: SeSystemEnvironmentPrivilege	1732	powershell.exe
Token: SeRemoteShutdownPrivilege	1732	powershell.exe
Token: SeUndockPrivilege	1732	powershell.exe
Token: SeManageVolumePrivilege	1732	powershell.exe
Token: 33	1732	powershell.exe
Token: 34	1732	powershell.exe
Token: 35	1732	powershell.exe
Token: 36	1732	powershell.exe
Token: SeLoadDriverPrivilege	1300	DRVSETUP64.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5896	CH341-USB-Serial-Drivers.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 5896	2512	CH341-USB-Serial-Drivers.exe	89
PID 5896 wrote to memory of 1732	5896	CH341-USB-Serial-Drivers.tmp	90
PID 1732 wrote to memory of 4444	1732	powershell.exe	93
PID 4444 wrote to memory of 1300	4444	SETUP.EXE	94

C:\Users\Admin\AppData\Local\Temp\CH341-USB-Serial-Drivers.exe
"C:\Users\Admin\AppData\Local\Temp\CH341-USB-Serial-Drivers.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\is-XBADUI1P8J.tmp\CH341-USB-Serial-Drivers.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-XBADUI1P8J.tmp\CH341-USB-Serial-Drivers.tmp" /SL5="$70252,1088934,842752,C:\Users\Admin\AppData\Local\Temp\CH341-USB-Serial-Drivers.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5896
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\is-I0TUDQ9PAC.tmp\CH341SER\Install-CH341SER-Auto.ps1" -NoPause
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\is-I0TUDQ9PAC.tmp\CH341SER\SETUP.EXE
      "C:\Users\Admin\AppData\Local\Temp\is-I0TUDQ9PAC.tmp\CH341SER\SETUP.EXE" /S
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\is-I0TUDQ9PAC.tmp\CH341SER\DRVSETUP64\DRVSETUP64.EXE
        
        C:\Users\Admin\AppData\Local\Temp\is-I0TUDQ9PAC.tmp\CH341SER\DRVSETUP64\DRVSETUP64.EXE \s
        5⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Checks SCSI registry key(s)
        Suspicious use of AdjustPrivilegeToken
        
        PID:1300

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{536f6678-054f-9543-b2ad-b2e69d956042}\CH341SER.INF" "9" "4a6a21c03" "0000000000000188" "WinSta0\Default" "0000000000000130" "208" "C:\Users\Admin\AppData\Local\Temp\is-I0TUDQ9PAC.tmp\CH341SER\WIN 1X"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:6396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CH341PT.DLL

Path C:\Users\Admin\AppData\Local\Temp\IS-I0T~1.TMP\CH341SER\WIN1X~1\CH341PT.DLL
Size 58KB
SHA256 4fae54a4cc5cbfd5bd0a59b6aff3f888bebeb3c78521dadcdd1247b40012c580
MD5 fff40ea944490b6bb79288dfaf0fc288
SHA1 9eee498028485dc9f83781ad20980cb053b18419
SHA512 2b5913f57148c951e446f529bb3246a74e22bd6cff7253815c651438906375973ae26dff21a14b1d9629e6442845767ba0fd9462e24bb4092b9a7ca2721dd74f
SSDEEP 768:HDM3FrWK86sl/RCt8kcVQ59uFc4Kh1u3fTHEQzsyHQZ19zNEb1nzxOW9zWKKDPjo:41u67h1GTkQzsMizNO1nzUizW+OdkzR
TLSH
T11E435A93CC289002DCD664705388F6A36C7D56B62B9054F3F785F6D418A27E6EB2836F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CH341P~1.DLL

