b319f3964c6dce387fae4554b3de199021e70738ee73cb9bce8715571e19d937

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_8704adec0c41038ff4ea10158db04d8d_cobalt-strike_cova_cryptbot_darkgate_gcleaner_icedid_njrat_satacom_vidar.exe
Size 22.6MB
Sample261102-tcfpmavway
SHA256 b319f3964c6dce387fae4554b3de199021e70738ee73cb9bce8715571e19d937
MD5 8704adec0c41038ff4ea10158db04d8d
SHA1 427107bd3fd1937fbba36c702cc64051c08e28f2
SHA512 e9687d439c470b4606230043a3910cbbe53d96d3c4236e7fb9793cbcc60d55d60b683e2de4a796360252b92bddc240f0dc60422d6f399cc0f59139c81cf60ae2
SSDEEP 393216:+PqEX1wZDb4YcpT96ZlHQ3OdwzFQMYFR7iimpC4a34vw/CwQNXiZ:+PX4/HcpTYLHKZz2MecZaZCHNyZ
TLSH
T1CB37334A73D698E4E8E2A97C8DD009299A737C510B39D78B071C762B1F377A0AD2D371
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution installer persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/memory/4152-634-0x0000000010000000-0x0000000010237000-memory.dmp	UPX

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	attrib.exe
File created	C:\Windows\SysWOW64\drivers\is-67RR4.tmp	BACKUPPER.tmp
File opened for modification	C:\Windows\system32\drivers\etc\hosts	attrib.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 13 IoCs

pid	Process
3636	SUPORTE.exe
4540	BACKUPPER.exe
4812	BACKUPPER.tmp
3604	HWiNFO64A.SYS
4524	DriverBooster.exe
4152	HWiNFO.exe
4080	Manta.exe
4800	AutoUpdate.exe
4764	RttHlp.exe
6024	Manta.exe
2756	Manta.exe
5272	RttHlp.exe
1728	SetupHlp.exe

Loads dropped DLL 60 IoCs

pid	Process
4812	BACKUPPER.tmp
4812	BACKUPPER.tmp
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4152	HWiNFO.exe
4080	Manta.exe
4080	Manta.exe
4080	Manta.exe
4080	Manta.exe
4524	DriverBooster.exe
4524	DriverBooster.exe
4764	RttHlp.exe
4764	RttHlp.exe
4764	RttHlp.exe
4764	RttHlp.exe
6024	Manta.exe
6024	Manta.exe
6024	Manta.exe
6024	Manta.exe
2756	Manta.exe
2756	Manta.exe
2756	Manta.exe
2756	Manta.exe
5272	RttHlp.exe
5272	RttHlp.exe
5272	RttHlp.exe
5272	RttHlp.exe
5272	RttHlp.exe
1728	SetupHlp.exe
1728	SetupHlp.exe
1728	SetupHlp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Driver Booster\ErrCodeSpec\is-EQ903.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\Icons\Apps\is-UHU3A.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\Language\is-F41FG.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\ScanData\scan.dat	DriverBooster.exe
File opened for modification	C:\Program Files (x86)\Driver Booster\HWiNFO\HWiNFO.exe	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\DrvInstall\is-KK5KP.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\ErrCodeSpec\is-HR2AU.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\Icons\Apps\is-PKIME.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\Language\is-93A96.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\Language\is-PJCEM.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\is-ADU6U.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\ScanData\is-KLIL7.tmp	BACKUPPER.tmp
File opened for modification	C:\Program Files (x86)\Driver Booster\ProductNews2.dll	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\unins000.dat	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\is-H06P4.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\is-JDPIK.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\DrvInstall\is-3VE8R.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\ErrCodeSpec\is-QTEUD.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\Icons\Apps\is-NK1NL.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\Language\is-R3NH5.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\is-VLJJ5.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\DrvInstall\is-BFB0V.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\ErrCodeSpec\is-8CB3H.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\Language\is-HUA37.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\Language\is-O701L.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\Language\is-O5JO3.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\Language\is-U89AN.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\Language\is-7D8FI.tmp	BACKUPPER.tmp
File opened for modification	C:\Program Files (x86)\Driver Booster\DBDownloader.exe	BACKUPPER.tmp
File opened for modification	C:\Program Files (x86)\Driver Booster\Zip.dll	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\is-UM8FL.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\is-DIKRF.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\is-SEDVH.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\is-25J95.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\Icons\Apps\is-FUB9J.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\Boost\is-L0PRR.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\is-AEQJK.tmp	BACKUPPER.tmp
File opened for modification	C:\Program Files (x86)\Driver Booster\OfflineUpdater.exe	BACKUPPER.tmp
File opened for modification	C:\Program Files (x86)\Driver Booster\RttHlp.exe	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\is-B2FSN.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\Language\is-R0SO7.tmp	BACKUPPER.tmp
File opened for modification	C:\Program Files (x86)\Driver Booster\Boost.exe	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\DpInst\x86\is-SJEP4.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\ErrCodeSpec\is-Q457B.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\Icons\Apps\is-Q473A.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\Icons\Apps\is-HDIGD.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\Language\is-IJB45.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\Skin\is-7CRAR.tmp	BACKUPPER.tmp
File opened for modification	C:\Program Files (x86)\Driver Booster\Scheduler.exe	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\DrvInstall\is-0LNUM.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\ErrCodeSpec\is-LLD4G.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\Language\is-PDUK0.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\Language\is-1LQ18.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\Language\is-PG4EN.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\Language\is-J359E.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\Language\is-UIFHT.tmp	BACKUPPER.tmp
File opened for modification	C:\Program Files (x86)\Driver Booster\DataState.dll	BACKUPPER.tmp
File opened for modification	C:\Program Files (x86)\Driver Booster\Scanner.dll	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\is-208RJ.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\is-6N39S.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\DpInst\x64\is-1ATCM.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\DpInst\x86\is-3HQHC.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\ErrCodeSpec\is-SKDP8.tmp	BACKUPPER.tmp
File created	C:\Program Files (x86)\Driver Booster\ErrCodeSpec\is-9B1LS.tmp	BACKUPPER.tmp

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3292	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5504	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DriverBooster.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DriverBooster.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HWiNFO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RttHlp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DriverBooster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Manta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RttHlp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Manta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Manta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupHlp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BACKUPPER.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BACKUPPER.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000c00000001c61f-24.dat	innosetup
behavioral2/memory/4540-30-0x0000000000400000-0x0000000000415000-memory.dmp	innosetup
behavioral2/memory/4540-63-0x0000000000400000-0x0000000000415000-memory.dmp	innosetup
behavioral2/memory/4540-598-0x0000000000400000-0x0000000000415000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	DriverBooster.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	DriverBooster.exe

