Analysis
-
max time kernel
1204s -
max time network
1208s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/11/2022, 20:06
Static task
static1
Behavioral task
behavioral1
Sample
IObit Driver Booster Pro 9.2.0.173 Multilingual.zip
Resource
win7-20220812-en
General
-
Target
IObit Driver Booster Pro 9.2.0.173 Multilingual.zip
-
Size
31.2MB
-
MD5
23065825b6884c76e36056a6cbd4d987
-
SHA1
4070a7e5ace6de9fc6ee8b56f859493aeea4f873
-
SHA256
567f903bfa1f6a7d84daee019e4aa5524567cf35ced3f5d70601870fc8589818
-
SHA512
1fc1c0c42f847e242da31e9e5f8340383e1df2f624560fbe762e39347538439348e579ae7af5c0457612c2953bea01f9f5129cfbc15b7ed7953c6ae1d2558808
-
SSDEEP
786432:W2YrbWmslCAqhgrhXqWEF2Z4LsPXWwkR1qsmP1mrY2FP:WJbOtrZqZv45kTgP1mrY2l
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0006000000022fcb-161.dat acprotect behavioral2/files/0x0006000000022fcb-159.dat acprotect -
Downloads MZ/PE file
-
Executes dropped EXE 28 IoCs
pid Process 4952 driver_booster_setup.exe 4048 driver_booster_setup.tmp 3236 setup.exe 4208 driver_booster_setup.exe 3772 driver_booster_setup.tmp 4524 HWiNFO.exe 4804 CareScan.exe 1460 ICONPIN64.exe 1188 SetupHlp.exe 1800 RttHlp.exe 3972 InstStat.exe 3536 SetupHlp.exe 3240 DriverBooster.exe 4956 HWiNFO.exe 456 Manta.exe 3432 AutoUpdate.exe 3180 ChangeIcon.exe 2644 NoteIcon.exe 1292 RttHlp.exe 4040 Manta.exe 1276 Manta.exe 4696 RttHlp.exe 1992 SetupHlp.exe 4580 AUpdate.exe 2304 ChangeIcon.exe 1852 sgupd.exe 3020 rma.exe 1648 ChangeIcon.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation driver_booster_setup.tmp Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation driver_booster_setup.tmp Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation setup.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AutoUpdate.exe -
Loads dropped DLL 64 IoCs
pid Process 4524 HWiNFO.exe 4804 CareScan.exe 4804 CareScan.exe 4804 CareScan.exe 4804 CareScan.exe 4804 CareScan.exe 4804 CareScan.exe 4804 CareScan.exe 4804 CareScan.exe 4804 CareScan.exe 1188 SetupHlp.exe 3068 Explorer.EXE 1188 SetupHlp.exe 1188 SetupHlp.exe 1800 RttHlp.exe 1800 RttHlp.exe 1800 RttHlp.exe 1800 RttHlp.exe 3972 InstStat.exe 3972 InstStat.exe 3536 SetupHlp.exe 3536 SetupHlp.exe 3536 SetupHlp.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 456 Manta.exe 456 Manta.exe 456 Manta.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3432 AutoUpdate.exe 3432 AutoUpdate.exe 3432 AutoUpdate.exe 3432 AutoUpdate.exe 3432 AutoUpdate.exe 3432 AutoUpdate.exe 3432 AutoUpdate.exe 456 Manta.exe 456 Manta.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks for any installed AV software in registry 1 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\AntiVir Desktop CareScan.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\AntiVir Desktop CareScan.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Avira\AntiVirus CareScan.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Avast Software\Avast CareScan.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\Avast Software\Avast CareScan.exe Key opened \REGISTRY\MACHINE\Software\Avast Software\Avast CareScan.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: CareScan.exe File opened (read-only) \??\V: CareScan.exe File opened (read-only) \??\X: CareScan.exe File opened (read-only) \??\Y: CareScan.exe File opened (read-only) \??\B: CareScan.exe File opened (read-only) \??\N: CareScan.exe File opened (read-only) \??\O: CareScan.exe File opened (read-only) \??\P: CareScan.exe File opened (read-only) \??\R: CareScan.exe File opened (read-only) \??\Z: CareScan.exe File opened (read-only) \??\A: CareScan.exe File opened (read-only) \??\K: CareScan.exe File opened (read-only) \??\M: CareScan.exe File opened (read-only) \??\U: CareScan.exe File opened (read-only) \??\H: CareScan.exe File opened (read-only) \??\L: CareScan.exe File opened (read-only) \??\G: CareScan.exe File opened (read-only) \??\I: CareScan.exe File opened (read-only) \??\J: CareScan.exe File opened (read-only) \??\Q: CareScan.exe File opened (read-only) \??\T: CareScan.exe File opened (read-only) \??\W: CareScan.exe File opened (read-only) \??\E: CareScan.exe File opened (read-only) \??\F: CareScan.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
pid Process 3240 DriverBooster.exe 456 Manta.exe 3432 AutoUpdate.exe 1292 RttHlp.exe 4040 Manta.exe 1276 Manta.exe 4696 RttHlp.exe 1992 SetupHlp.exe 4580 AUpdate.exe 3020 rma.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\DpInst\x86\is-KR3LU.tmp driver_booster_setup.tmp File opened for modification C:\Program Files (x86)\IObit\Driver Booster\9.2.0\ZLBA362.tmp CareScan.exe File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\is-0DUUN.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\ErrCodeSpec\is-RHA9S.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\ScanData\scan.dat DriverBooster.exe File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\is-HI0UI.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Language\is-MGGJ0.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\is-ETR5R.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\ErrCodeSpec\is-OQPUR.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\LocalData\is-V51KO.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Icons\Apps\is-HIJ4C.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\database\startupSignature.db CareScan.exe File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\is-UDC7G.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\DrvInstall\is-SG9QI.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Boost\is-M0B0E.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\ErrCodeSpec\is-ECD7H.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Icons\Apps\IVBicon.png AutoUpdate.exe File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\History\is-JHHFQ.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Language\is-9L4FM.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Language\is-R937B.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\ErrCodeSpec\is-AAETS.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\database\StartupInfoBlack.db CareScan.exe File opened for modification C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Update\Freeware.ini AutoUpdate.exe File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\DrvInstall\is-9PN2P.