Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
23-03-2023 03:47
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230220-en
General
-
Target
tmp.exe
-
Size
854KB
-
MD5
348dd4605cb1ab5e26dfe53bfcbd3a78
-
SHA1
5aa6c5019141b4b56fa12135a9c3e7889699b920
-
SHA256
63ad5b77e55d1cda15c8cd6aaf18a40ea64d409620bed1a763ee1d23e086bac1
-
SHA512
45929e6348185b8c8e216fae1a7eb733bfd1d48a69645f675da50a5b7f26c61b7daeaa50238d5569855824593d255061be115e0295c703a16e4330fa733b1a6a
-
SSDEEP
24576:mH5aTYLK8pfUzLNdZ68lxdNZSHaz/Fh52Wlv:mH1jp8td0AxRUazz/v
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1476-9722-0x0000000000400000-0x0000000000522000-memory.dmp unk_chinese_botnet -
Downloads MZ/PE file
-
Executes dropped EXE 12 IoCs
Processes:
computer.exe._cache_computer.exeSynaptics.exe._cache_Synaptics.exeImsossm.exeOcwwoqo.exeImsossm.exeImsossm.execomputer.exe._cache_computer.exeSynaptics.exe._cache_Synaptics.exepid process 1588 computer.exe 752 ._cache_computer.exe 1656 Synaptics.exe 684 ._cache_Synaptics.exe 912 Imsossm.exe 1248 Ocwwoqo.exe 896 Imsossm.exe 1064 Imsossm.exe 1512 computer.exe 2036 ._cache_computer.exe 1900 Synaptics.exe 2012 ._cache_Synaptics.exe -
Loads dropped DLL 19 IoCs
Processes:
tmp.execomputer.exeSynaptics.exeOcwwoqo.execomputer.exeSynaptics.exepid process 1476 tmp.exe 1476 tmp.exe 1588 computer.exe 1588 computer.exe 1588 computer.exe 1588 computer.exe 1588 computer.exe 1656 Synaptics.exe 1656 Synaptics.exe 1656 Synaptics.exe 1248 Ocwwoqo.exe 1248 Ocwwoqo.exe 1512 computer.exe 1512 computer.exe 1512 computer.exe 1512 computer.exe 1900 Synaptics.exe 1900 Synaptics.exe 1900 Synaptics.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
computer.execomputer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" computer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" computer.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
._cache_computer.exe._cache_computer.exetmp.exedescription ioc process File opened (read-only) \??\B: ._cache_computer.exe File opened (read-only) \??\N: ._cache_computer.exe File opened (read-only) \??\R: ._cache_computer.exe File opened (read-only) \??\Z: ._cache_computer.exe File opened (read-only) \??\O: ._cache_computer.exe File opened (read-only) \??\X: tmp.exe File opened (read-only) \??\M: ._cache_computer.exe File opened (read-only) \??\J: tmp.exe File opened (read-only) \??\F: ._cache_computer.exe File opened (read-only) \??\G: ._cache_computer.exe File opened (read-only) \??\X: ._cache_computer.exe File opened (read-only) \??\E: tmp.exe File opened (read-only) \??\R: tmp.exe File opened (read-only) \??\S: tmp.exe File opened (read-only) \??\E: ._cache_computer.exe File opened (read-only) \??\H: tmp.exe File opened (read-only) \??\S: ._cache_computer.exe File opened (read-only) \??\V: tmp.exe File opened (read-only) \??\G: tmp.exe File opened (read-only) \??\I: tmp.exe File opened (read-only) \??\K: ._cache_computer.exe File opened (read-only) \??\J: ._cache_computer.exe File opened (read-only) \??\B: tmp.exe File opened (read-only) \??\O: tmp.exe File opened (read-only) \??\Q: tmp.exe File opened (read-only) \??\Q: ._cache_computer.exe File opened (read-only) \??\L: tmp.exe File opened (read-only) \??\W: tmp.exe File opened (read-only) \??\H: ._cache_computer.exe File opened (read-only) \??\V: ._cache_computer.exe File opened (read-only) \??\N: ._cache_computer.exe File opened (read-only) \??\Y: ._cache_computer.exe File opened (read-only) \??\W: ._cache_computer.exe File opened (read-only) \??\U: tmp.exe File opened (read-only) \??\I: ._cache_computer.exe File opened (read-only) \??\K: ._cache_computer.exe File opened (read-only) \??\P: ._cache_computer.exe File opened (read-only) \??\N: tmp.exe File opened (read-only) \??\T: tmp.exe File opened (read-only) \??\Y: tmp.exe File opened (read-only) \??\Z: tmp.exe File opened (read-only) \??\E: ._cache_computer.exe File opened (read-only) \??\O: ._cache_computer.exe File opened (read-only) \??\B: ._cache_computer.exe File opened (read-only) \??\H: ._cache_computer.exe File opened (read-only) \??\T: ._cache_computer.exe File opened (read-only) \??\P: ._cache_computer.exe File opened (read-only) \??\Q: ._cache_computer.exe File opened (read-only) \??\Z: ._cache_computer.exe File opened (read-only) \??\K: tmp.exe File opened (read-only) \??\I: ._cache_computer.exe File opened (read-only) \??\T: ._cache_computer.exe File opened (read-only) \??\F: tmp.exe File opened (read-only) \??\S: ._cache_computer.exe File opened (read-only) \??\R: ._cache_computer.exe File opened (read-only) \??\X: ._cache_computer.exe File opened (read-only) \??\V: ._cache_computer.exe File opened (read-only) \??\P: tmp.exe File opened (read-only) \??\F: ._cache_computer.exe File opened (read-only) \??\J: ._cache_computer.exe File opened (read-only) \??\L: ._cache_computer.exe File opened (read-only) \??\M: ._cache_computer.exe File opened (read-only) \??\L: ._cache_computer.exe File opened (read-only) \??\U: ._cache_computer.exe -