Modifies registry class 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DB_Open_dbd\	BACKUPPER.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DB_Open_dbop	BACKUPPER.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dbd	BACKUPPER.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DB_Open_dbd\shell\open	BACKUPPER.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DB_Open_dbd\shell\open\command\ = "C:\\Program Files (x86)\\Driver Booster\\OfflineUpdater.exe \"%1\""	BACKUPPER.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DB_Open_dbop\shell\open\command	BACKUPPER.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DB_Open_dbop\shell\open\command\ = "C:\\Program Files (x86)\\Driver Booster\\OfflineUpdater.exe \"%1\""	BACKUPPER.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dbd\ = "DB_Open_dbd"	BACKUPPER.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dbop\ = "DB_Open_dbop"	BACKUPPER.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DB_Open_dbd\shell	BACKUPPER.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DB_Open_dbop\shell	BACKUPPER.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dbop	BACKUPPER.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DB_Open_dbd	BACKUPPER.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DB_Open_dbd\shell\open\command	BACKUPPER.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DB_Open_dbop\	BACKUPPER.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DB_Open_dbop\shell\open	BACKUPPER.tmp

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4812	BACKUPPER.tmp
4812	BACKUPPER.tmp
4524	DriverBooster.exe
4524	DriverBooster.exe
1728	SetupHlp.exe
1728	SetupHlp.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4152	HWiNFO.exe
Token: SeLoadDriverPrivilege	4152	HWiNFO.exe
Token: SeLoadDriverPrivilege	4152	HWiNFO.exe
Token: 33	4524	DriverBooster.exe
Token: SeIncBasePriorityPrivilege	4524	DriverBooster.exe
Token: 33	4524	DriverBooster.exe
Token: SeIncBasePriorityPrivilege	4524	DriverBooster.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4812	BACKUPPER.tmp
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4524	DriverBooster.exe
4524	DriverBooster.exe
4524	DriverBooster.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 5768 wrote to memory of 3636	5768	2026-11-01_8704adec0c41038ff4ea10158db04d8d_cobalt-strike_cova_cryptbot_darkgate_gcleaner_icedid_njrat_satacom_vidar.exe	88
PID 5768 wrote to memory of 5504	5768	2026-11-01_8704adec0c41038ff4ea10158db04d8d_cobalt-strike_cova_cryptbot_darkgate_gcleaner_icedid_njrat_satacom_vidar.exe	89
PID 5504 wrote to memory of 4124	5504	cmd.exe	91
PID 5504 wrote to memory of 2792	5504	cmd.exe	92
PID 5504 wrote to memory of 2276	5504	cmd.exe	93
PID 5768 wrote to memory of 4540	5768	2026-11-01_8704adec0c41038ff4ea10158db04d8d_cobalt-strike_cova_cryptbot_darkgate_gcleaner_icedid_njrat_satacom_vidar.exe	94
PID 4540 wrote to memory of 4812	4540	BACKUPPER.exe	95
PID 4812 wrote to memory of 3292	4812	BACKUPPER.tmp	97
PID 4812 wrote to memory of 4524	4812	BACKUPPER.tmp	102
PID 4524 wrote to memory of 4152	4524	DriverBooster.exe	103
PID 4524 wrote to memory of 4080	4524	DriverBooster.exe	104
PID 4524 wrote to memory of 4800	4524	DriverBooster.exe	106
PID 4524 wrote to memory of 4764	4524	DriverBooster.exe	108
PID 4524 wrote to memory of 6024	4524	DriverBooster.exe	109
PID 4524 wrote to memory of 2756	4524	DriverBooster.exe	110
PID 4524 wrote to memory of 5272	4524	DriverBooster.exe	113
PID 4524 wrote to memory of 1728	4524	DriverBooster.exe	114

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2792	attrib.exe
2276	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-01_8704adec0c41038ff4ea10158db04d8d_cobalt-strike_cova_cryptbot_darkgate_gcleaner_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_8704adec0c41038ff4ea10158db04d8d_cobalt-strike_cova_cryptbot_darkgate_gcleaner_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5768
- C:\Addon\SUPORTE.exe
  "C:\Addon\SUPORTE.exe"
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Addon\PRIVATE-USER.cmd" "
  2⤵
  - Drops file in Drivers directory
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5504
- - C:\Windows\system32\cacls.exe
    "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
    3⤵
    PID:4124
- - C:\Windows\system32\attrib.exe
    attrib -r C:\Windows\system32\drivers\etc\hosts
    3⤵
    - Drops file in Drivers directory
    - Views/modifies file attributes
    PID:2792
- - C:\Windows\system32\attrib.exe
    attrib +r C:\Windows\system32\drivers\etc\hosts
    3⤵
    - Drops file in Drivers directory
    - Views/modifies file attributes
    PID:2276
- C:\Addon\BACKUPPER.exe
  "C:\Addon\BACKUPPER.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Users\Admin\AppData\Local\Temp\is-AIADK.tmp\BACKUPPER.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-AIADK.tmp\BACKUPPER.tmp" /SL5="$E0070,21140175,58880,C:\Addon\BACKUPPER.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4812
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\system32\sc.exe" create HWiNFO32 binpath= "C:\Windows\SysWOW64\drivers\HWiNFO64A.sys" DisplayName= "HWiNFO32/64 Kernel Driver" type= kernel start= demand
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3292
  - - C:\Program Files (x86)\Driver Booster\DriverBooster.exe
      "C:\Program Files (x86)\Driver Booster\DriverBooster.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4524
    - - C:\Program Files (x86)\Driver Booster\HWiNFO\HWiNFO.exe
        
        "C:\Program Files (x86)\Driver Booster\HWiNFO\HWiNFO.exe" /brandname
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4152
    - - C:\Program Files (x86)\Driver Booster\Manta.exe
        
        "C:\Program Files (x86)\Driver Booster\Manta.exe" /CommStat /DoCommStat /Code="a602" /Days=0
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4080
    - - C:\Program Files (x86)\Driver Booster\AutoUpdate.exe
        
        "C:\Program Files (x86)\Driver Booster\AutoUpdate.exe" /main /App=db11 /MainHwnd=0
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4800
    - - C:\Program Files (x86)\Driver Booster\RttHlp.exe
        
        "C:\Program Files (x86)\Driver Booster\RttHlp.exe" /cnt
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4764
    - - C:\Program Files (x86)\Driver Booster\Manta.exe
        
        "C:\Program Files (x86)\Driver Booster\Manta.exe" /CommStat /DoCommStat /Code="A100" /Days=0
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:6024
    - - C:\Program Files (x86)\Driver Booster\Manta.exe
        
        "C:\Program Files (x86)\Driver Booster\Manta.exe" /CommStat /DoCommStat /Code="B100" /Days=7
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2756
    - - C:\Program Files (x86)\Driver Booster\RttHlp.exe
        
        "C:\Program Files (x86)\Driver Booster\RttHlp.exe" /stat
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5272
    - - C:\Program Files (x86)\Driver Booster\SetupHlp.exe
        
        "C:\Program Files (x86)\Driver Booster\SetupHlp.exe" /afterupgrade
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1728

C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS
C:\Windows\SysWOW64\drivers\HWiNFO64A.sys
1⤵
- Executes dropped EXE
PID:3604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BACKUPPER.exe