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Skin\is-NONLK.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\ErrCodeSpec\is-IKSK8.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\is-QOKFC.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\History\is-AABIU.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\LocalData\is-RT86U.tmp driver_booster_setup.tmp File opened for modification C:\Program Files (x86)\IObit\Driver Booster\9.2.0\LocalData\WhiteList.ini SetupHlp.exe File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Icons\Apps\pdfmini.png AutoUpdate.exe File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Language\is-7TBSV.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\ErrCodeSpec\is-ADBTC.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Icons\Apps\is-3BQR6.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Update\Update.ini.tmp AutoUpdate.exe File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\is-RIHD6.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\is-UE6ES.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\is-19I9F.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\DpInst\x64\is-PDPRQ.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Language\is-NTOER.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\LocalData\is-6F76J.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\is-U1BSA.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Database\is-VRAB0.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Language\is-E53LQ.tmp driver_booster_setup.tmp File opened for modification C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Update\appver-ac.ini AutoUpdate.exe File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Update\Temp\IVBicon.png AutoUpdate.exe File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Boost\is-2K79J.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\DrvInstall\is-FQIQI.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\is-3H4HP.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\ErrCodeSpec\is-U3EL4.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\ErrCodeSpec\is-HPBEU.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Icons\Apps\is-1AAOU.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Icons\Apps\is-F3OL0.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\is-CDD72.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Database\Scan\is-5FARF.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Language\is-ALFOK.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\LocalData\is-TKMA4.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\LocalData\Apps.ini AutoUpdate.exe File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\is-QLIVO.tmp driver_booster_setup.tmp File opened for modification C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Update\Update.ini AutoUpdate.exe File opened for modification C:\Program Files (x86)\IObit\Driver Booster\9.2.0\LocalData\IconState.ini ChangeIcon.exe File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\DrvInstall\is-HFSI2.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Language\is-8OEFT.tmp driver_booster_setup.tmp File created C:\Program Files (x86)\IObit\Driver Booster\9.2.0\LocalData\is-FNBS4.tmp driver_booster_setup.tmp -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\INF\c_processor.PNF DriverBooster.exe File created C:\Windows\INF\c_volume.PNF DriverBooster.exe File created C:\Windows\INF\c_monitor.PNF DriverBooster.exe File created C:\Windows\INF\c_diskdrive.PNF DriverBooster.exe File created C:\Windows\INF\c_media.PNF DriverBooster.exe File created C:\Windows\INF\c_display.PNF DriverBooster.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName DriverBooster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0009 DriverBooster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002 DriverBooster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003\ DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg DriverBooster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 DriverBooster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceCharacteristics DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\ DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\ DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ DriverBooster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 DriverBooster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceCharacteristics DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags DriverBooster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0004 DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002\ DriverBooster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0004 DriverBooster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DriverBooster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003 DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004\ DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004\ DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Driver DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Driver DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\ DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ DriverBooster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002 DriverBooster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc DriverBooster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003\ DriverBooster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 DriverBooster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LocationInformation DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Address DriverBooster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName DriverBooster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003 DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004\ DriverBooster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0009\ DriverBooster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004 DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceType DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Address DriverBooster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceType DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Address DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Mfg DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LocationInformation DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\ DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceType DriverBooster.