1c78dfb017659c303502c97118fa9d2a6d8dcd02024350219a8ac4c4342dbbe4

Analysis

max time kernel
39s
max time network
151s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
16-01-2023 12:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

1.5MB
MD5

90ec6306c82c23bc93301410e61d2461
SHA1

e50b0625f4ec6598516c0a5e98bbc2d6dd0aa327
SHA256

1c78dfb017659c303502c97118fa9d2a6d8dcd02024350219a8ac4c4342dbbe4
SHA512

e13a680612ebc84081e91716188230dd050e3e28dfd206d2236cd4d9c48bf9ccb00294a133f31f2837f1f85fe1e16a95e8f2801e6fa5b9558cf233cac39c88a4
SSDEEP

24576:FgChBvFvfSyOllGZ2O/F77tBPHGztHGxzgSJUypu4tHqZIYdAuE8kNZTdYjW:FgIvFCHHGPHGN0gqQwxY+V1iS

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
1724	._cache_tmp.exe
1500	Synaptics.exe

Loads dropped DLL 3 IoCs

pid	Process
2020	tmp.exe
2020	tmp.exe
2020	tmp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	tmp.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2020	tmp.exe
2020	tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1724	2020	tmp.exe	27
PID 2020 wrote to memory of 1724	2020	tmp.exe	27
PID 2020 wrote to memory of 1724	2020	tmp.exe	27
PID 2020 wrote to memory of 1724	2020	tmp.exe	27
PID 1724 wrote to memory of 1716	1724	._cache_tmp.exe	28
PID 1724 wrote to memory of 1716	1724	._cache_tmp.exe	28
PID 1724 wrote to memory of 1716	1724	._cache_tmp.exe	28
PID 1724 wrote to memory of 1716	1724	._cache_tmp.exe	28
PID 2020 wrote to memory of 1500	2020	tmp.exe	30
PID 2020 wrote to memory of 1500	2020	tmp.exe	30
PID 2020 wrote to memory of 1500	2020	tmp.exe	30
PID 2020 wrote to memory of 1500	2020	tmp.exe	30

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Users\Admin\AppData\Local\Temp\._cache_tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c md C:\windowss64
    3⤵
    PID:1716
- - C:\windowss64\computer.exe
    "C:\windowss64\computer.exe"
    3⤵
    PID:732
  - - C:\Users\Admin\AppData\Local\Temp\._cache_computer.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_computer.exe"
      4⤵
      PID:1736
  - - C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      4⤵
      PID:1716
- - \??\c:\Server_se.exe
    c:\Server_se.exe
    3⤵
    PID:1388
  - - C:\Users\Admin\AppData\Local\Temp\._cache_Server_se.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_Server_se.exe"
      4⤵
      PID:1624
  - - C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      4⤵
      PID:1592
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  PID:1500

C:\Program Files (x86)\Mcegqgc.exe
"C:\Program Files (x86)\Mcegqgc.exe"
1⤵
PID:1204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c md C:\windowss64
  2⤵
  PID:268
- C:\windowss64\computer.exe
  "C:\windowss64\computer.exe"
  2⤵
  PID:1928
- - C:\Windows\SysWOW64\._cache_computer.exe
    "C:\Windows\system32\._cache_computer.exe"
    3⤵
    PID:1492
  - - C:\Windows\SysWOW64\._cache_computer.exe
      C:\Windows\SysWOW64\._cache_computer.exe Win7
      4⤵
      PID:1036
- - C:\ProgramData\Synaptics\Synaptics.exe
    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
    3⤵
    PID:1356
- C:\Program Files (x86)\Mcegqgc.exe
  "C:\Program Files (x86)\Mcegqgc.exe" Win7
  2⤵
  PID:828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c md C:\windowss64
    3⤵
    PID:1788
- - C:\windowss64\computer.exe
    "C:\windowss64\computer.exe"
    3⤵
    PID:1944
  - - C:\Windows\SysWOW64\._cache_computer.exe
      "C:\Windows\system32\._cache_computer.exe"
      4⤵
      PID:1152
  - - C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      4⤵
      PID:548

