Overview

overview

9

Static

static

3

2026-08-25...at.exe

windows10-2004-x64

9

2026-08-25...at.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/08/2026, 18:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-25_8c9364907e2f3629b954953253a76853_amadey_cryptbot_elex_luca-stealer_lynx_njrat.exe
  • Size 43.1MB
  • Sample260826-wm4kjstdph
  • SHA256 a1066fe939836a25afcd639d4570e6454d3f668fa03cbc978d5dbca1471e3cc4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryinstaller

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 2 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 33 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-25_8c9364907e2f3629b954953253a76853_amadey_cryptbot_elex_luca-stealer_lynx_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-25_8c9364907e2f3629b954953253a76853_amadey_cryptbot_elex_luca-stealer_lynx_njrat.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3552
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Hook.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Hook.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:884
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\driver_booster_setup.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\driver_booster_setup.exe" /silent
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1296
      • C:\Users\Admin\AppData\Local\Temp\is-NJ49O.tmp\driver_booster_setup.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-NJ49O.tmp\driver_booster_setup.tmp" /SL5="$B0170,32734017,139264,C:\Users\Admin\AppData\Local\Temp\RarSFX0\driver_booster_setup.exe" /silent
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1552
        • C:\Program Files (x86)\IObit\Driver Booster\13.6.0\HWiNFO\HWiNFO.exe
          "C:\Program Files (x86)\IObit\Driver Booster\13.6.0\HWiNFO\HWiNFO.exe" /brandname
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5144
        • C:\Program Files (x86)\IObit\Driver Booster\13.6.0\SetupHlp.exe
          "C:\Program Files (x86)\IObit\Driver Booster\13.6.0\SetupHlp.exe" /install /setup="C:\Users\Admin\AppData\Local\Temp\RarSFX0\driver_booster_setup.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3320
          • C:\Program Files (x86)\IObit\Driver Booster\13.6.0\RttHlp.exe
            "C:\Program Files (x86)\IObit\Driver Booster\13.6.0\RttHlp.exe" /winstdate
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1232
        • C:\Program Files (x86)\IObit\Driver Booster\13.6.0\AutoUpdate.exe
          "C:\Program Files (x86)\IObit\Driver Booster\13.6.0\AutoUpdate.exe" /install
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:5608
        • C:\Program Files (x86)\IObit\Driver Booster\13.6.0\TaskbarPin\ICONPIN64.exe
          "C:\Program Files (x86)\IObit\Driver Booster\13.6.0\TaskbarPin\ICONPIN64.exe" pin "C:\Program Files (x86)\IObit\Driver Booster\13.6.0\DriverBooster.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          PID:2056
        • C:\Program Files (x86)\IObit\Driver Booster\13.6.0\DriverBooster.exe
          "C:\Program Files (x86)\IObit\Driver Booster\13.6.0\DriverBooster.exe" /skipuac
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1452
        • C:\Program Files (x86)\IObit\Driver Booster\13.6.0\InstStat.exe
          "C:\Program Files (x86)\IObit\Driver Booster\13.6.0\InstStat.exe" /install db13
          4⤵
          • Executes dropped EXE
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3112
    • C:\Windows\SysWOW64\timeout.exe
      "C:\Windows\System32\timeout.exe" /t 6
      2⤵
      • System Location Discovery: System Language Discovery
      • Delays execution with timeout.exe
      PID:1792
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "DriverBooster.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4216
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cybermania.ws/
      2⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2492
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd1701c188,0x7ffd1701c194,0x7ffd1701c1a0
        3⤵
          PID:5104
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,2430691983984235869,10954462570863636078,524288 --field-trial-handle=2844,i,2869493231968913307,11492011967566435734,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:11
          3⤵
          • System Time Discovery
          PID:788
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,17731806639856061580,7771824383704776458,524288 --field-trial-handle=2844,i,2869493231968913307,11492011967566435734,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:13
          3⤵
            PID:2288
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,12179427502064654420,8185339224032148963,262144 --field-trial-handle=2844,i,2869493231968913307,11492011967566435734,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:2
            3⤵
              PID:3124
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,17288787788634608083,13198092368905557582,2097152 --field-trial-handle=2844,i,2869493231968913307,11492011967566435734,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
              3⤵
                PID:5644
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,1680072450226482398,13719563010467683149,2097152 --field-trial-handle=2844,i,2869493231968913307,11492011967566435734,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
                3⤵
                  PID:1460
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,14601544141996309036,1798312022793319775,2097152 --field-trial-handle=2844,i,2869493231968913307,11492011967566435734,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
                  3⤵
                    PID:664
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,8304327353654879751,8071790498599765637,2097152 --field-trial-handle=2844,i,2869493231968913307,11492011967566435734,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:9
                    3⤵
                      PID:5208
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,11468082563530202431,2462916737243158484,524288 --field-trial-handle=2844,i,2869493231968913307,11492011967566435734,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14
                      3⤵
                        PID:2552
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3844,i,16330463555256951433,5105298735619095459,2097152 --field-trial-handle=2844,i,2869493231968913307,11492011967566435734,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
                        3⤵
                          PID:5420
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,8394904888802598244,10570517572199912334,524288 --field-trial-handle=2844,i,2869493231968913307,11492011967566435734,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
                          3⤵
                            PID:4616
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,10001283579053069958,12518309412418309921,524288 --field-trial-handle=2844,i,2869493231968913307,11492011967566435734,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
                            3⤵
                              PID:5796
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,3852768151067802784,16573076473785349566,524288 --field-trial-handle=2844,i,2869493231968913307,11492011967566435734,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
                              3⤵
                                PID:5944