Path C:\Users\Admin\AppData\Local\Temp\IS-I0T~1.TMP\CH341SER\WIN1X~1\CH341P~1.DLL
Size 69KB
SHA256 7e2169a614c608475921c45ca9d73ad63cb3bc82b2198197e6aecb969b9ed0e4
MD5 4beecf48670e0ca0d8685df35fc6e4bb
SHA1 50136de7b84d9bea29f8db918e7aba2ee832f757
SHA512 91efa5e0d19a311fe20150ac0c39505b1e0ddefca8e2dfe42e19d4f0ef52c552f6578596513961bffe955423fd784952aefe9549561e3e3fc627f1f1503dabdf
SSDEEP 1536:t8s8+BJ2QNhe2isPCV7cYeuhzd6zUizITzR:t8hyJvh1iCq7cYDhSUik9
TLSH
T1B8632B6157A45143E8B3297056B8E6533D3DBFF62B30C54FA650A68C2871BC6EE3432B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CH341P~2.DLL

Path C:\Users\Admin\AppData\Local\Temp\IS-I0T~1.TMP\CH341SER\WIN1X~1\CH341P~2.DLL
Size 81KB
SHA256 16ad9a058df6b58ce8259e086275b81f663f43202a2b7f0da7a634c356203e1d
MD5 9a08e20878252a329128012ed5fd01a4
SHA1 725c805db6b2a5466bf6205f127a894f73a97664
SHA512 3b9717d9731fc4efde0b1be91c3bddecb83d2c03f58af90b24d0e7e68a0381c278ccff463af2f8b5e35637d058406a7d1040ae5feb15d88ee35e9b362ee70b1a
SSDEEP 1536:m1WxG7H3ynh5GdMbcj0hzZfujzUizbCzrH:mc4HCnh5GybcAhd6UiS
TLSH
T1BE834C5283E84085E8B7EA3097FCCA53BD7579955B308ACF0250D95D0E33BC5DA3972A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CH341P~3.DLL

Path C:\Users\Admin\AppData\Local\Temp\IS-I0T~1.TMP\CH341SER\WIN1X~1\CH341P~3.DLL
Size 76KB
SHA256 9f8b6dbe2b81a720184f0a0a269e17a90ed6da9ecbb3fa3d9fa32d2b95ab1adc
MD5 2e85168392fa0dfdf61627a44b71d984
SHA1 91f599dfe43cb13b512c71c8fceb3fbb5bb18f44
SHA512 46756d6499b7634873c40d7ca0cab1c26584626633596637c82f1279b980396af846112acec6e24d43fe6b305a24aec6287f8a2bb995c91f630e3fe35625c125
SSDEEP 1536:KmL1cYoQB2Z9fMIaETrV4KGJNzYgsz5q31Tzu:79ow2ZiIaE/V4KGTUde1Ty
TLSH
T15B737DC3E7189081DC7BE07042A9E267ECB536A5CB1029FF2B91EA500A537D5FB3D619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CH341S64.SYS

Path C:\Users\Admin\AppData\Local\Temp\IS-I0T~1.TMP\CH341SER\WIN1X~1\CH341S64.SYS
Size 82KB
SHA256 a8cb7cf5050f9d14106b27d45d50dfb85f6cb119c0e871e673743ad62ecaeed0
MD5 cceb043a4fa87236115ed4205e9f751a
SHA1 a102530a0d0f3948e9c3f7e2c1daf8a313b7984c
SHA512 87e2eecafc9e261567f43389a50a65c414b29c0b3ae889d8aa6ea910beabe6a4592deb2c663912d8bcb383a5cf26c4c7af940c2fff6f513c8bf41ecf962ad629
SSDEEP 1536:9eI/Z0ULgTXI8yOdmaIvvY/NBiVlnn/H3zfrzUizb:9bWULWXIAdmAOVlnnf3zUiX
TLSH
T113837BD29AA940E6C9E7D5308279CEA3BF797098130497DF50C189180E97FD5AE3C3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CH341SER.SYS