C:\Program Files (x86)\Imsossm.exe
"C:\Program Files (x86)\Imsossm.exe"
1⤵
PID:680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Imsossm.exe

Filesize
400KB

MD5
20beeb0a82adcce3a58372804acc46be

SHA1
c579d9017d2c8298fe075ff5c05963901330e72a

SHA256
d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e

SHA512
7636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd

Download Submit
C:\Program Files (x86)\Mcegqgc.exe

Filesize
362KB

MD5
11354a4cb98f15439ab5444fd88e9bfe

SHA1
cc4c0e07f37f5d04f481d536cbe5068cf78fcf30

SHA256
6503d2695c614d42d223c485a554e34c06b47aaf9389ac58305aa17a7773c0e6

SHA512
b90c209df16e2530a21668b8d7c9aa0446fd280d4635ad1427bffc32777e0d9d52b57478ab08421593c1bef9e6804bf66fdaf40ee890b5f5d374173751e7ab0a

Download Submit
C:\Program Files (x86)\Mcegqgc.exe

Filesize
362KB

MD5
11354a4cb98f15439ab5444fd88e9bfe

SHA1
cc4c0e07f37f5d04f481d536cbe5068cf78fcf30

SHA256
6503d2695c614d42d223c485a554e34c06b47aaf9389ac58305aa17a7773c0e6

SHA512
b90c209df16e2530a21668b8d7c9aa0446fd280d4635ad1427bffc32777e0d9d52b57478ab08421593c1bef9e6804bf66fdaf40ee890b5f5d374173751e7ab0a

Download Submit
C:\Program Files (x86)\Mcegqgc.exe

Filesize
362KB

MD5
11354a4cb98f15439ab5444fd88e9bfe

SHA1
cc4c0e07f37f5d04f481d536cbe5068cf78fcf30

SHA256
6503d2695c614d42d223c485a554e34c06b47aaf9389ac58305aa17a7773c0e6

SHA512
b90c209df16e2530a21668b8d7c9aa0446fd280d4635ad1427bffc32777e0d9d52b57478ab08421593c1bef9e6804bf66fdaf40ee890b5f5d374173751e7ab0a

Download Submit
C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.5MB

MD5
90ec6306c82c23bc93301410e61d2461

SHA1
e50b0625f4ec6598516c0a5e98bbc2d6dd0aa327

SHA256
1c78dfb017659c303502c97118fa9d2a6d8dcd02024350219a8ac4c4342dbbe4

SHA512
e13a680612ebc84081e91716188230dd050e3e28dfd206d2236cd4d9c48bf9ccb00294a133f31f2837f1f85fe1e16a95e8f2801e6fa5b9558cf233cac39c88a4

Download Submit
C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.5MB

MD5
90ec6306c82c23bc93301410e61d2461

SHA1
e50b0625f4ec6598516c0a5e98bbc2d6dd0aa327

SHA256
1c78dfb017659c303502c97118fa9d2a6d8dcd02024350219a8ac4c4342dbbe4

SHA512
e13a680612ebc84081e91716188230dd050e3e28dfd206d2236cd4d9c48bf9ccb00294a133f31f2837f1f85fe1e16a95e8f2801e6fa5b9558cf233cac39c88a4

Download Submit
C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.5MB

MD5
90ec6306c82c23bc93301410e61d2461

SHA1
e50b0625f4ec6598516c0a5e98bbc2d6dd0aa327

SHA256
1c78dfb017659c303502c97118fa9d2a6d8dcd02024350219a8ac4c4342dbbe4

SHA512
e13a680612ebc84081e91716188230dd050e3e28dfd206d2236cd4d9c48bf9ccb00294a133f31f2837f1f85fe1e16a95e8f2801e6fa5b9558cf233cac39c88a4