Drops file in System32 directory 13 IoCs
Processes:
Synaptics.exeOcwwoqo.execomputer.exe._cache_computer.exe._cache_Synaptics.exeImsossm.exeImsossm.exedescription ioc process File opened for modification C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\WinSl\L3\23\2023 Synaptics.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Ocwwoqo.exe File opened for modification C:\Windows\SysWOW64\._cache_computer.exe computer.exe File created C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe File created C:\Windows\SysWOW64\._cache_computer.exe computer.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat ._cache_computer.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\WinSl Synaptics.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat ._cache_Synaptics.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Synaptics.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Imsossm.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Imsossm.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\exploror[1].exe Ocwwoqo.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 37 IoCs
Processes:
tmp.exeOcwwoqo.exepid process 1476 tmp.exe 1476 tmp.exe 1476 tmp.exe 1476 tmp.exe 1476 tmp.exe 1476 tmp.exe 1476 tmp.exe 1476 tmp.exe 1476 tmp.exe 1476 tmp.exe 1476 tmp.exe 1476 tmp.exe 1476 tmp.exe 1476 tmp.exe 1476 tmp.exe 1476 tmp.exe 1476 tmp.exe 1476 tmp.exe 1476 tmp.exe 1476 tmp.exe 1476 tmp.exe 1476 tmp.exe 1248 Ocwwoqo.exe 1248 Ocwwoqo.exe 1476 tmp.exe 1248 Ocwwoqo.exe 1476 tmp.exe 1248 Ocwwoqo.exe 1476 tmp.exe 1248 Ocwwoqo.exe 1476 tmp.exe 1248 Ocwwoqo.exe 1476 tmp.exe 1248 Ocwwoqo.exe 1476 tmp.exe 1248 Ocwwoqo.exe 1476 tmp.exe -
Drops file in Program Files directory 4 IoCs
Processes:
._cache_Synaptics.exetmp.exedescription ioc process File created C:\Program Files (x86)\Imsossm.exe ._cache_Synaptics.exe File opened for modification C:\Program Files (x86)\Imsossm.exe ._cache_Synaptics.exe File created C:\Program Files (x86)\Ocwwoqo.exe tmp.exe File opened for modification C:\Program Files (x86)\Ocwwoqo.exe tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
._cache_computer.exetmp.exe._cache_computer.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ._cache_computer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ._cache_computer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 tmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz tmp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ._cache_computer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ._cache_computer.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
Imsossm.exeOcwwoqo.exeImsossm.exeImsossm.exe._cache_Synaptics.exeSynaptics.exe._cache_computer.execomputer.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BA9D79B8-BC5A-4660-BA3E-3AF52963A232}\72-47-d6-4e-77-25 Imsossm.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000005000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0054000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Ocwwoqo.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BA9D79B8-BC5A-4660-BA3E-3AF52963A232}\WpadDecisionReason = "1" Ocwwoqo.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Imsossm.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BA9D79B8-BC5A-4660-BA3E-3AF52963A232}\WpadDecision = "0" Imsossm.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Imsossm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Ocwwoqo.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Ocwwoqo.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BA9D79B8-BC5A-4660-BA3E-3AF52963A232} Imsossm.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BA9D79B8-BC5A-4660-BA3E-3AF52963A232}\WpadDecisionTime = a0ad74e0425dd901 Imsossm.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000007000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0054000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ._cache_Synaptics.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Synaptics.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000006000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0054000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ._cache_computer.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-47-d6-4e-77-25\WpadDecision = "0" Synaptics.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-47-d6-4e-77-25\WpadDecision = "0" Imsossm.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" ._cache_computer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ._cache_computer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BA9D79B8-BC5A-4660-BA3E-3AF52963A232}\WpadDecisionTime = c0e10de4425dd901 ._cache_Synaptics.