Path C:\Users\Admin\AppData\Local\Temp\IS-I0T~1.TMP\CH341SER\WIN1X~1\CH341SER.SYS
Size 62KB
SHA256 2e8a6011677450461adc019a3bcc1829424924cf0ee91906ce0e05ccecff370f
MD5 3f4203eba812de55dea067d023f299e6
SHA1 60eae124208864ff2e28cab23db08eb7d35b7d71
SHA512 808da3d8cf190f9f5940565e17d18b28463d593c6127cac7e70aa5b97bd4004006730def132d57982ba75778103885f48be1da5e6ecf1525b97e4d2af2cd94f2
SSDEEP 1536:DlzEOK3AFK6qN8MklwUrquS00EI8wXsC4dezJPdzUiza:VEO0AF8N8l6UsEI8wQI/Ui+
TLSH
T1BC534B61AD1404F3DCCA69F0E2ACB767743F56EB070066D711A0DAD45D9E3C2BE3826A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_3ppw231q.pkk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ppw231q.pkk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

CH341SER.CAT

Path C:\Users\Admin\AppData\Local\Temp\is-I0TUDQ9PAC.tmp\CH341SER\CH341SER.CAT
Size 14KB
SHA256 b44f551843d0e36319ab4e911d4579a866b175201980daa9e8973919ad3fb1fe
MD5 114f929bc857e5fae94efdbf419ac7e6
SHA1 09cae5914d9ea880b5c511e889befec6f4db002a
SHA512 e5eb153d857abd15d86edbf95d2be0d969412fbaaaf0a3c6bf23b953b9a4d82b2ced90decddb607086d1140228feb61d23e79c967a8dead8a9163cb5745f054c
SSDEEP 192:+5MzDEQpDlqdmZUpjNrpyJw9EcyFIFIOckhLxyKR/2FWQFXiGnvM30LRLLX01k9Q:+oXZimUjHeFRJDkELRPR9zgd
TLSH
T1DE52E9B95A9D01C3E4AB987147D8D19FBC35A7D7AC00A97D21DBF7500983385FB0892E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DRVSETUP64.EXE

Path C:\Users\Admin\AppData\Local\Temp\is-I0TUDQ9PAC.tmp\CH341SER\DRVSETUP64\DRVSETUP64.EXE
Size 52KB
SHA256 b5d55fa31753fcd86145c460d644bac78f171f51d708a050326234b4a2876c4c
MD5 7ffb66cad5197396885b8835d79f0e29
SHA1 87b539785f4d91a398f730bd4a77b31dec4d9fe2
SHA512 ad7877d74416063ccd36e965ea15b95dfb6b6c9a3460ff3a1bf20390981e25ab479c82c2a2d82cc05a709c431386a080fd2bab4e87987f9d8c0e6d459ccad9ed
SSDEEP 768:AV/9p0Ykw0qaWKUGjrqUiwykN8CNUQCEryu/HDnYiN82Eh:AV/9O3d9tNUQ2u/Dn7N8X
TLSH
T1A4335A429740A099E42AC23598FB573BCBB574144B3553EF7318C9112F223D3D97FAA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install-CH341SER-Auto.ps1

Path C:\Users\Admin\AppData\Local\Temp\is-I0TUDQ9PAC.tmp\CH341SER\Install-CH341SER-Auto.ps1
Size 5KB
SHA256 1d7988c1d9efcf4a05e2cfa60c139612aaae7e0dab640e085532675c134c60ed
MD5 1d3661b5c7c87ea8f57ee0229faccaaa
SHA1 5b9e9fa5f6bdf85ee87c7eeee451fa6dd7cfa77c
SHA512 cb9d8d95286230e0de664a940dd3a755764f5ca243d460b1eaeced9b4132c4546c941ee209b7296864810b7132a95168c72829ca9fe4b20332cb15549b8e0071
SSDEEP 96:Vylv/WBHm/rzJZ0VG5SpIjbHKTNqJglfNvnqrh9m3aDI2hCU0oxU2G27fjssSJL7:8v/WBHO3TB5SOjbqxqJS1khserCkxZAl
TLSH
T1B5C1870C97D4466256DB06EE2CA6A0027BDD406F501D2E80B8EC9184FFD906DC6F4BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETUP.EXE

