URL:

http://file.drivethelife.com/download/7.1.15.48/DriverTalent_setup.exe

Full analysis: https://app.any.run/tasks/e08989e7-ef4d-4f1b-9547-4d09c9939ca7
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Analysis date: January 11, 2019, 04:36:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
adware
pup
installcore
trojan
Indicators:
MD5:

D1E33FC1ED2E41EA6A572951F5AC2A58

SHA1:

36E8ADBFB4181964290A0C4DF6446E39C0024468

SHA256:

73BC1BBFB2FDBBC27125631B5EDEC84C0964EFE87CA24A450858619B7E7D0602

SSDEEP:

3:N1KY0MRDExKLSOUQHi90Qh4A:CY0Mhm+C4A

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • DriverTalent_setup.exe (PID: 252)
      • DriverTalent_setup.exe (PID: 1076)
    • Downloads executable files from the Internet

      • chrome.exe (PID: 3036)
    • Loads dropped or rewritten executable

      • DriverTalent_setup.exe (PID: 1076)
      • svchost.exe (PID: 2712)
    • INSTALLCORE was detected

      • DriverTalent_setup.exe (PID: 1076)
    • Connects to CnC server

      • DriverTalent_setup.exe (PID: 1076)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 3036)
      • DriverTalent_setup.exe (PID: 1076)
    • Reads Environment values

      • DriverTalent_setup.exe (PID: 1076)
    • Reads internet explorer settings

      • DriverTalent_setup.exe (PID: 1076)
    • Reads Windows Product ID

      • DriverTalent_setup.exe (PID: 1076)
    • Reads the date of Windows installation

      • DriverTalent_setup.exe (PID: 1076)
    • Creates a software uninstall entry

      • DriverTalent_setup.exe (PID: 1076)
    • Reads the machine GUID from the registry

      • DriverTalent_setup.exe (PID: 1076)
    • Reads CPU info

      • DriverTalent_setup.exe (PID: 1076)
    • Creates files in the program directory

      • DriverTalent_setup.exe (PID: 1076)
  • INFO

    • Application launched itself

      • chrome.exe (PID: 3036)
    • Reads settings of System Certificates

      • chrome.exe (PID: 3036)
    • Reads Internet Cache Settings

      • chrome.exe (PID: 3036)
    • Dropped object may contain Bitcoin addresses

      • DriverTalent_setup.exe (PID: 1076)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
11
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs drivertalent_setup.exe no specs #INSTALLCORE drivertalent_setup.exe chrome.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
252"C:\Users\admin\Downloads\DriverTalent_setup.exe" C:\Users\admin\Downloads\DriverTalent_setup.exechrome.exe
User:
admin
Company:
OSToto Co., Ltd.
Integrity Level:
MEDIUM
Description:
Driver Talent Setup
Exit code:
3221226540
Version:
7.1.15.48
Modules
Images
c:\users\admin\downloads\drivertalent_setup.exe
c:\systemroot\system32\ntdll.dll
1076"C:\Users\admin\Downloads\DriverTalent_setup.exe" C:\Users\admin\Downloads\DriverTalent_setup.exe
chrome.exe
User:
admin
Company:
OSToto Co., Ltd.
Integrity Level:
HIGH
Description:
Driver Talent Setup
Exit code:
0
Version:
7.1.15.48
Modules
Images
c:\users\admin\downloads\drivertalent_setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
1964"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=916,6648249723427096982,15695952238347034389,131072 --enable-features=PasswordImport --lang=en-US --no-sandbox --service-request-channel-token=3F9A4C09251FAB766E9A0AEEC696B838 --mojo-platform-channel-handle=2420 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2272"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=916,6648249723427096982,15695952238347034389,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=AA494380577D90A2CDEFA9D0D1E41C19 --mojo-platform-channel-handle=1004 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2652"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=916,6648249723427096982,15695952238347034389,131072 --enable-features=PasswordImport --disable-gpu-sandbox --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=2B36FAA22B0BDFDFD6F8A73CB79AAA82 --mojo-platform-channel-handle=3780 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2680"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=916,6648249723427096982,15695952238347034389,131072 --enable-features=PasswordImport --service-pipe-token=06F0A89E26151B7EC37DAD82D462C525 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=06F0A89E26151B7EC37DAD82D462C525 --renderer-client-id=4 --mojo-platform-channel-handle=1900 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2712C:\Windows\System32\svchost.exe -k LocalDriverServiceC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\program files\ostotosoft\drivertalent\ldrvsvc.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\shell32.dll
3012"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3040 --on-initialized-event-handle=304 --parent-handle=308 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shlwapi.dll
3036"C:\Program Files\Google\Chrome\Application\chrome.exe" http://file.drivethelife.com/download/7.1.15.48/DriverTalent_setup.exeC:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3424"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=916,6648249723427096982,15695952238347034389,131072 --enable-features=PasswordImport --service-pipe-token=3CF9F7AC15F2A08AAA98938C746A79BB --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=3CF9F7AC15F2A08AAA98938C746A79BB --renderer-client-id=3 --mojo-platform-channel-handle=2056 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
1 210
Read events
1 100
Write events
107
Delete events
3

