f9049aac4336ee2ae89a25efa6ebaa88a759bfe1fb36a30952832c67b0e9ce4a

Analysis

max time kernel
188s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
03-08-2023 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UPSZebraDriver.exe
Size

10.8MB
MD5

c1fea9d4cee53f4d7b094aef4ebbf8dd
SHA1

c4198da1d17e013b99784df31fbf7d1d7e97b865
SHA256

f9049aac4336ee2ae89a25efa6ebaa88a759bfe1fb36a30952832c67b0e9ce4a
SHA512

c7c3269657cef028bdde083607368b7d4805b657bf556a111b4eb94f4175786dc6ac28d6d5fd030d8b3e2ec2d212bcc5df4fc0d2b81e9ba42c26873dcaf2705c
SSDEEP

196608:xqe9rCgbjDh3d8ot+Jov/UCTfiMrwCjh0IM3uy5pPkwVWPdPipNPDpsIPsikF2o:xqYrRhtj+LuiFCN0/J/M82dajyxikr

Score

8^/10

persistence

Malware Config

Signatures

Registers new Print Monitor 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\USB Monitor	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\IPP	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint\OfflinePorts	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Microsoft Shared Fax Monitor	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\IPP	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint\OfflinePorts	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\ZDesigner Language Monitor	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Microsoft Shared Fax Monitor	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\USB Monitor	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Ports	spoolsv.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\ZDesigner Language Monitor\Driver = "zdnNLM64.dll"	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Local Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Local Port	spoolsv.exe

Executes dropped EXE 10 IoCs

pid	Process
908	Setup.exe
1616	PrnInst.exe
1000	Prn64.bin
4892	Setup.exe
4128	PrnInst.exe
3208	Prn64.bin
1104	Prn64.bin
1604	ZebraFD.exe
1176	is-2Q9GA.tmp
1592	ZDDownloader2.exe

Loads dropped DLL 24 IoCs

pid	Process
3312	spoolsv.exe
3312	spoolsv.exe
3312	spoolsv.exe
3312	spoolsv.exe
3312	spoolsv.exe
3312	spoolsv.exe
3312	spoolsv.exe
3312	spoolsv.exe
3312	spoolsv.exe
3312	spoolsv.exe
3312	spoolsv.exe
3312	spoolsv.exe
3312	spoolsv.exe
3312	spoolsv.exe
3312	spoolsv.exe
3312	spoolsv.exe
1176	is-2Q9GA.tmp
1176	is-2Q9GA.tmp
1176	is-2Q9GA.tmp
1176	is-2Q9GA.tmp
1176	is-2Q9GA.tmp
1176	is-2Q9GA.tmp
1176	is-2Q9GA.tmp
1176	is-2Q9GA.tmp

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\ZDNSCH56.DLL	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\zbrn.inf_amd64_a046310532795a57\Common\AndaleK.MMF	DrvInst.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\{B1DA51ED-4603-47E2-88B2-0139CA72B157}\Common\MKai.MMF	PrnInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\{B1DA51ED-4603-47E2-88B2-0139CA72B157}\MKai.MMF	PrnInst.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\{B1DA51ED-4603-47E2-88B2-0139CA72B157}\Common\ToolsCPCLx64.dll	PrnInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET552A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\zbrn.inf_amd64_a046310532795a57\Win64\zdnPMU.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\zbrn.inf_amd64_a046310532795a57\Win64\ZDNKOR56.DLL	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\zbrn.inf_amd64_a046310532795a57\Common\ToolsZPLx64.dll	DrvInst.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\{B1DA51ED-4603-47E2-88B2-0139CA72B157}\Common\ZplErr.sme	PrnInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET552A.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\{B1DA51ED-4603-47E2-88B2-0139CA72B157}\ZDNSWE56.DLL	PrnInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\{B1DA51ED-4603-47E2-88B2-0139CA72B157}\ToolsKIOSKx64.dll	PrnInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\zdnPMU.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\ZDNdrv56.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET52D0.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET5332.tmp	DrvInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\ZDNRUS56.DLL	spoolsv.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET5249.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET5470.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET54F8.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\{B1DA51ED-4603-47E2-88B2-0139CA72B157}\ZDNFIN56.DLL	PrnInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\{B1DA51ED-4603-47E2-88B2-0139CA72B157}\ZDesign.CHM	PrnInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\ZDNSLO56.DLL	spoolsv.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\BZM4Z2.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET53A8.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET557E.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\{B1DA51ED-4603-47E2-88B2-0139CA72B157}\ZDNKOR56.DLL	PrnInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET54D7.tmp	DrvInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\{B1DA51ED-4603-47E2-88B2-0139CA72B157}\ZDNSLO56.DLL	PrnInst.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\{B1DA51ED-4603-47E2-88B2-0139CA72B157}\Common\ZebraBarcode.ttf	PrnInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET5495.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\zbrn.inf_amd64_a046310532795a57\Win64\ZDNRUS56.DLL	DrvInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\{B1DA51ED-4603-47E2-88B2-0139CA72B157}\ZDNFRA56.DLL	PrnInst.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\{B1DA51ED-4603-47E2-88B2-0139CA72B157}\Angsana.MMF	PrnInst.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\2\zdnNLM64.dll	PrnInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\ToolsZPL.dll	spoolsv.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET554F.tmp	DrvInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\ZDNSWE56.DLL	spoolsv.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\ZDNLIT56.DLL	DrvInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\{B1DA51ED-4603-47E2-88B2-0139CA72B157}\ZDNSPA56.DLL	PrnInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\ToolsKIOSKx64.dll	spoolsv.exe
File created	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET5227.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET5237.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET552B.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET5354.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET5366.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET541B.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET545F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET5225.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET528D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\zbrn.inf_amd64_a046310532795a57\ZBRN.cat	DrvInst.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\{B1DA51ED-4603-47E2-88B2-0139CA72B157}\Common\Korean.MMF	PrnInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\ToolsCPCL.dll	spoolsv.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\{B1DA51ED-4603-47E2-88B2-0139CA72B157}\Common\ZplKskErr.sme	PrnInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\{B1DA51ED-4603-47E2-88B2-0139CA72B157}\ZDNLIT56.DLL	PrnInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\{B1DA51ED-4603-47E2-88B2-0139CA72B157}\ToolsZPL.dll	PrnInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\ZDNRUS56.DLL	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET54D7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\zbrn.inf_amd64_a046310532795a57\Common\AndaleT.MMF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}	DrvInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\{B1DA51ED-4603-47E2-88B2-0139CA72B157}\ZDNDUT56.DLL	PrnInst.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\{B1DA51ED-4603-47E2-88B2-0139CA72B157}\ZDNRUS56.DLL	PrnInst.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Zebra Technologies\Zebra Font Downloader\unins000.dat	is-2Q9GA.tmp
File created	C:\Program Files (x86)\Zebra Technologies\Zebra Font Downloader\is-SOK9T.tmp	is-2Q9GA.tmp
File created	C:\Program Files (x86)\Zebra Technologies\Zebra Font Downloader\Font Download\is-8HE07.tmp	is-2Q9GA.tmp
File created	C:\Program Files (x86)\Zebra Technologies\Zebra Font Downloader\Font Download\is-UMMVF.tmp	is-2Q9GA.tmp
File created	C:\Program Files (x86)\Zebra Technologies\Zebra Font Downloader\Font Download\is-16NRP.tmp	is-2Q9GA.tmp
File created	C:\Program Files (x86)\Zebra Technologies\Zebra Font Downloader\Font Download\Plugins\is-5OM3N.tmp	is-2Q9GA.tmp
File created	C:\Program Files (x86)\Zebra Technologies\Zebra Font Downloader\Font Download\is-G5T23.tmp	is-2Q9GA.tmp
File created	C:\Program Files (x86)\Zebra Technologies\Zebra Font Downloader\Font Download\is-G8HM2.tmp	is-2Q9GA.tmp
File created	C:\Program Files (x86)\Zebra Technologies\Zebra Font Downloader\unins000.dat	is-2Q9GA.tmp
File created	C:\Program Files (x86)\Zebra Technologies\Zebra Font Downloader\is-6L9HT.tmp	is-2Q9GA.tmp
File created	C:\Program Files (x86)\Zebra Technologies\Zebra Font Downloader\Font Download\Plugins\is-N2GC5.tmp	is-2Q9GA.tmp
File created	C:\Program Files (x86)\Zebra Technologies\Zebra Font Downloader\Font Download\Plugins\is-A44AN.tmp	is-2Q9GA.tmp