Download Submit
C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.5MB

MD5
90ec6306c82c23bc93301410e61d2461

SHA1
e50b0625f4ec6598516c0a5e98bbc2d6dd0aa327

SHA256
1c78dfb017659c303502c97118fa9d2a6d8dcd02024350219a8ac4c4342dbbe4

SHA512
e13a680612ebc84081e91716188230dd050e3e28dfd206d2236cd4d9c48bf9ccb00294a133f31f2837f1f85fe1e16a95e8f2801e6fa5b9558cf233cac39c88a4

Download Submit
C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.5MB

MD5
90ec6306c82c23bc93301410e61d2461

SHA1
e50b0625f4ec6598516c0a5e98bbc2d6dd0aa327

SHA256
1c78dfb017659c303502c97118fa9d2a6d8dcd02024350219a8ac4c4342dbbe4

SHA512
e13a680612ebc84081e91716188230dd050e3e28dfd206d2236cd4d9c48bf9ccb00294a133f31f2837f1f85fe1e16a95e8f2801e6fa5b9558cf233cac39c88a4

Download Submit
C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.5MB

MD5
90ec6306c82c23bc93301410e61d2461

SHA1
e50b0625f4ec6598516c0a5e98bbc2d6dd0aa327

SHA256
1c78dfb017659c303502c97118fa9d2a6d8dcd02024350219a8ac4c4342dbbe4

SHA512
e13a680612ebc84081e91716188230dd050e3e28dfd206d2236cd4d9c48bf9ccb00294a133f31f2837f1f85fe1e16a95e8f2801e6fa5b9558cf233cac39c88a4

Download Submit
C:\Server_se.exe

Filesize
1.6MB

MD5
c326b83a1c289944a918f0dc22f7c003

SHA1
b835f673d18e44631d5e138e8d20243829ae93a7

SHA256
9af327b367b69a023c5269d7da2f73dbf7cb56580f6ac9a108c4bcb3a622842d

SHA512
8188fea4ebd3da84a752779a57b43e6f3cc573772dc305aff3f7173e7fc6c5be8f3f9629ab609a89603ee9ef5b27e31f79615f10dcecacb150866986cc6b3975

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_Server_se.exe

Filesize
865KB

MD5
84336e3d11c2715b850e1029aff93803

SHA1
26c9e96ce4263bb599e3b92b6d52bf006d829ccb

SHA256
c5717a66a3b087ffcf68b53018bef0881d179922b7654eeab0075da195b5054a

SHA512
fbe5ade00745a2b287d63b3a3363f3ef6c14d274de61e7afafcbc646a98395bb7994da65429f1cc827e1ea2748f1b81c782ee98501611a46fc75410862198f92

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_computer.exe

Filesize
400KB

MD5
20beeb0a82adcce3a58372804acc46be

SHA1
c579d9017d2c8298fe075ff5c05963901330e72a

SHA256
d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e

SHA512
7636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_computer.exe

Filesize
400KB

MD5
20beeb0a82adcce3a58372804acc46be

SHA1
c579d9017d2c8298fe075ff5c05963901330e72a

SHA256
d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e

SHA512
7636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_tmp.exe

Filesize
362KB

MD5
11354a4cb98f15439ab5444fd88e9bfe

SHA1
cc4c0e07f37f5d04f481d536cbe5068cf78fcf30

SHA256
6503d2695c614d42d223c485a554e34c06b47aaf9389ac58305aa17a7773c0e6

SHA512
b90c209df16e2530a21668b8d7c9aa0446fd280d4635ad1427bffc32777e0d9d52b57478ab08421593c1bef9e6804bf66fdaf40ee890b5f5d374173751e7ab0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_tmp.exe