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft ._cache_computer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BA9D79B8-BC5A-4660-BA3E-3AF52963A232}\WpadNetworkName = "Network 3" Imsossm.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-47-d6-4e-77-25\WpadDecisionTime = a0ad74e0425dd901 ._cache_computer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-47-d6-4e-77-25\WpadDetectedUrl ._cache_Synaptics.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-47-d6-4e-77-25\WpadDecisionTime = 805c0ce7425dd901 Synaptics.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-47-d6-4e-77-25\WpadDecisionTime = 003404c5425dd901 Imsossm.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Imsossm.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage computer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BA9D79B8-BC5A-4660-BA3E-3AF52963A232}\WpadDecisionTime = 200732e0425dd901 Ocwwoqo.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Synaptics.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings ._cache_Synaptics.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-47-d6-4e-77-25\WpadDecision = "0" ._cache_computer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-47-d6-4e-77-25 Imsossm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Imsossm.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{596AB062-B4D2-4215-9F74-E9109B0A8153} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 010000000000000040deb3df425dd901 computer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BA9D79B8-BC5A-4660-BA3E-3AF52963A232} Ocwwoqo.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-47-d6-4e-77-25\WpadDecisionTime = 003404c5425dd901 Imsossm.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000005000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0054000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Imsossm.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Imsossm.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ._cache_Synaptics.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BA9D79B8-BC5A-4660-BA3E-3AF52963A232}\WpadDecision = "0" Synaptics.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BA9D79B8-BC5A-4660-BA3E-3AF52963A232}\WpadDecisionTime = 003404c5425dd901 Imsossm.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-47-d6-4e-77-25\WpadDetectedUrl Ocwwoqo.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-47-d6-4e-77-25\WpadDecisionReason = "1" ._cache_computer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-47-d6-4e-77-25\WpadDetectedUrl Imsossm.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-47-d6-4e-77-25\WpadDecisionTime = c0e10de4425dd901 ._cache_Synaptics.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Imsossm.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{85BBD920-42A0-1069-A2E4-08002B30309D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 01000000000000006002bbdf425dd901 computer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ._cache_Synaptics.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-47-d6-4e-77-25\WpadDecisionTime = a0ad74e0425dd901 ._cache_Synaptics.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-47-d6-4e-77-25\WpadDetectedUrl Synaptics.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0054000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Imsossm.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Imsossm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Ocwwoqo.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BA9D79B8-BC5A-4660-BA3E-3AF52963A232}\WpadDecision = "0" Ocwwoqo.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BA9D79B8-BC5A-4660-BA3E-3AF52963A232}\72-47-d6-4e-77-25 ._cache_computer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Imsossm.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Imsossm.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Ocwwoqo.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-47-d6-4e-77-25\WpadDecisionTime = a0ad74e0425dd901 Imsossm.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-47-d6-4e-77-25\WpadDecisionTime = 00f3bce3425dd901 ._cache_computer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0054000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Imsossm.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Imsossm.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0054000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Imsossm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Ocwwoqo.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Imsossm.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
tmp.exe._cache_computer.exe._cache_computer.exepid process 1476 tmp.exe 752 ._cache_computer.exe 1476 tmp.exe 2036 ._cache_computer.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
tmp.exepid process 1476 tmp.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