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	PrnInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	Prn64.bin
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne02:"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft Print to PDF = "winspool,Ne01:,15,45"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne02:,15,45"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne02:"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft Print to PDF = "winspool,Ne01:,15,45"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft Print to PDF = "winspool,Ne01:"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne02:"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne00:"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft Print to PDF = "winspool,Ne01:"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Printers\ConvertUserDevModesCount\Eltron LP2348 = "1"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft Print to PDF = "winspool,Ne01:"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft Print to PDF = "winspool,Ne01:,15,45"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Eltron LP2348 = "winspool,LPT1:"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft Print to PDF = "winspool,Ne01:,15,45"	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne00:"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne02:,15,45"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne02:"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne00:"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0437A30B-E132-4F10-BA5F-8C5D19D8AE30}\Version	ZDDownloader2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DAD9DAE8-DEBF-4D19-94A3-E1999A30FF35}\InprocServer32\ThreadingModel = "Apartment"	is-2Q9GA.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Epl4dl.Intermec Memory Card\Clsid\ = "{DAD9DAE8-DEBF-4D19-94A3-E1999A30FF35}"	is-2Q9GA.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DAD9DAE8-DEBF-4D19-94A3-E1999A30FF35}\ProgID\ = "Epl4dl.Intermec Memory Card"	is-2Q9GA.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{192896F0-26ED-4F26-8CBF-8EAE529BAEC9}\	is-2Q9GA.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Zebra4dl.Zebra Memory Card\Clsid	is-2Q9GA.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZDDownloader2.App\ = "Application Object"	ZDDownloader2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZDDownloader2.App\Clsid	ZDDownloader2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DAD9DAE8-DEBF-4D19-94A3-E1999A30FF35}\InprocServer32	is-2Q9GA.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{1D93F0A3-DD14-4C59-9344-6D885BF0CA69}\800 = "MemMaster plug-ins"	is-2Q9GA.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{192896F0-26ED-4F26-8CBF-8EAE529BAEC9}\Implemented Categories	is-2Q9GA.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cpcldl.CPCL Memory Card	is-2Q9GA.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cpcldl.CPCL Memory Card\Clsid\ = "{6569DE09-90E0-4799-922B-73E2C871172F}"	is-2Q9GA.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05DBC581-D1BC-4CF9-ABC4-D39DA78C73E9}	ZDDownloader2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DAD9DAE8-DEBF-4D19-94A3-E1999A30FF35}\Implemented Categories\{1D93F0A3-DD14-4C59-9344-6D885BF0CA69}	is-2Q9GA.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{192896F0-26ED-4F26-8CBF-8EAE529BAEC9}\InprocServer32\ = "C:\\PROGRA~2\\ZEBRAT~1\\ZEBRAF~1\\FONTDO~1\\Plugins\\Zebra4dl.mmp"	is-2Q9GA.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Zebra4dl.Zebra Memory Card\	is-2Q9GA.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6569DE09-90E0-4799-922B-73E2C871172F}	is-2Q9GA.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6DEE2E0C-9D95-477A-A748-56A3CF15F046}\1.0\0\win32\ = "C:\\Program Files (x86)\\Zebra Technologies\\Zebra Font Downloader\\Font Download\\ZDDownloader2.exe"	ZDDownloader2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0437A30B-E132-4F10-BA5F-8C5D19D8AE30}\ = "Application Object"	ZDDownloader2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0437A30B-E132-4F10-BA5F-8C5D19D8AE30}\TypeLib	ZDDownloader2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{192896F0-26ED-4F26-8CBF-8EAE529BAEC9}\ProgID\ = "Zebra4dl.Zebra Memory Card"	is-2Q9GA.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05DBC581-D1BC-4CF9-ABC4-D39DA78C73E9}\ = "IApplication"	ZDDownloader2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05DBC581-D1BC-4CF9-ABC4-D39DA78C73E9}\TypeLib\Version = "1.0"	ZDDownloader2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZDDownloader2.App	ZDDownloader2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0437A30B-E132-4F10-BA5F-8C5D19D8AE30}\TypeLib\ = "{6DEE2E0C-9D95-477A-A748-56A3CF15F046}"	ZDDownloader2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6569DE09-90E0-4799-922B-73E2C871172F}\InprocServer32\ThreadingModel = "Apartment"	is-2Q9GA.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6569DE09-90E0-4799-922B-73E2C871172F}\ProgID\ = "cpcldl.CPCL Memory Card"	is-2Q9GA.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6569DE09-90E0-4799-922B-73E2C871172F}\Implemented Categories\{1D93F0A3-DD14-4C59-9344-6D885BF0CA69}	is-2Q9GA.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6DEE2E0C-9D95-477A-A748-56A3CF15F046}\1.0\HELPDIR	ZDDownloader2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0437A30B-E132-4F10-BA5F-8C5D19D8AE30}\ProgID\ = "ZDDownloader2.App"	ZDDownloader2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6DEE2E0C-9D95-477A-A748-56A3CF15F046}\1.0\FLAGS	ZDDownloader2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	UPSZebraDriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{192896F0-26ED-4F26-8CBF-8EAE529BAEC9}\InprocServer32\ThreadingModel = "Apartment"	is-2Q9GA.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{192896F0-26ED-4F26-8CBF-8EAE529BAEC9}\Implemented Categories\{1D93F0A3-DD14-4C59-9344-6D885BF0CA69}	is-2Q9GA.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6DEE2E0C-9D95-477A-A748-56A3CF15F046}\1.0	ZDDownloader2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6DEE2E0C-9D95-477A-A748-56A3CF15F046}\1.0\FLAGS\ = "0"	ZDDownloader2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6DEE2E0C-9D95-477A-A748-56A3CF15F046}\1.0\0	ZDDownloader2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05DBC581-D1BC-4CF9-ABC4-D39DA78C73E9}\TypeLib\ = "{6DEE2E0C-9D95-477A-A748-56A3CF15F046}"	ZDDownloader2.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	UPSZebraDriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6569DE09-90E0-4799-922B-73E2C871172F}\	is-2Q9GA.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6569DE09-90E0-4799-922B-73E2C871172F}\InprocServer32\ = "C:\\PROGRA~2\\ZEBRAT~1\\ZEBRAF~1\\FONTDO~1\\Plugins\\cpcldl.mmp"	is-2Q9GA.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6DEE2E0C-9D95-477A-A748-56A3CF15F046}\1.0\ = "ZebraDesigner Font Downloader automation server"	ZDDownloader2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZDDownloader2.App\Clsid\ = "{0437A30B-E132-4F10-BA5F-8C5D19D8AE30}"	ZDDownloader2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05DBC581-D1BC-4CF9-ABC4-D39DA78C73E9}\TypeLib	ZDDownloader2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DAD9DAE8-DEBF-4D19-94A3-E1999A30FF35}	is-2Q9GA.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories	is-2Q9GA.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DAD9DAE8-DEBF-4D19-94A3-E1999A30FF35}\Implemented Categories	is-2Q9GA.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cpcldl.CPCL Memory Card\	is-2Q9GA.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6DEE2E0C-9D95-477A-A748-56A3CF15F046}\1.0\0\win32	ZDDownloader2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05DBC581-D1BC-4CF9-ABC4-D39DA78C73E9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	ZDDownloader2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05DBC581-D1BC-4CF9-ABC4-D39DA78C73E9}\TypeLib	ZDDownloader2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DAD9DAE8-DEBF-4D19-94A3-E1999A30FF35}\ProgID	is-2Q9GA.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cpcldl.CPCL Memory Card\Clsid	is-2Q9GA.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05DBC581-D1BC-4CF9-ABC4-D39DA78C73E9}\ProxyStubClsid32	ZDDownloader2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0437A30B-E132-4F10-BA5F-8C5D19D8AE30}	ZDDownloader2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Zebra4dl.Zebra Memory Card	is-2Q9GA.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0437A30B-E132-4F10-BA5F-8C5D19D8AE30}\ProgID	ZDDownloader2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Epl4dl.Intermec Memory Card	is-2Q9GA.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{192896F0-26ED-4F26-8CBF-8EAE529BAEC9}	is-2Q9GA.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Zebra4dl.Zebra Memory Card\Clsid\ = "{192896F0-26ED-4F26-8CBF-8EAE529BAEC9}"	is-2Q9GA.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6DEE2E0C-9D95-477A-A748-56A3CF15F046}	ZDDownloader2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6DEE2E0C-9D95-477A-A748-56A3CF15F046}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Zebra Technologies\\Zebra Font Downloader\\Font Download\\"	ZDDownloader2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05DBC581-D1BC-4CF9-ABC4-D39DA78C73E9}\ProxyStubClsid32	ZDDownloader2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3208	Prn64.bin
3208	Prn64.bin
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
1104	Prn64.bin
1104	Prn64.bin
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe
4128	PrnInst.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeAuditPrivilege	1160	svchost.exe
Token: SeSecurityPrivilege	1160	svchost.exe
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin
Token: SeDebugPrivilege	3208	Prn64.bin

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1616	PrnInst.exe
4128	PrnInst.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1616	PrnInst.exe
4128	PrnInst.exe
1176	is-2Q9GA.tmp
1176	is-2Q9GA.tmp
1592	ZDDownloader2.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 1616	908	Setup.exe	106
PID 908 wrote to memory of 1616	908	Setup.exe	106
PID 908 wrote to memory of 1616	908	Setup.exe	106
PID 1616 wrote to memory of 1000	1616	PrnInst.exe	107
PID 1616 wrote to memory of 1000	1616	PrnInst.exe	107
PID 1160 wrote to memory of 1084	1160	svchost.exe	109
PID 1160 wrote to memory of 1084	1160	svchost.exe	109
PID 4892 wrote to memory of 4128	4892	Setup.exe	111
PID 4892 wrote to memory of 4128	4892	Setup.exe	111
PID 4892 wrote to memory of 4128	4892	Setup.exe	111
PID 4128 wrote to memory of 3208	4128	PrnInst.exe	112
PID 4128 wrote to memory of 3208	4128	PrnInst.exe	112
PID 4128 wrote to memory of 1104	4128	PrnInst.exe	113
PID 4128 wrote to memory of 1104	4128	PrnInst.exe	113
PID 4128 wrote to memory of 1604	4128	PrnInst.exe	118
PID 4128 wrote to memory of 1604	4128	PrnInst.exe	118
PID 4128 wrote to memory of 1604	4128	PrnInst.exe	118
PID 1604 wrote to memory of 1176	1604	ZebraFD.exe	119
PID 1604 wrote to memory of 1176	1604	ZebraFD.exe	119
PID 1604 wrote to memory of 1176	1604	ZebraFD.exe	119
PID 1176 wrote to memory of 1592	1176	is-2Q9GA.tmp	121
PID 1176 wrote to memory of 1592	1176	is-2Q9GA.tmp	121
PID 1176 wrote to memory of 1592	1176	is-2Q9GA.tmp	121

C:\Users\Admin\AppData\Local\Temp\UPSZebraDriver.exe
"C:\Users\Admin\AppData\Local\Temp\UPSZebraDriver.exe"
1⤵
- Modifies registry class
PID:3164

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3360

C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\Setup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908
- C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\PrnInst.exe
  "C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\PrnInst.exe" /PREINSTALL="C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\ZBRN\ZBRN.inf"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\ZBRN\Win64\Prn64.bin
    C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\ZBRN\Win64\Prn64.bin "PreinstallDriverPackage=C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\ZBRN\ZBRN.inf"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{a85654e3-3a0a-5747-80ea-1b2226877eca}\ZBRN.inf" "9" "4b2ab3d07" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\ZBRN"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:1084

C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\Setup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\PrnInst.exe
  "C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\PrnInst.exe" /NOWEL
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\ZBRN\Win64\Prn64.bin
    C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\ZBRN\Win64\Prn64.bin "GetDllOwnerList=C:\Windows\system32\zdnPMS.dll|C:\Users\Admin\AppData\Local\Temp\tmpD3A3.tmp"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3208
- - C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\ZBRN\Win64\Prn64.bin
    C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\ZBRN\Win64\Prn64.bin "GetDllOwnerList=C:\Windows\system32\zdnPMS.dll|C:\Users\Admin\AppData\Local\Temp\tmpD653.tmp"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1104
- - C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\ZBRN\ZebraFD.exe
    C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\ZBRN\ZebraFD.exe /LANG=en
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\is-3I2GU.tmp\is-2Q9GA.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-3I2GU.tmp\is-2Q9GA.tmp" /SL4 $13003E "C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\ZBRN\ZebraFD.exe" 2869566 55808 /LANG=en
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1176
    - - C:\Program Files (x86)\Zebra Technologies\Zebra Font Downloader\Font Download\ZDDownloader2.exe
        
        "C:\Program Files (x86)\Zebra Technologies\Zebra Font Downloader\Font Download\ZDDownloader2.exe" /regserver
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:1592

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
- Registers new Print Monitor
- Modifies data under HKEY_USERS
PID:900

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
- Registers new Print Monitor
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Zebra Technologies\Zebra Font Downloader\Font Download\Plugins\Epl4dl.mmp

Filesize
2.3MB

MD5
8baf0a10589daf11d9fdb88aaed8179d

SHA1
8d46ed5ef037cfbbceedf348f9232cbb09c206e9

SHA256
de913546ca684505ba9f7fcc85cb6565e176b5a8a32e02b067e2b5079d87a502

SHA512
8e58d5b1a0da7f248f47681a0140745a2218ce6c24a6005b36fc4cb2dbed8da0dd699375dc577a3c1b520e03a5c512f8b142677f21180df351103f04864272d7

Download Submit
C:\Program Files (x86)\Zebra Technologies\Zebra Font Downloader\Font Download\Plugins\Zebra4dl.mmp

Filesize
2.7MB

MD5
0766c9f9a4e78641d79d7fc07e9e742c

SHA1
111f9cc8faa167fe1eafb2e4242a36df2225269d

SHA256
79e86871c06129da5f398081d4fd344288a9a44c64caf7ecef4eb50e30528651

SHA512
ca09e7a54ce241d6cac2f69fad7bb8d2dd9bc61048de9b47fce38a17919bb42f07f172c951b4bdbe2a47ab9b7864e5753df54311468f01c87f6a7e78ab1f91ed

Download Submit
C:\Program Files (x86)\Zebra Technologies\Zebra Font Downloader\Font Download\Plugins\cpcldl.mmp

Filesize
2.8MB

MD5
b206c2c63b470c7508908327647f9b38

SHA1
3a8a1850b2479b852ae1726f4b3d605f8b640bf6

SHA256
582e58b92a0528bb795a212328be54d80b8a2dd6be8a7296819eb0dbf508d847

SHA512
32f5a1ea528f1c83475ea54e04409a0aaa58b6b03eabab779777a35c0033e389b49d63b6d762d1b616595e5b0c07660d6d3267a53255f4a0e2f92d394606df1b

Download Submit
C:\Program Files (x86)\Zebra Technologies\Zebra Font Downloader\Font Download\ZDDownloader2.exe

Filesize
3.3MB

MD5
3130687c73193cf39b13b0497c3765c6

SHA1
d3c9e6a88893286dcfa8b28877cfc29fd3565061

SHA256
b0407480f02fd87ccc8403cec8820c71bfdbf245599d933e0a3a2eade4e915d6

SHA512
fe78de2def02774c0532f5fa7510396e866b03ddcadf57c837801f3e566118bf14eeb5382d4e9c26af53017b54395b491268b9d88d158d04cc9a2d150cf3fcad

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\PrnInst.exe

Filesize
1.7MB

MD5
114b44ea18b1788790f28de1f9aa08d6

SHA1
28c58b53ccfc68fc9ce3cf5a0db7ac1cbc2069b4

SHA256
0fdb891146991d8fee25d9a950a52d5f0412cb8fd43efd2ee4af39334bb8f43d

SHA512
5e3a5b594761e0d2cea6f42599c67d6672b42836b6e2d2e14dc9196c422d4f96a7e05bd12b8f2eb64762a5cd1cee02f643d864929b285535457239a869bc5b32