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0009\ DriverBooster.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 DriverBooster.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString DriverBooster.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Toolbar Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Explorer.EXE -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193" Explorer.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dbop\ = "DB_Open_dbop" SetupHlp.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\MRUListEx = 00000000ffffffff Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dbop SetupHlp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DB_Open_dbop\shell SetupHlp.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0\MRUListEx = 00000000ffffffff Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DB_Open_dbop SetupHlp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DB_Open_dbd\shell SetupHlp.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0\0 = 5600310000000000625587a910003932463939427e312e3000003c0009000400efbe625585a9625587a92e000000882f02000000060000000000000000000000000000009114990039002e0032002e00300000001a000000 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DB_Open_dbd SetupHlp.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1 = 9800310000000000625585a9110050524f4752417e320000800009000400efbe874fdb49625587a92e000000c3040000000001000000000000000000560000000000a94bd200500072006f006700720061006d002000460069006c0065007300200028007800380036002900000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003700000018000000 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0\0 Explorer.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dbd\ = "DB_Open_dbd" SetupHlp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DB_Open_dbd\ SetupHlp.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" Explorer.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DB_Open_dbop\ SetupHlp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dbd SetupHlp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DB_Open_dbd\shell\open\command SetupHlp.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 Explorer.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DB_Open_dbop\shell\open\command\ = "C:\\Program Files (x86)\\IObit\\Driver Booster\\9.2.0\\OfflineUpdater.exe \"%1\"" SetupHlp.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 0100000000000000ffffffff Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\MRUListEx = 00000000ffffffff Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 0000000001000000ffffffff Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0 = 6600310000000000625585a910004452495645527e3100004e0009000400efbe625585a9625587a92e000000872f0200000006000000000000000000000000000000a94bd200440072006900760065007200200042006f006f007300740065007200000018000000 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0\0\MRUListEx = ffffffff Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193" Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DB_Open_dbd\shell\open SetupHlp.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0\0\NodeSlot = "3" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Explorer.EXE -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 DriverBooster.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e AutoUpdate.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 DriverBooster.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e DriverBooster.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 DriverBooster.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e AutoUpdate.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e AutoUpdate.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e AutoUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 DriverBooster.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e DriverBooster.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e DriverBooster.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 DriverBooster.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e DriverBooster.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 DriverBooster.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 AutoUpdate.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3068 Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4048 driver_booster_setup.tmp 4048 driver_booster_setup.tmp 4048 driver_booster_setup.tmp 4048 driver_booster_setup.tmp 3236 setup.exe 3236 setup.exe 3772 driver_booster_setup.tmp 3772 driver_booster_setup.tmp 3772 driver_booster_setup.tmp 3772 driver_booster_setup.tmp 4804 CareScan.exe 4804 CareScan.exe 3772 driver_booster_setup.tmp 3772 driver_booster_setup.tmp 1188 SetupHlp.exe 1188 SetupHlp.exe 3772 driver_booster_setup.tmp 3772 driver_booster_setup.tmp 3972 InstStat.exe 3972 InstStat.exe 3536 SetupHlp.exe 3536 SetupHlp.exe 3536 SetupHlp.exe 3536 SetupHlp.exe 4804 CareScan.exe 4804 CareScan.exe 4804 CareScan.exe 4804 CareScan.exe 4804 CareScan.exe 4804 CareScan.exe 4804 CareScan.exe 4804 CareScan.exe 4804 CareScan.exe 4804 CareScan.exe 4804 CareScan.exe 4804 CareScan.exe 4804 CareScan.exe 4804 CareScan.exe 4804 CareScan.exe 4804 CareScan.exe 4804 CareScan.exe 4804 CareScan.exe 4804 CareScan.exe 4804 CareScan.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 3240 DriverBooster.exe 456 Manta.exe 456 Manta.exe 3432 AutoUpdate.exe 3432 AutoUpdate.exe 456 Manta.exe 456 Manta.exe 3432 AutoUpdate.exe 3432 AutoUpdate.exe 1292 RttHlp.exe 1292 RttHlp.exe 4040 Manta.exe 4040 Manta.exe 1276 Manta.exe 1276 Manta.exe 1292 RttHlp.exe 1292 RttHlp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3068 Explorer.EXE -
Suspicious behavior: LoadsDriver 6 IoCs
pid Process 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 3788 7zG.exe Token: 35 3788 7zG.exe Token: SeSecurityPrivilege 3788 7zG.exe Token: SeSecurityPrivilege 3788 7zG.exe Token: SeRestorePrivilege 4984 7zG.exe Token: 35 4984 7zG.exe Token: SeSecurityPrivilege 4984 7zG.exe Token: SeSecurityPrivilege 4984 7zG.exe Token: SeDebugPrivilege 4048 driver_booster_setup.tmp Token: SeDebugPrivilege 3772 driver_booster_setup.tmp Token: SeLoadDriverPrivilege 4524 HWiNFO.exe Token: SeLoadDriverPrivilege 4524 HWiNFO.exe Token: SeLoadDriverPrivilege 4524 HWiNFO.exe Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeRestorePrivilege 4804 CareScan.exe Token: SeBackupPrivilege 4804 CareScan.exe Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE -
Suspicious use of FindShellTrayWindow 22 IoCs
pid Process 3788 7zG.exe 4984 7zG.exe 3236 setup.exe 3772 driver_booster_setup.tmp 1460 ICONPIN64.exe 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3240 DriverBooster.exe 3240 DriverBooster.exe 3068 Explorer.EXE 3068 Explorer.EXE 3240 DriverBooster.exe 3068 Explorer.EXE 3068 Explorer.EXE 3240 DriverBooster.exe 3240 DriverBooster.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE 3068 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4952 wrote to memory of 4048 4952 driver_booster_setup.exe 103 PID 4952 wrote to memory of 4048 4952 driver_booster_setup.exe 103 PID 4952 wrote to memory of 4048 4952 driver_booster_setup.exe 103 PID 4048 wrote to memory of 3236 4048 driver_booster_setup.tmp 104 PID 4048 wrote to memory of 3236 4048 driver_booster_setup.tmp 104 PID 4048 wrote to memory of 3236 4048 driver_booster_setup.tmp 104 PID 3236 wrote to memory of 4208 3236 setup.exe 105 PID 3236 wrote to memory of 4208 3236 setup.exe 105 PID 3236 wrote to memory of 4208 3236 setup.exe 105 PID 4208 wrote to memory of 3772 4208 driver_booster_setup.exe 106 PID 4208 wrote to memory of 3772 4208 driver_booster_setup.exe 106 PID 4208 wrote to memory of 3772 4208 driver_booster_setup.exe 106 PID 3772 wrote to memory of 4524 3772 driver_booster_setup.tmp 107 PID 3772 wrote to memory of 4524 3772 driver_booster_setup.tmp 107 PID 3772 wrote to memory of 4524 3772 driver_booster_setup.tmp 107 PID 3772 wrote to memory of 4804 3772 driver_booster_setup.tmp 108 PID 3772 wrote to memory of 4804 3772 driver_booster_setup.tmp 108 PID 3772 wrote to memory of 4804 3772 driver_booster_setup.tmp 108 PID 3772 wrote to memory of 1460 3772 driver_booster_setup.tmp 110 PID 3772 wrote to memory of 1460 3772 driver_booster_setup.tmp 110 PID 3772 wrote to memory of 1188 3772 driver_booster_setup.tmp 109 PID 3772 wrote to memory of 1188 3772 driver_booster_setup.tmp 109 PID 3772 wrote to memory of 1188 3772 driver_booster_setup.tmp 109 PID 1460 wrote to memory of 3068 1460 ICONPIN64.exe 48 PID 1188 wrote to memory of 1800 1188 SetupHlp.exe 113 PID 1188 wrote to memory of 1800 1188 SetupHlp.exe 113 PID 1188 wrote to memory of 1800 1188 SetupHlp.exe 113 PID 3772 wrote to memory of 3972 3772 driver_booster_setup.tmp 115 PID 3772 wrote to memory of 3972 3772 driver_booster_setup.tmp 115 PID 3772 wrote to memory of 3972 3772 driver_booster_setup.tmp 115 PID 3236 wrote to memory of 3536 3236 setup.exe 116 PID 3236 wrote to memory of 3536 3236 setup.exe 116 PID 3236 wrote to memory of 3536 3236 setup.exe 116 PID 3068 wrote to memory of 3240 3068 Explorer.EXE 117 PID 3068 wrote to memory of 3240 3068 Explorer.EXE 117 PID 3068 wrote to memory of 3240 3068 Explorer.EXE 117 PID 3240 wrote to memory of 4956 3240 DriverBooster.exe 118 PID 3240 wrote to memory of 4956 3240 DriverBooster.exe 118 PID 3240 wrote to memory of 4956 3240 DriverBooster.exe 118 PID 3240 wrote to memory of 456 3240 DriverBooster.exe 119 PID 3240 wrote to memory of 456 3240 DriverBooster.exe 119 PID 3240 wrote to memory of 456 3240 DriverBooster.exe 119 PID 3240 wrote to memory of 3432 3240 DriverBooster.exe 120 PID 3240 wrote to memory of 3432 3240 DriverBooster.exe 120 PID 3240 wrote to memory of 3432 3240 DriverBooster.exe 120 PID 3240 wrote to memory of 3180 3240 DriverBooster.exe 121 PID 3240 wrote to memory of 3180 3240 DriverBooster.exe 121 PID 3240 wrote to memory of 3180 3240 DriverBooster.exe 121 PID 3240 wrote to memory of 2644 3240 DriverBooster.exe 122 PID 3240 wrote to memory of 2644 3240 DriverBooster.exe 122 PID 3240 wrote to memory of 2644 3240 DriverBooster.exe 122 PID 3240 wrote to memory of 1292 3240 DriverBooster.exe 123 PID 3240 wrote to memory of 1292 3240 DriverBooster.exe 123 PID 3240 wrote to memory of 1292 3240 DriverBooster.exe 123 PID 3240 wrote to memory of 4040 3240 DriverBooster.exe 124 PID 3240 wrote to memory of 4040 3240 DriverBooster.exe 124 PID 3240 wrote to memory of 4040 3240 DriverBooster.exe 124 PID 3240 wrote to memory of 1276 3240 DriverBooster.exe 125 PID 3240 wrote to memory of 1276 3240 DriverBooster.exe 125 PID 3240 wrote to memory of 1276 3240 DriverBooster.exe 125 PID 3240 wrote to memory of 4696 3240 DriverBooster.exe 128 PID 3240 wrote to memory of 4696 3240 DriverBooster.exe 128 PID 3240 wrote to memory of 4696 3240 DriverBooster.exe 128 PID 3240 wrote to memory of 1992 3240 DriverBooster.exe 127
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\IObit Driver Booster Pro 9.2.0.173 Multilingual.zip"2⤵PID:2276
-
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap1664:174:7zEvent212752⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3788
-
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\IObit Driver Booster Pro 9.2.0.173 Multilingual\" -an -ai#7zMap21033:192:7zEvent15692⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4984
-
-
C:\Users\Admin\Desktop\IObit Driver Booster Pro 9.2.0.173 Multilingual\driver_booster_setup.exe"C:\Users\Admin\Desktop\IObit Driver Booster Pro 9.2.0.173 Multilingual\driver_booster_setup.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\is-HGRTR.tmp\driver_booster_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-HGRTR.tmp\driver_booster_setup.tmp" /SL5="$3035C,26666375,139264,C:\Users\Admin\Desktop\IObit Driver Booster Pro 9.2.0.173 Multilingual\driver_booster_setup.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\is-79QG3.tmp-dbinst\setup.exe"C:\Users\Admin\AppData\Local\Temp\is-79QG3.tmp-dbinst\setup.exe" "C:\Users\Admin\Desktop\IObit Driver Booster Pro 9.2.0.173 Multilingual\driver_booster_setup.exe" /title="Driver Booster 9" /dbver=9.2.0.173 /eula="C:\Users\Admin\AppData\Local\Temp\is-79QG3.tmp-dbinst\EULA.rtf" /showlearnmore /pmtproduct /nochromepmt4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\Desktop\IObit Driver Booster Pro 9.2.0.173 Multilingual\driver_booster_setup.exe"C:\Users\Admin\Desktop\IObit Driver Booster Pro 9.2.0.173 Multilingual\driver_booster_setup.exe" /sp- /verysilent /Installer /norestart /DIR="C:\Program Files (x86)\IObit\Driver Booster" /Installer-DeskIcon /Installer-TaskIcon5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\is-P4JTM.tmp\driver_booster_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-P4JTM.tmp\driver_booster_setup.tmp" /SL5="$4007C,26666375,139264,C:\Users\Admin\Desktop\IObit Driver Booster Pro 9.2.0.173 Multilingual\driver_booster_setup.exe" /sp- /verysilent /Installer /norestart /DIR="C:\Program Files (x86)\IObit\Driver Booster" /Installer-DeskIcon /Installer-TaskIcon6⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Program Files (x86)\IObit\Driver Booster\9.2.0\HWiNFO\HWiNFO.exe"C:\Program Files (x86)\IObit\Driver Booster\9.2.0\HWiNFO\HWiNFO.exe" /brandname7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4524