Path C:\Addon\BACKUPPER.exe
Size 20.6MB
SHA256 e2fd54cee391f4481280de680694c6885b93cd86759d6b7adcfb0ac3c1751511
MD5 9477713f3d0faebafbee4b84369dd263
SHA1 dc2601f622165f1395eac914e93b63892c25e77d
SHA512 33da29f449c5aaad9752cfa95d68f44eadf88469d403f4b614e4770adf7bf9407b3efe3cad78e3b3a3a2ad5f316312e6ea1e71fe3a8c13fec2d10e11d3a59412
SSDEEP 393216:A1wZDb4YcpT96ZlHQ3OdwzFQMYFR7iimpC4a34vw/CwQNXie:j/HcpTYLHKZz2MecZaZCHNye
TLSH
T167273397D987D405D0C06CFC56E40E3E2C06FE990A1EF7825F054E2B9E396B6B54A3B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PRIVATE-USER.cmd

Path C:\Addon\PRIVATE-USER.cmd
Size 1KB
SHA256 8c4111341dc841c28635f2addf5cfb8d8db8f4f4f2bd712ec8816a3c860d08cb
MD5 84add811da32776d05a60b71705a2b6d
SHA1 798b1a66721d777179e49e5aae2d6bfc678c9059
SHA512 d318da7ef125c1e0ca82c36e8e77f92ab2b39e5eae4d292465220e637047ce1c2ab1bc3e1c6b81abb3b9936a212f9457650ed7522aec5a3ad966953b75e1b643
TLSH
T13211C3581546CBA211FEC550D31E3055F07DB21F2D189C64F5E3E1B08A59198DEFDDD1
MD5 SHA1 SHA512 TLSH

Submit Download

SUPORTE.exe

Path C:\Addon\SUPORTE.exe
Size 1.6MB
SHA256 4d296e115922566a3e56afcea77eb9a436c1b70ec84c32f047ffd866940b1b16
MD5 57e31a60a690725dc65c2fb6e9b21762
SHA1 9d2f2c166e828b9a73a23253d2e64a05e4a27d60
SHA512 70f48d81e59f38518813b60fe93fc34e5944fea0254def03f8ea17e78c5ba686f5a31ca025075cd43e02745d843408e7df5db54be11663d9a45410a031aa68fb
SSDEEP 49152:O5219/BUxXrHTkdEFzdHMfgLV4dSmwISz5niVdpFM:OG95UxPkdEFRsfgLmST/ViVdU
TLSH
T1EA85015973E918F4EDB7A63DCD910949C2737C224B30C69F035CB66A1F376909A3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DataState.dll

Path C:\Program Files (x86)\Driver Booster\DataState.dll
Size 77KB
SHA256 0b9e80726a2dc59741fb7d951b1bd31de99c2c79f714f3101988b2eb3f6eeff4
MD5 01c2e74799bfec9b06546adcc8db2337
SHA1 d4b73ea0e83e0177eec95070826d12321df9825f
SHA512 6af310e48b285176a75fe7c0b15d0c2ae1e850cf4a931eb6ba57fa6f28b9bff2168c0139988ae640411d5c2526d88677dc82eddb0ac55c015f76a7f12c6c672e
SSDEEP 1536:D0KlWKJYKfFIzlzEQatJjGaDYfmLPxLwe3hGu:D0Kw2evatJjGaUgx0u
TLSH
T154738C113950C473C95B1A746494E7729EBEB9406FF5C08B3FAE46AA6F513C0A73A20F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DriverBooster.exe

Path C:\Program Files (x86)\Driver Booster\DriverBooster.exe
Size 8.6MB
SHA256 a7c87fe55400619ead050e4ae3520447a3d9c5d335c4d8fca26dbfc9866e21de
MD5 0b9ad3bfab85afc2e8b69cacd803bd62
SHA1 58d64b3eb4fcf3ef548ab512da7939ee5ad2f85d
SHA512 729c1b67e09469eaaa869ee4f7b56fbfc6f5d2441ad2c0c58ae0cda4a03149ac1751f4b8998e2f10b6e96730aa24635a3e91e6b89f56052b056e4316d7a083cd
SSDEEP 98304:8uFFybYMld2iUcwl9SxADZ9ly1LWPDwNjnAGeEf/51LG2j0X5yi:lgUMkZ96Wc9OgBtpA
TLSH
T12F968D04AB85C511E2E74EF24C7BC5B598217E325F38C01F7A991B0D6BBEA64B4243B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-SHRPE.tmp

Path C:\Program Files (x86)\Driver Booster\Icons\Apps\is-SHRPE.tmp
Size 1KB
SHA256 ac4531a4b4fe3b34054eb33f2caabe2776be0ea5fc5056670c139caffd51b4f4
MD5 a364eb8919ad57f2278960cf6a062862
SHA1 dd7fa8dd5894960fa47e8c74e2acec034da803d3
SHA512 68e06dcbf244211caac4e386bc73856a7b4da97681e58de3470d6f1000abd336c2d13c84ee11e2bcda9a48afd176efc34f9567ef3bebd5577731956402ead96b
TLSH
T16A410809E4087D05E2ECB99636FD557AADB3084040FCE8D2B48FC0562F50A76B59E9CF
MD5 SHA1 SHA512 TLSH

Submit Download

Arabic.lng

Path C:\Program Files (x86)\Driver Booster\Language\Arabic.lng
Size 211KB
SHA256 a95673d6d094b404935f0f30438d84a62b1422669aee1422125a2c92b70ec000
MD5 cfdb02fb919d945a23a23ea285ff6ab2
SHA1 9b50799aef8af26f731969aac2fe7deb32c2ffab
SHA512 221d80b8433345eae150e28f1906487d4c2598d4a715f57e2b94901f21248eb101a04c3a2d5459cbe0c973268daf4baa8fdc783928a5b1a14047535952e32844
SSDEEP 3072:eucpvVX66kb3dAgrQZWb+6ZGqZr6eTC7OU154XKejgZ2UY6rY14SKsiXyTgkLrZ:vc9Jw
TLSH
T1D02468016FA8C23CB6F35754D766C853422AACAADDDCA23D16B6442D05E09348A1FFF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bulgarian.lng

Path C:\Program Files (x86)\Driver Booster\Language\Bulgarian.lng
Size 206KB
SHA256 745a046a539682d4ba3c3bbab48da232919aa5ee4bce9828ec77ca30fedadb2e
MD5 83adb05755626dde83dd5cdf9f8581f3
SHA1 cc02800d58778fec08c9dafdbcd8885fc740514d
SHA512 666004079764229efd16eb8c42ca2e37054ecafba35d378f78fad144cfffb6fdd9fbb3a5bf7c1a08b7ad7319bcb9385bf8d937f056c1d6c4fec50efb54fe9d9f
SSDEEP 3072:By1uH5DaGtKvh3cXLXNOBc6OZo5ew88xfpuoGJv:B5hE88xhE
TLSH
T17724370FF6FC9114B5E2D740AF7685E601FABFA06728858C119F7C6CA068A7163227D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Catalan.lng

Path C:\Program Files (x86)\Driver Booster\Language\Catalan.lng
Size 237KB
SHA256 dc7422c6e5788a3e7c439573c0d3406e746caf90bc624ee41e65422d5e646406
MD5 2336a61f5d67e4d654098f6bf17c82f0
SHA1 8be86fbb362846c86d6303bf2681cd4f485daee5
SHA512 b9c86793a6057c64847356e4f93d6df0f0f6288117ffc46b6ab1dfa8cddb4fbe06f918f4a061eb246e427ce987bc14686ec28657479877f7de0dea215eca0306
SSDEEP 3072:ggUokF4xPFHkH+h8LaKWEjURGNwC1ExaW1mJ33qzIrNIw/hv3tuS:N5hxN+L2I3rP
TLSH
T11534421267FE2258F2F36F44BEB959654E3BBDA6AC3DC11C12A1415E09F0E10C972B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ChineseSimp.lng