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,3852768151067802784,16573076473785349566,524288 --field-trial-handle=2844,i,2869493231968913307,11492011967566435734,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
                                3⤵
                                  PID:3540
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,3423161891474652705,1864362655952899114,524288 --field-trial-handle=2844,i,2869493231968913307,11492011967566435734,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
                                  3⤵
                                    PID:5972
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,11563856107816263737,17809841137349617331,524288 --field-trial-handle=2844,i,2869493231968913307,11492011967566435734,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
                                    3⤵
                                      PID:1064
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,5236682479952877155,9279976238393192587,524288 --field-trial-handle=2844,i,2869493231968913307,11492011967566435734,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
                                      3⤵
                                        PID:5980
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,1428753632203995806,7938453410503564572,524288 --field-trial-handle=2844,i,2869493231968913307,11492011967566435734,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
                                        3⤵
                                          PID:236
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5216,i,8716475357886127127,1378683339310592008,2097152 --field-trial-handle=2844,i,2869493231968913307,11492011967566435734,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
                                          3⤵
                                            PID:2028
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,1373905016879883694,1803056985537761524,524288 --field-trial-handle=2844,i,2869493231968913307,11492011967566435734,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:14
                                            3⤵
                                              PID:4352
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,16437055284434441911,14340458028104904329,524288 --field-trial-handle=2844,i,2869493231968913307,11492011967566435734,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
                                              3⤵
                                                PID:4972
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,8444579240888118416,17964231362143059137,524288 --field-trial-handle=2844,i,2869493231968913307,11492011967566435734,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
                                                3⤵
                                                  PID:5076
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,12133519524676494394,460346533482290336,524288 --field-trial-handle=2844,i,2869493231968913307,11492011967566435734,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
                                                  3⤵
                                                    PID:5144
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7088,i,1657376387741766664,17333223673305166201,524288 --field-trial-handle=2844,i,2869493231968913307,11492011967566435734,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:14
                                                    3⤵
                                                      PID:1896
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7100,i,6733624514998615829,15830061174706449308,524288 --field-trial-handle=2844,i,2869493231968913307,11492011967566435734,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:14
                                                      3⤵
                                                        PID:1196
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,17571757566806849652,12761081706642484225,524288 --field-trial-handle=2844,i,2869493231968913307,11492011967566435734,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:14
                                                        3⤵
                                                          PID:5376
                                                    • C:\Program Files (x86)\IObit\Driver Booster\13.6.0\AutoUpdate.exe
                                                      "C:\Program Files (x86)\IObit\Driver Booster\13.6.0\AutoUpdate.exe"
                                                      1⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Drops file in Program Files directory
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of SendNotifyMessage
                                                      PID:1904
                                                    • C:\Program Files (x86)\IObit\Driver Booster\13.6.0\Scheduler.exe
                                                      "C:\Program Files (x86)\IObit\Driver Booster\13.6.0\Scheduler.exe"
                                                      1⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:1056
                                                    • C:\Program Files (x86)\IObit\Driver Booster\13.6.0\DriverBooster.exe
                                                      "C:\Program Files (x86)\IObit\Driver Booster\13.6.0\DriverBooster.exe"
                                                      1⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • System Location Discovery: System Language Discovery
                                                      • Checks processor information in registry
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of SendNotifyMessage
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2996
                                                      • C:\Program Files (x86)\IObit\Driver Booster\13.6.0\HWiNFO\HWiNFO.exe
                                                        "C:\Program Files (x86)\IObit\Driver Booster\13.6.0\HWiNFO\HWiNFO.exe" /brandname
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:5368
                                                      • C:\Program Files (x86)\IObit\Driver Booster\13.6.0\Manta.exe
                                                        "C:\Program Files (x86)\IObit\Driver Booster\13.6.0\Manta.exe" /CommStat /DoCommStat /Code="602" /PostNow=0 /Wait=0 /Path="" /ExtParam=""
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5116
                                                        • C:\Program Files (x86)\IObit\Driver Booster\13.6.0\ProductStat3.exe
                                                          "C:\Program Files (x86)\IObit\Driver Booster\13.6.0\ProductStat3.exe" /statcom /stflag 602 /appid "db13" /pd "db" /url "https://stats.iobit.com/usage_v2.php" /user 0 /insur "other" /type 0 /pr "iobit" /ver "13.6.0.438"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:4328
                                                      • C:\Program Files (x86)\IObit\Driver Booster\13.6.0\AutoUpdate.exe
                                                        "C:\Program Files (x86)\IObit\Driver Booster\13.6.0\AutoUpdate.exe" /main /App=db13 /MainHwnd=0
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        PID:5532
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                      1⤵
                                                        PID:1904
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                        1⤵
                                                          PID:3600