-
-
C:\Program Files (x86)\IObit\Driver Booster\9.2.0\CareScan.exe"C:\Program Files (x86)\IObit\Driver Booster\9.2.0\CareScan.exe" /savefile /silentscan /low /output="C:\Program Files (x86)\IObit\Driver Booster\9.2.0\ScanData\ScanResult_all.ini"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4804
-
-
C:\Program Files (x86)\IObit\Driver Booster\9.2.0\SetupHlp.exe"C:\Program Files (x86)\IObit\Driver Booster\9.2.0\SetupHlp.exe" /install /setup="C:\Users\Admin\Desktop\IObit Driver Booster Pro 9.2.0.173 Multilingual\driver_booster_setup.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Program Files (x86)\IObit\Driver Booster\9.2.0\RttHlp.exe"C:\Program Files (x86)\IObit\Driver Booster\9.2.0\RttHlp.exe" /winstdate8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800
-
-
-
C:\Program Files (x86)\IObit\Driver Booster\9.2.0\TaskbarPin\ICONPIN64.exe"C:\Program Files (x86)\IObit\Driver Booster\9.2.0\TaskbarPin\ICONPIN64.exe" pin "C:\Program Files (x86)\IObit\Driver Booster\9.2.0\DriverBooster.exe"7⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1460
-
-
C:\Program Files (x86)\IObit\Driver Booster\9.2.0\InstStat.exe"C:\Program Files (x86)\IObit\Driver Booster\9.2.0\InstStat.exe" /install db97⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3972
-
-
-
-
C:\Program Files (x86)\IObit\Driver Booster\9.2.0\SetupHlp.exe"C:\Program Files (x86)\IObit\Driver Booster\9.2.0\SetupHlp.exe" /afterinstall /setup="C:\Users\Admin\AppData\Local\Temp\is-79QG3.tmp-dbinst\setup.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3536
-
-
-
-
-
C:\Program Files (x86)\IObit\Driver Booster\9.2.0\DriverBooster.exe"C:\Program Files (x86)\IObit\Driver Booster\9.2.0\DriverBooster.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Program Files (x86)\IObit\Driver Booster\9.2.0\HWiNFO\HWiNFO.exe"C:\Program Files (x86)\IObit\Driver Booster\9.2.0\HWiNFO\HWiNFO.exe" /brandname3⤵
- Executes dropped EXE
PID:4956
-
-
C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Manta.exe"C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Manta.exe" /CommStat /DoCommStat /Code="a602" /Days=03⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:456
-
-
C:\Program Files (x86)\IObit\Driver Booster\9.2.0\AutoUpdate.exe"C:\Program Files (x86)\IObit\Driver Booster\9.2.0\AutoUpdate.exe" /auto /App=db9 /MainHwnd=03⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:3432 -
C:\Program Files (x86)\IObit\Driver Booster\9.2.0\sgupd.exe"C:\Program Files (x86)\IObit\Driver Booster\9.2.0\sgupd.exe" /db4⤵
- Executes dropped EXE
PID:1852
-
-
C:\Program Files (x86)\IObit\Driver Booster\9.2.0\rma.exe"C:\Program Files (x86)\IObit\Driver Booster\9.2.0\rma.exe" /run /auto4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3020
-
-
-
C:\Program Files (x86)\IObit\Driver Booster\9.2.0\ChangeIcon.exe"C:\Program Files (x86)\IObit\Driver Booster\9.2.0\ChangeIcon.exe" /0 "C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Icons\Main\"3⤵
- Executes dropped EXE
PID:3180
-
-
C:\Program Files (x86)\IObit\Driver Booster\9.2.0\NoteIcon.exe"C:\Program Files (x86)\IObit\Driver Booster\9.2.0\NoteIcon.exe" "C:\Program Files (x86)\IObit\Driver Booster\9.2.0\DriverBooster.exe"3⤵
- Executes dropped EXE
PID:2644
-
-
C:\Program Files (x86)\IObit\Driver Booster\9.2.0\RttHlp.exe"C:\Program Files (x86)\IObit\Driver Booster\9.2.0\RttHlp.exe" /cnt3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1292
-
-
C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Manta.exe"C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Manta.exe" /CommStat /DoCommStat /Code="A100" /Days=03⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4040
-
-
C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Manta.exe"C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Manta.exe" /CommStat /DoCommStat /Code="B100" /Days=73⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1276
-
-
C:\Program Files (x86)\IObit\Driver Booster\9.2.0\SetupHlp.exe"C:\Program Files (x86)\IObit\Driver Booster\9.2.0\SetupHlp.exe" /afterupgrade3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1992
-
-
C:\Program Files (x86)\IObit\Driver Booster\9.2.0\RttHlp.exe"C:\Program Files (x86)\IObit\Driver Booster\9.2.0\RttHlp.exe" /stat3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4696 -
C:\Program Files (x86)\IObit\Driver Booster\9.2.0\AUpdate.exe"C:\Program Files (x86)\IObit\Driver Booster\9.2.0\AUpdate.exe" /u http://stats.iobit.com/active_month.php /a db9 /p iobit /v 9.2.0.173 /t 2 /d 7 /db /user4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4580
-
-
-
C:\Program Files (x86)\IObit\Driver Booster\9.2.0\ChangeIcon.exe"C:\Program Files (x86)\IObit\Driver Booster\9.2.0\ChangeIcon.exe" /0 "C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Icons\Main\"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2304
-
-
C:\Program Files (x86)\IObit\Driver Booster\9.2.0\ChangeIcon.exe"C:\Program Files (x86)\IObit\Driver Booster\9.2.0\ChangeIcon.exe" /0 "C:\Program Files (x86)\IObit\Driver Booster\9.2.0\Icons\Main\"3⤵
- Executes dropped EXE
PID:1648
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2440
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD5c6feb1cdfb75f6bf43176c68a6be5d1f
SHA1a33c81b1813e0952684f776251f18442d728b446
SHA2569da000115b0e339b87006085a2cd036ae6a8a3b6d1d1bd9b4fb6509e04f5e467
SHA5125b5b68857e7b9fffffabbc08f2d692eb902c21f44e1d162ac46b88f5b79084804ea02e14fbc119a992292178ee2ceec6f895a73132b72d0fea2fd7dbdd672984
-
Filesize
3.4MB
MD5c6feb1cdfb75f6bf43176c68a6be5d1f
SHA1a33c81b1813e0952684f776251f18442d728b446
SHA2569da000115b0e339b87006085a2cd036ae6a8a3b6d1d1bd9b4fb6509e04f5e467