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\PrnInst.exe

Filesize
1.7MB

MD5
114b44ea18b1788790f28de1f9aa08d6

SHA1
28c58b53ccfc68fc9ce3cf5a0db7ac1cbc2069b4

SHA256
0fdb891146991d8fee25d9a950a52d5f0412cb8fd43efd2ee4af39334bb8f43d

SHA512
5e3a5b594761e0d2cea6f42599c67d6672b42836b6e2d2e14dc9196c422d4f96a7e05bd12b8f2eb64762a5cd1cee02f643d864929b285535457239a869bc5b32

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\Setup.exe

Filesize
2.7MB

MD5
0cf4517caf54650da69dd92c1069a058

SHA1
e178a72dba413c9b701ff6d65bdbf3f20e6d3c9a

SHA256
1a62e8f499357c6df188452f30c082fb984053b68874f37a0f6c523d7185ffaf

SHA512
78fa4a1165b63c92ce31339319293ec7b2b7ec26985db7c97549ff1552c1603a7e69c7edba7aa98d435409325e2f465030c147021e094e4bddbc46638bbf13e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\Setup.exe

Filesize
2.7MB

MD5
0cf4517caf54650da69dd92c1069a058

SHA1
e178a72dba413c9b701ff6d65bdbf3f20e6d3c9a

SHA256
1a62e8f499357c6df188452f30c082fb984053b68874f37a0f6c523d7185ffaf

SHA512
78fa4a1165b63c92ce31339319293ec7b2b7ec26985db7c97549ff1552c1603a7e69c7edba7aa98d435409325e2f465030c147021e094e4bddbc46638bbf13e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\ZBRN\Win64\Prn64.bin

Filesize
80KB

MD5
09a428edb9524a087cef49a3eb870da5

SHA1
4ed56e9012c8d283cf5d8175d4a0a70cd304b352

SHA256
55ce92ad93c8c0517543881756c3fdf1e73504f7f9ff6a454e70839ab18d4b53

SHA512
cee39a68554bb58dc026ff2c325c2e8957012bae07cb4256d5560ad4000ea68362652a357ba2f4b965c553ea9723a10aa01bf1e109c906cf05fbd0bc0c4bdc11

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\ZBRN\Win64\Prn64.bin

Filesize
80KB

MD5
09a428edb9524a087cef49a3eb870da5

SHA1
4ed56e9012c8d283cf5d8175d4a0a70cd304b352

SHA256
55ce92ad93c8c0517543881756c3fdf1e73504f7f9ff6a454e70839ab18d4b53

SHA512
cee39a68554bb58dc026ff2c325c2e8957012bae07cb4256d5560ad4000ea68362652a357ba2f4b965c553ea9723a10aa01bf1e109c906cf05fbd0bc0c4bdc11

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_1_7_certified_w10\ZBRN\ZBRN.inf

Filesize
24KB

MD5
1511e10cb038451be3c4e0aca1dc1b7a

SHA1
66789863f6432daa668eeccef59c086d35816ba5

SHA256
a5440ae0acd4906fdde54cc10373b914e113f69cb87db70197ef0e2709038891

SHA512
6b8c3f81ee7ad4d81d671b2f9aaca5d0996fc734532dc12f333daffd0c663f53ab147f57b730090d51af1909adc0c128119e83a60e21494dc63c5ba6a286d155

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\AndaleJ.MMF

Filesize
7KB

MD5
21c405a9a3f49f691168a942ef4c8ca0

SHA1
eb8911775f8056e2829225d55013f22276e209f9

SHA256
264259b5d1538b085ad8012df47ef5c091fcf68e49bb2c344d8cd72ee6d3da1e

SHA512
15a53c2f711185216b9110328e52bb42f93d3f9cb402eff2a51155d04259f190a35453f398a460a31fdf79b6628aa256e28eecbc51f39c2044f934cab53cb03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\BA110XI42.dat

Filesize
12KB

MD5
cec392c0a1f0405485d8980a356d4bf3

SHA1
8e45515442f528ecf7f45dea27a6ba1ef9903beb

SHA256
8e1e8e266855ec30488891e03ce6b7a5b22b7cc7caec206a310341b89cea5bb6

SHA512
938460dd929963fb24255445133f68183b6071edd3a06adad8e5337148c4acb1c9ecc120daac56f9379a836edbadb78f566f3ae6d60e6f38f2992b046549f887

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\BA14XI3P.dat

Filesize
14KB

MD5
ec8514199a5df6601fd8658638cc62eb

SHA1
f45656ecbb339ffb5b8ade441a3ec328d5b64b4e

SHA256
c24d46a136755a081e284f38021786ee987410acc2f1f624537e8ab1f620a26c

SHA512
7a52ba3ba5dcff9f51298456ce9100b4d73a5f25883515524fa5cccf31e93a1049ebd8f503b004251b3363c2a3455eef7395ff445f34f6fd9194d9d622f4d2df

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\BAB2044.dat

Filesize
14KB

MD5
2a0e09ab5261005f75ba0fa91214add0

SHA1
f4cef2f28b37507822eca22fe1873126e98aff46

SHA256
cb69a5aab2dec2d7c0f23ee5bbaca8e031a100b99534613a30109d61d056932f

SHA512
2b406d1907e22936d7848f8f5101fd874778a292d6f29160344ba5d7ca994146e38aaea1feabc2f10be44a8ed51a9325945e0c95614daec8695116f00a6ccd67

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\BAB2348.dat

Filesize
14KB

MD5
9a12c24896d550f22d36891b7e95b24d

SHA1
e149b5699e4a5d5e31148fc067b9922150576a01

SHA256
02c64466f4f391c943d983de94ad1f575fce47c8cba6d17e6d90aeba72e0183f

SHA512
bd5a08e7a6bdfdfd95efc7262cd9a88d1569e4b4793ab9b5b2b25d8daa702907aa2393a4f179b9aa30596a156843a8ac6af4eca38ed4dbf6798b45e7fb6b462b

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\BAB2442.dat

Filesize
15KB

MD5
172b944942e584a231051abd03e11664

SHA1
699e68932911b02218532e73265ca57a4f1b6132

SHA256
6a2cfa8994378f479f102b0d1616f96dbc2ebf99ea74bfbd197d5967ca7a6aee

SHA512
5067686561d24112ccfe285b52d59c49ae287a53443f30eada09231195817e1dce12d7525ff65e616af2337431f7897406ac0d7f29dfad0111fb6601dc4c27ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\BAB2844.dat

Filesize
14KB

MD5
1c2b83e2bc5c3152f63e0518cfed4328

SHA1
6936c81a683a0193d840ea9d52f9d1e893aa85a2

SHA256
90fd9560cbc1767238afef6f4ce057f1f42ffd148a6e4a9ce583bace9dcf2b3b

SHA512
3bff29d736ffcf45c15ccef57f15e03faf32708b468ed484f89f6e273ee598c8dd594d2d6a275dd16205636e88e5c3bc7e46e6c355239f15d967c503d775e68a

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\BAGK420D.dat

Filesize
12KB

MD5
ee0987050eb466a6955c3ce77356975a

SHA1
da40b044b4ca6fa1d247a1095fb8242f31f3b925

SHA256
0f0608175ca0baf76b6a4e481141887543750c1571bd11be280f0bd6a1088f30

SHA512
ee3928ab3becef68b31bd6d6e78c6eeabc6224013060be8e3ae6b9d33f20f5083ce0116f471b3fe8dd53661690e5d4c793f6f71cdcefb70c47a5b9e29bdfeb8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\BAQLN320.dat

Filesize
990B

MD5
c1a53561b4ec0025a63b78cd2de37c2e

SHA1
3f489dd900a0cef68e118d9fb54f4ac734a046b3

SHA256
f5f9c649214f2827267ee8110ac46dbf4160eea67eb821e34581a0da7133079f

SHA512
807d11dd67ecf353a01d722c340c8c0e7d2779d39066fc502726740fdcc721c75788a00bf8fc76d65613ca8f0655dbbfd6b5bae6694a1073f7d74ffb82425be1

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\BAR110XI.dat

Filesize
15KB

MD5
7f5e360bfc0f16dec0fcc11faa4c894c

SHA1
5b33cb58be60981f2428a9eddf50dfc07e4d0edd

SHA256
f961559d654b14d0f10b1391821c71b56334850bc21fda16a91fa9fa0bc0b9ba

SHA512
f5fccc1f3cc84cd31959dba38d228bbd7904619485619faf6f4ac87d102de6ad285616f8b62498b0073babee7c84cf69497035302799f68ffc69052cfd52edb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\BARW420.dat

Filesize
998B

MD5
32698df6cf171971d67b5efa4ba013ed

SHA1
4058c3772f00f531b635917dcc65093174c2d059

SHA256
0d9b59e25026f442de21da3087a83e61dd6fc80c3a43d13c152eb11064f91002

SHA512
d33ca435c010cdddf3468d4f18a55ae41108f10c2fb294a96f66022489360015f11f29bf24aef65d99d5939c0b28b8b6d103a4ab9dc6d08ac4f9cf3de69b9834

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\BAS4ME2.dat

Filesize
14KB

MD5
acea908361f45e68e9816cdd2fd7bbd0

SHA1
f28acdb96fb33d583ddb82a9a6a62ef8f191200c

SHA256
0636f3f9e0f615991bb07154ca999e2ef8b6603332804176cb02883a2b855eeb

SHA512
6d617c69dbd0c670c0ad22c1b31b5db26b3e755b655f503d06fba4e25a5d09e1e2fae8ee62a0de3b536daefdfaefa601d6e59b649b514629757bc21119387954

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\BAS4MZ2.dat

Filesize
14KB

MD5
1bf0c4ef99999e7cec4cf6332ee00026

SHA1
bdace9ab6bf880ae5631c032191a5f6a37d97772

SHA256
12f73802408184a535c18fee5f6b14c55c05550497b12ad75ce00419d5fd5abb

SHA512
e628c3a8a09d22cb7815dd4723f8080c6b3b88ab4103420321a0c55f77f513817d0d960565d924867d87be55e694bcedd15bec8f943cb34fd4e403bde03efa4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\BAZ4M1P.dat

Filesize
14KB

MD5
91ee90c884853e460bcad28c5a11edb7

SHA1
d89dec8bdb585ef42f88b2a28c91d06c218823b9

SHA256
b8d7cb8d198d31b3d7a131f9790f97db756a1538f03588ba49ed4bf9cbe2b1ce

SHA512
2dd0ea312e5f0bad8ab36b3272fb3af83067390875d35a367c3f4165e805ee816fa335d5754ddd8e6ef63b12dc8526362319c295e305f11cd01c52ed186749cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\BGK420DE.dat

Filesize
14KB

MD5
9d504457856a81fe294183c9a4738196

SHA1
fd7f80cc22aca2b6e75b5f8add8deb3dbad8a5d6

SHA256
6de101525b8d1c4f4c47e4dcd16bbf50063bab4c9a06b3ef7845a92b638d76cc

SHA512
d68d3e512965ac1b820fc3d45edd528013c0e373b32f88f00d38568a609018b4a59805970c877ad7632c1fd74c80c5236a7ded28ffd477884d6b71638d6b6b45

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\BZM4Z2.dat

Filesize
14KB

MD5
278a119ac30e4af6c47ae471205ec5fd

SHA1
f57d6643ad5adbd288aaba6ab7f2cb9438cde92e

SHA256
e121fc4928352af3036d673345133be4c309ece7af14cef605b3c5bbc4845315

SHA512
07977a470385a27dc0500c483ece094fdef0ccd77b6f23c78d10a344f5c89ed5c71145364f4823d2256294afe2d7de746d6da58739534ce954cd93d14cc34390

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\EplErr.sme

Filesize
981B

MD5
9e69cea0836f846aaf4474fb3721494a

SHA1
b5ad65c7d211ccdbeada7d4119e5bd31247d8f85

SHA256
6d54023d1dca98ba0f8ded4786553b9b699f9fb90002eaf9d446c80690dfb984

SHA512
3206411620d0fe9d4ee74e7ac196cdf2beda6236a579d13595f738c9ab2ce78d9f38ac20e872146e1378b0c6d0788be59f54d4b39e00fae7b36df7f9c7c9133d