Filesize
362KB

MD5
11354a4cb98f15439ab5444fd88e9bfe

SHA1
cc4c0e07f37f5d04f481d536cbe5068cf78fcf30

SHA256
6503d2695c614d42d223c485a554e34c06b47aaf9389ac58305aa17a7773c0e6

SHA512
b90c209df16e2530a21668b8d7c9aa0446fd280d4635ad1427bffc32777e0d9d52b57478ab08421593c1bef9e6804bf66fdaf40ee890b5f5d374173751e7ab0a

Download Submit
C:\Windows\SysWOW64\._cache_computer.exe

Filesize
400KB

MD5
20beeb0a82adcce3a58372804acc46be

SHA1
c579d9017d2c8298fe075ff5c05963901330e72a

SHA256
d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e

SHA512
7636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd

Download Submit
C:\Windows\SysWOW64\._cache_computer.exe

Filesize
400KB

MD5
20beeb0a82adcce3a58372804acc46be

SHA1
c579d9017d2c8298fe075ff5c05963901330e72a

SHA256
d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e

SHA512
7636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd

Download Submit
C:\Windows\SysWOW64\._cache_computer.exe

Filesize
400KB

MD5
20beeb0a82adcce3a58372804acc46be

SHA1
c579d9017d2c8298fe075ff5c05963901330e72a

SHA256
d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e

SHA512
7636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd

Download Submit
C:\Windows\SysWOW64\._cache_computer.exe

Filesize
400KB

MD5
20beeb0a82adcce3a58372804acc46be

SHA1
c579d9017d2c8298fe075ff5c05963901330e72a

SHA256
d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e

SHA512
7636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd

Download Submit
C:\windowss64\computer.exe

Filesize
1.1MB

MD5
be689578752179e22bf915dbcf4f7520

SHA1
e798e703bfb90707a2872b51da73f32af566aedb

SHA256
de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e

SHA512
89c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8

Download Submit
C:\windowss64\computer.exe

Filesize
1.1MB

MD5
be689578752179e22bf915dbcf4f7520

SHA1
e798e703bfb90707a2872b51da73f32af566aedb

SHA256
de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e

SHA512
89c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8

Download Submit
C:\windowss64\computer.exe

Filesize
1.1MB

MD5
be689578752179e22bf915dbcf4f7520

SHA1
e798e703bfb90707a2872b51da73f32af566aedb

SHA256
de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e

SHA512
89c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8

Download Submit
C:\windowss64\computer.exe

Filesize
1.1MB

MD5
be689578752179e22bf915dbcf4f7520

SHA1
e798e703bfb90707a2872b51da73f32af566aedb

SHA256
de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e

SHA512
89c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8

Download Submit
C:\windowss64\computer.exe

Filesize
1.1MB

MD5
be689578752179e22bf915dbcf4f7520

SHA1
e798e703bfb90707a2872b51da73f32af566aedb

SHA256
de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e

SHA512
89c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8

Download Submit
C:\windowss64\computer.exe

Filesize
1.1MB

MD5
be689578752179e22bf915dbcf4f7520

SHA1
e798e703bfb90707a2872b51da73f32af566aedb

SHA256
de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e

SHA512
89c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8

Download Submit
\??\c:\Server_se.exe

Filesize
1.6MB

MD5
c326b83a1c289944a918f0dc22f7c003

SHA1
b835f673d18e44631d5e138e8d20243829ae93a7

SHA256
9af327b367b69a023c5269d7da2f73dbf7cb56580f6ac9a108c4bcb3a622842d

SHA512
8188fea4ebd3da84a752779a57b43e6f3cc573772dc305aff3f7173e7fc6c5be8f3f9629ab609a89603ee9ef5b27e31f79615f10dcecacb150866986cc6b3975

Download Submit
\??\c:\Server_se.exe

Filesize
69KB

MD5
09721983f046a337c91940761a3e1e44

SHA1
68d7924be84a023ad37c91911d96d0a6346a6c29

SHA256
99809097ac03d87a553ae21eccac6f6ba79e28868c6ffda3a2dfeaac64e88ba8

SHA512
bf61617832cc62fb384d15ac9e2e985cd2e37526737ae1233e4d0a5a7cd483ae7f71433880840d6fb8477b430979b5b650c366aada6161cced092b1419612e38