SHA5125b5b68857e7b9fffffabbc08f2d692eb902c21f44e1d162ac46b88f5b79084804ea02e14fbc119a992292178ee2ceec6f895a73132b72d0fea2fd7dbdd672984
-
Filesize
75KB
MD505d73ef4eac3ef5cd06f81ab292ec499
SHA14c8f7c64f2900ef70e048105f02805f1c38b94ff
SHA256f4ab13542590fb63929cefc3c2c598d37637a61f49ab99b8de4eeb3f8a4683b9
SHA512bd6bd095eb3281deb65590659a39fb9e34bab5c1e7ebd9796ec021514de149e9c09a9eabaa5a796371b5ec9d92989b5ae8dc6381fe7443aa0a9b5adcd795d102
-
Filesize
1.4MB
MD5195fe93c446ea4f419924e439c2a2605
SHA1fad7c54e47ec0415bfadf8aa39ffcee77592aa05
SHA256c676c90ebdb55b173ec584b00b17c7f0b7a98953165852dd86da52e2e49c45de
SHA512d5acccbbd9774970bc679146331e14b85df6ec6e031f3e8328f4331224348227905e85b001639dd83b792b1036a904b5e5945adf40753abd03489db3d7a9d468
-
Filesize
8.3MB
MD59530bf698d8ef79361ff6840da2f9b28
SHA115409f4bb4ef7c7862511b6fd2ee48f401cd3113
SHA2569b4d7f91b21f59d450fd95623dc3cf7843f9599ad659cc6870d30a687a183eb1
SHA512209f8fdf4bbb7b4ad1ed5652d74f2b6e587492792bc7b05efb3fcb5711a38c07843e0519525deab18dbbf5a3bd83244e6226b9aa0f925e65cdc1a85bac31346b
-
Filesize
171KB
MD5226c4e3cc9f513f98a128c08f3dc7e80
SHA1428f8c580aff677e4a36d06f71bde29106d4e2ae
SHA2569f1d61d16b505064c9cba003630c09b1d09f25e3e42deeaacb105a7b246d49e2
SHA512a6fd2c5df7939ae18ec7c1f1dab883c23017028f74b3a6ea708fec3f568ce99ae69827b4e5ea4587b55a45ff13cf4ea229044521cd8a12ddf4a90e73f5504d9a
-
Filesize
171KB
MD5226c4e3cc9f513f98a128c08f3dc7e80
SHA1428f8c580aff677e4a36d06f71bde29106d4e2ae
SHA2569f1d61d16b505064c9cba003630c09b1d09f25e3e42deeaacb105a7b246d49e2
SHA512a6fd2c5df7939ae18ec7c1f1dab883c23017028f74b3a6ea708fec3f568ce99ae69827b4e5ea4587b55a45ff13cf4ea229044521cd8a12ddf4a90e73f5504d9a
-
Filesize
1.2MB
MD5e937e1a411075768ef3f287f9abc128a
SHA1ee63928100563c1d846ecdc462a5c163ecce3d4c
SHA256cb81c7cbd229b639f24db6655edc67f4c32954778d24e086d45a7229cc58351c
SHA512a8a6123e1b88d3708ae76ab1ea2d3f15549d03549ee07fdf935357d06792fe63cceae7034e250588415040b8e11b0e892016bba165c488068c6c48f4cc7726a5
-
Filesize
1.2MB
MD5e937e1a411075768ef3f287f9abc128a
SHA1ee63928100563c1d846ecdc462a5c163ecce3d4c
SHA256cb81c7cbd229b639f24db6655edc67f4c32954778d24e086d45a7229cc58351c
SHA512a8a6123e1b88d3708ae76ab1ea2d3f15549d03549ee07fdf935357d06792fe63cceae7034e250588415040b8e11b0e892016bba165c488068c6c48f4cc7726a5
-
Filesize
1.3MB
MD5e3f556feb681696c1532a4a373132d68
SHA1221814339cf1180d2162b8e816aefed067b303dc
SHA2561067311ee6f0a00653f59bf70c2136d85188304e89b27dd11be888a0d2a8dcae
SHA512795b00adb28dd9ef62aa7fe94e1e0908eabcd1ec94145e8e261901d12596d517921389437c1257578b2c9537190396f02fe1ad9113da5f05a0d3c8ff4e03687c
-
Filesize
1.3MB
MD5e3f556feb681696c1532a4a373132d68
SHA1221814339cf1180d2162b8e816aefed067b303dc
SHA2561067311ee6f0a00653f59bf70c2136d85188304e89b27dd11be888a0d2a8dcae
SHA512795b00adb28dd9ef62aa7fe94e1e0908eabcd1ec94145e8e261901d12596d517921389437c1257578b2c9537190396f02fe1ad9113da5f05a0d3c8ff4e03687c
-
Filesize
132B
MD576be398d57ba9a293f99b31db9985f62
SHA11306388768b595be31b738baf3ad267d3ac07fe7
SHA25632d640bdabcdc4514dddf0b669a4b1d60bae16e700e9dabd0516544c6ab68cf5
SHA512627a0bee4ba7b9c3ecda4abebb7a2f0d515080e10d200444ce0cd97668a8e2b8bfb69ea298ba4228e4adf04412cbae2a539950f45a8f3fbee6dac04b4af5e321
-
Filesize
1.0MB
MD56caa319bdaad461f70be7215b1a14f1c
SHA188e5e169f004e0a423df672219dca962e8a8c23d
SHA256c06ef0b045143a04f3df20cf3cd9938f47be24c207f0af1c1fe011c01f39a795
SHA512bbc2fc020167a083fbc0d615983968ebca77224f7cd91b4fc6a489d9a1b2c677cef8abc99c8268ef18f8b9fa3bf86960b0709aa164362a6066c8c93e4abb25fa
-
Filesize
1.0MB
MD56caa319bdaad461f70be7215b1a14f1c
SHA188e5e169f004e0a423df672219dca962e8a8c23d
SHA256c06ef0b045143a04f3df20cf3cd9938f47be24c207f0af1c1fe011c01f39a795
SHA512bbc2fc020167a083fbc0d615983968ebca77224f7cd91b4fc6a489d9a1b2c677cef8abc99c8268ef18f8b9fa3bf86960b0709aa164362a6066c8c93e4abb25fa
-
Filesize
1.0MB
MD56caa319bdaad461f70be7215b1a14f1c
SHA188e5e169f004e0a423df672219dca962e8a8c23d
SHA256c06ef0b045143a04f3df20cf3cd9938f47be24c207f0af1c1fe011c01f39a795
SHA512bbc2fc020167a083fbc0d615983968ebca77224f7cd91b4fc6a489d9a1b2c677cef8abc99c8268ef18f8b9fa3bf86960b0709aa164362a6066c8c93e4abb25fa
-
Filesize
1.0MB
MD56caa319bdaad461f70be7215b1a14f1c
SHA188e5e169f004e0a423df672219dca962e8a8c23d
SHA256c06ef0b045143a04f3df20cf3cd9938f47be24c207f0af1c1fe011c01f39a795
SHA512bbc2fc020167a083fbc0d615983968ebca77224f7cd91b4fc6a489d9a1b2c677cef8abc99c8268ef18f8b9fa3bf86960b0709aa164362a6066c8c93e4abb25fa
-
Filesize
1.0MB
MD56caa319bdaad461f70be7215b1a14f1c
SHA188e5e169f004e0a423df672219dca962e8a8c23d
SHA256c06ef0b045143a04f3df20cf3cd9938f47be24c207f0af1c1fe011c01f39a795
SHA512bbc2fc020167a083fbc0d615983968ebca77224f7cd91b4fc6a489d9a1b2c677cef8abc99c8268ef18f8b9fa3bf86960b0709aa164362a6066c8c93e4abb25fa
-
Filesize
1.0MB
MD56caa319bdaad461f70be7215b1a14f1c
SHA188e5e169f004e0a423df672219dca962e8a8c23d
SHA256c06ef0b045143a04f3df20cf3cd9938f47be24c207f0af1c1fe011c01f39a795
SHA512bbc2fc020167a083fbc0d615983968ebca77224f7cd91b4fc6a489d9a1b2c677cef8abc99c8268ef18f8b9fa3bf86960b0709aa164362a6066c8c93e4abb25fa
-
Filesize
1.0MB
MD56caa319bdaad461f70be7215b1a14f1c
SHA188e5e169f004e0a423df672219dca962e8a8c23d
SHA256c06ef0b045143a04f3df20cf3cd9938f47be24c207f0af1c1fe011c01f39a795
SHA512bbc2fc020167a083fbc0d615983968ebca77224f7cd91b4fc6a489d9a1b2c677cef8abc99c8268ef18f8b9fa3bf86960b0709aa164362a6066c8c93e4abb25fa
-
Filesize
123KB
MD58abcd3adfd60590deb7d06e350c96873
SHA193b5bd0d1e44799dbdd91f8cba445006f481f3ff
SHA256fa36fda225a0d7431e7f8335e20013f43d960cda87cdd447f4695aca187b1eed
SHA51257b289a03966ef2d5398b433e2cb0b51c1b6caa58681b689b0fba0e5fecf0c5b970762ac94a61778e8a454ed101dd9492a98415c1d7943784c9fc1326dd83bfc
-
Filesize
123KB
MD58abcd3adfd60590deb7d06e350c96873
SHA193b5bd0d1e44799dbdd91f8cba445006f481f3ff
SHA256fa36fda225a0d7431e7f8335e20013f43d960cda87cdd447f4695aca187b1eed
SHA51257b289a03966ef2d5398b433e2cb0b51c1b6caa58681b689b0fba0e5fecf0c5b970762ac94a61778e8a454ed101dd9492a98415c1d7943784c9fc1326dd83bfc
-
Filesize
2.3MB
MD54608eb2b3bc2ae80c301f63ac8538a97
SHA125dc359b4db73e352684a76ea1b4c5fd64c726b8
SHA256fd01b7e1550b7ad7d79616f180d3856c0205f03e08de73e4dfd106a853d560b7
SHA512f796c07fce5f7ddea3ea4a845b660f73c4c8b80cb47a37a372f00d2a13a329c89901cf16b584c4771653c9bf30a8456b98cdf51b4b9b2a0f45686b55a83fbf23
-
Filesize
2.3MB
MD54608eb2b3bc2ae80c301f63ac8538a97
SHA125dc359b4db73e352684a76ea1b4c5fd64c726b8
SHA256fd01b7e1550b7ad7d79616f180d3856c0205f03e08de73e4dfd106a853d560b7
