adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28

Analysis

max time kernel
149s
max time network
145s
platform
windows7_x64
resource
win7v20210408
submitted
09-05-2021 19:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
Size

939KB
MD5

3c421e69d0be9accecfe6ace1928c3c6
SHA1

33d3c93af60f4702e34d6d435affff390bcbe897
SHA256

adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28
SHA512

7fefb37f607147d320477ad2156bc2f7f428ba3de3f29532fcef0dd327285f74e6355ae032fa495ccb785eb254dba51609f457c13b368764528f9bbfcc6021b3

Score

8^/10

macro persistence vmprotect

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exeSynaptics.exe

pid process

1968 ._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
1724 Synaptics.exe

pid	process
1968	._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
1724	Synaptics.exe

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\RXnekder.xlsm	office_macros

VMProtect packed file 9 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	vmprotect
behavioral1/memory/1968-72-0x0000000000210000-0x0000000000211000-memory.dmp	vmprotect
\Users\Admin\AppData\Local\Temp\._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	vmprotect
\Users\Admin\AppData\Local\Temp\._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	vmprotect
\Users\Admin\AppData\Local\Temp\._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	vmprotect
\Users\Admin\AppData\Local\Temp\._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	vmprotect
\Users\Admin\AppData\Local\Temp\._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	vmprotect

Loads dropped DLL 8 IoCs

Processes:

adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exeWerFault.exe

pid	process
1992	adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
1992	adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
1992	adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
784	WerFault.exe
784	WerFault.exe
784	WerFault.exe
784	WerFault.exe
784	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

784 1968 WerFault.exe ._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

pid	pid_target	process	target process
784	1968	WerFault.exe	._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Synaptics.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Synaptics.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Synaptics.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1732 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

784 WerFault.exe
784 WerFault.exe
784 WerFault.exe
784 WerFault.exe
784 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

784 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 784 WerFault.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

EXCEL.EXE

pid process

1732 EXCEL.EXE

pid	process
1732	EXCEL.EXE

pid	process
784	WerFault.exe
784	WerFault.exe
784	WerFault.exe
784	WerFault.exe
784	WerFault.exe

pid	process
784	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	784	WerFault.exe

pid	process
1732	EXCEL.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe

description	pid	process	target process
PID 1992 wrote to memory of 1968	1992	adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
PID 1992 wrote to memory of 1968	1992	adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
PID 1992 wrote to memory of 1968	1992	adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
PID 1992 wrote to memory of 1968	1992	adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
PID 1992 wrote to memory of 1724	1992	adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	Synaptics.exe
PID 1992 wrote to memory of 1724	1992	adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	Synaptics.exe
PID 1992 wrote to memory of 1724	1992	adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	Synaptics.exe
PID 1992 wrote to memory of 1724	1992	adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	Synaptics.exe
PID 1968 wrote to memory of 784	1968	._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	WerFault.exe
PID 1968 wrote to memory of 784	1968	._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	WerFault.exe
PID 1968 wrote to memory of 784	1968	._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	WerFault.exe
PID 1968 wrote to memory of 784	1968	._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
"C:\Users\Admin\AppData\Local\Temp\adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1992

C:\Users\Admin\AppData\Local\Temp\._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
"C:\Users\Admin\AppData\Local\Temp\._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 584
3⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:784

C:\ProgramData\Synaptics\Synaptics.exe
"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
2⤵
- Executes dropped EXE
- Modifies system certificate store
PID:1724

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1732

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe
MD5
17d6f5e04057dc97d2b85ce7280b91f9

SHA1
80455f1cc09b53bb3de182b022ade40ced6e8496

SHA256
05c8d54f83ae4bb668fcf0cfc0ae79ebdd7b93acf85e5bb17a9ec5851369d1d7

SHA512
a1883f10007e97588a3ec4b107ba4967086d1895caaabdd23a538a6988967860401f7400ec8f80c507cfcca0aff467ecae695367150e91c5d10b0d226d222976

Download Submit
C:\ProgramData\Synaptics\Synaptics.exe
MD5
17d6f5e04057dc97d2b85ce7280b91f9

SHA1
80455f1cc09b53bb3de182b022ade40ced6e8496

SHA256
05c8d54f83ae4bb668fcf0cfc0ae79ebdd7b93acf85e5bb17a9ec5851369d1d7

SHA512
a1883f10007e97588a3ec4b107ba4967086d1895caaabdd23a538a6988967860401f7400ec8f80c507cfcca0aff467ecae695367150e91c5d10b0d226d222976

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
MD5
2683402f267742314f82a5f9f75d4401

SHA1
6c4ee0f59eb2ebf9b9bea81769fe14b7219c2b16

SHA256
9175f7e7700e28fb568d1e0090ee39d87089003fb1ba02f8223f4f1643f7c16e

SHA512
61e9d520db82aa16ce5fc1fd095c278d0b07b259029d6d5c288b8ec8e4f9660c85d1edb26f7993bef0a112cfc2dc19e28eb6622b51a786098988e391475cd3df

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
MD5
2683402f267742314f82a5f9f75d4401