                                                        Network

                                                              MITRE ATT&CK Enterprise v16

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              AutoUpdate.exe
                                                              • Path C:\Program Files (x86)\IObit\Driver Booster\13.6.0\AutoUpdate.exe
                                                              • Size 2.4MB
                                                              • SHA256 793ad19064b25850cdd660b1b99c359df55eafcaf769be30fbed8e242ea18b12
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              initial.wlst
                                                              • Path C:\Program Files (x86)\IObit\Driver Booster\13.6.0\Database\Scan\initial.wlst
                                                              • Size 2.0MB
                                                              • SHA256 1796cb853cd4aaf1309d8e19f959f23433bd25834bf31aa3b652d73360bbb9c4
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              DriverBooster.exe
                                                              • Path C:\Program Files (x86)\IObit\Driver Booster\13.6.0\DriverBooster.exe
                                                              • Size 8.3MB
                                                              • SHA256 b8ca41c46214888091a1f52c79d71276b2a79d370297f8f013bb9cac185c91b2
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              HWiNFO.exe
                                                              • Path C:\Program Files (x86)\IObit\Driver Booster\13.6.0\HWiNFO\HWiNFO.exe
                                                              • Size 590KB
                                                              • SHA256 146e416e162af03c667b9968f9d69f3eb1973f9dadb09db4ca4eff04821c326b
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              HWiNFO32.dll
                                                              • Path C:\Program Files (x86)\IObit\Driver Booster\13.6.0\HWiNFO\HWiNFO32.dll
                                                              • Size 1.2MB
                                                              • SHA256 cb81c7cbd229b639f24db6655edc67f4c32954778d24e086d45a7229cc58351c
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              is-A09L9.tmp
                                                              • Path C:\Program Files (x86)\IObit\Driver Booster\13.6.0\Icons\Apps\is-A09L9.tmp
                                                              • Size 1KB
                                                              • SHA256 ac4531a4b4fe3b34054eb33f2caabe2776be0ea5fc5056670c139caffd51b4f4
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              InstStat.exe
                                                              • Path C:\Program Files (x86)\IObit\Driver Booster\13.6.0\InstStat.exe
                                                              • Size 1.7MB
                                                              • SHA256 c7a3795b67137998cd3db766c2fc4c9506c01d00b4f49011ed7bca77546d86ec
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              WhiteList.ini
                                                              • Path C:\Program Files (x86)\IObit\Driver Booster\13.6.0\LocalData\WhiteList.ini
                                                              • Size 132B
                                                              • SHA256 674a858a663aef7c23f5ff1307ca26e6718b729f17bf4a8dbc23a2f65ceeacf3
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              Register.dll
                                                              • Path C:\Program Files (x86)\IObit\Driver Booster\13.6.0\Register.dll
                                                              • Size 1.1MB
                                                              • SHA256 99adb1b7592678c30fc9f9be07663233b85abc84f761600885b7525483936117
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              RttHlp.exe
                                                              • Path C:\Program Files (x86)\IObit\Driver Booster\13.6.0\RttHlp.exe
                                                              • Size 167KB
                                                              • SHA256 d6e6831b8a3e27d75fbbf7ab106ba955282e9625f8d6a0db1628a5d540c4032e
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Scheduler.exe
                                                              • Path C:\Program Files (x86)\IObit\Driver Booster\13.6.0\Scheduler.exe
                                                              • Size 160KB
                                                              • SHA256 24c761a32df6024702e8339e716cc95d9736bd54ed85c8871ab13094a15b7490
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              SetupHlp.exe
                                                              • Path C:\Program Files (x86)\IObit\Driver Booster\13.6.0\SetupHlp.exe
                                                              • Size 2.0MB
                                                              • SHA256 e125dead08c432ea0dc29a5614ca739a8b34be976e8866793f91cb43228f6231
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ICONPIN64.exe
                                                              • Path C:\Program Files (x86)\IObit\Driver Booster\13.6.0\TaskbarPin\ICONPIN64.exe
                                                              • Size 1.6MB
                                                              • SHA256 0b63193c6556834c0043cf27c592eb2e76584617a17ffa4cab5f3a0f13afc473
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              datastate.dll
                                                              • Path C:\Program Files (x86)\IObit\Driver Booster\13.6.0\datastate.dll
                                                              • Size 77KB
                                                              • SHA256 0b9e80726a2dc59741fb7d951b1bd31de99c2c79f714f3101988b2eb3f6eeff4