tmp.execomputer.exeSynaptics.exeImsossm.exeOcwwoqo.exeImsossm.execomputer.exeSynaptics.exedescription pid process target process PID 1476 wrote to memory of 1944 1476 tmp.exe cmd.exe PID 1476 wrote to memory of 1944 1476 tmp.exe cmd.exe PID 1476 wrote to memory of 1944 1476 tmp.exe cmd.exe PID 1476 wrote to memory of 1944 1476 tmp.exe cmd.exe PID 1476 wrote to memory of 1588 1476 tmp.exe computer.exe PID 1476 wrote to memory of 1588 1476 tmp.exe computer.exe PID 1476 wrote to memory of 1588 1476 tmp.exe computer.exe PID 1476 wrote to memory of 1588 1476 tmp.exe computer.exe PID 1588 wrote to memory of 752 1588 computer.exe ._cache_computer.exe PID 1588 wrote to memory of 752 1588 computer.exe ._cache_computer.exe PID 1588 wrote to memory of 752 1588 computer.exe ._cache_computer.exe PID 1588 wrote to memory of 752 1588 computer.exe ._cache_computer.exe PID 1588 wrote to memory of 1656 1588 computer.exe Synaptics.exe PID 1588 wrote to memory of 1656 1588 computer.exe Synaptics.exe PID 1588 wrote to memory of 1656 1588 computer.exe Synaptics.exe PID 1588 wrote to memory of 1656 1588 computer.exe Synaptics.exe PID 1656 wrote to memory of 684 1656 Synaptics.exe ._cache_Synaptics.exe PID 1656 wrote to memory of 684 1656 Synaptics.exe ._cache_Synaptics.exe PID 1656 wrote to memory of 684 1656 Synaptics.exe ._cache_Synaptics.exe PID 1656 wrote to memory of 684 1656 Synaptics.exe ._cache_Synaptics.exe PID 912 wrote to memory of 896 912 Imsossm.exe Imsossm.exe PID 912 wrote to memory of 896 912 Imsossm.exe Imsossm.exe PID 912 wrote to memory of 896 912 Imsossm.exe Imsossm.exe PID 912 wrote to memory of 896 912 Imsossm.exe Imsossm.exe PID 1248 wrote to memory of 1392 1248 Ocwwoqo.exe cmd.exe PID 1248 wrote to memory of 1392 1248 Ocwwoqo.exe cmd.exe PID 1248 wrote to memory of 1392 1248 Ocwwoqo.exe cmd.exe PID 1248 wrote to memory of 1392 1248 Ocwwoqo.exe cmd.exe PID 896 wrote to memory of 1064 896 Imsossm.exe Imsossm.exe PID 896 wrote to memory of 1064 896 Imsossm.exe Imsossm.exe PID 896 wrote to memory of 1064 896 Imsossm.exe Imsossm.exe PID 896 wrote to memory of 1064 896 Imsossm.exe Imsossm.exe PID 1248 wrote to memory of 1512 1248 Ocwwoqo.exe computer.exe PID 1248 wrote to memory of 1512 1248 Ocwwoqo.exe computer.exe PID 1248 wrote to memory of 1512 1248 Ocwwoqo.exe computer.exe PID 1248 wrote to memory of 1512 1248 Ocwwoqo.exe computer.exe PID 1512 wrote to memory of 2036 1512 computer.exe ._cache_computer.exe PID 1512 wrote to memory of 2036 1512 computer.exe ._cache_computer.exe PID 1512 wrote to memory of 2036 1512 computer.exe ._cache_computer.exe PID 1512 wrote to memory of 2036 1512 computer.exe ._cache_computer.exe PID 1512 wrote to memory of 1900 1512 computer.exe Synaptics.exe PID 1512 wrote to memory of 1900 1512 computer.exe Synaptics.exe PID 1512 wrote to memory of 1900 1512 computer.exe Synaptics.exe PID 1512 wrote to memory of 1900 1512 computer.exe Synaptics.exe PID 1900 wrote to memory of 2012 1900 Synaptics.exe ._cache_Synaptics.exe PID 1900 wrote to memory of 2012 1900 Synaptics.exe ._cache_Synaptics.exe PID 1900 wrote to memory of 2012 1900 Synaptics.exe ._cache_Synaptics.exe PID 1900 wrote to memory of 2012 1900 Synaptics.exe ._cache_Synaptics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c md C:\windowss642⤵
-
C:\windowss64\computer.exe"C:\windowss64\computer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_computer.exe"C:\Users\Admin\AppData\Local\Temp\._cache_computer.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Imsossm.exe"C:\Program Files (x86)\Imsossm.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Imsossm.exe"C:\Program Files (x86)\Imsossm.exe" Win72⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Imsossm.exe"C:\Program Files (x86)\Imsossm.exe" Win73⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Ocwwoqo.exe"C:\Program Files (x86)\Ocwwoqo.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c md C:\windowss642⤵
-
C:\windowss64\computer.exe"C:\windowss64\computer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\._cache_computer.exe"C:\Windows\system32\._cache_computer.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe" InjUpdate4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Imsossm.exeFilesize
400KB
MD520beeb0a82adcce3a58372804acc46be
SHA1c579d9017d2c8298fe075ff5c05963901330e72a
SHA256d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e
SHA5127636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd
-
C:\Program Files (x86)\Imsossm.exeFilesize
400KB
MD520beeb0a82adcce3a58372804acc46be
SHA1c579d9017d2c8298fe075ff5c05963901330e72a
SHA256d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e
SHA5127636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd
-
C:\Program Files (x86)\Imsossm.exeFilesize
400KB
MD520beeb0a82adcce3a58372804acc46be
SHA1c579d9017d2c8298fe075ff5c05963901330e72a