SHA1
6c4ee0f59eb2ebf9b9bea81769fe14b7219c2b16

SHA256
9175f7e7700e28fb568d1e0090ee39d87089003fb1ba02f8223f4f1643f7c16e

SHA512
61e9d520db82aa16ce5fc1fd095c278d0b07b259029d6d5c288b8ec8e4f9660c85d1edb26f7993bef0a112cfc2dc19e28eb6622b51a786098988e391475cd3df

Download Submit
C:\Users\Admin\AppData\Local\Temp\RXnekder.xlsm
MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
\ProgramData\Synaptics\Synaptics.exe
MD5
17d6f5e04057dc97d2b85ce7280b91f9

SHA1
80455f1cc09b53bb3de182b022ade40ced6e8496

SHA256
05c8d54f83ae4bb668fcf0cfc0ae79ebdd7b93acf85e5bb17a9ec5851369d1d7

SHA512
a1883f10007e97588a3ec4b107ba4967086d1895caaabdd23a538a6988967860401f7400ec8f80c507cfcca0aff467ecae695367150e91c5d10b0d226d222976

Download Submit
\ProgramData\Synaptics\Synaptics.exe
MD5
17d6f5e04057dc97d2b85ce7280b91f9

SHA1
80455f1cc09b53bb3de182b022ade40ced6e8496

SHA256
05c8d54f83ae4bb668fcf0cfc0ae79ebdd7b93acf85e5bb17a9ec5851369d1d7

SHA512
a1883f10007e97588a3ec4b107ba4967086d1895caaabdd23a538a6988967860401f7400ec8f80c507cfcca0aff467ecae695367150e91c5d10b0d226d222976

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
MD5
2683402f267742314f82a5f9f75d4401

SHA1
6c4ee0f59eb2ebf9b9bea81769fe14b7219c2b16

SHA256
9175f7e7700e28fb568d1e0090ee39d87089003fb1ba02f8223f4f1643f7c16e

SHA512
61e9d520db82aa16ce5fc1fd095c278d0b07b259029d6d5c288b8ec8e4f9660c85d1edb26f7993bef0a112cfc2dc19e28eb6622b51a786098988e391475cd3df

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
MD5
2683402f267742314f82a5f9f75d4401

SHA1
6c4ee0f59eb2ebf9b9bea81769fe14b7219c2b16

SHA256
9175f7e7700e28fb568d1e0090ee39d87089003fb1ba02f8223f4f1643f7c16e

SHA512
61e9d520db82aa16ce5fc1fd095c278d0b07b259029d6d5c288b8ec8e4f9660c85d1edb26f7993bef0a112cfc2dc19e28eb6622b51a786098988e391475cd3df

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
MD5
2683402f267742314f82a5f9f75d4401

SHA1
6c4ee0f59eb2ebf9b9bea81769fe14b7219c2b16

SHA256
9175f7e7700e28fb568d1e0090ee39d87089003fb1ba02f8223f4f1643f7c16e

SHA512
61e9d520db82aa16ce5fc1fd095c278d0b07b259029d6d5c288b8ec8e4f9660c85d1edb26f7993bef0a112cfc2dc19e28eb6622b51a786098988e391475cd3df

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
MD5
2683402f267742314f82a5f9f75d4401

SHA1
6c4ee0f59eb2ebf9b9bea81769fe14b7219c2b16

SHA256
9175f7e7700e28fb568d1e0090ee39d87089003fb1ba02f8223f4f1643f7c16e

SHA512
61e9d520db82aa16ce5fc1fd095c278d0b07b259029d6d5c288b8ec8e4f9660c85d1edb26f7993bef0a112cfc2dc19e28eb6622b51a786098988e391475cd3df

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
MD5
2683402f267742314f82a5f9f75d4401

SHA1
6c4ee0f59eb2ebf9b9bea81769fe14b7219c2b16

SHA256
9175f7e7700e28fb568d1e0090ee39d87089003fb1ba02f8223f4f1643f7c16e

SHA512
61e9d520db82aa16ce5fc1fd095c278d0b07b259029d6d5c288b8ec8e4f9660c85d1edb26f7993bef0a112cfc2dc19e28eb6622b51a786098988e391475cd3df

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
MD5
2683402f267742314f82a5f9f75d4401

SHA1
6c4ee0f59eb2ebf9b9bea81769fe14b7219c2b16

SHA256
9175f7e7700e28fb568d1e0090ee39d87089003fb1ba02f8223f4f1643f7c16e

SHA512
61e9d520db82aa16ce5fc1fd095c278d0b07b259029d6d5c288b8ec8e4f9660c85d1edb26f7993bef0a112cfc2dc19e28eb6622b51a786098988e391475cd3df

Download Submit
memory/784-86-0x0000000002110000-0x0000000002111000-memory.dmp

Filesize
4KB

Download
memory/784-77-0x0000000000000000-mapping.dmp

Download
memory/1724-68-0x0000000000000000-mapping.dmp

Download
memory/1724-71-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1732-75-0x000000006FDF1000-0x000000006FDF3000-memory.dmp

Filesize
8KB

Download
memory/1732-74-0x000000002F3E1000-0x000000002F3E4000-memory.dmp

Filesize
12KB

Download
memory/1732-82-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1968-72-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/1968-63-0x0000000000000000-mapping.dmp

Download
memory/1992-60-0x0000000075B31000-0x0000000075B33000-memory.dmp

Filesize
8KB

Download
memory/1992-61-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download