Path C:\Users\Admin\AppData\Local\Temp\is-I0TUDQ9PAC.tmp\CH341SER\SETUP.EXE
Size 90KB
SHA256 b89fd6c6a1eb20df0fb347e9af5e935be2e6f2e2915b984543c0532e6d0ffaa2
MD5 ee3c4e765ec0e7fcc1f69e4571dbc44a
SHA1 e620c48f82d9e6bad321e343624b4ad627689d5b
SHA512 71e83b588ea6eedff518850370209e7654c94d2494b28c55c399ebff96c58e9937caaaf1573011020d5f5010cf1643edcc65135abc4ceae81f043e1f5703b52d
SSDEEP 1536:az5z0khtMnlTVLV63kWpCKLOFO0soj/s/359/7NW2Z:algAteQ0wDLOQfojs/J9/gI
TLSH
T19E937C1369D24873F061063121E217B69FBDAA132667E4DFFF1FC9414E7929282276F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CH341SER.INF

Path C:\Users\Admin\AppData\Local\Temp\is-I0TUDQ9PAC.tmp\CH341SER\WIN 1X\CH341SER.INF
Size 9KB
SHA256 fb573086ee1b6f65d68a330cc4b48350439e3327c85292fc455b3588dff053a3
MD5 867d71937ac1f93dbeb22e7de5cf677c
SHA1 121188adcc605358564742aabc988e0dfe531fc3
SHA512 ad43e8d38fabeecafa2919e6eeff6af254db90bde3dbcef0c8cc9d9aaa556abd4afc69372d83f9d102ad0b3ae641fbd393b736b9d70486f57cff3fe4c5cc211f
SSDEEP 192:4F6pCs/xOFevOsZafiEOPQj94j4FJ4TvyhGQFuD4JSpQYQLhQfQYh6AT5qq:FCs/xOFevOsbEQQekF2TvyhVFuDISpQ4
TLSH
T12312AA3C9ECF34797A36633CAA47A8C2DFCA1B59B00066952BD466048EC8505D777CDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ch341ser-auto-20260705-072457.log

Path C:\Users\Admin\AppData\Local\Temp\is-I0TUDQ9PAC.tmp\CH341SER\logs\ch341ser-auto-20260705-072457.log
Size 329B
SHA256 f30f96f2cbaf41c27e4c8012b897490d30826a8887871fc58760a18519fce0b8
MD5 97039533fd7381300d44857ab22c30f7
SHA1 ed30255649c498023e99ca8548a6ce678b075639
SHA512 52182d53a6e19e69c65ba15bb3f0e794e87012921e3c38cb44c0d563f74419e11b99d41bc13b0c6fe50ac05cbb76166f42ca46c5ee665906b05738e6e55c7d1e
TLSH
T1DFE07D1822FFD245D37717CB4DE3D00492F1FC305D4433480254C1045881532CE62B33
MD5 SHA1 SHA512 TLSH

Submit Download

CH341-USB-Serial-Drivers.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-XBADUI1P8J.tmp\CH341-USB-Serial-Drivers.tmp
Size 4.1MB
SHA256 aceb078799a88255882e3344a0213f625f8836def840fb673bb60af8c94de9a0
MD5 1d5936a0292a18f4ecd6f1b5e53a1938
SHA1 446ca2318927fd29ac65d3f3a2e0b8f27c8fe983
SHA512 1385547ef23e7b7631e0e225db26abb47809813936789b312fe04a8febed76f46cc1b0c8b5e8608e7710f1b02abcce3a61836478722fc8cd7bb908b7c3be1984
SSDEEP 98304:PYU5hnuOajWwMPdCpepI3GrwrA+Js333q:ZxuHjWfZIzH
TLSH
T1F8168F03B388753EE4671A3A583FA284983F7A213A26CD4F6BF40D5C8F395416D2A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ch341ser.inf_amd64_34a3206305b40d57.ini