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\Gothic.MMF

Filesize
7KB

MD5
153e9fe286ee02dd8039c70fa66a5829

SHA1
0304f92b8329c54cb37b8b0f9d183492ac8acac6

SHA256
3cfe346bd13ccc431181af992ca0c216b8e5494e8bc093921458f6c3e0d5245b

SHA512
9d97a0a8d60a2844ca878c9fc2964b9b01d496f384adf3a5eae336cde90cdceb5b4e198d992d7af89183fcf1a5abe8530261e14ee1e3ebfb94c70d4fd7fab306

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\Korean.MMF

Filesize
7KB

MD5
5c2f196400c249f819f9b69133f41a71

SHA1
6e351780089b26ce9b6bc47129874ea7e28791e8

SHA256
9eec7baedff3928213e9be6e49e76b92d8844f644aaade9a72f356c63d4b1b8f

SHA512
790d2648e207ceb53451183417b094d6f0b5f9ad718a860ec370eb09a5403e0a7a71438c16e6bf0b9090f953136ca5f20d1fb6e3a49f5879b2accd7fbc519b49

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\MSung.MMF

Filesize
7KB

MD5
8e2720b65fe78ad3ca1b6a2574483891

SHA1
8ef3f0ec40dea6edf239a61b057e7e7863a43aa1

SHA256
0aee6412c533e9fcffd7be0b38362c35140dd3cfeb1913d3e3208269dac08d13

SHA512
078486e30c6f728a66167d1f71d8b5a20a4b317344f36e74246c813abc7ffba3deae3fa42a1410daf2ef65601d76238e42a426041a3807cfb7bc454a28fdf165

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\Mincho.MMF

Filesize
7KB

MD5
05f695ee072e6ee7039764d43c639f17

SHA1
881ce59bd8519651cb84c6c50081402c8338381a

SHA256
932cf1340efe270a904cac4d4b6953c86afdf0eb639165b40db217f97253ca42

SHA512
4128e50723ae1372ff253b023e8f8eed94f44c0c613278391e825d94ff5d67d6572ddba34bd49346459d353aed0fe50dfc37be8bc36c1259140636bbec1fd168

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\ToolsCPCL.dll

Filesize
219KB

MD5
edccc42d11368620098dc7643a8656cf

SHA1
9da229356de06d3e1bbe5d5524aef4c5c9096ce8

SHA256
47b2242748b331ab18fcd0145d079a07b532af5c2e4b5c408a6981d296cc0b6b

SHA512
977fd78cf98156a6701d9ca6ecdfd72801fe9c7b2db74fa4d4b9aa5448c3b557c6b21cdbc2ffda5a0ae2e849dba42b89fb84c6f3c1848f915af76ae19a57b101

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\ToolsCPCLx64.dll

Filesize
225KB

MD5
e477408112ea146a76cc751ec8eab0c2

SHA1
f8a6a2da7eb097992734cf7d89795bb6e9c4da7b

SHA256
63eb323713954bae4f4f34c22b13fb7d278491db8cab1620d3a71f0833813cc4

SHA512
d262ddcd53d39f65ae8eb60666019000d21264ec0f0a32bd1ac33872013c9a9ac71ff5806137a6223eeeefd38fea55169aaedb894b363a0a8264045b3dffa372

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\ToolsEPLx64.dll

Filesize
205KB

MD5
148f2fe32adb18d8b6d05a2021b29438

SHA1
a2341ba9127ae6020a1dca8b89988b260f059f42

SHA256
82c9475708a6257ba15b681643ca2b51da533aa1cffbffd487a92bbf56c819de

SHA512
9d7920dac099948db0ede017c1cef9a82e0f34522ef39bf8b1b15743b388ea1cb1f75f7e9fc5ebb26109c93626452fde70ea118d1302d5a29597a082da1a2af3

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\ToolsKIOSK.dll

Filesize
233KB

MD5
984d0be6d63e3ec0af165aaa176e0f9e

SHA1
09fd7b57ceb0971c4833412cadeea23be0829694

SHA256
0e0b5d548f5079e61d5caae0e049b04b692f28e3abb739955742ab2b56c7fe00

SHA512
d4a7cd152b6eb93aee580c797bb11c2748e6898658464119b94036cc51157d66cd0f8d4c9dd700ffe8d40f72764785e79bde51a908f41b7674893c81392ca813

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\ToolsZPLx64.dll

Filesize
231KB

MD5
2da87f6675df88fc8cfcc4a22166804f

SHA1
41d53abac2326379f7723a9fffc2b71526fa074a

SHA256
f284547372395c5d8ba1f6b4d850ecc34d961bf77f587e6e1467d840d7a12776

SHA512
54f824930a144a8a4d12fd63f72bf257127fe6c5e92c5dc9bee6e9a084c1215416c967ffcb2f9364a9aa5a30b798651852b813e04d80f5c9e36f74d652a58519

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\ZplErr.sme

Filesize
588B

MD5
07c5bc637fcc3fed91570282debb0754

SHA1
22e3f121c16eb0401c1f06a159e17e7a1e7ee3fd

SHA256
7e6b16e1d89085eb0e5c0152e00b30a8f7f22ee5ae4067d896efa36f887be17a

SHA512
1c8af713b4446cdfec160e77a9383d0226e3484f271edd3592936c078d310281ecaea8c7d9007c7234dcbd3a4a71e39f846ab9fbafc71136cc71c1fc99623870

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\ZplKskErr.sme

Filesize
1KB

MD5
6ae9a23c59ffded1dc45093219674deb

SHA1
402b2f7ca4ad62ac4dca7cdc86b7ed8222fc1295

SHA256
b44397f0b040b635292ebaf8403074afdbd7259a266c7c74768918a13047197e

SHA512
0078d98a74cd79dca706327388748203a92b2a3302fc57a622b6ec1f5f9d8242868c0c0a90320040ce3a4aa4280187f58a860a5cd0d3f2ea1107242807627bc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Common\zlogo.bmp

Filesize
456KB

MD5
5babb4cc34960e23528851148d931ab0

SHA1
fe94b3cffa39c4bbc828cc592f7be0e48a08cf19

SHA256
be06f2c0840bc6de68984793a1d24e141c23ae9aa82d2ab9df6f831b2a268fa1

SHA512
020b6e216b4ea2b004c2a0c885a93a8bad22c240909e9644c0c43d81e27570045eae4a81fb1ee481d4c2ff0187262ce8444365645bab48e236fd4e61f18acae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\ZDNCHI56.DLL

Filesize
45KB

MD5
2cb84fd2638cf334850506061d539d60

SHA1
fbf0872b72f4b849afd0b62b57534ddf7ff14a4e

SHA256
0d147b96c250c4760d190b20dd8d2b17c5afee092a8e63ad160cf9603de03843

SHA512
62ab91d33e47dd4cd3242f1067de161a02ac98039395dfe766e2939806fe41b53ab8cbf6cb9e168bb18db76ab94e3f3fc0666843e9434fadcd863174d29b898f

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\ZDNCRO56.DLL

Filesize
63KB

MD5
80be85e673fc3cd8f3770b5d0a627fed

SHA1
4ba8c5e101373b41689467f3263eea349ae8cda3

SHA256
7830ac4e2b190c0ce7a0780779f9cfc34a1db3008c8d34d5765892c80513436f

SHA512
8a609558bc4f0eb03e8881124d5fbabaed6907557ab3f2052b4fd85956d558b0925ae390c2b294360d7a302fb99e10c6a8f34a4a3802b2897273a54207bf4024

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\ZDNCZE56.DLL

Filesize
63KB

MD5
68f62f67c4e1977d78d8b9aa4ffa6b28

SHA1
cc2cddfb1047b018eee919610ac0dba715c45b5c

SHA256
8c6350751c68602aa83090b3455f5d4f476532aa0949697d8abdd672390838b4

SHA512
988d1b67b36a128e5fb4462195b3963fcf02be8ac55488be43a36b6930c3736fa73325281207e953556f017c1742ce124559a3c8c1386e78dc62134825c9b652

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\ZDNDUT56.DLL

Filesize
65KB

MD5
1b92a68caab47fc3b4a18f0735b4ded5

SHA1
48cf68bfc6766301e48d69a2cf5a7d212c47970f

SHA256
837c4df5a53313ddc20de798705a26893328dda1e465063b795b0a8a3c5921fc

SHA512
69569c7a3d65069578296ec7e6ef9904386aa450a32feed509d7ee4bcf8e8c02f9c928c7255469e3ae1184a723c84be7d75c3e3f8c8b475d90f6da7fcf9d4836

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\ZDNENG56.DLL

Filesize
61KB

MD5
fdf5e14126a83f57f978940accf9ed3b

SHA1
bdb476d2b4547e1df826fc33de71462db9f399ac

SHA256
b25688df04a3ea78205e877fc596faaaeac4da4a7cc1b5e8a2aa4e1f6a44d0d0

SHA512
791ef57ad5fc5fd63df8f65764e41256f932c232ce3fec71ae37a716500371924b91ec76885a778ab511a325074473b0b058c93675bf54a26c5a726b5f82e664

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\ZDNFIN56.DLL

Filesize
64KB

MD5
05b7a0f16d03ce0644b7008161a91bd6

SHA1
9dc0c5ae07eb34de295e6f595e0bb68598c34aef

SHA256
0d296344ee86742059cd84616658a12673b24ad80b3f466f704bd7f31e1fad84

SHA512
fbfec3f21fad10868fb7e10614e476e6f8b4b34e8903154fbfec4fc15376ec65d57f38a516576dfd93af770d7c746877b57f36cca22cf4d330e594554df2a24a

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\ZDNFRA56.DLL

Filesize
67KB

MD5
f9f9614aae1eee9a6d1370fcf9c85635

SHA1
f0b71804b163beee78e05464f1dc1988abd6aec4

SHA256
b4c917cc7f11d5c5fbd2426b688687891942d44f77348e7e25466c5c06ac4e81

SHA512
88b32e8e1224e34ef20607413afc7886f4f5cd79ad21498ce2618cba2da5cb42fa101965412f2a6f51d6df892d719b8f787b3cc553100fadb44a1ecf5eae49c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\ZDNGER56.DLL

Filesize
65KB

MD5
c427cc9550db1006a6ab646ecbb67845

SHA1
7abcee900d9e4d21fed1beb6dd4f6eb71c81f916

SHA256
3e6f4ca45d3ceedf558702810f5ae8ac9020dfd709a2d1f7799701f8e4bc574b

SHA512
842e3f76cadd7ba09a118420ad02fdd38192de648a14bc3ba56b05eb52a31c2a4ced5463c1c911ae7a44e511d81a01cd48a5037c6cd488f95210f0a1c6c9e177

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\ZDNHUN56.DLL

Filesize
65KB

MD5
668f7e0724b130367aad94ae03ad739d

SHA1
dfcfc67a9b42118d97fb865d9095e0aae2a8fcbf

SHA256
d9b9c94fa456e3cc52436932447086b385bc87d2a163068c62f331f9145d2bb4

SHA512
6f6cb988b3f364b13e64c1d029879a0461636264f365572ae27fe97973f99e43d3a376e2ddd5d0c51ade63fd084e7776866871ef4d306bae4471b05dcb3993ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\ZDNITA56.DLL

Filesize
67KB

MD5
2f019a2aa8c859b98d29eb67242cc093

SHA1
4f42b0d6d78ab68c7348cde20aeeeef7e3cb592b

SHA256
f422d5a55a693da1aa478c12a897c27edb6eb06ab671aaa6c2208c8a1f7b5f81

SHA512
1a46f9f70d031eb8939fbf80d1820b763eabc347acfdf02449f9da88223078eab09860926d8df5b44027be7af7606e72f9f660ef4302ecfb2a9330c41052257b

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\ZDNJAP56.DLL

Filesize
49KB

MD5
5e5843d277bd6cf4263cccac34c4f403

SHA1
7472f2ad76251b9e4500090d044c514d42044ea9

SHA256
1626f8cf33553c4159d2934becd97ec6165d387a5feec34df635b8d56b21555f

SHA512
46fc557727936d9786ac31c1e60135d38439e418361ecc6a654eb0949146e37daec1a0f868e2a2252b0a4128ae8b6d44ef30da7f2bc9101aeefcc8d532131281

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\ZDNKOR56.DLL

Filesize
48KB

MD5
12bad4ca073309645d8181234f76b064

SHA1
28693c7694597a782e39951370142735c9a41e3b

SHA256
44d948f0ce93f1e3342cc2d49fa3da090eafbdcc55d9ca5dc59168c36b9e3f90

SHA512
dd5b7fb170b67ead123336eeaf5c5787cabec688110418f94119b80aeca39e80d388772e2f898baf392f7e7d385fa36c1a47ca0e40c8e97d937ce8aa9af65391