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              lang.dat
                                                              • Path C:\Program Files (x86)\IObit\Driver Booster\13.6.0\lang.dat
                                                              • Size 60B
                                                              • SHA256 b16f3d34196d371bee19b1407d3747e90a213cb9c759551366d5c8fb53c24573
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              local.dat
                                                              • Path C:\Program Files (x86)\IObit\Driver Booster\13.6.0\local.dat
                                                              • Size 1KB
                                                              • SHA256 c4e847a4f1d815b65e1eebc3948483bc9cf989c5a30d53b4ad30515ab67adf61
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              madBasic_.bpl
                                                              • Path C:\Program Files (x86)\IObit\Driver Booster\13.6.0\madBasic_.bpl
                                                              • Size 212KB
                                                              • SHA256 4926203fdd4fd70b55409e84728faf927d71274fb368193205d44e4f04a605f8
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              madDisAsm_.bpl
                                                              • Path C:\Program Files (x86)\IObit\Driver Booster\13.6.0\madDisAsm_.bpl
                                                              • Size 64KB
                                                              • SHA256 20ddd0bdf076a91d9d82c8e447e1dbf6dba52fe6613cfe1e5373aeac7f889b62
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              madExcept_.bpl
                                                              • Path C:\Program Files (x86)\IObit\Driver Booster\13.6.0\madExcept_.bpl
                                                              • Size 438KB
                                                              • SHA256 655c2a4b484ce587c8c99cbc17f7cada640e79fc8f92b4de2d68882d79c0c815
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              rtl120.bpl
                                                              • Path C:\Program Files (x86)\IObit\Driver Booster\13.6.0\rtl120.bpl
                                                              • Size 1.1MB
                                                              • SHA256 b3dee68af7b2805f6cf74976b60564dcc7d6d38444078d32cdca99ee1bb5bb22
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              vcl120.bpl
                                                              • Path C:\Program Files (x86)\IObit\Driver Booster\13.6.0\vcl120.bpl
                                                              • Size 1.9MB
                                                              • SHA256 52b78e79ae9b9cccd8f85dea12dd8f5dbc8ffb62f9bc537efb1ced7a4b21c244
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              version.dll
                                                              • Path C:\Program Files (x86)\IObit\Driver Booster\13.6.0\version.dll
                                                              • Size 5.3MB
                                                              • SHA256 4e12ff9a72b7c2357f46ef645400cb6311330ced73ee787244c85ba7c57e8c8e
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              zip.dll
                                                              • Path C:\Program Files (x86)\IObit\Driver Booster\13.6.0\zip.dll
                                                              • Size 1.2MB
                                                              • SHA256 e6c5bcff1d5158f4b1b7372397d4c4a15b4568ec99e56eef347f9233f3a7f29a
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              DBRtt.ept
                                                              • Path C:\ProgramData\IObit\IObitRtt\DBRtt.ept
                                                              • Size 148B
                                                              • SHA256 52d96c74263f7bc0864ddd336ed534f86d0800ecb451a5c6639537871a87fa96
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              Install.ini
                                                              • Path C:\ProgramData\IObit\Install.ini
                                                              • Size 202B
                                                              • SHA256 4117918d46a3cbb778e78b5e66a0ab9c13a84b9e19973a8f1b561bc975708b25
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              StatCache3.db
                                                              • Path C:\ProgramData\ProductData3\StatCache3.db
                                                              • Size 403B
                                                              • SHA256 98a891e19d89dd1d86d47c2784c6f82167eac3fd0967d332724187ee627c5331
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              db13Stat3.ini
                                                              • Path C:\ProgramData\ProductData3\db\db13Stat3.ini
                                                              • Size 100B
                                                              • SHA256 1d4ee130d06e3e0cc7482d168b6ffc6ed09e7ee9810ecf7bb3c0de3e184e6c53
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              69c3ebe2-7af5-4089-8b54-c756bea0b44e.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\69c3ebe2-7af5-4089-8b54-c756bea0b44e.tmp
                                                              • Size 40KB
                                                              • SHA256 cad9567808470f8b79d99ae53d3ca5cda1d5b348895ddee1b76fc5bfe285a805
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              settings.dat
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                              • Size 280B
                                                              • SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              settings.dat
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                              • Size 280B