SHA512f796c07fce5f7ddea3ea4a845b660f73c4c8b80cb47a37a372f00d2a13a329c89901cf16b584c4771653c9bf30a8456b98cdf51b4b9b2a0f45686b55a83fbf23
-
Filesize
605KB
MD5a495cef182d461779e6881087b68aec9
SHA1ba7cc36e057f52d792e1956cb4719b5266c4e53c
SHA25657a07e46906e045178c4e0054d7906cb7f7a562f66efa707510a986e46b12053
SHA512a6d976205ca122beb8d1340cc7911bc2f954333a63d3b0588ddb89ab4f0deff11d978952409ed6b180bd29752e349df4a00105f6197e836b750b7cf75fbc4932
-
Filesize
605KB
MD5a495cef182d461779e6881087b68aec9
SHA1ba7cc36e057f52d792e1956cb4719b5266c4e53c
SHA25657a07e46906e045178c4e0054d7906cb7f7a562f66efa707510a986e46b12053
SHA512a6d976205ca122beb8d1340cc7911bc2f954333a63d3b0588ddb89ab4f0deff11d978952409ed6b180bd29752e349df4a00105f6197e836b750b7cf75fbc4932
-
Filesize
1.6MB
MD5e1f5755f7158a4d356e99f49d020a11e
SHA1c756c2f5358462f046cd1d0daea86fa900ab8e8c
SHA256ac4f7cab4f8616e117dfaa06e82669cbe9326da356e18c1ed0fa0f2b11fa6864
SHA512294dcfac583d8f4ec6b3cb6a3edea802bcd16a4ffc824355f0d53c21db9f297a1734c1bbecbbf1fb9fa3e2ffe7aefae25ecf5869035b036d18f95044ad0118e3
-
Filesize
1.6MB
MD5e1f5755f7158a4d356e99f49d020a11e
SHA1c756c2f5358462f046cd1d0daea86fa900ab8e8c
SHA256ac4f7cab4f8616e117dfaa06e82669cbe9326da356e18c1ed0fa0f2b11fa6864
SHA512294dcfac583d8f4ec6b3cb6a3edea802bcd16a4ffc824355f0d53c21db9f297a1734c1bbecbbf1fb9fa3e2ffe7aefae25ecf5869035b036d18f95044ad0118e3
-
Filesize
1KB
MD5e1da3b63bd6a8c8fe91b193ec3e07c12
SHA19f9a5eec6aae21d72f9d3fd23cddd27a5af92e54
SHA2561c2f9f082d3c56e7e604d806060fa9dd8736cae3c04d6ea36b87429162588d0b
SHA5124e99508de7bb6543ca7dfdd68b1c6094b1ce2a1566de12c7808ae8399d66182e019066b54b351e2d35e29c1b737cb9ab2ac80fb212ea464bcc27b02ddbdf76ba
-
Filesize
75KB
MD505d73ef4eac3ef5cd06f81ab292ec499
SHA14c8f7c64f2900ef70e048105f02805f1c38b94ff
SHA256f4ab13542590fb63929cefc3c2c598d37637a61f49ab99b8de4eeb3f8a4683b9
SHA512bd6bd095eb3281deb65590659a39fb9e34bab5c1e7ebd9796ec021514de149e9c09a9eabaa5a796371b5ec9d92989b5ae8dc6381fe7443aa0a9b5adcd795d102
-
Filesize
27B
MD525f5875159bd806eadaa7bc41cd61dc1
SHA102f5ae9c79c122bb52236d930c2541b2d3ead3a8
SHA256d5062ff936c218c4c23c1f0846fa1ab4ec359be885cd2ab1cb24178da5b0ff2c
SHA5120292ff0478ce6819d56bd430c786bb0c648895e8d9e6a689383274e37a643cca46958de23e75a25637c760911bb4328e7fb1d02882dfa42dbed7d17ee90fe8b5
-
Filesize
1KB
MD568c291e76f401815759a88cb3fa3a876
SHA1b1d9b789798718e90859fed77997ae4c694717cb
SHA256d52e6bcf805af1d4116cf24eaf0e40eb28a046e580c264facfc29708df4940fa
SHA5126ff8f73f9507a5260e1ef1371a6e6c85f197351b8d45a4ac3a41b60dab779c00c98ac25626afb15b25ba8af37426a49625b685792d41168bb7cc3ad6a906b215
-
Filesize
209KB
MD5752d6cd2023479342250eb576af4b451
SHA1aabc6e14b64a68dd9e934036d25d3a602684cd3e
SHA2566bd8913a44147de462eb971335938caa3906ad5a4bacbb8615c60024670caa5c
SHA51215521c8a1d4d6a13783c347ebc601ecd6bbb3a489b46893ce0aa4c4dfafb9ce8f3cd2b8e80938d157e7812064b64836e187f274e3ffdaa68cc3bd5a4313c7ec2
-
Filesize
209KB
MD5752d6cd2023479342250eb576af4b451
SHA1aabc6e14b64a68dd9e934036d25d3a602684cd3e
SHA2566bd8913a44147de462eb971335938caa3906ad5a4bacbb8615c60024670caa5c
SHA51215521c8a1d4d6a13783c347ebc601ecd6bbb3a489b46893ce0aa4c4dfafb9ce8f3cd2b8e80938d157e7812064b64836e187f274e3ffdaa68cc3bd5a4313c7ec2
-
Filesize
62KB
MD51856c3d0aba628ead9a1ac8a713fb11e
SHA1196f94ce689b4de0537190582baba76e131e00cc
SHA2569e3bda2c295be18ddcd7406366c325bf52b090f87612854ce3e35f80b633e931
SHA5129e5896398def73664fa502ee4e0964aa3d4a5f3145cf118c2a2fd27e58e8908fd2bf26db472e8e96d2f2508d24bccd065a4a347da33c44f800ed4ab8599b389e
-
Filesize
62KB
MD51856c3d0aba628ead9a1ac8a713fb11e
SHA1196f94ce689b4de0537190582baba76e131e00cc
SHA2569e3bda2c295be18ddcd7406366c325bf52b090f87612854ce3e35f80b633e931
SHA5129e5896398def73664fa502ee4e0964aa3d4a5f3145cf118c2a2fd27e58e8908fd2bf26db472e8e96d2f2508d24bccd065a4a347da33c44f800ed4ab8599b389e
-
Filesize
435KB
MD570d73d518ceab5e50623cb73353dab4f
SHA1c23656077432925131c95ab754ffb773d3cb9796
SHA256eb2573197363b52d7a240c7e8944ab6b4a07fe101f1df0da764f281a611246fd
SHA5128956b520619ce8380d19e58743c94a7a26980cc0dd3874172df9cfb9a09f4cff7855fc3d69c79acb42a21626590d59609d92a258ca8c8f99f16732080fe20688
-
Filesize
435KB
MD570d73d518ceab5e50623cb73353dab4f
SHA1c23656077432925131c95ab754ffb773d3cb9796
SHA256eb2573197363b52d7a240c7e8944ab6b4a07fe101f1df0da764f281a611246fd
SHA5128956b520619ce8380d19e58743c94a7a26980cc0dd3874172df9cfb9a09f4cff7855fc3d69c79acb42a21626590d59609d92a258ca8c8f99f16732080fe20688
-
Filesize
1.1MB
MD5af6ba2df6a5fd24af4074be3b9a3e419
SHA1a507188f63e54b48a13f5f1f6350773b9b97605b
SHA256d1dab9914233a86b06c4fdb192507db7a516367b274180accf181cde5bbf9efd
SHA512242aadc1ea77870f3de5e866661be04ca2693b4a67ac8ea457ce9fe05ca067d2877b500a5cbb8a880a91f50a5bfe5c7407d7f784d97707ea4fb39c2f1d277942
-
Filesize
1.1MB
MD5af6ba2df6a5fd24af4074be3b9a3e419
SHA1a507188f63e54b48a13f5f1f6350773b9b97605b
SHA256d1dab9914233a86b06c4fdb192507db7a516367b274180accf181cde5bbf9efd
SHA512242aadc1ea77870f3de5e866661be04ca2693b4a67ac8ea457ce9fe05ca067d2877b500a5cbb8a880a91f50a5bfe5c7407d7f784d97707ea4fb39c2f1d277942
-
Filesize
1.1MB
MD5af6ba2df6a5fd24af4074be3b9a3e419
SHA1a507188f63e54b48a13f5f1f6350773b9b97605b
SHA256d1dab9914233a86b06c4fdb192507db7a516367b274180accf181cde5bbf9efd
SHA512242aadc1ea77870f3de5e866661be04ca2693b4a67ac8ea457ce9fe05ca067d2877b500a5cbb8a880a91f50a5bfe5c7407d7f784d97707ea4fb39c2f1d277942
-
Filesize
1.1MB
MD5af6ba2df6a5fd24af4074be3b9a3e419
SHA1a507188f63e54b48a13f5f1f6350773b9b97605b
SHA256d1dab9914233a86b06c4fdb192507db7a516367b274180accf181cde5bbf9efd
SHA512242aadc1ea77870f3de5e866661be04ca2693b4a67ac8ea457ce9fe05ca067d2877b500a5cbb8a880a91f50a5bfe5c7407d7f784d97707ea4fb39c2f1d277942
-
Filesize
905KB
MD593e1cbff5471692742520ac78f9d39c2
SHA12bf8cb6683e135922c232b2480c60157ce2e23f0
SHA256c1f0111baf2423027596ada8458685957e913f0b72021faa34c498a14d70b9ce
SHA5128e237c2d3db98b72c8abfb2eced58f5e3868cd79d66ac48b730a12a945eb64c287d8ef17a5f19b53b1d2fee8a19a91aac29861be5201ce55bd219f945406c9b3
-
Filesize
905KB
MD593e1cbff5471692742520ac78f9d39c2
SHA12bf8cb6683e135922c232b2480c60157ce2e23f0
SHA256c1f0111baf2423027596ada8458685957e913f0b72021faa34c498a14d70b9ce
SHA5128e237c2d3db98b72c8abfb2eced58f5e3868cd79d66ac48b730a12a945eb64c287d8ef17a5f19b53b1d2fee8a19a91aac29861be5201ce55bd219f945406c9b3
-
Filesize
1.9MB
MD53dac8fc6c8c43f85ef76d33b1736133f
SHA16d2d2ca5087b755c8e49be84871436b9fa6cf903