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\ZDNLIT56.DLL

Filesize
67KB

MD5
7bf307be29dc6c8eec829f07c25b7f5c

SHA1
53e11cc4e79fbb031f125fc2418656b34bfb160a

SHA256
ed51debd3b1074f41b2a9d02a07465918c14de0356f80f2c8f4b8f82faf8b65b

SHA512
1a009734a1ad9106163f63c8eef61f1689ba1e4874dbcfec7d907359b46a6bd3344d7ea14c0171dab64f4abfc7b9b19d77121c69f50463b8f83b800a1b19eb82

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\ZDNPOL56.DLL

Filesize
66KB

MD5
36210719ed588769fe5cd9812cfd67a9

SHA1
9501082ce43999a4558f6f7d7778b22145dbe1fd

SHA256
83b5554e10d2e80debe6f747340036c6992b858422811f58609588dee496431f

SHA512
3dba309fb630e326405fa71b30f2cd98975666fe90705b7e54ca2dfc50c3bfe5c6b05bd195291d5a028d7bb163aee2ccb15e90af299eedabdf3600b814e2e97a

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\ZDNPOR56.DLL

Filesize
67KB

MD5
b0fe29c88fcea063caeb051a37a12ba4

SHA1
d075805cb756767116bdf1a24cd8aa3a687b93ea

SHA256
9bbd765d67dbc65a5e9f5e8e833337b6292d7cf0289b8695b53017682cef4f6d

SHA512
e1f2ceab7c25366697c5e204f185a573f9dc7e5a4894b09abae992909c39f2202601f1d84e91521d82fce515fe9fc4d48527fb3ab07336d52ccecb06c40543f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\ZDNRUS56.DLL

Filesize
64KB

MD5
f7446b9c03c41aa0135c148f92d785e2

SHA1
6e06ee2733835b7442fd15b135e024cf56ffbc85

SHA256
97919a0164599e5b3adab297e6d0697f79c6cf0a56f7166e1508048f8996f4b1

SHA512
08567379d75657064c0663e5bc52d12cfd7e5cba9e207c13421816b83f129583fd12f951186b1f648c0a8687b22a2f572d8df54a3925cdc3658bee36ec483c24

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\ZDNSCH56.DLL

Filesize
45KB

MD5
0f9804f18ff9a447c2d8f3c9857eab71

SHA1
8b4038ae9e2776a70ae51cb9514c507d929c16a7

SHA256
521554390f727a4c3674805b1a3c9fee6417bbc75b3528c48c9a84fa3eaf4100

SHA512
fce5166143e69e4671d18dc600eccd3dc28efb64d9e1e4a946ca34b0763060b32db993b0999057545b7c6a4e3b9660cd4fd38c62ae10761ebaed08db31d92841

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\ZDNSLO56.DLL

Filesize
63KB

MD5
e7d25d0a3488f91ab00bdd3b4ff3af4f

SHA1
5ff0c2569535e2abe47f5744d07f5b1ca9b3cbfd

SHA256
54cbb07c2f8e8d8e753c05e86d8090a4b80dace118a8dfb5caf4c17c0e2c757a

SHA512
59ae338bf4d77a2f5cc730d9ddf1e8c7c2e1d2b0f9c32c0968b94d48417df2dd54519d562faecc8bdcff166b39c4d1a52f2b949f7ce595c66e0a635371aa8298

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\ZDNSPA56.DLL

Filesize
69KB

MD5
fabfc7005a025f13c81acdfb98444ba9

SHA1
bebb174627611399ce8ad5f2bafb5d53a419de0e

SHA256
c26234548b76630c126863458a927e62597d1e512856c745da61b9c7b2a35a85

SHA512
8ee11d18eb1ef7dae70383603aabef15d541166fd6a285e29d9ed9fc4877babacb51f16eacafc2dd59d2f88365a18265b2bffbe97865b2a8021a8de021c635d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\ZDNSWE56.DLL

Filesize
63KB

MD5
b8c149599054f8018edb943b831c664d

SHA1
e2b601bc67be75f7bdc2f4fe475f9a8cfae399e4

SHA256
392ccee1dcd1729a6f6cc6cd3cffb4e80fff54973a16201abaa27e5b2b4ead95

SHA512
a87841149fe52044a147c1e04f326ba140e1a6d31994e6a6c13f71ae89069e2bcfcc92cfcef7765a7cd0e2d550454bf69959756c64110dc421aa1e81aaca9b77

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\ZDNTAI56.DLL

Filesize
61KB

MD5
24369c05e4e81af0a48219de1fd7c7eb

SHA1
164e7ea8985f73c104e734f6bc98c25853ad6a3e

SHA256
46dc1994e91ee01b0e68935f1f3fcd2344ac1513015ea8ff74452fb92292d92e

SHA512
0578b58e47d8eb26e7bb93a88464ca596f63ca2b7cbd26e3e3b53c9dcd3c5f36e76dfa4f27252f34e27e080079103c17b161466abb285e691c5959fa69c0071f

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\ZDNTUR56.DLL

Filesize
63KB

MD5
7090e5b8184706069072a69ce8e6ce63

SHA1
10d4a2135353baccc04a8067822e140472933ba0

SHA256
1bfb329b4a5f38f427f3119c9ea4569b7ccce38d6123c00879170ad9213187db

SHA512
93627c16462bc0f706f8952c99e302f4b8c7df23e115c3509e49291ff413f5d5848419eb0e4f622aeff167d965bcb4d7e158aea6327c635f92783df7c87b74ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\ZDNUKR56.DLL

Filesize
66KB

MD5
6c80d94fa4eb9bcf32aa1d8b98f24358

SHA1
023cd379e206b9da6624a684b8a6ff05edb43574

SHA256
2f8d19d38c9efb90a675113fd7da26ad825f701885fc3dfa785a96a656258b90

SHA512
a2fc0a2b4393c279314244bdfcd23a399c705005e9fee9f05dee8f574da87ffc957503cb735065a458a2e6b08b1563d3308578df9f4af5145297fb5af1612e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\ZDNdrv56.dll

Filesize
1.3MB

MD5
ce601212d134a50e1d03275366015676

SHA1
eee6983cb4e7cce8474ab8a1a3e1dfc40457aaf6

SHA256
88cd126432627d8c99a74ca765240eeedb939e6d4289a75a2bb77848f79a46a3

SHA512
2469163f9f8d22f92dce6878b75d72ddedab85ed6114235cb5ba39bddcde2e5bc403023e8f67cd56167230f2ea5ab40a02ef0c7f802c1424bd686c9b21046a47

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\ZDNui56.dll

Filesize
1.0MB

MD5
dc9584dbb91a63f3b24e5ad204635bde

SHA1
c887448421ac0b3e70740ecee07537c54d49180f

SHA256
10506082fc608c7fbae61fcfb4d3d5ef16def7763186c2c6fc15d5b0033b89ca

SHA512
cb235f01b6359a6a804838c060460ab07e8c451904db9ddb01ef6173bc1dd531387e347079cbe169200fa1d6b3d3c775d4fc8687b1116ee811ad16f420443968

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\zdnNLM64.dll

Filesize
237KB

MD5
3ddf14f4738665c65605119f677954b3

SHA1
29b6f3dacdc249bc2a5c33ddfef9d098f419ea41

SHA256
c2dfc26d3eedd5221f39fbcb982d4ccd6890e8eaed1fdff23c0d38226b6e2f2f

SHA512
7de10b5fedc9dead5abb6e0b315501940cf3f9a0b244808873121311cf7b7803a4beffd2167f75905d491c784090e0244534f457ee705bff5abcca7400034c5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\zdnPMS.dll

Filesize
112KB

MD5
9e0d88a774e08c7b556c13dd90a38a52

SHA1
a9aea9bba767342c5f785522b1e23e9c5c369f05

SHA256
91c2ab35a5765a4576c2767452bcd0639ac2cf3da1fc35d303bf61d7732f7782

SHA512
af60d11274585ac51ee4d00d4e4bda3cd1587dc21ea784365587cfbfdd496f82de8db7e5cd6276f31c41001d2940d2cbee3b6ea21cf421a958380236d1c91948

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPS_5_~1\ZBRN\Win64\zdnPMU.dll

Filesize
111KB

MD5
e3bb98e4c620cdb44afb9514181a04fb

SHA1
da2e8829e14de367c5c94874736ccd8c6995c901

SHA256
ed3a9cbc5a33c49bbb0cd2089aeb7fded2dd1aa9761e8318db24de5a4f0ab2ef

SHA512
a92962a6ce12ef6bc6409ad1427a6f237e70a45c2a39e37140354d37fe1edab46c2f1d0dd071579b00fa4b2c0cea20999041acf8fabaad765d68652ff0af0929

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET5343.tmp

Filesize
219KB

MD5
edccc42d11368620098dc7643a8656cf

SHA1
9da229356de06d3e1bbe5d5524aef4c5c9096ce8

SHA256
47b2242748b331ab18fcd0145d079a07b532af5c2e4b5c408a6981d296cc0b6b

SHA512
977fd78cf98156a6701d9ca6ecdfd72801fe9c7b2db74fa4d4b9aa5448c3b557c6b21cdbc2ffda5a0ae2e849dba42b89fb84c6f3c1848f915af76ae19a57b101

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET5354.tmp

Filesize
14KB

MD5
2a0e09ab5261005f75ba0fa91214add0

SHA1
f4cef2f28b37507822eca22fe1873126e98aff46

SHA256
cb69a5aab2dec2d7c0f23ee5bbaca8e031a100b99534613a30109d61d056932f

SHA512
2b406d1907e22936d7848f8f5101fd874778a292d6f29160344ba5d7ca994146e38aaea1feabc2f10be44a8ed51a9325945e0c95614daec8695116f00a6ccd67

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET5355.tmp

Filesize
15KB

MD5
172b944942e584a231051abd03e11664

SHA1
699e68932911b02218532e73265ca57a4f1b6132

SHA256
6a2cfa8994378f479f102b0d1616f96dbc2ebf99ea74bfbd197d5967ca7a6aee

SHA512
5067686561d24112ccfe285b52d59c49ae287a53443f30eada09231195817e1dce12d7525ff65e616af2337431f7897406ac0d7f29dfad0111fb6601dc4c27ef

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET5356.tmp

Filesize
14KB

MD5
9a12c24896d550f22d36891b7e95b24d

SHA1
e149b5699e4a5d5e31148fc067b9922150576a01

SHA256
02c64466f4f391c943d983de94ad1f575fce47c8cba6d17e6d90aeba72e0183f

SHA512
bd5a08e7a6bdfdfd95efc7262cd9a88d1569e4b4793ab9b5b2b25d8daa702907aa2393a4f179b9aa30596a156843a8ac6af4eca38ed4dbf6798b45e7fb6b462b

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET5366.tmp

Filesize
1KB

MD5
6ae9a23c59ffded1dc45093219674deb

SHA1
402b2f7ca4ad62ac4dca7cdc86b7ed8222fc1295

SHA256
b44397f0b040b635292ebaf8403074afdbd7259a266c7c74768918a13047197e

SHA512
0078d98a74cd79dca706327388748203a92b2a3302fc57a622b6ec1f5f9d8242868c0c0a90320040ce3a4aa4280187f58a860a5cd0d3f2ea1107242807627bc7

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET5396.tmp

Filesize
14KB

MD5
1c2b83e2bc5c3152f63e0518cfed4328

SHA1
6936c81a683a0193d840ea9d52f9d1e893aa85a2

SHA256
90fd9560cbc1767238afef6f4ce057f1f42ffd148a6e4a9ce583bace9dcf2b3b

SHA512
3bff29d736ffcf45c15ccef57f15e03faf32708b468ed484f89f6e273ee598c8dd594d2d6a275dd16205636e88e5c3bc7e46e6c355239f15d967c503d775e68a

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET5397.tmp

Filesize
14KB

MD5
278a119ac30e4af6c47ae471205ec5fd

SHA1
f57d6643ad5adbd288aaba6ab7f2cb9438cde92e

SHA256
e121fc4928352af3036d673345133be4c309ece7af14cef605b3c5bbc4845315

SHA512
07977a470385a27dc0500c483ece094fdef0ccd77b6f23c78d10a344f5c89ed5c71145364f4823d2256294afe2d7de746d6da58739534ce954cd93d14cc34390