                                                              • SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              temp-index
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                              • Size 3KB
                                                              • SHA256 c7f711828966284c6ce24d30420e4a798775a694532685cc2ed5876e5de91b57
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                              • Size 3KB
                                                              • SHA256 6c35e1cf533d50601de89dc36b2978573cdf9297001d2dc199c49331f0be6682
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index~RFe59a222.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a222.TMP
                                                              • Size 3KB
                                                              • SHA256 203a98b181b51c66e0034ed8f50b8d2e37551c19b9067c7d8ecd1413f48d7877
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              SiteList-Enterprise.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                              • Size 2B
                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Edge Profile.ico
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                              • Size 70KB
                                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              88ae6600-5678-46a7-828b-50769d58df28.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\88ae6600-5678-46a7-828b-50769d58df28.tmp
                                                              • Size 40B
                                                              • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Network Persistent State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                              • Size 7KB
                                                              • SHA256 ba0a0a9905409babe8d3f597347be82e71625b8392843b12dc3288eff054fbaa
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              SCT Auditing Pending Reports
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                              • Size 2B
                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              • Size 13KB
                                                              • SHA256 ba28dd291df7f2fa90921c3c6da4eae7177d9dedf0700426a680bef1a1c4521c
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              • Size 12KB
                                                              • SHA256 67e40ca2250ec5c90fccd505ac7219ea702b43517d68d492a4e07f204b684922
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              • Size 12KB
                                                              • SHA256 f57e0f54132a68020faef6b494623349259ed2d8665448727758258ec22e59ea
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Secure Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                              • Size 29KB
                                                              • SHA256 505eab52ca69cde944a4d34b29b7e9f418d90a7c6cf0220d243ff594ba7cf498
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              sync_diagnostic.log
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                              • Size 4KB
                                                              • SHA256 fa7c463e6c49263ea56c971bf7280095a270f92769d4ffe13f247c969eae5e1c
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              a62d53a5-644e-4c6a-9c1d-8b1a122c5f0f.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a62d53a5-644e-4c6a-9c1d-8b1a122c5f0f.tmp
                                                              • Size 22KB
                                                              • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 38KB
                                                              • SHA256 18170d16a11ca87e0010e8fb27d71db7786fbb0c630a034a468bd185f0ec104c
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 32KB
                                                              • SHA256 5f4f928c72898101fcce25ac780c324f91c02a73413b5c5c731c6221f7c15c2e
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 39KB
                                                              • SHA256 b2a14f38e43fb031af2d8cf468e94936cb9094a36ed8c7e9e6108cacb2ff0b34
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 38KB
                                                              • SHA256 2fcfebc0ce116fb746721d3bd83c162b25540cf157b9cfa18ea203e53987b60d
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 38KB
                                                              • SHA256 f4a1a31d8b376fed118ac9098184a42471dd091f0cc50a423e788b97057c37ba
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                              • Size 132B
                                                              • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                              • Size 252B
                                                              • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              a7da0ed1-82cd-41e3-9a53-8e9d1d6794f1.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a7da0ed1-82cd-41e3-9a53-8e9d1d6794f1.tmp
                                                              • Size 13B
                                                              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                              • Size 154KB
                                                              • SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              metadata.json~RFe597584.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe597584.TMP
                                                              • Size 132B
                                                              • SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              676b6b4b-76fe-4f1d-8c6a-0bb47d70350a.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Temp\676b6b4b-76fe-4f1d-8c6a-0bb47d70350a.tmp
                                                              • Size 1B