Path C:\Program Files (x86)\Driver Booster\Language\ChineseSimp.lng
Size 131KB
SHA256 03c04933dfe40994bf059746ea092360bc2253a40b6b196ac9f427c748cfa69c
MD5 61c4c78a7fc1ba4bfd7a16f24f25f4de
SHA1 76e5af90be6009bea3d952d63b162ee6a4050845
SHA512 7fcac4b0dacadc2f496cf729cb5eef2a8f388ed560046e8d75efd68348ba63018d5ed0d4d20adf53ed20e680b26006d544f0b226460a313308477c3a32e56eab
SSDEEP 3072:owQFtpVYD+zKw7ph5MsyESxxeMOZ5L61jTLRDuRFFcoZYX5:KhugMOZ8gRFF45
TLSH
T123D3A91233FD1224F5F35B80EBB99864477BBCE5A92CC61C25EA842D45B0E0194A37FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ChineseTrad.lng

Path C:\Program Files (x86)\Driver Booster\Language\ChineseTrad.lng
Size 135KB
SHA256 19170de8030cf072095db196661d416ab5fc81cbfd135a7fef45bf469d973e9b
MD5 a9a87f25ca5be09f5d6dec340094e275
SHA1 339fd142063e2ab6338f8926e61998175bf90da9
SHA512 60c8aa89e4c33ab97001a3e2abd4cf571b0529743760d6bde85aa380d4db9e67a9caeb20bb6990b7a60928b26d18031f9ea51f23175f9c602f948ce139508d2f
SSDEEP 3072:GdLz9vOwEgJI4sIsR5wT659fSJ20AMM09YGpw+0y3/:GdLzUXp50rMop
TLSH
T1F4D3AA1233FD1224F0F35B80EBB58865477BBCE5A96CD56C21EA802D55B0E429463BFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Czech.lng

Path C:\Program Files (x86)\Driver Booster\Language\Czech.lng
Size 231KB
SHA256 98ccd0746e2396d08ab37135957835b7c3d144fe088f0fce7e41a5113d54586d
MD5 68b2e055d98f0c7de85ecf7412d22586
SHA1 caaa414b133d90c8a1b6af872a8e6a275cc6eb4f
SHA512 a585b4776dbdbf33317ae94b1231ebc0f369d90ed2cdc9bd097c89b19e84007b1846e670bd12358317f481c1a89f3069a83cf468d69a8bb7ff7f68ef5133931b
SSDEEP 3072:Q53S0BxVRrTNyHKj45kXjZb6YrVHIVaH3xbVYEckTa+gSFFROsRr84DYwQQdj85e:wiGVq05Yy
TLSH
T1AE34D00323FC1254F1F76F85BEB545B14A7B7CE2BA39C10E6591426D59F0E8098A2BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Danish.lng

Path C:\Program Files (x86)\Driver Booster\Language\Danish.lng
Size 228KB
SHA256 2bab9288dda37c1284429d89d2f78986f00c01c2c74b3f537681dff5409a2f13
MD5 bd5488920632677b690c5c0da79e2d78
SHA1 9eac941f008c9bf88b9601028df01c47430ae183
SHA512 d015edf3b7e509997220da499d8603a7f8dabfe843bc93e156488ea39bf6b81b45bb9bc26a323abac13982a8f225c81bc329a73854c9f898bb258b235c363119
SSDEEP 3072:vyKIbXxfVglCiTe1yoTGTtCkBkACq42StG3bgF4TtE7uUDutQG4:vJINua
TLSH
T13C34A91263F81218F5F32B90BEB985A44A7ABCE6BD3DD21C2191506D4DF1B94C4B2B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dutch.lng

Path C:\Program Files (x86)\Driver Booster\Language\Dutch.lng
Size 237KB
SHA256 2126840b937827cf0037bd299d50efa79e35f9600a0f1d17f0cc1236623d2b22
MD5 95dab9303b6c2f3261d60713703271d1
SHA1 03e495476d27d1e581e2fd43d2a0a0efb3c28694
SHA512 d6c31e09f8e4529c0969cc969bce2b1db66dd71474967b891c2581a18372fa9fa754a4bc161c4178cb19cc3086c9af98df49a96ed5faa8554292f9f2cb6a9e2b
SSDEEP 3072:mjFzKsxnZdAuHDOz2M7AzM3jGlPjJX2UPyytzoPkNvL/LgwrkH08LIPdg7Mu3OIW:uB0Gp
TLSH
T1DB34AD4223F95218F5F32B40BEB845A44E7BBCE6AD39D25C129151AD49F0F80D9B2B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

English.lng

Path C:\Program Files (x86)\Driver Booster\Language\English.lng
Size 217KB
SHA256 2008cb238e860a57084f455b540f99548338fe9876d4959c774431a62921a174
MD5 1c58bdac22e96ab6ead9b6209ce1d238
SHA1 ee69e38919ebca1e7d9af23504c68557bf9f4729
SHA512 248635aa8ddbe918c65c1532022afcf6a7532e404094423d1460a4e9c2c5ccf34321673ddae7709896ce1b0e89125e9b749f3cf52fb21464b3ed53fb7df75a9f
SSDEEP 3072:50xx4NzsUPEKQBeDwWi/Rph+xC90Q4VGbQ0j6Dzq4CorkzYo0PVDx7YYgoEw+WZh:0C+KURph+O0Q4VGbCfuoPVDx0YgoEGh
TLSH
T119248B4263F91218F5F37F90AEB985744A3ABCE2AD78D25C1191906E49F1F50C8B2B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Finnish.lng

Path C:\Program Files (x86)\Driver Booster\Language\Finnish.lng
Size 235KB
SHA256 5a4980aeebbb74e175d0003903545508ab3e57e53fcd03cbae3d9bc89c639f4f
MD5 5b13223448b3dc8eb27609b0e90ded32
SHA1 e22c28ea6a02cfec58167d5c6dca83acb146111c
SHA512 aca14bc9fbcab5960f90b1e59e4a5a5d98bee67d630d4d668bcec2039a6ea1c095213d8d1d13938babe4ef027aeb64aae7fcef443c19aa2231a6902b9863740a
SSDEEP 3072:dPZrhSr/liXxbKukTxZ+MxdlUNfRZsgRkWTKC7wQ+M4I/XxuODJELWasTHMqUN2z:jrhaWmeE03lRH
TLSH
T10634BC5663FD5224F2F35F40BEB485640A7BBDE3ADBCD21C1A55402D89B0A80D8B2B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