Path C:\Windows\System32\DriverStore\FileRepository\ch341ser.inf_amd64_34a3206305b40d57.ini
Size 768B
SHA256 a3a2a7cd0ec1c56965643cb0cf65bdd99339c7b044cb6a85d47e5ecd4cc1f045
MD5 93deb3c213ed9e358d8be28ec488f2eb
SHA1 8d8b5b0518afc1fe0353f3df903446869371ae7c
SHA512 9ccd2a85bc4445154089baacafda95473d578d19e7b2356f693f0e1dd47fa66ac5b07024942f2565ed5ad3441c497f823ab660f3de9b50816553c4739481d4a9
TLSH
T135012265631DE1BCF16A550CC32E9A71CD41F7DA40281B953B04EA901B06832EBE399B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1732-76-0x0000000005D20000-0x0000000005D86000-memory.dmp

Download

memory/1732-86-0x00000000062C0000-0x00000000062DE000-memory.dmp

Download

memory/1732-143-0x0000000072CA0000-0x000000007345C000-memory.dmp

Download

memory/1732-87-0x00000000067E0000-0x000000000682C000-memory.dmp

Download

memory/1732-91-0x0000000007460000-0x00000000074F6000-memory.dmp

Download

memory/1732-92-0x00000000073F0000-0x000000000740A000-memory.dmp

Download

memory/1732-93-0x0000000007500000-0x0000000007522000-memory.dmp

Download

memory/1732-94-0x0000000007AF0000-0x00000000080AA000-memory.dmp

Download

memory/1732-95-0x0000000008730000-0x0000000008DAC000-memory.dmp

Download

memory/1732-99-0x000000006F710000-0x000000006F75C000-memory.dmp

Download

memory/1732-98-0x0000000007710000-0x0000000007746000-memory.dmp

Download

memory/1732-101-0x0000000072CA0000-0x000000007345C000-memory.dmp

Download

memory/1732-106-0x0000000072CA0000-0x000000007345C000-memory.dmp

Download

memory/1732-108-0x00000000076F0000-0x0000000007710000-memory.dmp

Download

memory/1732-109-0x0000000007760000-0x0000000007803000-memory.dmp

Download

memory/1732-110-0x0000000007880000-0x000000000788A000-memory.dmp

Download

memory/1732-111-0x00000000079E0000-0x00000000079F1000-memory.dmp

Download

memory/1732-140-0x0000000072CA0000-0x000000007345C000-memory.dmp

Download

memory/1732-75-0x00000000054F0000-0x0000000005512000-memory.dmp

Download

memory/1732-115-0x0000000072CA0000-0x000000007345C000-memory.dmp

Download

memory/1732-139-0x0000000072CB2000-0x0000000072CB3000-memory.dmp

Download

memory/1732-83-0x0000000005E00000-0x000000000615B000-memory.dmp

Download

memory/1732-84-0x0000000072CA0000-0x000000007345C000-memory.dmp

Download

memory/1732-77-0x0000000005D90000-0x0000000005DF6000-memory.dmp

Download

memory/1732-74-0x0000000072CA0000-0x000000007345C000-memory.dmp

Download

memory/1732-73-0x00000000056D0000-0x0000000005D1A000-memory.dmp

Download

memory/1732-72-0x0000000002F10000-0x0000000002F46000-memory.dmp

Download

memory/1732-71-0x0000000072CB2000-0x0000000072CB3000-memory.dmp

Download

memory/2512-0-0x0000000000810000-0x00000000008EC000-memory.dmp

Download

memory/2512-88-0x0000000000810000-0x00000000008EC000-memory.dmp

Download

memory/2512-148-0x0000000000810000-0x00000000008EC000-memory.dmp

Download

memory/5896-70-0x0000000002E50000-0x0000000002E51000-memory.dmp

Download

memory/5896-89-0x0000000000980000-0x0000000000DB7000-memory.dmp

Download

memory/5896-145-0x0000000000980000-0x0000000000DB7000-memory.dmp

Download

memory/5896-6-0x0000000002E50000-0x0000000002E51000-memory.dmp

Download

memory/5896-147-0x0000000000980000-0x0000000000DB7000-memory.dmp

Download