                                                              • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              HWiNFO64A_151.SYS
                                                              • Path C:\Users\Admin\AppData\Local\Temp\HWiNFO64A_151.SYS
                                                              • Size 61KB
                                                              • SHA256 a6e75c3a21436941e9a6a111fe3a708be1753ab656ba247a40b401206096641c
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              CyberMania.url
                                                              • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\CyberMania.url
                                                              • Size 77B
                                                              • SHA256 ae6a476ce9024230ccaf426ba9f0f6f3dbe6a54547fd317f5e014dacd1671121
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              Hook.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Hook.exe
                                                              • Size 5.5MB
                                                              • SHA256 ca73ce96a1c88044bbc047227937ddcf680b373d1dd006914ff3383689373f31
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              driver_booster_setup.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\driver_booster_setup.exe
                                                              • Size 31.9MB
                                                              • SHA256 a67d4d48e93daae7a844bcdb235b83c88ad8b4d8f819c8241204a32e41696d61
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Inno_English.lng
                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-A7HM2.tmp\Inno_English.lng
                                                              • Size 8KB
                                                              • SHA256 5acf921d2b7d33d5fc9ab02569be5f46b5f3cf8656bf1c245f2f61f55529bb3b
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              driver_booster_setup.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-NJ49O.tmp\driver_booster_setup.tmp
                                                              • Size 1.2MB
                                                              • SHA256 8dfc033ff5a1ebac9282f15f14ab048b73fb058fec927a1f5d188a359315c6eb
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              content_new.js
                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2492_1711492918\CRX_INSTALL\content_new.js
                                                              • Size 10KB
                                                              • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Config.ini
                                                              • Path C:\Users\Admin\AppData\Roaming\IObit\Driver Booster\Config.ini
                                                              • Size 29B
                                                              • SHA256 fb3eb20b4566ae0ba7f93c5a60a13bd3a6922d12fb13ecbd971c96efbb1b7895
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Config.ini
                                                              • Path C:\Users\Admin\AppData\Roaming\IObit\Driver Booster\Config.ini
                                                              • Size 54B
                                                              • SHA256 5e77484e2784e3ce36f6da5a8de91cebeb56e6aaee14c216367a973d65aaf774
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              Config.ini
                                                              • Path C:\Users\Admin\AppData\Roaming\IObit\Driver Booster\Config.ini
                                                              • Size 214B
                                                              • SHA256 a5d77de302649f11d176bc20326be12c036f63b24a7071340abefa9c051632b4
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              Config.ini
                                                              • Path C:\Users\Admin\AppData\Roaming\IObit\Driver Booster\Config.ini
                                                              • Size 460B
                                                              • SHA256 9f4b6766e4274a6dffb2c2ca75a95034063e8b876831a6a34b8be26cf1a52f07
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              Config.ini
                                                              • Path C:\Users\Admin\AppData\Roaming\IObit\Driver Booster\Config.ini
                                                              • Size 672B
                                                              • SHA256 2f93976646338f08a9dbd22250fbe8122690b83511a6fb2adab1560e58422083
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              Config.ini
                                                              • Path C:\Users\Admin\AppData\Roaming\IObit\Driver Booster\Config.ini
                                                              • Size 772B
                                                              • SHA256 e18d94f7f18b5b99356761d0fc473e57f86c47d6c5fc8998d3993be46e370066
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              20260826.log
                                                              • Path C:\Users\Admin\AppData\Roaming\IObit\Driver Booster\Logs\Scan\20260826.log
                                                              • Size 2B
                                                              • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Driver Booster.lnk
                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Driver Booster.lnk
                                                              • Size 1KB
                                                              • SHA256 571fa5b4ca010079ae5a46d6f77acebe7141f3f1e40feb2d820c38e079165551
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              memory/1056-619-0x0000000002190000-0x0000000002191000-memory.dmp
                                                              Download