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET53A8.tmp

Filesize
456KB

MD5
5babb4cc34960e23528851148d931ab0

SHA1
fe94b3cffa39c4bbc828cc592f7be0e48a08cf19

SHA256
be06f2c0840bc6de68984793a1d24e141c23ae9aa82d2ab9df6f831b2a268fa1

SHA512
020b6e216b4ea2b004c2a0c885a93a8bad22c240909e9644c0c43d81e27570045eae4a81fb1ee481d4c2ff0187262ce8444365645bab48e236fd4e61f18acae2

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET53B9.tmp

Filesize
7KB

MD5
8e2720b65fe78ad3ca1b6a2574483891

SHA1
8ef3f0ec40dea6edf239a61b057e7e7863a43aa1

SHA256
0aee6412c533e9fcffd7be0b38362c35140dd3cfeb1913d3e3208269dac08d13

SHA512
078486e30c6f728a66167d1f71d8b5a20a4b317344f36e74246c813abc7ffba3deae3fa42a1410daf2ef65601d76238e42a426041a3807cfb7bc454a28fdf165

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET53BA.tmp

Filesize
998B

MD5
32698df6cf171971d67b5efa4ba013ed

SHA1
4058c3772f00f531b635917dcc65093174c2d059

SHA256
0d9b59e25026f442de21da3087a83e61dd6fc80c3a43d13c152eb11064f91002

SHA512
d33ca435c010cdddf3468d4f18a55ae41108f10c2fb294a96f66022489360015f11f29bf24aef65d99d5939c0b28b8b6d103a4ab9dc6d08ac4f9cf3de69b9834

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET53BB.tmp

Filesize
233KB

MD5
984d0be6d63e3ec0af165aaa176e0f9e

SHA1
09fd7b57ceb0971c4833412cadeea23be0829694

SHA256
0e0b5d548f5079e61d5caae0e049b04b692f28e3abb739955742ab2b56c7fe00

SHA512
d4a7cd152b6eb93aee580c797bb11c2748e6898658464119b94036cc51157d66cd0f8d4c9dd700ffe8d40f72764785e79bde51a908f41b7674893c81392ca813

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET540A.tmp

Filesize
205KB

MD5
148f2fe32adb18d8b6d05a2021b29438

SHA1
a2341ba9127ae6020a1dca8b89988b260f059f42

SHA256
82c9475708a6257ba15b681643ca2b51da533aa1cffbffd487a92bbf56c819de

SHA512
9d7920dac099948db0ede017c1cef9a82e0f34522ef39bf8b1b15743b388ea1cb1f75f7e9fc5ebb26109c93626452fde70ea118d1302d5a29597a082da1a2af3

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET540B.tmp

Filesize
14KB

MD5
acea908361f45e68e9816cdd2fd7bbd0

SHA1
f28acdb96fb33d583ddb82a9a6a62ef8f191200c

SHA256
0636f3f9e0f615991bb07154ca999e2ef8b6603332804176cb02883a2b855eeb

SHA512
6d617c69dbd0c670c0ad22c1b31b5db26b3e755b655f503d06fba4e25a5d09e1e2fae8ee62a0de3b536daefdfaefa601d6e59b649b514629757bc21119387954

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET541B.tmp

Filesize
231KB

MD5
2da87f6675df88fc8cfcc4a22166804f

SHA1
41d53abac2326379f7723a9fffc2b71526fa074a

SHA256
f284547372395c5d8ba1f6b4d850ecc34d961bf77f587e6e1467d840d7a12776

SHA512
54f824930a144a8a4d12fd63f72bf257127fe6c5e92c5dc9bee6e9a084c1215416c967ffcb2f9364a9aa5a30b798651852b813e04d80f5c9e36f74d652a58519

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET542C.tmp

Filesize
14KB

MD5
91ee90c884853e460bcad28c5a11edb7

SHA1
d89dec8bdb585ef42f88b2a28c91d06c218823b9

SHA256
b8d7cb8d198d31b3d7a131f9790f97db756a1538f03588ba49ed4bf9cbe2b1ce

SHA512
2dd0ea312e5f0bad8ab36b3272fb3af83067390875d35a367c3f4165e805ee816fa335d5754ddd8e6ef63b12dc8526362319c295e305f11cd01c52ed186749cf

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET542D.tmp

Filesize
14KB

MD5
1bf0c4ef99999e7cec4cf6332ee00026

SHA1
bdace9ab6bf880ae5631c032191a5f6a37d97772

SHA256
12f73802408184a535c18fee5f6b14c55c05550497b12ad75ce00419d5fd5abb

SHA512
e628c3a8a09d22cb7815dd4723f8080c6b3b88ab4103420321a0c55f77f513817d0d960565d924867d87be55e694bcedd15bec8f943cb34fd4e403bde03efa4a

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET542E.tmp

Filesize
7KB

MD5
05f695ee072e6ee7039764d43c639f17

SHA1
881ce59bd8519651cb84c6c50081402c8338381a

SHA256
932cf1340efe270a904cac4d4b6953c86afdf0eb639165b40db217f97253ca42

SHA512
4128e50723ae1372ff253b023e8f8eed94f44c0c613278391e825d94ff5d67d6572ddba34bd49346459d353aed0fe50dfc37be8bc36c1259140636bbec1fd168

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET545E.tmp

Filesize
7KB

MD5
153e9fe286ee02dd8039c70fa66a5829

SHA1
0304f92b8329c54cb37b8b0f9d183492ac8acac6

SHA256
3cfe346bd13ccc431181af992ca0c216b8e5494e8bc093921458f6c3e0d5245b

SHA512
9d97a0a8d60a2844ca878c9fc2964b9b01d496f384adf3a5eae336cde90cdceb5b4e198d992d7af89183fcf1a5abe8530261e14ee1e3ebfb94c70d4fd7fab306

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET545F.tmp

Filesize
7KB

MD5
5c2f196400c249f819f9b69133f41a71

SHA1
6e351780089b26ce9b6bc47129874ea7e28791e8

SHA256
9eec7baedff3928213e9be6e49e76b92d8844f644aaade9a72f356c63d4b1b8f

SHA512
790d2648e207ceb53451183417b094d6f0b5f9ad718a860ec370eb09a5403e0a7a71438c16e6bf0b9090f953136ca5f20d1fb6e3a49f5879b2accd7fbc519b49

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET546F.tmp

Filesize
12KB

MD5
ee0987050eb466a6955c3ce77356975a

SHA1
da40b044b4ca6fa1d247a1095fb8242f31f3b925

SHA256
0f0608175ca0baf76b6a4e481141887543750c1571bd11be280f0bd6a1088f30

SHA512
ee3928ab3becef68b31bd6d6e78c6eeabc6224013060be8e3ae6b9d33f20f5083ce0116f471b3fe8dd53661690e5d4c793f6f71cdcefb70c47a5b9e29bdfeb8c

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET5470.tmp

Filesize
14KB

MD5
9d504457856a81fe294183c9a4738196

SHA1
fd7f80cc22aca2b6e75b5f8add8deb3dbad8a5d6

SHA256
6de101525b8d1c4f4c47e4dcd16bbf50063bab4c9a06b3ef7845a92b638d76cc

SHA512
d68d3e512965ac1b820fc3d45edd528013c0e373b32f88f00d38568a609018b4a59805970c877ad7632c1fd74c80c5236a7ded28ffd477884d6b71638d6b6b45

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET5471.tmp

Filesize
981B

MD5
9e69cea0836f846aaf4474fb3721494a

SHA1
b5ad65c7d211ccdbeada7d4119e5bd31247d8f85

SHA256
6d54023d1dca98ba0f8ded4786553b9b699f9fb90002eaf9d446c80690dfb984

SHA512
3206411620d0fe9d4ee74e7ac196cdf2beda6236a579d13595f738c9ab2ce78d9f38ac20e872146e1378b0c6d0788be59f54d4b39e00fae7b36df7f9c7c9133d

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET5482.tmp

Filesize
12KB

MD5
cec392c0a1f0405485d8980a356d4bf3

SHA1
8e45515442f528ecf7f45dea27a6ba1ef9903beb

SHA256
8e1e8e266855ec30488891e03ce6b7a5b22b7cc7caec206a310341b89cea5bb6

SHA512
938460dd929963fb24255445133f68183b6071edd3a06adad8e5337148c4acb1c9ecc120daac56f9379a836edbadb78f566f3ae6d60e6f38f2992b046549f887

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET5483.tmp

Filesize
990B

MD5
c1a53561b4ec0025a63b78cd2de37c2e

SHA1
3f489dd900a0cef68e118d9fb54f4ac734a046b3

SHA256
f5f9c649214f2827267ee8110ac46dbf4160eea67eb821e34581a0da7133079f

SHA512
807d11dd67ecf353a01d722c340c8c0e7d2779d39066fc502726740fdcc721c75788a00bf8fc76d65613ca8f0655dbbfd6b5bae6694a1073f7d74ffb82425be1

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET5484.tmp

Filesize
15KB

MD5
7f5e360bfc0f16dec0fcc11faa4c894c

SHA1
5b33cb58be60981f2428a9eddf50dfc07e4d0edd

SHA256
f961559d654b14d0f10b1391821c71b56334850bc21fda16a91fa9fa0bc0b9ba

SHA512
f5fccc1f3cc84cd31959dba38d228bbd7904619485619faf6f4ac87d102de6ad285616f8b62498b0073babee7c84cf69497035302799f68ffc69052cfd52edb8

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET5495.tmp

Filesize
588B

MD5
07c5bc637fcc3fed91570282debb0754

SHA1
22e3f121c16eb0401c1f06a159e17e7a1e7ee3fd

SHA256
7e6b16e1d89085eb0e5c0152e00b30a8f7f22ee5ae4067d896efa36f887be17a

SHA512
1c8af713b4446cdfec160e77a9383d0226e3484f271edd3592936c078d310281ecaea8c7d9007c7234dcbd3a4a71e39f846ab9fbafc71136cc71c1fc99623870

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET54B5.tmp

Filesize
14KB

MD5
ec8514199a5df6601fd8658638cc62eb

SHA1
f45656ecbb339ffb5b8ade441a3ec328d5b64b4e

SHA256
c24d46a136755a081e284f38021786ee987410acc2f1f624537e8ab1f620a26c

SHA512
7a52ba3ba5dcff9f51298456ce9100b4d73a5f25883515524fa5cccf31e93a1049ebd8f503b004251b3363c2a3455eef7395ff445f34f6fd9194d9d622f4d2df

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET54D5.tmp

Filesize
225KB

MD5
e477408112ea146a76cc751ec8eab0c2

SHA1
f8a6a2da7eb097992734cf7d89795bb6e9c4da7b

SHA256
63eb323713954bae4f4f34c22b13fb7d278491db8cab1620d3a71f0833813cc4

SHA512
d262ddcd53d39f65ae8eb60666019000d21264ec0f0a32bd1ac33872013c9a9ac71ff5806137a6223eeeefd38fea55169aaedb894b363a0a8264045b3dffa372

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET54D6.tmp

Filesize
7KB

MD5
21c405a9a3f49f691168a942ef4c8ca0

SHA1
eb8911775f8056e2829225d55013f22276e209f9

SHA256
264259b5d1538b085ad8012df47ef5c091fcf68e49bb2c344d8cd72ee6d3da1e

SHA512
15a53c2f711185216b9110328e52bb42f93d3f9cb402eff2a51155d04259f190a35453f398a460a31fdf79b6628aa256e28eecbc51f39c2044f934cab53cb03f

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET54D7.tmp

Filesize
7KB

MD5
28fa70b15f3a073fc2f2d2da5ac57768

SHA1
2919eb0f81635ff406f8578e8c84186e987be7e6

SHA256
0844c5416fb2d3c88e96a37a7a3b7990d23d7d288879ed6db9428cdcaf788fd1

SHA512
288419fb8543e9b641fd8babca5474d24dd0cf449563c4bbbd2f0be5bf9c5c2b2bb527667cc6bf0371d76b2218d7f3f32d5eb99a4696e89ca9ca6af43d2d9286

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET54D8.tmp

Filesize
7KB

MD5
d10adaee855c107a8f81b59030b4970c

SHA1
20e94f31e83abfdb6736a3116da815d5ad8b4afe

SHA256
8ff2342f4008cb40d1b69bc5367232f8d581497277dc55831c855e0daf48b7cb

SHA512
c73d4b1a7cdf49148640100682acf5795272a5ecae4e9522346628d8f961145349441852b0cf7b648b11db0f5739509b37051c1c18f46a609e147d97a2964f1b

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET54F8.tmp

Filesize
7KB

MD5
a76d521af9d4eaea89b67c1eba0f9e63

SHA1
3dd70f401e6046b4cb5176fd83f52e8c1152759f

SHA256
c440a4e50db54b6418e85d9d0a5f34a8c6257aef83a45ab67896af5a69c60368

SHA512
a81fb85d531b7bf4dfd5c11a0d561def4318bce9fdbad625b58a86ab399e2bb0a21a1e2ddf707ba3858b5f5f3f6b84ed70238230b0e9122b3c7996a90aca8098

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET5509.tmp

Filesize
7KB

MD5
d6905b8439bffddfc4d24f92b412c19d

SHA1
73f7f968859534b4caee9dd52a1ce1fc8e9b7f31

SHA256
fed3edf18efb65863597afd1af8edb0ef97e43e98e6d0e9164a6f58bd8f28d72

SHA512
17e31055fac3071f6ec272681311b3e8f82ba180a459c23b858e890ae8f2954b0efdea32c78ae4efeb87189d2888c4af93d70e15b0e547acac7bee4430a294b0

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET550A.tmp

Filesize
200KB

MD5
09adb97022fd11f154350e09f09a54e0

SHA1
67f4ba31f44833be0e129c63ac3a6df09e72db38

SHA256
2e5e43b024583f5a46a6ff707295e8b00af8e19294d48a7244bc306c04f47e4f

SHA512
d47249f4eedd983dd72f0ca72e56f27cea39f3adc5cb8eb17c1493ac66663b9364ba4d7b5509fa61ee9c2498957466193f474873a978638b38abe0949f0336c5

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET552A.tmp

Filesize
603B

MD5
cd33efe8f2a00f78095f7b2584a507bc

SHA1
69d2bec01f8e92ae14eccd55578c62ea6459dec7

SHA256
41b2f7cb1972b54894d9b0c2a39114cba72fe131b72032b7b3415ae7891628db

SHA512
de580e91a3f8a329362c0e72734f8e49f69a35a44fc21762c9feda6b0a8084942155f653e41d7e5e48f08e7f6b2d620a5b90ed8112850eb8a8ef62834e57a673

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET552B.tmp

Filesize
44KB

MD5
86783bb204bd942a98768ca9de2aef5e

SHA1
25eb4aecf9be00b99a7cb5bd87a7a51a429a0b73

SHA256
4a19c33bafd4a19f433bf047c0a65b03032f30ca9e79cf81162679c995ab7fd3

SHA512
5be1ae3c295f1c9ff55c64180ccb2090fc19b2e56da32023fc94b2608366a535e169fa1a13123d90093c8b3236c185dc4601f5ba81ae8c3bd7437d600aec8e23

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET552C.tmp

Filesize
920B

MD5
0924c62c7215be2b94c3101438b18331

SHA1
903210416166af1209c2d07321abc8042f71fd1a

SHA256
5e57b254e8238268336bf1979664e6edb036918cebaea261701bfb031fd127f0

SHA512
6388fd5576dffa987ec5005b3740363d6dc06f5c9f408ef8721186c4af125f69b1efa8f092e8a650e590c2953f38ee08cc12db879347b23d210d8c896b5f8331

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET552D.tmp

Filesize
234KB

MD5
169585dc9d5d651b23e10b643b222bec

SHA1
0138cd263a1a525918e288e0696f50a6a1d5e4fd

SHA256
bb79bab266b47ed66193721e5ba862f4e57737f2afe1137a428eb3d7a3c42170

SHA512
34b9e2f87613db9eb4641848ef49ea5ab1c39f983af24853cc83439b0d6a2ac26f796db619c30b22063e7bf630d9c861e423f0ca0057276b0b413e003c10c8c6

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET552E.tmp

Filesize
203KB

MD5
252cbe4fb5a2556e1961451e665228dd

SHA1
cfeb52d5167f79c9a7abfa5fb372b2ccac9131c1

SHA256
ceb59006a99d5c3703cad3ad30095c2b52fa713851f1ab01be575954dc58c525

SHA512
1e820bf11d0f44cb2f9e1a2d72237ca770cd9224efae66bc17516644f612d370771cf68c61d2794332b4a6116440c734ca78ef571b0842a4d289e7fa16ec01e8

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET554F.tmp

Filesize
14KB

MD5
50c689382b87745dff2204108e9382c1

SHA1
72fa86b073950457f4149729eec77a20b34f9a1a

SHA256
c5b542b0dc854a119da2c70815f76a23de4badd22279c70d6daf9979579d6345

SHA512
cc2312bc0dfad04da8b9e96e4e54a7e2ee253bb154830879203bbb919030989dc7fe9674f5ba9bfa5640ed784a3e887eb72818442036fd647753882c3296c25c

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET557E.tmp

Filesize
230KB

MD5
e91e609c087d735f0ea97b0145563046

SHA1
8c71e33105a17a6eea88ea99245df3ec4b58d17c

SHA256
4d5475f5f67f87023005c6f7984f12f7a8bf004c9e95fc15b14fae604ed12f6a

SHA512
52606285c72140f1e58da7d11e677a2d52c2b1d74d6f5009b0a02dad7c265f76d5df70e4a6df1af53f636b74727308ce14ef6813f61a782572d2d848f3585578

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Common\SET557F.tmp

Filesize
7KB

MD5
28bc09e9b96da00302652f9369cc0d0f

SHA1
2a34feafa843805958c9822e8328ca96e342b678

SHA256
262532eba530e8cc4b6f051e354966ecee290c4dbc20473f749ca99bdd997934

SHA512
8be8d529f70e0ffb67fa7495d0d650e38f2c7f9198c8b71b7abe066d6aee12340309bced6b90d72789b828e888dc6032c309a5ef3d826e83e5ca8f0faa0d79d1

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\SET55AF.tmp

Filesize
57KB

MD5
21c1324e7ab96aa4f7e5df694cbc3307

SHA1
3d5c1a1ce71cccf38240fb54e5ce2546ed7f53ac

SHA256
5612420351304ee65070bf405695d4fc57d656c1a383d5c2146afe90e56d9884

SHA512
eec55513d5888c9ce96c15c7dcb3d2a03dcec81b5dbb220b0b491c5a0a0ff9e9a96333d89bdadff016db0d2fb0a27a7d8bb12dd0a7ecdd08dfef54af3ada15c5

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\SET55B0.tmp

Filesize
24KB

MD5
1511e10cb038451be3c4e0aca1dc1b7a

SHA1
66789863f6432daa668eeccef59c086d35816ba5

SHA256
a5440ae0acd4906fdde54cc10373b914e113f69cb87db70197ef0e2709038891

SHA512
6b8c3f81ee7ad4d81d671b2f9aaca5d0996fc734532dc12f333daffd0c663f53ab147f57b730090d51af1909adc0c128119e83a60e21494dc63c5ba6a286d155

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET5172.tmp

Filesize
1.0MB

MD5
dc9584dbb91a63f3b24e5ad204635bde

SHA1
c887448421ac0b3e70740ecee07537c54d49180f

SHA256
10506082fc608c7fbae61fcfb4d3d5ef16def7763186c2c6fc15d5b0033b89ca

SHA512
cb235f01b6359a6a804838c060460ab07e8c451904db9ddb01ef6173bc1dd531387e347079cbe169200fa1d6b3d3c775d4fc8687b1116ee811ad16f420443968

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET5173.tmp

Filesize
112KB

MD5
9e0d88a774e08c7b556c13dd90a38a52

SHA1
a9aea9bba767342c5f785522b1e23e9c5c369f05

SHA256
91c2ab35a5765a4576c2767452bcd0639ac2cf3da1fc35d303bf61d7732f7782

SHA512
af60d11274585ac51ee4d00d4e4bda3cd1587dc21ea784365587cfbfdd496f82de8db7e5cd6276f31c41001d2940d2cbee3b6ea21cf421a958380236d1c91948

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET5193.tmp

Filesize
111KB

MD5
e3bb98e4c620cdb44afb9514181a04fb

SHA1
da2e8829e14de367c5c94874736ccd8c6995c901

SHA256
ed3a9cbc5a33c49bbb0cd2089aeb7fded2dd1aa9761e8318db24de5a4f0ab2ef

SHA512
a92962a6ce12ef6bc6409ad1427a6f237e70a45c2a39e37140354d37fe1edab46c2f1d0dd071579b00fa4b2c0cea20999041acf8fabaad765d68652ff0af0929

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET5194.tmp

Filesize
45KB

MD5
2cb84fd2638cf334850506061d539d60

SHA1
fbf0872b72f4b849afd0b62b57534ddf7ff14a4e

SHA256
0d147b96c250c4760d190b20dd8d2b17c5afee092a8e63ad160cf9603de03843

SHA512
62ab91d33e47dd4cd3242f1067de161a02ac98039395dfe766e2939806fe41b53ab8cbf6cb9e168bb18db76ab94e3f3fc0666843e9434fadcd863174d29b898f

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET51E3.tmp

Filesize
67KB

MD5
f9f9614aae1eee9a6d1370fcf9c85635

SHA1
f0b71804b163beee78e05464f1dc1988abd6aec4

SHA256
b4c917cc7f11d5c5fbd2426b688687891942d44f77348e7e25466c5c06ac4e81

SHA512
88b32e8e1224e34ef20607413afc7886f4f5cd79ad21498ce2618cba2da5cb42fa101965412f2a6f51d6df892d719b8f787b3cc553100fadb44a1ecf5eae49c0

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET51E4.tmp

Filesize
61KB

MD5
fdf5e14126a83f57f978940accf9ed3b

SHA1
bdb476d2b4547e1df826fc33de71462db9f399ac

SHA256
b25688df04a3ea78205e877fc596faaaeac4da4a7cc1b5e8a2aa4e1f6a44d0d0

SHA512
791ef57ad5fc5fd63df8f65764e41256f932c232ce3fec71ae37a716500371924b91ec76885a778ab511a325074473b0b058c93675bf54a26c5a726b5f82e664

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET5204.tmp

Filesize
49KB

MD5
5e5843d277bd6cf4263cccac34c4f403

SHA1
7472f2ad76251b9e4500090d044c514d42044ea9

SHA256
1626f8cf33553c4159d2934becd97ec6165d387a5feec34df635b8d56b21555f

SHA512
46fc557727936d9786ac31c1e60135d38439e418361ecc6a654eb0949146e37daec1a0f868e2a2252b0a4128ae8b6d44ef30da7f2bc9101aeefcc8d532131281

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET5225.tmp

Filesize
64KB

MD5
05b7a0f16d03ce0644b7008161a91bd6

SHA1
9dc0c5ae07eb34de295e6f595e0bb68598c34aef

SHA256
0d296344ee86742059cd84616658a12673b24ad80b3f466f704bd7f31e1fad84

SHA512
fbfec3f21fad10868fb7e10614e476e6f8b4b34e8903154fbfec4fc15376ec65d57f38a516576dfd93af770d7c746877b57f36cca22cf4d330e594554df2a24a

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET5226.tmp

Filesize
61KB

MD5
24369c05e4e81af0a48219de1fd7c7eb

SHA1
164e7ea8985f73c104e734f6bc98c25853ad6a3e

SHA256
46dc1994e91ee01b0e68935f1f3fcd2344ac1513015ea8ff74452fb92292d92e

SHA512
0578b58e47d8eb26e7bb93a88464ca596f63ca2b7cbd26e3e3b53c9dcd3c5f36e76dfa4f27252f34e27e080079103c17b161466abb285e691c5959fa69c0071f

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET5227.tmp

Filesize
45KB

MD5
0f9804f18ff9a447c2d8f3c9857eab71

SHA1
8b4038ae9e2776a70ae51cb9514c507d929c16a7

SHA256
521554390f727a4c3674805b1a3c9fee6417bbc75b3528c48c9a84fa3eaf4100

SHA512
fce5166143e69e4671d18dc600eccd3dc28efb64d9e1e4a946ca34b0763060b32db993b0999057545b7c6a4e3b9660cd4fd38c62ae10761ebaed08db31d92841

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET5237.tmp

Filesize
67KB

MD5
2f019a2aa8c859b98d29eb67242cc093

SHA1
4f42b0d6d78ab68c7348cde20aeeeef7e3cb592b

SHA256
f422d5a55a693da1aa478c12a897c27edb6eb06ab671aaa6c2208c8a1f7b5f81

SHA512
1a46f9f70d031eb8939fbf80d1820b763eabc347acfdf02449f9da88223078eab09860926d8df5b44027be7af7606e72f9f660ef4302ecfb2a9330c41052257b

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET5238.tmp

Filesize
65KB

MD5
c427cc9550db1006a6ab646ecbb67845

SHA1
7abcee900d9e4d21fed1beb6dd4f6eb71c81f916

SHA256
3e6f4ca45d3ceedf558702810f5ae8ac9020dfd709a2d1f7799701f8e4bc574b

SHA512
842e3f76cadd7ba09a118420ad02fdd38192de648a14bc3ba56b05eb52a31c2a4ced5463c1c911ae7a44e511d81a01cd48a5037c6cd488f95210f0a1c6c9e177

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET5249.tmp

Filesize
63KB

MD5
68f62f67c4e1977d78d8b9aa4ffa6b28

SHA1
cc2cddfb1047b018eee919610ac0dba715c45b5c

SHA256
8c6350751c68602aa83090b3455f5d4f476532aa0949697d8abdd672390838b4

SHA512
988d1b67b36a128e5fb4462195b3963fcf02be8ac55488be43a36b6930c3736fa73325281207e953556f017c1742ce124559a3c8c1386e78dc62134825c9b652

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET524A.tmp

Filesize
69KB

MD5
fabfc7005a025f13c81acdfb98444ba9

SHA1
bebb174627611399ce8ad5f2bafb5d53a419de0e

SHA256
c26234548b76630c126863458a927e62597d1e512856c745da61b9c7b2a35a85

SHA512
8ee11d18eb1ef7dae70383603aabef15d541166fd6a285e29d9ed9fc4877babacb51f16eacafc2dd59d2f88365a18265b2bffbe97865b2a8021a8de021c635d2

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET526A.tmp

Filesize
63KB

MD5
80be85e673fc3cd8f3770b5d0a627fed

SHA1
4ba8c5e101373b41689467f3263eea349ae8cda3

SHA256
7830ac4e2b190c0ce7a0780779f9cfc34a1db3008c8d34d5765892c80513436f

SHA512
8a609558bc4f0eb03e8881124d5fbabaed6907557ab3f2052b4fd85956d558b0925ae390c2b294360d7a302fb99e10c6a8f34a4a3802b2897273a54207bf4024

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET526B.tmp

Filesize
237KB

MD5
3ddf14f4738665c65605119f677954b3

SHA1
29b6f3dacdc249bc2a5c33ddfef9d098f419ea41

SHA256
c2dfc26d3eedd5221f39fbcb982d4ccd6890e8eaed1fdff23c0d38226b6e2f2f

SHA512
7de10b5fedc9dead5abb6e0b315501940cf3f9a0b244808873121311cf7b7803a4beffd2167f75905d491c784090e0244534f457ee705bff5abcca7400034c5e

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET526C.tmp

Filesize
67KB

MD5
7bf307be29dc6c8eec829f07c25b7f5c

SHA1
53e11cc4e79fbb031f125fc2418656b34bfb160a

SHA256
ed51debd3b1074f41b2a9d02a07465918c14de0356f80f2c8f4b8f82faf8b65b

SHA512
1a009734a1ad9106163f63c8eef61f1689ba1e4874dbcfec7d907359b46a6bd3344d7ea14c0171dab64f4abfc7b9b19d77121c69f50463b8f83b800a1b19eb82

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET527D.tmp

Filesize
66KB

MD5
36210719ed588769fe5cd9812cfd67a9

SHA1
9501082ce43999a4558f6f7d7778b22145dbe1fd

SHA256
83b5554e10d2e80debe6f747340036c6992b858422811f58609588dee496431f

SHA512
3dba309fb630e326405fa71b30f2cd98975666fe90705b7e54ca2dfc50c3bfe5c6b05bd195291d5a028d7bb163aee2ccb15e90af299eedabdf3600b814e2e97a

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET528D.tmp

Filesize
65KB

MD5
668f7e0724b130367aad94ae03ad739d

SHA1
dfcfc67a9b42118d97fb865d9095e0aae2a8fcbf

SHA256
d9b9c94fa456e3cc52436932447086b385bc87d2a163068c62f331f9145d2bb4

SHA512
6f6cb988b3f364b13e64c1d029879a0461636264f365572ae27fe97973f99e43d3a376e2ddd5d0c51ade63fd084e7776866871ef4d306bae4471b05dcb3993ca

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET528E.tmp

Filesize
1.3MB

MD5
ce601212d134a50e1d03275366015676

SHA1
eee6983cb4e7cce8474ab8a1a3e1dfc40457aaf6

SHA256
88cd126432627d8c99a74ca765240eeedb939e6d4289a75a2bb77848f79a46a3

SHA512
2469163f9f8d22f92dce6878b75d72ddedab85ed6114235cb5ba39bddcde2e5bc403023e8f67cd56167230f2ea5ab40a02ef0c7f802c1424bd686c9b21046a47

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET528F.tmp

Filesize
48KB

MD5
12bad4ca073309645d8181234f76b064

SHA1
28693c7694597a782e39951370142735c9a41e3b

SHA256
44d948f0ce93f1e3342cc2d49fa3da090eafbdcc55d9ca5dc59168c36b9e3f90

SHA512
dd5b7fb170b67ead123336eeaf5c5787cabec688110418f94119b80aeca39e80d388772e2f898baf392f7e7d385fa36c1a47ca0e40c8e97d937ce8aa9af65391

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET52A0.tmp

Filesize
65KB

MD5
1b92a68caab47fc3b4a18f0735b4ded5

SHA1
48cf68bfc6766301e48d69a2cf5a7d212c47970f

SHA256
837c4df5a53313ddc20de798705a26893328dda1e465063b795b0a8a3c5921fc

SHA512
69569c7a3d65069578296ec7e6ef9904386aa450a32feed509d7ee4bcf8e8c02f9c928c7255469e3ae1184a723c84be7d75c3e3f8c8b475d90f6da7fcf9d4836

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET52D0.tmp

Filesize
63KB

MD5
e7d25d0a3488f91ab00bdd3b4ff3af4f

SHA1
5ff0c2569535e2abe47f5744d07f5b1ca9b3cbfd

SHA256
54cbb07c2f8e8d8e753c05e86d8090a4b80dace118a8dfb5caf4c17c0e2c757a

SHA512
59ae338bf4d77a2f5cc730d9ddf1e8c7c2e1d2b0f9c32c0968b94d48417df2dd54519d562faecc8bdcff166b39c4d1a52f2b949f7ce595c66e0a635371aa8298

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET530F.tmp

Filesize
63KB

MD5
b8c149599054f8018edb943b831c664d

SHA1
e2b601bc67be75f7bdc2f4fe475f9a8cfae399e4

SHA256
392ccee1dcd1729a6f6cc6cd3cffb4e80fff54973a16201abaa27e5b2b4ead95

SHA512
a87841149fe52044a147c1e04f326ba140e1a6d31994e6a6c13f71ae89069e2bcfcc92cfcef7765a7cd0e2d550454bf69959756c64110dc421aa1e81aaca9b77

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET5330.tmp

Filesize
67KB

MD5
b0fe29c88fcea063caeb051a37a12ba4

SHA1
d075805cb756767116bdf1a24cd8aa3a687b93ea

SHA256
9bbd765d67dbc65a5e9f5e8e833337b6292d7cf0289b8695b53017682cef4f6d

SHA512
e1f2ceab7c25366697c5e204f185a573f9dc7e5a4894b09abae992909c39f2202601f1d84e91521d82fce515fe9fc4d48527fb3ab07336d52ccecb06c40543f3

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET5331.tmp

Filesize
66KB

MD5
6c80d94fa4eb9bcf32aa1d8b98f24358

SHA1
023cd379e206b9da6624a684b8a6ff05edb43574

SHA256
2f8d19d38c9efb90a675113fd7da26ad825f701885fc3dfa785a96a656258b90

SHA512
a2fc0a2b4393c279314244bdfcd23a399c705005e9fee9f05dee8f574da87ffc957503cb735065a458a2e6b08b1563d3308578df9f4af5145297fb5af1612e4c

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET5332.tmp

Filesize
64KB

MD5
f7446b9c03c41aa0135c148f92d785e2

SHA1
6e06ee2733835b7442fd15b135e024cf56ffbc85

SHA256
97919a0164599e5b3adab297e6d0697f79c6cf0a56f7166e1508048f8996f4b1

SHA512
08567379d75657064c0663e5bc52d12cfd7e5cba9e207c13421816b83f129583fd12f951186b1f648c0a8687b22a2f572d8df54a3925cdc3658bee36ec483c24

Download Submit
C:\Windows\System32\DriverStore\Temp\{981089a2-641f-b448-a1e1-6664acd2c32d}\Win64\SET5342.tmp

Filesize
63KB

MD5
7090e5b8184706069072a69ce8e6ce63

SHA1
10d4a2135353baccc04a8067822e140472933ba0

SHA256
1bfb329b4a5f38f427f3119c9ea4569b7ccce38d6123c00879170ad9213187db

SHA512
93627c16462bc0f706f8952c99e302f4b8c7df23e115c3509e49291ff413f5d5848419eb0e4f622aeff167d965bcb4d7e158aea6327c635f92783df7c87b74ee

Download Submit
memory/908-1114-0x0000000000400000-0x0000000000736000-memory.dmp

Filesize
3.2MB

Download
memory/908-1131-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/908-260-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/908-1282-0x0000000000400000-0x0000000000736000-memory.dmp

Filesize
3.2MB

Download
memory/908-1283-0x0000000000400000-0x0000000000736000-memory.dmp

Filesize
3.2MB

Download
memory/1176-2893-0x0000000003990000-0x0000000003A03000-memory.dmp

Filesize
460KB

Download
memory/1176-2894-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/1176-2902-0x00000000058B0000-0x00000000058B1000-memory.dmp

Filesize
4KB

Download
memory/1176-2905-0x00000000058C0000-0x00000000058C1000-memory.dmp

Filesize
4KB

Download
memory/1176-2914-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/1176-2851-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/1176-2854-0x0000000003990000-0x0000000003A03000-memory.dmp

Filesize
460KB

Download
memory/1176-2910-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/1176-2886-0x00000000055B0000-0x0000000005807000-memory.dmp

Filesize
2.3MB

Download
memory/1176-2898-0x0000000005960000-0x0000000005961000-memory.dmp

Filesize
4KB

Download
memory/1176-2901-0x00000000055B0000-0x0000000005892000-memory.dmp

Filesize
2.9MB

Download
memory/1176-2892-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/1176-2896-0x00000000055B0000-0x0000000005885000-memory.dmp

Filesize
2.8MB

Download
memory/1592-2909-0x0000000000400000-0x0000000000761000-memory.dmp

Filesize
3.4MB

Download
memory/1592-2908-0x0000000002680000-0x0000000002681000-memory.dmp

Filesize
4KB

Download
memory/1604-2889-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1604-2842-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1604-2915-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1616-1281-0x0000000000400000-0x00000000005C2000-memory.dmp

Filesize
1.8MB

Download
memory/1616-263-0x0000000004E70000-0x0000000004E71000-memory.dmp

Filesize
4KB

Download
memory/4128-1607-0x0000000000400000-0x00000000005C2000-memory.dmp

Filesize
1.8MB

Download
memory/4128-1286-0x0000000004C60000-0x0000000004C61000-memory.dmp

Filesize
4KB

Download
memory/4128-2850-0x0000000000400000-0x00000000005C2000-memory.dmp

Filesize
1.8MB

Download
memory/4128-1608-0x0000000004C60000-0x0000000004C61000-memory.dmp

Filesize
4KB

Download
memory/4128-2917-0x0000000000400000-0x00000000005C2000-memory.dmp

Filesize
1.8MB

Download
memory/4892-1285-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/4892-1287-0x0000000000400000-0x0000000000736000-memory.dmp

Filesize
3.2MB

Download