SHA256d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e
SHA5127636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd
-
C:\Program Files (x86)\Imsossm.exeFilesize
400KB
MD520beeb0a82adcce3a58372804acc46be
SHA1c579d9017d2c8298fe075ff5c05963901330e72a
SHA256d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e
SHA5127636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd
-
C:\Program Files (x86)\Ocwwoqo.exeFilesize
854KB
MD5348dd4605cb1ab5e26dfe53bfcbd3a78
SHA15aa6c5019141b4b56fa12135a9c3e7889699b920
SHA25663ad5b77e55d1cda15c8cd6aaf18a40ea64d409620bed1a763ee1d23e086bac1
SHA51245929e6348185b8c8e216fae1a7eb733bfd1d48a69645f675da50a5b7f26c61b7daeaa50238d5569855824593d255061be115e0295c703a16e4330fa733b1a6a
-
C:\Program Files (x86)\Ocwwoqo.exeFilesize
854KB
MD5348dd4605cb1ab5e26dfe53bfcbd3a78
SHA15aa6c5019141b4b56fa12135a9c3e7889699b920
SHA25663ad5b77e55d1cda15c8cd6aaf18a40ea64d409620bed1a763ee1d23e086bac1
SHA51245929e6348185b8c8e216fae1a7eb733bfd1d48a69645f675da50a5b7f26c61b7daeaa50238d5569855824593d255061be115e0295c703a16e4330fa733b1a6a
-
C:\ProgramData\Synaptics\Synaptics.exeFilesize
1.1MB
MD5be689578752179e22bf915dbcf4f7520
SHA1e798e703bfb90707a2872b51da73f32af566aedb
SHA256de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e
SHA51289c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8
-
C:\ProgramData\Synaptics\Synaptics.exeFilesize
1.1MB
MD5be689578752179e22bf915dbcf4f7520
SHA1e798e703bfb90707a2872b51da73f32af566aedb
SHA256de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e
SHA51289c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8
-
C:\ProgramData\Synaptics\Synaptics.exeFilesize
1.1MB
MD5be689578752179e22bf915dbcf4f7520
SHA1e798e703bfb90707a2872b51da73f32af566aedb
SHA256de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e
SHA51289c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exeFilesize
400KB
MD520beeb0a82adcce3a58372804acc46be
SHA1c579d9017d2c8298fe075ff5c05963901330e72a
SHA256d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e
SHA5127636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exeFilesize
400KB
MD520beeb0a82adcce3a58372804acc46be
SHA1c579d9017d2c8298fe075ff5c05963901330e72a
SHA256d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e
SHA5127636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd
-
C:\Users\Admin\AppData\Local\Temp\._cache_computer.exeFilesize
400KB
MD520beeb0a82adcce3a58372804acc46be
SHA1c579d9017d2c8298fe075ff5c05963901330e72a
SHA256d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e
SHA5127636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd
-
C:\Users\Admin\AppData\Local\Temp\._cache_computer.exeFilesize
400KB
MD520beeb0a82adcce3a58372804acc46be
SHA1c579d9017d2c8298fe075ff5c05963901330e72a
SHA256d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e
SHA5127636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd
-
C:\Windows\SysWOW64\._cache_Synaptics.exeFilesize
400KB
MD520beeb0a82adcce3a58372804acc46be
SHA1c579d9017d2c8298fe075ff5c05963901330e72a
SHA256d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e
SHA5127636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd
-
C:\Windows\SysWOW64\._cache_computer.exeFilesize
400KB
MD520beeb0a82adcce3a58372804acc46be
SHA1c579d9017d2c8298fe075ff5c05963901330e72a
SHA256d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e
SHA5127636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd
-
C:\windowss64\computer.exeFilesize
1.1MB
MD5be689578752179e22bf915dbcf4f7520
SHA1e798e703bfb90707a2872b51da73f32af566aedb
SHA256de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e
SHA51289c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8
-
C:\windowss64\computer.exeFilesize
1.1MB
MD5be689578752179e22bf915dbcf4f7520
SHA1e798e703bfb90707a2872b51da73f32af566aedb
SHA256de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e
SHA51289c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8
-
C:\windowss64\computer.exeFilesize
1.1MB
MD5be689578752179e22bf915dbcf4f7520
SHA1e798e703bfb90707a2872b51da73f32af566aedb
SHA256de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e
SHA51289c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8
-
C:\windowss64\computer.exeFilesize
1.1MB
MD5be689578752179e22bf915dbcf4f7520
SHA1e798e703bfb90707a2872b51da73f32af566aedb
SHA256de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e
SHA51289c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8
-
C:\windowss64\computer.exeFilesize
1.1MB
MD5be689578752179e22bf915dbcf4f7520
SHA1e798e703bfb90707a2872b51da73f32af566aedb
SHA256de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e
SHA51289c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\ProgramData\Synaptics\Synaptics.exeFilesize
1.1MB
MD5be689578752179e22bf915dbcf4f7520
SHA1e798e703bfb90707a2872b51da73f32af566aedb
SHA256de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e