                                                              memory/1056-637-0x0000000057800000-0x0000000057812000-memory.dmp
                                                              Download

                                                              memory/1056-636-0x0000000050120000-0x000000005030E000-memory.dmp
                                                              Download

                                                              memory/1056-620-0x00000000021A0000-0x00000000021A1000-memory.dmp
                                                              Download

                                                              memory/1056-621-0x0000000071CD0000-0x000000007254D000-memory.dmp
                                                              Download

                                                              memory/1056-632-0x0000000000400000-0x0000000000426000-memory.dmp
                                                              Download

                                                              memory/1056-634-0x0000000059800000-0x000000005986E000-memory.dmp
                                                              Download

                                                              memory/1056-635-0x0000000057000000-0x000000005703F000-memory.dmp
                                                              Download

                                                              memory/1056-633-0x0000000050000000-0x0000000050117000-memory.dmp
                                                              Download

                                                              memory/1232-563-0x00000000006F0000-0x00000000006F1000-memory.dmp
                                                              Download

                                                              memory/1232-571-0x0000000000400000-0x0000000000428000-memory.dmp
                                                              Download

                                                              memory/1232-573-0x0000000050120000-0x000000005030E000-memory.dmp
                                                              Download

                                                              memory/1232-572-0x0000000050000000-0x0000000050117000-memory.dmp
                                                              Download

                                                              memory/1232-565-0x0000000071CD0000-0x000000007254D000-memory.dmp
                                                              Download

                                                              memory/1232-564-0x0000000000700000-0x0000000000701000-memory.dmp
                                                              Download

                                                              memory/1296-38-0x0000000000400000-0x000000000042C000-memory.dmp
                                                              Download

                                                              memory/1296-27-0x0000000000400000-0x000000000042C000-memory.dmp
                                                              Download

                                                              memory/1296-695-0x0000000000400000-0x000000000042C000-memory.dmp
                                                              Download

                                                              memory/1452-668-0x0000000001270000-0x000000000146E000-memory.dmp
                                                              Download

                                                              memory/1452-667-0x0000000001130000-0x0000000001269000-memory.dmp
                                                              Download

                                                              memory/1552-39-0x0000000000400000-0x0000000000532000-memory.dmp
                                                              Download

                                                              memory/1552-678-0x0000000000400000-0x0000000000532000-memory.dmp
                                                              Download

                                                              memory/1552-581-0x0000000000400000-0x0000000000532000-memory.dmp
                                                              Download

                                                              memory/1904-647-0x0000000050000000-0x0000000050117000-memory.dmp
                                                              Download

                                                              memory/1904-646-0x0000000000400000-0x00000000006AD000-memory.dmp
                                                              Download

                                                              memory/1904-623-0x0000000002430000-0x0000000002431000-memory.dmp
                                                              Download

                                                              memory/1904-622-0x0000000002420000-0x0000000002421000-memory.dmp
                                                              Download

                                                              memory/1904-642-0x00000000050B0000-0x00000000050CA000-memory.dmp
                                                              Download