Download Submit
\ProgramData\Synaptics\Synaptics.exe

Filesize
1.5MB

MD5
90ec6306c82c23bc93301410e61d2461

SHA1
e50b0625f4ec6598516c0a5e98bbc2d6dd0aa327

SHA256
1c78dfb017659c303502c97118fa9d2a6d8dcd02024350219a8ac4c4342dbbe4

SHA512
e13a680612ebc84081e91716188230dd050e3e28dfd206d2236cd4d9c48bf9ccb00294a133f31f2837f1f85fe1e16a95e8f2801e6fa5b9558cf233cac39c88a4

Download Submit
\ProgramData\Synaptics\Synaptics.exe

Filesize
1.5MB

MD5
90ec6306c82c23bc93301410e61d2461

SHA1
e50b0625f4ec6598516c0a5e98bbc2d6dd0aa327

SHA256
1c78dfb017659c303502c97118fa9d2a6d8dcd02024350219a8ac4c4342dbbe4

SHA512
e13a680612ebc84081e91716188230dd050e3e28dfd206d2236cd4d9c48bf9ccb00294a133f31f2837f1f85fe1e16a95e8f2801e6fa5b9558cf233cac39c88a4

Download Submit
\ProgramData\Synaptics\Synaptics.exe

Filesize
1.5MB

MD5
90ec6306c82c23bc93301410e61d2461

SHA1
e50b0625f4ec6598516c0a5e98bbc2d6dd0aa327

SHA256
1c78dfb017659c303502c97118fa9d2a6d8dcd02024350219a8ac4c4342dbbe4

SHA512
e13a680612ebc84081e91716188230dd050e3e28dfd206d2236cd4d9c48bf9ccb00294a133f31f2837f1f85fe1e16a95e8f2801e6fa5b9558cf233cac39c88a4

Download Submit
\ProgramData\Synaptics\Synaptics.exe

Filesize
1.5MB

MD5
90ec6306c82c23bc93301410e61d2461

SHA1
e50b0625f4ec6598516c0a5e98bbc2d6dd0aa327

SHA256
1c78dfb017659c303502c97118fa9d2a6d8dcd02024350219a8ac4c4342dbbe4

SHA512
e13a680612ebc84081e91716188230dd050e3e28dfd206d2236cd4d9c48bf9ccb00294a133f31f2837f1f85fe1e16a95e8f2801e6fa5b9558cf233cac39c88a4

Download Submit
\ProgramData\Synaptics\Synaptics.exe

Filesize
1.5MB

MD5
90ec6306c82c23bc93301410e61d2461

SHA1
e50b0625f4ec6598516c0a5e98bbc2d6dd0aa327

SHA256
1c78dfb017659c303502c97118fa9d2a6d8dcd02024350219a8ac4c4342dbbe4

SHA512
e13a680612ebc84081e91716188230dd050e3e28dfd206d2236cd4d9c48bf9ccb00294a133f31f2837f1f85fe1e16a95e8f2801e6fa5b9558cf233cac39c88a4

Download Submit
\ProgramData\Synaptics\Synaptics.exe

Filesize
1.5MB

MD5
90ec6306c82c23bc93301410e61d2461

SHA1
e50b0625f4ec6598516c0a5e98bbc2d6dd0aa327

SHA256
1c78dfb017659c303502c97118fa9d2a6d8dcd02024350219a8ac4c4342dbbe4

SHA512
e13a680612ebc84081e91716188230dd050e3e28dfd206d2236cd4d9c48bf9ccb00294a133f31f2837f1f85fe1e16a95e8f2801e6fa5b9558cf233cac39c88a4