SHA51289c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8
-
\ProgramData\Synaptics\Synaptics.exeFilesize
1.1MB
MD5be689578752179e22bf915dbcf4f7520
SHA1e798e703bfb90707a2872b51da73f32af566aedb
SHA256de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e
SHA51289c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8
-
\ProgramData\Synaptics\Synaptics.exeFilesize
1.1MB
MD5be689578752179e22bf915dbcf4f7520
SHA1e798e703bfb90707a2872b51da73f32af566aedb
SHA256de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e
SHA51289c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8
-
\ProgramData\Synaptics\Synaptics.exeFilesize
1.1MB
MD5be689578752179e22bf915dbcf4f7520
SHA1e798e703bfb90707a2872b51da73f32af566aedb
SHA256de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e
SHA51289c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8
-
\ProgramData\Synaptics\Synaptics.exeFilesize
1.1MB
MD5be689578752179e22bf915dbcf4f7520
SHA1e798e703bfb90707a2872b51da73f32af566aedb
SHA256de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e
SHA51289c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8
-
\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exeFilesize
400KB
MD520beeb0a82adcce3a58372804acc46be
SHA1c579d9017d2c8298fe075ff5c05963901330e72a
SHA256d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e
SHA5127636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd
-
\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exeFilesize
400KB
MD520beeb0a82adcce3a58372804acc46be
SHA1c579d9017d2c8298fe075ff5c05963901330e72a
SHA256d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e
SHA5127636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd
-
\Users\Admin\AppData\Local\Temp\._cache_computer.exeFilesize
400KB
MD520beeb0a82adcce3a58372804acc46be
SHA1c579d9017d2c8298fe075ff5c05963901330e72a
SHA256d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e
SHA5127636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd
-
\Users\Admin\AppData\Local\Temp\._cache_computer.exeFilesize
400KB
MD520beeb0a82adcce3a58372804acc46be
SHA1c579d9017d2c8298fe075ff5c05963901330e72a
SHA256d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e
SHA5127636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd
-
\Windows\SysWOW64\._cache_Synaptics.exeFilesize
400KB
MD520beeb0a82adcce3a58372804acc46be
SHA1c579d9017d2c8298fe075ff5c05963901330e72a
SHA256d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e
SHA5127636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd
-
\Windows\SysWOW64\._cache_Synaptics.exeFilesize
400KB
MD520beeb0a82adcce3a58372804acc46be
SHA1c579d9017d2c8298fe075ff5c05963901330e72a
SHA256d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e
SHA5127636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd
-
\Windows\SysWOW64\._cache_computer.exeFilesize
400KB
MD520beeb0a82adcce3a58372804acc46be
SHA1c579d9017d2c8298fe075ff5c05963901330e72a
SHA256d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e
SHA5127636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd
-
\Windows\SysWOW64\._cache_computer.exeFilesize
400KB
MD520beeb0a82adcce3a58372804acc46be
SHA1c579d9017d2c8298fe075ff5c05963901330e72a
SHA256d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e
SHA5127636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd
-
\windowss64\computer.exeFilesize
1.1MB
MD5be689578752179e22bf915dbcf4f7520
SHA1e798e703bfb90707a2872b51da73f32af566aedb
SHA256de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e
SHA51289c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8
-
\windowss64\computer.exeFilesize
1.1MB
MD5be689578752179e22bf915dbcf4f7520
SHA1e798e703bfb90707a2872b51da73f32af566aedb
SHA256de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e
SHA51289c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8
-
\windowss64\computer.exeFilesize
1.1MB
MD5be689578752179e22bf915dbcf4f7520
SHA1e798e703bfb90707a2872b51da73f32af566aedb
SHA256de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e
SHA51289c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8
-
\windowss64\computer.exeFilesize
1.1MB
MD5be689578752179e22bf915dbcf4f7520
SHA1e798e703bfb90707a2872b51da73f32af566aedb
SHA256de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e
SHA51289c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8
-
\windowss64\computer.exeFilesize
1.1MB
MD5be689578752179e22bf915dbcf4f7520
SHA1e798e703bfb90707a2872b51da73f32af566aedb
SHA256de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e
SHA51289c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8
-
\windowss64\computer.exeFilesize
1.1MB
MD5be689578752179e22bf915dbcf4f7520
SHA1e798e703bfb90707a2872b51da73f32af566aedb
SHA256de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e
SHA51289c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8
-
memory/1248-4901-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/1248-9668-0x0000000001EF0000-0x0000000001FF0000-memory.dmpFilesize