SHA256132828f816e9e4f0ba2ed5ae5cd62d213e4cfc698bf06543cc7890c5ed5792e1
SHA51268ddf4b68101fd9ca9899a901e7e22ed66067c0416ccc96780f8c109724ffe583aa135996fffe47b185c25d768ab48c84c256c43eb769ed90e143e5235530fc6
-
Filesize
1.9MB
MD53dac8fc6c8c43f85ef76d33b1736133f
SHA16d2d2ca5087b755c8e49be84871436b9fa6cf903
SHA256132828f816e9e4f0ba2ed5ae5cd62d213e4cfc698bf06543cc7890c5ed5792e1
SHA51268ddf4b68101fd9ca9899a901e7e22ed66067c0416ccc96780f8c109724ffe583aa135996fffe47b185c25d768ab48c84c256c43eb769ed90e143e5235530fc6
-
Filesize
1.9MB
MD53dac8fc6c8c43f85ef76d33b1736133f
SHA16d2d2ca5087b755c8e49be84871436b9fa6cf903
SHA256132828f816e9e4f0ba2ed5ae5cd62d213e4cfc698bf06543cc7890c5ed5792e1
SHA51268ddf4b68101fd9ca9899a901e7e22ed66067c0416ccc96780f8c109724ffe583aa135996fffe47b185c25d768ab48c84c256c43eb769ed90e143e5235530fc6
-
Filesize
1KB
MD53c75e47bc05971085b83b7a88e15a7b0
SHA18cb313034c66145b7a0d73f27fee9ca309d36338
SHA25653617da86563d416fd888360a6c4b18ddac876f42278233497dac6d0d76f9af4
SHA512684b392c269a74160b0fc5f224c74dfe5db0cb1f0d37abeed3be91c668561efd97d618af53496e4394c72bc992304a2f475b90e2a1b2e2465f2dd92ddfe003e5
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Booster 9\Uninstall Driver Booster 9.lnk
Filesize1KB
MD55868dbdf7558889f3263af8a69483ed7
SHA194797e313b69757feb0b6001034eddcaca62b71a
SHA2561266a60883f3ac6ca074de81a1d6874e38ea8bf024f79d63287199fa21b46e83
SHA512b7815b38173f2ef65a25b999f7a271aed731e40c4f84af65a53cc0e5fda4a6967e0e8c7e1f3846a7c44a4abe17d90e54bf8d0b78c7fe660627bdc554613acb8b
-
Filesize
232B
MD50b4c6b249bba530f470fecd10e3600ef
SHA18ff1c587a9a7ae4f429432f1c116b1784e2768a4
SHA256caeb3e66f28305316b25c14cc205741d7191af670da8f6a714b11b05c0dc3cc1
SHA5125e89dda4228bf31c5956310bf98690ca0296e092930ff0f0d67a4e1215d61c397d935f8b70fee3dc335ae3083fadcf35c6088a1c0e810144a25c4d8bb02e8d87
-
Filesize
232B
MD50b4c6b249bba530f470fecd10e3600ef
SHA18ff1c587a9a7ae4f429432f1c116b1784e2768a4
SHA256caeb3e66f28305316b25c14cc205741d7191af670da8f6a714b11b05c0dc3cc1
SHA5125e89dda4228bf31c5956310bf98690ca0296e092930ff0f0d67a4e1215d61c397d935f8b70fee3dc335ae3083fadcf35c6088a1c0e810144a25c4d8bb02e8d87
-
Filesize
8.0MB
MD564b0b4eea59afe83254ea2d00c059702
SHA17652e55829d667b55b1734b7d0bd0cb677bfd138
SHA256e818ca17509436a84bf5753cb5e9faca74746895e16e1ed9c7d7e39ef170ea52
SHA512bdbc2e9225852f2e4172913e602b289359d40b7b4d8cfa22eb89ef1f5bbe64f681517f82d5e95a42d37d7688536438f65735393ee4941666e1750b0069e64f28
-
Filesize
8.0MB
MD564b0b4eea59afe83254ea2d00c059702
SHA17652e55829d667b55b1734b7d0bd0cb677bfd138
SHA256e818ca17509436a84bf5753cb5e9faca74746895e16e1ed9c7d7e39ef170ea52
SHA512bdbc2e9225852f2e4172913e602b289359d40b7b4d8cfa22eb89ef1f5bbe64f681517f82d5e95a42d37d7688536438f65735393ee4941666e1750b0069e64f28
-
Filesize
1.2MB
MD568b52a0b8e3d45bf3b520a0e7f16dad1
SHA1e50408326eafb5ca8adc70db29c33b64e25bbbbd
SHA256b409d6d6f8896dc2afd1774479c741ca253c0e9b4732daaa08af84aa9c96888b
SHA512b8e0b486e2b9652831eb8efe48cf9575eef49204e827a64d69ae7c9c30304b2d98a66c28f1072fe8596847c15f13bbf7ec39d7708684ff64051bbae7ed063faf
-
Filesize
1.2MB
MD568b52a0b8e3d45bf3b520a0e7f16dad1
SHA1e50408326eafb5ca8adc70db29c33b64e25bbbbd
SHA256b409d6d6f8896dc2afd1774479c741ca253c0e9b4732daaa08af84aa9c96888b
SHA512b8e0b486e2b9652831eb8efe48cf9575eef49204e827a64d69ae7c9c30304b2d98a66c28f1072fe8596847c15f13bbf7ec39d7708684ff64051bbae7ed063faf
-
Filesize
1.2MB
MD568b52a0b8e3d45bf3b520a0e7f16dad1
SHA1e50408326eafb5ca8adc70db29c33b64e25bbbbd
SHA256b409d6d6f8896dc2afd1774479c741ca253c0e9b4732daaa08af84aa9c96888b
SHA512b8e0b486e2b9652831eb8efe48cf9575eef49204e827a64d69ae7c9c30304b2d98a66c28f1072fe8596847c15f13bbf7ec39d7708684ff64051bbae7ed063faf
-
Filesize
1.2MB
MD568b52a0b8e3d45bf3b520a0e7f16dad1
SHA1e50408326eafb5ca8adc70db29c33b64e25bbbbd
SHA256b409d6d6f8896dc2afd1774479c741ca253c0e9b4732daaa08af84aa9c96888b
SHA512b8e0b486e2b9652831eb8efe48cf9575eef49204e827a64d69ae7c9c30304b2d98a66c28f1072fe8596847c15f13bbf7ec39d7708684ff64051bbae7ed063faf
-
Filesize
56B
MD537ba980823908ef9d3dbbab646a0c436
SHA15a549c0e5b38479bdb797ad75ed20a3196c6976c
SHA256bda1cde581bd73cff85aaebd778a7e4a13a4c6028477431a86ffd9ed43f481f6
SHA512583c84bb9cdc3eca80ed484b29b747df27931b783af319733f4b90fc2d959e066f32f25f08b4d94906dfb4df895684f8db0fd0567d0f4ccdbba7dcb92867d242
-
Filesize
81B
MD512fdeadf3187a4dd52ce49d95aaee00e
SHA1d2054533c253424e08f891ef6231171b199060dd
SHA2560ed62c59ac1cf107c97cff692f2dc7c73edb6b898b0cdb5b6db494fbe4e6c970
SHA512c6148772037c7585d971aea3a2cf021ba94c3d2744437a093554f62fff8ec47dc44be37ceb329c7121059a969c919e9e251a8070c7675dd04023efdb94fba654
-
Filesize
263B
MD5d22a9af5b3c3b0f450dd695c58c37dfa
SHA17aa5962a3fdd827b9707c6cd6d742576a8f8cea0
SHA2561421f4420cbe1adc72314756e1fcb3970fc3229efb74f2dcb9889d9eef60f61a
SHA512d3fb7c23239169f12a1e21a70f9333544c584a2a599486c502fe985e83aad2684dc0f04b99564043d678ba0f5cd5c87688bb5dfa8bc5a604e875352aa60d8209
-
Filesize
5.2MB
MD5163fda49b46c275fa70a723124c88ea3
SHA158d1e5f036075b649f948d038b81eae347f28eea
SHA256fc6c881b0834ef49c97b48bc8fd949acc1480040947796e4d7a3b14a9c6cb88e
SHA51234fe6955472a8a7d6f5e603f4272f6cfba8970fb7a848e6e46e72ae4d3ea71ed7eced60aad6742d3151841b26be6e9f54b2e943e5c634f6e7c1820de1017e706
-
Filesize
26.1MB
MD568ef7178ed9673afed56b2a94fa78892
SHA1cabd01540b4b7dffcc3865d9f7b3134d1e123226
SHA25653b1ba6f5e6f410b83942a08059b1152d7f9abe3e7e00918f8d4405ae8e82653
SHA512846411d677e3688db9d334953c47d4df3b41a9b3a47019b4678eb76549e9249388dd814f61ed723c675cda816888b5cbaf1d88b26cc4cf37133dc9f81ea3978f
-
Filesize
26.1MB
MD568ef7178ed9673afed56b2a94fa78892
SHA1cabd01540b4b7dffcc3865d9f7b3134d1e123226
SHA25653b1ba6f5e6f410b83942a08059b1152d7f9abe3e7e00918f8d4405ae8e82653
SHA512846411d677e3688db9d334953c47d4df3b41a9b3a47019b4678eb76549e9249388dd814f61ed723c675cda816888b5cbaf1d88b26cc4cf37133dc9f81ea3978f
-
Filesize
26.1MB
MD568ef7178ed9673afed56b2a94fa78892
SHA1cabd01540b4b7dffcc3865d9f7b3134d1e123226
SHA25653b1ba6f5e6f410b83942a08059b1152d7f9abe3e7e00918f8d4405ae8e82653
SHA512846411d677e3688db9d334953c47d4df3b41a9b3a47019b4678eb76549e9249388dd814f61ed723c675cda816888b5cbaf1d88b26cc4cf37133dc9f81ea3978f
-
Filesize
1KB
MD5c30e0f922cca5f84376f9af4ea375a5c
SHA19d2b84b182ba61b8cb2049aa11ffd654726f38b5
SHA256231e3cbc112490f9ef90e6b4c968005f9c7e8afa96dfa48ff86e3c7a328ec4ae
SHA512ab0a46c217950b3330c2cc9f1b22217801e6f52e703930b1fe90b19b86f08a2a39c3bae0c962e8fb02b1d7e656c90d8f6ffb36408f9e0cb97a0d7fe0adaf2957