French.lng

Path C:\Program Files (x86)\Driver Booster\Language\French.lng
Size 259KB
SHA256 74fa1cdff88027f6db3c5bcfb75d214e49a7303856fbb0daa5973cdfe36c692a
MD5 8b10d871b0d73ddb16bf5b689459a700
SHA1 7c92476f79e0adad039511f49c81227858b26a3c
SHA512 133a56fa211a36dc67d944531bb94a9f37f291e78b717872f7b9b02881b02ec0b3ed6487a3877cd551a3b943774b98d310fc1d0eda01249a2182f2b7a13ec3e2
SSDEEP 3072:JdvnjlfmAW20gFSO6Aeo+A1H0HTyzE1dq1c41FypV1qkGN+GWN2:bnQ+N4G
TLSH
T128446312A3F81215F6F37F42BEB945654E3B7CE6AD39C12C1291909E18B0E54C9B2B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Georgian.lng

Path C:\Program Files (x86)\Driver Booster\Language\Georgian.lng
Size 195KB
SHA256 e54340b8680d62180b92a912b0f13f7319a150547f46ec6aca8418c9f1946470
MD5 769c190424feff62f765f7e84db5a8ae
SHA1 f06a128c07cb81b824754581f3b88dcd69d4a303
SHA512 0c1c48ee16832bca05847c4813fb79349321ba046035b8abf229499573d836143317473d80562c38f7b21d0219a4aea55cb745163e487f66cd146a9a535005b5
SSDEEP 6144:3dRjfpM8lmUL6BY6G/VrBA/M2Y8PdyxYB5cfb:3dFfpM8lmUL6k/VrBA/M2Y8PdaYB5cfb
TLSH
T1C414270223A7452561EA17B0B9BCCD9DA23DEFD02058D51EA3E19D9DD2A0EC385B7373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

German.lng

Path C:\Program Files (x86)\Driver Booster\Language\German.lng
Size 249KB
SHA256 5c2e5f279093fbabcfe3a8985ddbd7a678011275d5184d8acee9137b4e7daf6c
MD5 754e61f04d0a081322880e61fd407067
SHA1 ca75c88cf57a7de20d796f00e8dd68c43484d8d0
SHA512 ae6aa0dd4adfb62ad71b54608a6147c1b483a39bcda8941209d62fee4ccbef48bc9f312ff0be661747ff76d78919723228521df88c26d566b8040337e0087ca5
SSDEEP 3072:9DW4UUivdr4GIluZK3l09lwL23KCMp+pNHrOnYBkIR9pQ7PMzG2cMf2cVW0WdxzK:BWCAk4RjMYr
TLSH
T11844DD1263F95628F2F32F80BEB481A85E77BCE6BD79D51D2290506D08F1E409972B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Greek.lng

Path C:\Program Files (x86)\Driver Booster\Language\Greek.lng
Size 262KB
SHA256 5ceaf262d6d469c164f5adaa7f0d9a0cc4fc026088edda86567a0910f449341d
MD5 9a2bc36fe3972c9b2f06913a7f769589
SHA1 2a78aea4393b0e3458c45f3092241dfd4f1d873a
SHA512 ad72bca3df6f1879365397eeda21c2bf44ab79195564cec504597d3f9a0a94423651a22db0465af57588811c0258154a8c656992e72ec8d993dbb3e4224b1f5b
SSDEEP 3072:ydOQ5rYAQh2J8n3BUkbA4dKePJ6urc4LyWd+qGbHJMHIIdtyx7FrZPl77AV1Sb77:QIJA4dKe2JMGpkJGv1xd
TLSH
T1A544044E1AFF1220BEF659F1A973846A4B2FF892042CDD6A71F17018D96CD1189C3B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PowerMgr.dll

Path C:\Program Files (x86)\Driver Booster\PowerMgr.dll
Size 75KB
SHA256 4b4c3be51b5a01082ca287c1e572e46f602edc020d3ef1b20b77620d08c3225a
MD5 d906a057f3ec4c351a5b55c4c7daef90
SHA1 69dd632d06b566bb65176d7f83edf46b96e4dabf
SHA512 fe6a0fa097915a1672f06f63389713f24c30c37eca735c4285ca4638f9d79912f276b88938e61e2cdd306e4f0cbc787e2078547bff3d36f3e3f3af228e819694
SSDEEP 1536:ej80JDGqWpMfdHh9LsjwXKiNXcxAmLPxjwPE3hnF3:o8Iyyh+9iNXoxxr3
TLSH
T17C737B116620D032F9936A3475E9D7325C3E79625BF090CB3FAA42A94F903D1B77932B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductNews2.dll

Path C:\Program Files (x86)\Driver Booster\ProductNews2.dll
Size 2.1MB
SHA256 a7b8a67953e4ec724fe64f612ab37c2ea9709ec9b5e64103bfad871416692466
MD5 c9684e20fb4372f243fc50d37fb19dba
SHA1 ef111eab87994f135d201c7b6b491512c6441e4e
SHA512 9c2b89d088f77a46ea46627d5c31dffc22e73fbe9c317d7848315e327530dd9005e15cdcddceba0734667744d905755a1df21591d4e7365ca119af76202190ae
SSDEEP 49152:kUb8SX5jX6m/THvsGVl4d3ELIYsa31+seT0IEqgFkMa:kI8Sp7PT0Gb23ELI7Br78a
TLSH
T158A54B2166D58037E0732E7A9C6AD6D4683A7E301E74D84F3EE85A4C1F39B41AD353A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Driver Booster\Register.dll
Size 1.0MB
SHA256 455942c27ce3563e2de7e0485f7f6d0297a81335c1bafe3ac89617639b9a351d
MD5 156f95ef4b275304d8785cfa8ee63fe1
SHA1 8d4856b56f57b6fb6df3d4554adb0ca651c51c3e
SHA512 623c5f82fd8f83630643dbe3a3d3ef2d5b2815e02a639a7f18e099c223f8443bfd66c5f0740114d995d280d93fff19057ba9a612ba4a95eb1150819b0ede7199
SSDEEP 24576:nkUunZsR5TDWQjVPIv1zzl7CVyRtCSI2tT8+uN5C:k76QdzB79TIUT3n
TLSH
T101355C12A3C64437E0721F7A8D6AD6946C29BD312EA4D84F7EF88B4C0F39B41AD34657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scan.dat

Path C:\Program Files (x86)\Driver Booster\ScanData\scan.dat
Size 130B
SHA256 a9c5e2c5aad2a658cf843e4ec3cc91429baf83fc89fcf0e138f6a93ea1475fd6
MD5 70df5c34fd3bc550b80bb0df7811ad62
SHA1 a356d36cd50d71539d9699ac12d76fd97b8931f2
SHA512 7a386a9fd66383f5fc0380702e09ae18ca2487773582066cf10773ae22aa4246b260707a04674e78a43656e9bc631f007ddcd1853530eb52689e4fd9527b91db
TLSH
T12BC09BD45D15111AD541417621C4745875E499425A490694D3146B5C5C24641C975C84
MD5 SHA1 SHA512 TLSH