1024KB
-
memory/1248-9666-0x00000000022E0000-0x00000000023F1000-memory.dmpFilesize
1.1MB
-
memory/1248-6385-0x0000000002030000-0x00000000021B1000-memory.dmpFilesize
1.5MB
-
memory/1248-6383-0x0000000001EF0000-0x0000000001FF0000-memory.dmpFilesize
1024KB
-
memory/1476-489-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-493-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-506-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-507-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-508-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-509-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-510-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-511-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-512-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-513-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-514-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-515-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-517-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-516-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-518-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-519-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-520-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-521-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-522-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-523-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-1336-0x0000000000720000-0x0000000000820000-memory.dmpFilesize
1024KB
-
memory/1476-1337-0x0000000002090000-0x0000000002211000-memory.dmpFilesize
1.5MB
-
memory/1476-4806-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-4810-0x0000000000720000-0x0000000000820000-memory.dmpFilesize
1024KB
-
memory/1476-504-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-503-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-502-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-501-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-9722-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/1476-500-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-499-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-498-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-497-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-496-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-495-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-494-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-492-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-505-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-320-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/1476-491-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-490-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-54-0x00000000754B0000-0x00000000754F7000-memory.dmpFilesize
284KB
-
memory/1476-488-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-487-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-486-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-485-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-462-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-484-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-483-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-482-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-481-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-480-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-479-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-478-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-477-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-476-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-475-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-474-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-473-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-472-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-471-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-470-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-469-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-468-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-467-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-461-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-466-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-465-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-463-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1476-464-0x0000000002220000-0x0000000002331000-memory.dmpFilesize
1.1MB
-
memory/1512-9696-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1588-4827-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1656-4890-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1656-4860-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1900-9721-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB