PUP.SilentInstallBuilder

The detection of PUP.SilentInstallBuilder on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take immediate action to remove it to prevent further damage.

What Is PUP.SilentInstallBuilder?

PUP.SilentInstallBuilder is a type of potentially unwanted program that can install itself on your system without your knowledge or consent. This type of software can be bundled with other programs or downloaded from the internet, often through deceptive means. PUPs can cause a range of problems, including slowing down your computer, displaying unwanted advertisements, and potentially leading to more severe security threats.

How PUP.SilentInstallBuilder Operates

PUP.SilentInstallBuilder operates by exploiting vulnerabilities in your system's security, often through social engineering tactics or software exploits. Once installed, it can begin to modify system settings, install additional software, and collect sensitive information without your permission. This type of malware can be challenging to detect, as it may not exhibit obvious symptoms, making it crucial to use reputable security software to identify and remove it.

Symptoms of Infection

While PUP.SilentInstallBuilder may not always exhibit obvious symptoms, some common signs of infection include slow system performance, unwanted pop-ups or advertisements, and unfamiliar programs or toolbars installed on your browser. You may also notice that your system's settings have been changed, or that your browser's homepage has been altered. If you suspect that your system has been infected with PUP.SilentInstallBuilder, it is essential to take immediate action to remove it.

How to Remove PUP.SilentInstallBuilder

1. Boot your system in Safe Mode with Networking to prevent the malware from loading and to allow for a more straightforward removal process.
2. Use a reputable security tool, such as SpyHunter, to perform a full scan of your system and identify all instances of PUP.SilentInstallBuilder.
3. Uninstall any suspicious programs or software that may be related to the PUP, taking care to follow the uninstallation instructions carefully.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or add-ons.
5. Reboot your system and perform a follow-up scan with your security software to ensure that all instances of the PUP have been removed.

Conclusion

Removing PUP.SilentInstallBuilder from your system requires careful attention to detail and a thorough understanding of the removal process. By following the steps outlined above and using reputable security software, you can effectively remove this potentially unwanted program and restore your system to a secure state. It is essential to remain vigilant and take proactive steps to protect your system from future threats, including keeping your operating system and software up to date, using strong antivirus software, and being cautious when downloading software or clicking on links from unknown sources.

Analysis Report

General information

Family Name:	PUP.SilentInstallBuilder
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: a32fc03a4961a6265a8580f88b030e7e SHA1: 89d93842a0102fba860fbf9ccb6523d2bbb93ede SHA256: F6ACC9C3B5D72E3DD9C8C3C1E2BC946F5235DD249718C3D53661517B21B03605 File Size: 1.97 MB, 1966088 bytes

MD5: fd1fbd0254ebf49926ba6e276836d89f SHA1: 94326a55988033de6ced221bc9f3fa0f1388a103 SHA256: 4152C034517F052815CF68791785AAAF76936774C44AADCB20E5EADFBDCD6E59 File Size: 417.82 KB, 417818 bytes

MD5: 53e234e810a6ff3c3f30454a59cfc9ed SHA1: 82f2c47c001d66e98f7d9ed65964a1827899efc8 SHA256: 388FF97DB8C8FF40915FE069FB83746DF7EF03871117F0088BFEBD3DA045C128 File Size: 816.07 KB, 816071 bytes

MD5: c021c05985c2085a64d0a21b3707382e SHA1: d7f20ebed9f2d7cc66bb5c9f5d0e798e9b0ce24e SHA256: 21ABB55BEE181A2775BA20F21DED526BE47FFD871FDC124D1E273833ED08E0F2 File Size: 3.86 MB, 3856384 bytes

MD5: 33db850591c72328cf7806f6e0492e00 SHA1: 8d9287c1550f81707e0e357d6ea757ac4ee8860a SHA256: 439647625B3A4946F018755524A14A441F90F1947340EA9004836A27B35C4544 File Size: 940.66 KB, 940657 bytes

Show More

MD5: a49b9592c3c23c9c026238ad4991028c SHA1: 350f7247f99c67fc701cc22ff1cc46e734a19f77 SHA256: F8736C5AE62E36DC555B7AA8096413B54851076D26D2CC0C88E169B8D8D92F43 File Size: 271.04 KB, 271040 bytes

MD5: 327c1b6e03a3e82f9634ff951a9eab57 SHA1: 7b4a545e924772c35dfefc35ac4c61608108a1f3 SHA256: 3D62B36C7C7011D1A84E08007A2D7FAF53297AB8782354919EE9C0214050FA06 File Size: 4.91 MB, 4913152 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)

Show More

• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	AprelTech, llc Synaptics TODO: <Company name>
File Description	Sibl Synaptics Pointing Device Driver TODO: <File description>
File Version	6.4.0.0 1.0.0.4 1.0.0.1 1.0.0 0.0.0.0
Internal Name	Sibl.exe stub.exe
Legal Copyright	Copyright (C) 2018 Copyright © 2025 AprelTech, llc
Original Filename	Sibl.exe stub.exe
Product Name	Silent Install Builder Synaptics Pointing Device Driver TODO: <Product name> xfpsp2023
Product Version	6.4.0.0 1.0.0.1 1.0.0.0 1.0.0 0.0.0.0

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
APREL Tehnologija d.o.o.	Sectigo Public Code Signing Root R46	Hash Mismatch

File Traits

• Installer Version
• WriteProcessMemory
• x86

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe\dav rpc service	Generic Read,Write Data,Write Attributes,Write extended,Append data
\device\namedpipe\gmdasllogger	Generic Write,Read Attributes
\device\namedpipe\pshost.134169797421801444.208.defaultappdomain.powershell	Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288
\device\namedpipe\wkssvc	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\programdata\synaptics	Synchronize,Write Attributes
c:\programdata\synaptics\rcxfbda.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\programdata\synaptics\synaptics.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\programdata\synaptics\synaptics.exe	Synchronize,Write Attributes
c:\programdata\synaptics\synaptics.exe	Synchronize,Write Data
c:\users\user\appdata\local\sibl\sib.dat	Generic Read,Write Data,Write Attributes,Write extended,Append data

Show More

c:\users\user\appdata\local\temp\__psscriptpolicytest_4q44xbke.1jc.ps1	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\__psscriptpolicytest_ljgr2oxe.5ud.psm1	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\hvju4xi.ini	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nsabc70.tmp\sibuia.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaf65.tmp\sibuia.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsqbdb8.tmp\sibuia.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nszb8c7.tmp\modern-wizard.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nszb8c7.tmp\nsdialogs.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nszb8c7.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\psa862.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\psa862.tmp.ps1	Synchronize,Write Data
c:\users\user\appdata\local\temp\rgic2bc.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rgic2bc.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rgic33a.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rgic33a.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rgic389.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rgic389.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rgic3f7.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rgic3f7.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rgic475.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rgic475.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\sibafc3.tmp\0\c204.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\sibafc3.tmp\0\c204.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\sibafc3.tmp\sibca.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\sibafc3.tmp\sibca.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\sibafc3.tmp\sibclr.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\sibafc3.tmp\sibclr.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\sibbccf.tmp\0\sorv7.cmd	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\sibbccf.tmp\0\sorv7.cmd	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\sibbccf.tmp\0\xfpsp2023.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\sibbccf.tmp\0\xfpsp2023.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\sibbccf.tmp\2\ccleaner.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\sibbccf.tmp\ionic.zip.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\sibbccf.tmp\ionic.zip.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\sibbccf.tmp\sibca.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\sibbccf.tmp\sibca.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\sibbccf.tmp\sibclr.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\sibbccf.tmp\sibclr.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\sibbccf.tmp\zip.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\sibbccf.tmp\zip.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\sibbe17.tmp\0\patch.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\sibbe17.tmp\0\patch.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\sibbe17.tmp\sibca.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\sibbe17.tmp\sibca.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\sibbe17.tmp\sibclr.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\sibbe17.tmp\sibclr.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\tmp4352$.tmp	Generic Write,Read Attributes,Delete
c:\users\user\appdata\roaming\winsl	Synchronize,Write Attributes
c:\users\user\appdata\roaming\winsl\l5\8\2026	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\downloads\._cache_7b4a545e924772c35dfefc35ac4c61608108a1f3_0004913152	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\downloads\._cache_7b4a545e924772c35dfefc35ac4c61608108a1f3_0004913152	Synchronize,Write Attributes
c:\users\user\downloads\82f2c47c001d66e98f7d9ed65964a1827899efc8_0000816071	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\downloads\82f2c47c001d66e98f7d9ed65964a1827899efc8_0000816071	Generic Write,Read Attributes
c:\users\user\downloads\82f2c47c001d66e98f7d9ed65964a1827899efc8_0000816071	Synchronize,Write Attributes
c:\users\user\downloads\plagins.dat	Generic Write,Read Attributes
c:\windows\appcompat\programs\amcache.hve	Read Data,Read Control,Write Data
c:\windows\appcompat\programs\amcache.hve	Write Attributes
c:\windows\svchost.exe	Generic Write,Read Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\software\wow6432node\microsoft\schedulingagent::taskkey	譙┝	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\schedulingagent::checsib	2025-11-19	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	ᒠﯢꙺǜ	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\advanced inf setup\ie complist::ie.hkcuzoneinfo		RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	ル䫷ꪸǜ	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries	`$�!�:i��+00�� �Gs]XM���"�2� �FX D�':D��exA-��LG=�A��J� �C �	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries	`$�!�:i��+00�� �Gs]XM���"�2� �FX D�':D��exA-�]T�� �B�����wȻ	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries	`$�!�:i��+00�� �Gs]XM���"�2� �FX ���n����<���]T�� �B�����wȻ	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	Ul ( �v�Z������Bx(�1`1�1HO@V�A��H[uN$ _�zk`k�qw�n{b��P���! ��� ����3 �������������m�Ù��V����$ �8წ���V�l��&M�~�=�S/�B1_T�Vw�`�V �R���%�� �������AE�Q]��D��&��	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::synaptics pointing device driver	C:\ProgramData\Synaptics\Synaptics.exe	RegNtPreCreateKey