Submit Download

SysRest.dll

Path C:\Program Files (x86)\Driver Booster\SysRest.dll
Size 110KB
SHA256 9577f60b9fc028a2494a84e3268556e3ef340440b46dafa51ff9585e655c4a2c
MD5 1e580b51208008ff8d9ef0763eccd721
SHA1 5e1ece1e257c43efa93f5b69e9621dc4122e9612
SHA512 d2893e4acd94df1e698427fb2c94ca110fab7a64257a59f3038b94470303009fc614903655c42dcadf0458a971c8f811640052a7e375269fb01ec7e7f709c3da
SSDEEP 1536:VdK80NVoWFRtp2+XKdcs4ZsWjcdsgB3s50po58CDqymLPx+oFw63hgP:VdK808sRC+XKpV3s50poagqPxEP
TLSH
T150B36B4136E09471E8AF0A3148B4E7225B3E7AA2DFF0D8C73B95024E5AA13C06F74767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebRes.dll

Path C:\Program Files (x86)\Driver Booster\WebRes.dll
Size 885KB
SHA256 aee0c8bd793c33c2965537a16de1d8434ab9c3682928e8bc390b63cfa6c068d3
MD5 15cd47fd2adf99223a8e032f6872c963
SHA1 01dcd05009c130d3febae0278a6d97528e31d538
SHA512 e0355b5c582dd8fb26d36437e5e8e54a54db79d719ba67870e085814e15472f244e7b8b671507f5eb886f434525c6609f9e080ed75ee12eae9bbeb44d4fc2f00
SSDEEP 24576:rqNAogNi7/VlKAA4LVL8pJsv6tWKFdu9CcuuKTr9/4:2EiRlLb9GJsv6tWKFdu9CtuKTJ/4
TLSH
T192158D409AEB01BBF2FF5A3155BF123542BBBE228631A93F11CC35095E753A1AB17712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Zip.dll

Path C:\Program Files (x86)\Driver Booster\Zip.dll
Size 582KB
SHA256 a7a8af1a7dbafa56a1741b19cc276947fc75247c0742b1073cf6daabdf079219
MD5 8c1858aa9763d8837d2d0dc81ed62cbc
SHA1 2d528c0179c05092c7907ac584fbf10461b0e20d
SHA512 f3b9b9377bce69aa710612e60728613cdec745727b2fa89afa66690be91c68be17e8685dad65b11a18c672363d4e5af8499dbf02792ddec440b528655a85a7f7
SSDEEP 12288:EdIS4iujAs1+7lwEFbxGJKkUGBbl2+ZjuNPuiNV1T0jJF5V:XZiu0s2lwEFbxGJKkUGBbl2+ZjuNPuio
TLSH
T19BC45C23A240553BC8E51B38A8F39320983F767179D9BC461FE44D6FCA6D1506A3F2E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

madBasic_.bpl

Path C:\Program Files (x86)\Driver Booster\madBasic_.bpl
Size 211KB
SHA256 c2df993943c87b1e0f07ddd7a807bb66c2ef518c7cf427f6aa4ba0f2543f1ea0
MD5 641c567225e18195bc3d2d04bde7440b
SHA1 20395a482d9726ad80820c08f3a698cf227afd10
SHA512 1e6023d221ba16a6374cfeb939f795133130b9a71f6f57b1bc6e13e3641f879d409783cf9b1ef4b8fd79b272793ba612d679a213ff97656b3a728567588ecfb9
SSDEEP 6144:XN/kSQxE6qeM/k4qTl5L5e5+53WCG1CbF/FrfPf:AqeM/k4qR5L5e5+53WulZn
TLSH
T13B247E36A100CC33C6A7797BCCBEB550A96479640A3644DF7DEC8E80AB5A2D5372D387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

madDisAsm_.bpl

Path C:\Program Files (x86)\Driver Booster\madDisAsm_.bpl
Size 64KB
SHA256 2aec41414aca38de5aba1cab7bda2030e1e2b347e0ae77079533722c85fe4566
MD5 3936a92320f7d4cec5fa903c200911c7
SHA1 a61602501ffebf8381e39015d1725f58938154ca
SHA512 747ea892f6e5e3b7500c363d40c5c2a62e9fcf898ade2648262a4277ad3b31e0bcd5f8672d79d176b4759790db688bf1a748b09cbcb1816288a44554016e46d3
SSDEEP 1536:LNy3eqMne0sXB0IWtCLwEJhY0w1VmLPx5wdB3htW:LqMnfIB04LwEJhY0w16xAFW
TLSH
T1BD538CA34248D437D94375738CAAE6F5A9B0BB221D3090D73CEC0B94EF597842F4A65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

madExcept_.bpl

Path C:\Program Files (x86)\Driver Booster\madExcept_.bpl
Size 437KB
SHA256 cb32cf24c663542179eac8f540b20c68abf3e7143150f5b168f397d70940cb9f
MD5 4a4843040feaddb047eb0c7ef91ccce4
SHA1 f3c989732c6f6709f78b93314af8c24eb64745d8
SHA512 39325271ae33e6389e526aa51f4ef4a386605722dc1016fc4bf4be27ee4f7dc40e28e93519dabadc5537766bd2ace22b95f74b9564339e41a0b2d071d85c4d01
SSDEEP 6144:hlAz49EKhEV30F8sl88nTjQ4Q50gEcW/jd+o72niVFNMa4Yn2Bq:hlG4ut30F8slzYlQcW/jd++2nQ6u2Y
TLSH
T152944D31D288C477D062263BCC2AD6C461B975341A34A85F7DE80F4CAF77A91AF26397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rtl120.bpl

Path C:\Program Files (x86)\Driver Booster\rtl120.bpl
Size 1.1MB
SHA256 d6dd7a4f46f2cfde9c4eb9463b79d5ff90fc690da14672ba1da39708ee1b9b50
MD5 adf82ed333fb5567f8097c7235b0e17f
SHA1 e6ccaf016fc45edcdadeb40da64c207ddb33859f
SHA512 2253c7b51317a3b5734025b6c7639105dbc81c340703718d679a00c13d40dd74ccaba1f6d04b21ee440f19e82ba680aa4b2a6a75c618aed91bd85a132be9fc92
SSDEEP 24576:GbhVoNWbA1m6z1hGaMopv3RdaK6IPFf0DtDN9Tox0gc:vtQZPTtgc
TLSH
T10D357C31F3498CBBD2B626BD4519BA149C787E10A5A0D5AABCF8CD0DB975480373C39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Program Files (x86)\Driver Booster\sqlite3.dll
Size 908KB
SHA256 7cc676d23aa669a035fe9a2b35144ca97a1753e3c99ef76c519d5016bc672975
MD5 753be2d89198c016fe02d922f6d6d808
SHA1 56d6ca0fb0ebed16de7cda10842317f3cc4ea249
SHA512 3c936304d1f5df81580e6624ebd49da932ce69229814f858d1b0611b68deab203d956edaf4b381de3c2427a5df56208c04726fed27682a2ad29a3b8e7173d313
SSDEEP 24576:FRxNAQB74x0FwTuis6eCwjH+SW61zf/AX:Fa+syis/LjH+S31I
TLSH
T1C1157E46EA17A87BDC5701754607F39B0575DA30A832CB8BEBC91D68DEB3ED2160A343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcl120.bpl