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_Server_se.exe

Filesize
865KB

MD5
84336e3d11c2715b850e1029aff93803

SHA1
26c9e96ce4263bb599e3b92b6d52bf006d829ccb

SHA256
c5717a66a3b087ffcf68b53018bef0881d179922b7654eeab0075da195b5054a

SHA512
fbe5ade00745a2b287d63b3a3363f3ef6c14d274de61e7afafcbc646a98395bb7994da65429f1cc827e1ea2748f1b81c782ee98501611a46fc75410862198f92

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_computer.exe

Filesize
400KB

MD5
20beeb0a82adcce3a58372804acc46be

SHA1
c579d9017d2c8298fe075ff5c05963901330e72a

SHA256
d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e

SHA512
7636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_computer.exe

Filesize
400KB

MD5
20beeb0a82adcce3a58372804acc46be

SHA1
c579d9017d2c8298fe075ff5c05963901330e72a

SHA256
d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e

SHA512
7636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_tmp.exe

Filesize
362KB

MD5
11354a4cb98f15439ab5444fd88e9bfe

SHA1
cc4c0e07f37f5d04f481d536cbe5068cf78fcf30

SHA256
6503d2695c614d42d223c485a554e34c06b47aaf9389ac58305aa17a7773c0e6

SHA512
b90c209df16e2530a21668b8d7c9aa0446fd280d4635ad1427bffc32777e0d9d52b57478ab08421593c1bef9e6804bf66fdaf40ee890b5f5d374173751e7ab0a