                                                              memory/1904-649-0x0000000059800000-0x000000005986E000-memory.dmp
                                                              Download

                                                              memory/1904-651-0x0000000057800000-0x0000000057812000-memory.dmp
                                                              Download

                                                              memory/1904-643-0x0000000005370000-0x000000000548B000-memory.dmp
                                                              Download

                                                              memory/1904-648-0x0000000057000000-0x000000005703F000-memory.dmp
                                                              Download

                                                              memory/1904-624-0x0000000071CD0000-0x000000007254D000-memory.dmp
                                                              Download

                                                              memory/1904-650-0x0000000050120000-0x000000005030E000-memory.dmp
                                                              Download

                                                              memory/2996-689-0x000000000C220000-0x000000000C23A000-memory.dmp
                                                              Download

                                                              memory/2996-617-0x0000000001270000-0x00000000013A9000-memory.dmp
                                                              Download

                                                              memory/2996-626-0x0000000002D70000-0x0000000002D71000-memory.dmp
                                                              Download

                                                              memory/2996-679-0x000000000B670000-0x000000000B78B000-memory.dmp
                                                              Download

                                                              memory/2996-652-0x00000000071E0000-0x00000000072B0000-memory.dmp
                                                              Download

                                                              memory/2996-653-0x0000000007130000-0x00000000071CF000-memory.dmp
                                                              Download

                                                              memory/2996-625-0x0000000002D60000-0x0000000002D61000-memory.dmp
                                                              Download

                                                              memory/2996-627-0x0000000071CD0000-0x000000007254D000-memory.dmp
                                                              Download

                                                              memory/2996-677-0x000000000B2E0000-0x000000000B4B5000-memory.dmp
                                                              Download

                                                              memory/2996-618-0x00000000013B0000-0x00000000015AE000-memory.dmp
                                                              Download

                                                              memory/3112-699-0x0000000000850000-0x0000000000851000-memory.dmp
                                                              Download

                                                              memory/3112-698-0x0000000000840000-0x0000000000841000-memory.dmp
                                                              Download

                                                              memory/3320-523-0x0000000004B90000-0x0000000004CAB000-memory.dmp
                                                              Download

                                                              memory/3320-588-0x0000000004B90000-0x0000000004CAB000-memory.dmp
                                                              Download

                                                              memory/3320-587-0x0000000000400000-0x00000000005FD000-memory.dmp
                                                              Download

                                                              memory/3320-509-0x0000000071CD0000-0x000000007254D000-memory.dmp
                                                              Download

                                                              memory/3320-508-0x00000000008E0000-0x00000000008E1000-memory.dmp
                                                              Download

                                                              memory/3320-507-0x00000000008D0000-0x00000000008D1000-memory.dmp
                                                              Download

                                                              memory/4780-696-0x0000000000400000-0x00000000004A1000-memory.dmp
                                                              Download

                                                              memory/5144-506-0x0000000000400000-0x0000000000498000-memory.dmp
                                                              Download

                                                              memory/5144-488-0x0000000010000000-0x0000000010237000-memory.dmp
                                                              Download

                                                              memory/5368-697-0x0000000000400000-0x0000000000498000-memory.dmp
                                                              Download

                                                              memory/5608-657-0x0000000050120000-0x000000005030E000-memory.dmp
                                                              Download

                                                              memory/5608-630-0x0000000071CD0000-0x000000007254D000-memory.dmp
                                                              Download

                                                              memory/5608-640-0x00000000050D0000-0x00000000050EA000-memory.dmp
                                                              Download

                                                              memory/5608-644-0x0000000000400000-0x00000000006AD000-memory.dmp
                                                              Download

                                                              memory/5608-655-0x0000000057000000-0x000000005703F000-memory.dmp
                                                              Download

                                                              memory/5608-645-0x0000000050000000-0x0000000050117000-memory.dmp
                                                              Download

                                                              memory/5608-628-0x0000000000820000-0x0000000000821000-memory.dmp
                                                              Download

                                                              memory/5608-641-0x0000000005340000-0x000000000545B000-memory.dmp
                                                              Download

                                                              memory/5608-654-0x0000000059800000-0x000000005986E000-memory.dmp
                                                              Download