Path C:\Program Files (x86)\Driver Booster\vcl120.bpl
Size 1.9MB
SHA256 572edb7d630e9b03f93bd15135d2ca360176c1232051293663ec5b75c2428aec
MD5 c594d746ff6c99d140b5e8da97f12fd4
SHA1 f21742707c5f3fee776f98641f36bd755e24a7b0
SHA512 33b9902b2cf1154d850779cd012c0285882e158b9d1422c54ea9400ca348686773b6bacb760171060d1a0e620f8ff4a26ecd889dea3c454e8fc5fa59b173832b
SSDEEP 24576:j2gekcIlYas4GaAKBTZTkZbJ7YBRSjr2WLPcgjzTGlyz6F:jRvzfZT3XSmqcOTGc+F
TLSH
T18E956CA0A33D0DF2D5932B7C259FAF20E925AF106320D65BAAF5BD4C5EF15803B1521B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DBRtt.ept

Path C:\ProgramData\IObit\IObitRtt\DBRtt.ept
Size 140B
SHA256 388256d89d869f71f20545688f4c8d0afaa87f0d8fddd4abb2b29fd650d0f298
MD5 f2dc2eef0e95712f2db6b19495be49bf
SHA1 4076d8c96e62d6755a9757b23a3dc93f49c2b0d7
SHA512 29154c07c5aff1d939d18a413e8a67c3c88d010621f15775b025e830d79bfaaefd94b19ecaaf3773e6499dd27819a324c5cc6732e4f92f094f26a422728d8343
TLSH
T1C9C02B00EF26E005DD6C52F9802EF8006029D3005CF0B0C6E08029C0A4C8A58C340CAC
MD5 SHA1 SHA512 TLSH

Submit Download

HWiNFO64A_151.SYS

Path C:\Users\Admin\AppData\Local\Temp\HWiNFO64A_151.SYS
Size 61KB
SHA256 a6e75c3a21436941e9a6a111fe3a708be1753ab656ba247a40b401206096641c
MD5 b8b796586c1c177ce49dac10c57088ea
SHA1 37df4c40300da4ef18971ef4dff96c864c3e463a
SHA512 e4039f6cb66115fcd01845ccc1cf3d0cff5791f2c7b5aa32a6fe741d8317e865e608e99174ecb13d5bd1130f0b12811c8f7bfd60b0e00b869c4d84d0265ca9d5
SSDEEP 1536:C65xIxwMHQwoQoNzyjifr1a7OQmbF0d0UCncvjdRUDd8uK7MPL+kGOxtt1+:C6x2/wwoQoNzyjifBa7OQmbF0dcnEUDq
TLSH
T118538DD5AB984825ED2AEA701E918153FA343D850F25DEEF41A4C2252F87FE063B437D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BACKUPPER.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-AIADK.tmp\BACKUPPER.tmp
Size 915KB
SHA256 b7af342b739b00144496854dc9c0f7e77db76ba1e860a83ceccb2e25d99b5f5c
MD5 f958584a9408fd515aefd45924e379a9
SHA1 46b23e7aeaa09a3d152158653b5e73263c637d84
SHA512 99c601c627a7c63ea9548e52695b970789a6bbbfbf346086b5ccfa69bff1e59e568763892958f62ca9aa0d4e77a131c6338a87e4e222a56f54f655613cf5e227
SSDEEP 24576:9kHgKPNrPA37hzHIA6/oR36vln6sYEubnhRgZtnT/DExlaH:96frPA37hzHIA6/3UvjhRgZ9TUE
TLSH
T1FA158C22F280C437C1B31A749E4786E5693BBD053E28A9DB7BF91F4C4F3A55139262D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Portable.bmp

Path C:\Users\Admin\AppData\Local\Temp\is-L2BGA.tmp\Portable.bmp
Size 35KB
SHA256 20ac142f4dda7cf471187390ed263c757000018a48faa52c3c18335dedcae7b5
MD5 4779c60261e74957c3393d9e14e0262b
SHA1 5b8e4fc6ac7fe8e204d10cfceb4f9d56ee38a3db
SHA512 5839796a00a29927004b64b1b3d075429a5a904ad3dd5107dc517faf32b89f796312913903ed7c9a826e64f4ee34422d97822c93dfa1664bb5d7a77f37b9ca19
SSDEEP 384:pE2qGIrtQkpZWqesOn3pqiP6K7Y3jqmf3dYQH/fCEU46OmuOnUV3L4JVCcTz:NIpQkjWUOXY3Omf3dJCQ6+VKn3
TLSH
T1C6F22B5A7830E74D7AA920BDEC6641EC7AB84F84CDCA1277C806729CEEB4D1C57F6121
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

innocallback.dll

Path C:\Users\Admin\AppData\Local\Temp\is-L2BGA.tmp\innocallback.dll
Size 63KB
SHA256 6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
MD5 1c55ae5ef9980e3b1028447da6105c75
SHA1 f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA512 1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
SSDEEP 1536:+VqUE7JhgAzj/ZuhnOwKWSAXvze/V2C0mswp91:gWgAnB3XDAqt/p91
TLSH
T198534A17B5E14AB1E0A2CABC5C399314873FBD302E78D599A7BD0DCE8D393829858357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Config.ini

Path C:\Users\Admin\AppData\Roaming\IObit\Driver Booster\Config.ini
Size 702B
SHA256 e99544c674db5d8eeb5d78b5ba4eecfd43a7cbbae712b96a864a7e62914213cc
MD5 1489081b2b3f17c33ab39ded358084fa
SHA1 b75278e7c701db771d7dfebe6c77e760dcf31ebb
SHA512 fce9a4b93e519e509b5f8ccbf14a0de258da7a2b5939f25b1d42a67a262e82c494401ba7997a6e0dd9e4acc958f269ac1e4d1ebb93030e53df248afc3475060e
TLSH
T1E7013C7327E91220EAB7A788D77868716B37BC5A640CC84CE0C1510D8DF0A1094237FB
MD5 SHA1 SHA512 TLSH

Submit Download

Config.ini

Path C:\Users\Admin\AppData\Roaming\IObit\Driver Booster\Config.ini
Size 816B
SHA256 d27462bd5711bfb48908462449f163010f14a2bea5cc369de3a3bc851ed8e4fd
MD5 53ac6fddbe6259b204acfccdf03c7b6b
SHA1 0a66c278c9ff94f2af2e3bc6176d8f235a043f96
SHA512 c4414a5986469dc18ba2b5350e1df230de3cc9b9cb0a8c0d9bc2a6a306c7c7d5aea0562f87f7aa332f5728e6117e22afadbe3dd4cb7b0e4fbabaafdee69b674a
TLSH
T13301447327E41164EAB76B88EB7454716B367C5A581DC85CE0D1520D8DF0910D4737FB
MD5 SHA1 SHA512 TLSH

Submit Download

Config.ini

Path C:\Users\Admin\AppData\Roaming\IObit\Driver Booster\Config.ini
Size 866B
SHA256 a7ed778045952503276b2494079452947920a2695c25d5dc4145712cc114e098
MD5 196b9faf761ec6fdb6e0f0147e522933
SHA1 c297c79abc36e7842a110b011425cfd15710786e
SHA512 6232246692f4f2458e1584a9ecbddc9d06026adf5905e5fedb1634badf0f7efdb08c483074738414b4567efd381e63405f68af2c62d736dba8fb402a6eef788f
TLSH
T1CB11757327E81264EAB76B88EB7454716B367C59181DC85CE0C1510D8DF0900D8733FB
MD5 SHA1 SHA512 TLSH