Show More

HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475	陌 ȁ 獖}	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	Vl . �v�Z��������Bx(�1`1�1HO@V�A��H[uN$ _�zk`k�qw�n{b��P���! ��� ��7 ����3 �M�������������m�Ù��IV�V����$ �8წ���V�l��&M�(! ��j�~� �=�S/�B1_T�Vw�`�V �R���%��	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	Wl / �v�Z��������Bx(�1`1�1HO@V�A��H[uN$ _�zk`k�qr�7 w�n{b��P���! ��� ��7 ����3 �M�������������m�Ù��IV�V����$ �8წ���V�l��&M�(! ��j�~� �=�S/�B1_T�Vw�`�V �R���	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Anti Debug	IsDebuggerPresent NtQuerySystemInformation
User Data Access	GetComputerNameEx GetUserDefaultLocaleName GetUserName GetUserNameEx GetUserObjectInformation
Other Suspicious	AdjustTokenPrivileges SetWindowsHookEx
Encryption Used	BCryptOpenAlgorithmProvider CryptAcquireContext
Keyboard Access	GetKeyState
Network Winhttp	WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest
Process Manipulation Evasion	NtUnmapViewOfSection ReadProcessMemory ZwMapViewOfSection
Process Shell Execute	CreateProcess ShellExecuteEx
Process Terminate	TerminateProcess
Service Control	OpenSCManager StartServiceCtrlDispatcher
Syscall Use	ntdll.dll!NtAccessCheck ntdll.dll!NtAlertThreadByThreadId ntdll.dll!NtAlpcConnectPortEx ntdll.dll!NtAlpcQueryInformation ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtClearEvent ntdll.dll!NtClose ntdll.dll!NtConnectPort ntdll.dll!NtCreateEvent Show More ntdll.dll!NtCreateFile ntdll.dll!NtCreateMutant ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore ntdll.dll!NtDeviceIoControlFile ntdll.dll!NtDuplicateObject ntdll.dll!NtDuplicateToken ntdll.dll!NtEnumerateKey ntdll.dll!NtEnumerateValueKey ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenDirectoryObject ntdll.dll!NtOpenEvent ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenMutant ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenProcessTokenEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenSemaphore ntdll.dll!NtOpenThreadToken ntdll.dll!NtOpenThreadTokenEx ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQuerySecurityObject ntdll.dll!NtQuerySystemInformation ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtQueryWnfStateData ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseSemaphore ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationKey ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSetTimer2 ntdll.dll!NtSubscribeWnfStateChange ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtWaitForAlertByThreadId ntdll.dll!NtWaitForMultipleObjects ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWorkerFactoryWorkerReady ntdll.dll!NtWriteFile UNKNOWN
Network Winsock2	WSAStartup WSAttemptAutodialName
Network Wininet	InternetOpen InternetOpenUrl InternetReadFile
Network Winsock	bind closesocket gethostbyname getsockname socket

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

C:\Windows\Microsoft.NET\Framework\v2.0.50727\\dw20.exe dw20.exe -x -s 1300

C:\Users\Cibosnjx\AppData\Local\Temp\sibAFC3.tmp\0\C204.exe

"C:\WINDOWS\svchost.exe" "c:\users\user\downloads\82f2c47c001d66e98f7d9ed65964a1827899efc8_0000816071"

"c:\users\user\downloads\82f2c47c001d66e98f7d9ed65964a1827899efc8_0000816071"

C:\Users\Esmnxvrb\AppData\Local\Temp\sibBE17.tmp\0\Patch.exe

Show More

"sorv7.cmd" /s

C:\Users\Ssdxcbia\AppData\Local\Temp\sibBCCF.tmp\0\xfpsp2023.exe xfpsp2023.exe

"C:\Users\Ssdxcbia\AppData\Local\Temp\sibBCCF.tmp\2\ccleaner.exe" /s

C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file "C:\Users\Hnvwintr\AppData\Local\Temp\psA862.tmp.ps1"

runas c:\users\user\downloads\._cache_7b4a545e924772c35dfefc35ac4c61608108a1f3_0004913152

runas C:\ProgramData\Synaptics\Synaptics.exe InjUpdate