Download Submit
\Windows\SysWOW64\._cache_computer.exe

Filesize
400KB

MD5
20beeb0a82adcce3a58372804acc46be

SHA1
c579d9017d2c8298fe075ff5c05963901330e72a

SHA256
d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e

SHA512
7636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd

Download Submit
\Windows\SysWOW64\._cache_computer.exe

Filesize
400KB

MD5
20beeb0a82adcce3a58372804acc46be

SHA1
c579d9017d2c8298fe075ff5c05963901330e72a

SHA256
d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e

SHA512
7636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd

Download Submit
\Windows\SysWOW64\._cache_computer.exe

Filesize
400KB

MD5
20beeb0a82adcce3a58372804acc46be

SHA1
c579d9017d2c8298fe075ff5c05963901330e72a

SHA256
d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e

SHA512
7636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd

Download Submit
\Windows\SysWOW64\._cache_computer.exe

Filesize
400KB

MD5
20beeb0a82adcce3a58372804acc46be

SHA1
c579d9017d2c8298fe075ff5c05963901330e72a

SHA256
d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e

SHA512
7636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd

Download Submit
\Windows\SysWOW64\._cache_computer.exe

Filesize
400KB

MD5
20beeb0a82adcce3a58372804acc46be

SHA1
c579d9017d2c8298fe075ff5c05963901330e72a

SHA256
d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e

SHA512
7636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd

Download Submit
\Windows\SysWOW64\._cache_computer.exe

Filesize
400KB

MD5
20beeb0a82adcce3a58372804acc46be

SHA1
c579d9017d2c8298fe075ff5c05963901330e72a

SHA256
d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e

SHA512
7636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd

Download Submit
\windowss64\computer.exe

Filesize
1.1MB

MD5
be689578752179e22bf915dbcf4f7520

SHA1
e798e703bfb90707a2872b51da73f32af566aedb

SHA256
de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e

SHA512
89c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8

Download Submit
\windowss64\computer.exe

Filesize
1.1MB

MD5
be689578752179e22bf915dbcf4f7520

SHA1
e798e703bfb90707a2872b51da73f32af566aedb

SHA256
de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e

SHA512
89c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8

Download Submit
\windowss64\computer.exe

Filesize
1.1MB

MD5
be689578752179e22bf915dbcf4f7520

SHA1
e798e703bfb90707a2872b51da73f32af566aedb

SHA256
de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e

SHA512
89c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8

Download Submit
\windowss64\computer.exe

Filesize
1.1MB

MD5
be689578752179e22bf915dbcf4f7520

SHA1
e798e703bfb90707a2872b51da73f32af566aedb

SHA256
de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e

SHA512
89c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8

Download Submit
\windowss64\computer.exe

Filesize
1.1MB

MD5
be689578752179e22bf915dbcf4f7520

SHA1
e798e703bfb90707a2872b51da73f32af566aedb

SHA256
de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e

SHA512
89c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8

Download Submit
\windowss64\computer.exe

Filesize
1.1MB

MD5
be689578752179e22bf915dbcf4f7520

SHA1
e798e703bfb90707a2872b51da73f32af566aedb

SHA256
de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e

SHA512
89c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8

Download Submit
\windowss64\computer.exe

Filesize
1.1MB

MD5
be689578752179e22bf915dbcf4f7520

SHA1
e798e703bfb90707a2872b51da73f32af566aedb

SHA256
de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e

SHA512
89c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8

Download Submit
\windowss64\computer.exe

Filesize
1.1MB

MD5
be689578752179e22bf915dbcf4f7520

SHA1
e798e703bfb90707a2872b51da73f32af566aedb

SHA256
de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e

SHA512
89c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8

Download Submit
\windowss64\computer.exe

Filesize
1.1MB

MD5
be689578752179e22bf915dbcf4f7520

SHA1
e798e703bfb90707a2872b51da73f32af566aedb

SHA256
de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e

SHA512
89c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8

Download Submit
memory/548-10485-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/1356-9495-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/1388-8666-0x0000000004FE0000-0x0000000005105000-memory.dmp

Filesize
1.1MB

Download
memory/1500-8465-0x0000000001FA0000-0x00000000020A0000-memory.dmp

Filesize
1024KB

Download
memory/1500-6344-0x00000000020E0000-0x0000000002261000-memory.dmp

Filesize
1.5MB

Download
memory/1500-6343-0x0000000001FA0000-0x00000000020A0000-memory.dmp

Filesize
1024KB

Download
memory/1500-8187-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/1500-5209-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/1592-8710-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/1592-9301-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/1624-8671-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/1716-8116-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/1928-9489-0x0000000005270000-0x0000000005492000-memory.dmp

Filesize
2.1MB

Download
memory/1928-8896-0x0000000005270000-0x0000000005492000-memory.dmp

Filesize
2.1MB

Download
memory/1944-9860-0x0000000004F80000-0x00000000051A2000-memory.dmp

Filesize
2.1MB

Download
memory/2020-500-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-491-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-516-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-515-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-518-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-514-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-513-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-511-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-512-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-519-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-510-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-509-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-520-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-521-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-508-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-507-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-4831-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2020-506-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-505-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-504-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-522-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-502-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/2020-503-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-3283-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2020-523-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-501-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-499-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-498-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-524-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-4825-0x0000000004190000-0x00000000041A0000-memory.dmp

Filesize
64KB

Download
memory/2020-497-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-496-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-495-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-494-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-493-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-492-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-517-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-490-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-489-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-488-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-487-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-485-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-486-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-4824-0x00000000024E0000-0x0000000002581000-memory.dmp

Filesize
644KB

Download
memory/2020-484-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-483-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-482-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-481-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-4823-0x0000000001FB0000-0x00000000020B1000-memory.dmp

Filesize
1.0MB

Download
memory/2020-4822-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2020-1479-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2020-480-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-479-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-478-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-477-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-1480-0x00000000021B0000-0x0000000002331000-memory.dmp

Filesize
1.5MB

Download
memory/2020-476-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-475-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-474-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-473-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-472-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-471-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-470-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-469-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-468-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-467-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-4812-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-466-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-465-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-464-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-463-0x00000000023C0000-0x00000000024D1000-memory.dmp

Filesize
1.1MB

Download
memory/2020-462-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2020-56-0x0000000074E30000-0x0000000074E77000-memory.dmp

Filesize
284KB

Download