Submit Download

HWiNFO64A.SYS

Path C:\Windows\SysWOW64\Drivers\HWiNFO64A.SYS
Size 26KB
SHA256 f0d052daf48a62e4a90d067bfcb5ee9563804de68d0ea82e0e11c8d16ad19d29
MD5 ef558a02d734a1403583e95cceec2487
SHA1 799bd9b507484bd02c6795f463609f65540a6400
SHA512 22d1869be7b9acf62a266df42c750feea905265d48b642c6de04ae61485eed0454b3f04b658152d6495f7c1c8498ea545f4069ce6131d526a758bcca03a64753
SSDEEP 768:AI32BcseAj3xzJtrLcc0Ikm5CgXh0o02/8n:aQADxv8zmgAhtvs
TLSH
T19AC25BC1AB2A2469E6DBCA70DFF1DAA7F9707D41474496EF4214CA602D51FF0373821A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 c32076e095cc58ad46e4744894b9eecebaae34a9f08103cf8da037ad358b746e
MD5 e2c2e6d324bad7c47d03a2c134d155c7
SHA1 81fd2a3fc48b46557b84d0a83e5f1d9425327afa
SHA512 2101722d82f1a7456412f99f87d81c2b73b3544c2e1d6268266a3dd284bd2b91eb509bd00f7a9c9c3c907ffdd7df3cf81b7bb6e257cf1a5ce0b8edd115e8115b
TLSH
T14C21DF260B4995DD22B24195851DB42FF35FD0EF0A2B8DCD3E8D050F7B92A2D5323786
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1728-890-0x0000000004760000-0x000000000486D000-memory.dmp

Download

memory/1728-891-0x0000000000400000-0x000000000064C000-memory.dmp

Download

memory/1728-892-0x0000000050000000-0x0000000050116000-memory.dmp

Download

memory/1728-893-0x0000000004760000-0x000000000486D000-memory.dmp

Download

memory/2756-867-0x0000000050120000-0x000000005030D000-memory.dmp

Download

memory/2756-864-0x00000000032B0000-0x00000000033BD000-memory.dmp

Download

memory/2756-868-0x00000000032B0000-0x00000000033BD000-memory.dmp

Download

memory/2756-866-0x0000000050000000-0x0000000050116000-memory.dmp

Download

memory/2756-865-0x0000000000400000-0x00000000004E3000-memory.dmp

Download

memory/3604-553-0x0000000000010000-0x000000000001A000-memory.dmp

Download

memory/4080-635-0x0000000002460000-0x000000000256D000-memory.dmp

Download

memory/4080-653-0x0000000002460000-0x000000000256D000-memory.dmp

Download

memory/4080-652-0x0000000050120000-0x000000005030D000-memory.dmp

Download

memory/4080-651-0x0000000050000000-0x0000000050116000-memory.dmp

Download

memory/4080-650-0x0000000000400000-0x00000000004E3000-memory.dmp

Download

memory/4152-855-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4152-634-0x0000000010000000-0x0000000010237000-memory.dmp

Download

memory/4524-617-0x00000000078A0000-0x0000000007971000-memory.dmp

Download

memory/4524-594-0x0000000001420000-0x000000000164F000-memory.dmp

Download

memory/4524-904-0x00000000078A0000-0x0000000007971000-memory.dmp

Download

memory/4524-905-0x0000000007330000-0x00000000073CC000-memory.dmp

Download

memory/4524-965-0x0000000050000000-0x0000000050116000-memory.dmp

Download

memory/4524-937-0x0000000050000000-0x0000000050116000-memory.dmp

Download

memory/4524-899-0x0000000050120000-0x000000005030D000-memory.dmp

Download

memory/4524-673-0x000000000DB30000-0x000000000DBC2000-memory.dmp

Download

memory/4524-619-0x000000000B920000-0x000000000BA79000-memory.dmp

Download

memory/4524-618-0x0000000007330000-0x00000000073CC000-memory.dmp

Download

memory/4524-602-0x0000000007050000-0x000000000715D000-memory.dmp

Download

memory/4524-596-0x0000000001650000-0x00000000016E7000-memory.dmp

Download

memory/4524-923-0x0000000050000000-0x0000000050116000-memory.dmp

Download

memory/4524-909-0x0000000050000000-0x0000000050116000-memory.dmp

Download

memory/4524-901-0x0000000001420000-0x000000000164F000-memory.dmp

Download

memory/4524-903-0x0000000007050000-0x000000000715D000-memory.dmp

Download

memory/4524-895-0x0000000050000000-0x0000000050116000-memory.dmp

Download

memory/4524-906-0x000000000B920000-0x000000000BA79000-memory.dmp

Download

memory/4524-907-0x000000000DB30000-0x000000000DBC2000-memory.dmp

Download

memory/4524-902-0x0000000001650000-0x00000000016E7000-memory.dmp

Download

memory/4524-894-0x0000000000400000-0x0000000000CD4000-memory.dmp

Download

memory/4524-896-0x0000000057000000-0x000000005703F000-memory.dmp

Download

memory/4524-897-0x0000000057800000-0x0000000057812000-memory.dmp

Download

memory/4524-898-0x0000000059800000-0x000000005986E000-memory.dmp

Download

memory/4524-900-0x0000000061E00000-0x0000000061ECA000-memory.dmp

Download

memory/4540-63-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4540-598-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4540-30-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4764-857-0x0000000050000000-0x0000000050116000-memory.dmp

Download

memory/4764-856-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4764-850-0x00000000026A0000-0x00000000027AD000-memory.dmp

Download

memory/4764-858-0x0000000050120000-0x000000005030D000-memory.dmp

Download

memory/4764-863-0x00000000026A0000-0x00000000027AD000-memory.dmp

Download

memory/4812-46-0x0000000005BC0000-0x0000000005BD5000-memory.dmp

Download

memory/4812-65-0x0000000005BC0000-0x0000000005BD5000-memory.dmp

Download

memory/4812-583-0x0000000000400000-0x00000000004F8000-memory.dmp

Download

memory/4812-597-0x0000000000400000-0x00000000004F8000-memory.dmp

Download

memory/4812-64-0x0000000000400000-0x00000000004F8000-memory.dmp

Download

memory/4812-584-0x0000000005BC0000-0x0000000005BD5000-memory.dmp

Download

memory/5272-886-0x0000000050000000-0x0000000050116000-memory.dmp

Download

memory/5272-887-0x0000000050120000-0x000000005030D000-memory.dmp

Download

memory/5272-888-0x00000000032A0000-0x00000000033AD000-memory.dmp

Download

memory/5272-885-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5272-882-0x00000000032A0000-0x00000000033AD000-memory.dmp

Download

memory/6024-851-0x00000000030C0000-0x00000000031CD000-memory.dmp

Download

memory/6024-859-0x0000000000400000-0x00000000004E3000-memory.dmp

Download

memory/6024-860-0x0000000050000000-0x0000000050116000-memory.dmp

Download

memory/6024-861-0x0000000050120000-0x000000005030D000-memory.dmp

Download

memory/6024-862-0x00000000030C0000-0x00000000031CD000-memory.dmp

Download