Modification events

(PID) Process:(3012) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:3036-13191654994089125
Value:
259
(PID) Process:(3036) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3036) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3036) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3036) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(3036) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(3036) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3516-13180984670829101
Value:
0
(PID) Process:(3036) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(3036) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3036-13191654994089125
Value:
259
(PID) Process:(3036) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid
Value:
Executable files
78
Suspicious files
43
Text files
196
Unknown types
12

Dropped files

PID
Process
Filename
Type
3036chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\9cdc75cc-e6cb-4f89-b478-346ea05c9ba0.tmp
MD5:
SHA256:
3036chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\000016.dbtmp
MD5:
SHA256:
3036chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000016.dbtmp
MD5:
SHA256:
3036chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\40903231-b706-4c3d-ae11-5e85bfc9bc5d.tmp
MD5:
SHA256:
3036chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\297432ab-1a3a-4cae-8c06-ffc39e298fd6.tmp
MD5:
SHA256:
3036chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:
SHA256:
3036chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF20ea35.TMPtext
MD5:
SHA256:
3036chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:
SHA256:
3036chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:
SHA256:
3036chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG.oldtext
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
20
DNS requests
17
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3036
chrome.exe
GET
200
52.222.163.50:80
http://file.drivethelife.com/download/7.1.15.48/DriverTalent_setup.exe
US
executable
15.7 Mb
whitelisted
1076
DriverTalent_setup.exe
POST
200
52.209.41.250:80
http://os.bestupdatemeta.com/FusionOSToto_New/
IE
binary
340 Kb
malicious
1076
DriverTalent_setup.exe
POST
200
52.214.73.247:80
http://rp.bestupdatemeta.com/
IE
malicious
1076
DriverTalent_setup.exe
POST
200
52.214.73.247:80
http://rp.bestupdatemeta.com/
IE
malicious
1076
DriverTalent_setup.exe
POST
200
52.214.73.247:80
http://rp.bestupdatemeta.com/
IE
malicious
1076
DriverTalent_setup.exe
POST
200
52.214.73.247:80
http://rp.bestupdatemeta.com/
IE
malicious
1076
DriverTalent_setup.exe
GET
200
192.96.201.162:80
http://img.bestupdatemeta.com/img/Rowabobeso/bg_fus_TB.png
US
image
10.5 Kb
malicious
1076
DriverTalent_setup.exe
POST
200
52.214.73.247:80
http://rp.bestupdatemeta.com/
IE
malicious
1076
DriverTalent_setup.exe
POST
200
52.214.73.247:80
http://rp.bestupdatemeta.com/
IE
malicious
1076
DriverTalent_setup.exe
GET
200
192.96.201.162:80
http://img.bestupdatemeta.com/img/Vavavag/V2_FS/NO-min.png
US
image
47.4 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
52.53.229.133:7020
behaviorgather.integrate.drivethelife.com
Amazon.com, Inc.
US
malicious
2712
svchost.exe
52.53.229.133:4040
behaviorgather.integrate.drivethelife.com
Amazon.com, Inc.
US
malicious
13.57.48.181:6033
dispatch.integrate.drivethelife.com
Amazon.com, Inc.
US
unknown
3036
chrome.exe
172.217.16.195:443
www.gstatic.com
Google Inc.
US
whitelisted
3036
chrome.exe
216.58.205.227:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
3036
chrome.exe
52.222.163.50:80
file.drivethelife.com
Amazon.com, Inc.
US
suspicious
3036
chrome.exe
172.217.23.142:443
sb-ssl.google.com
Google Inc.
US
whitelisted
3036
chrome.exe
172.217.21.227:443
ssl.gstatic.com
Google Inc.
US
whitelisted
1076
DriverTalent_setup.exe
52.214.73.247:80
rp.bestupdatemeta.com
Amazon.com, Inc.
IE
malicious
1076
DriverTalent_setup.exe
93.184.221.240:80
www.download.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 216.58.205.227
whitelisted
www.gstatic.com
  • 172.217.16.195
whitelisted
file.drivethelife.com
  • 52.222.163.50
  • 52.222.163.175
  • 52.222.163.106
  • 52.222.163.90
whitelisted
accounts.google.com
  • 172.217.22.13
shared
sb-ssl.google.com
  • 172.217.23.142
whitelisted
ssl.gstatic.com
  • 172.217.21.227
whitelisted
www.download.windowsupdate.com
  • 93.184.221.240
whitelisted
dispatch.integrate.drivethelife.com
  • 13.57.48.181
unknown
rp.bestupdatemeta.com
  • 52.214.73.247
  • 54.194.149.175
malicious
os.bestupdatemeta.com
  • 52.209.41.250
  • 52.210.70.79
malicious

Threats

PID
Process
Class
Message
3036
chrome.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1076
DriverTalent_setup.exe
Misc activity
ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M1
1076
DriverTalent_setup.exe
Misc activity
ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M2
1076
DriverTalent_setup.exe
Misc activity
ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M3
1076
DriverTalent_setup.exe
Misc activity
ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M4
13 ETPRO signatures available at the full report
Process
Message
DriverTalent_setup.exe
hwang global_licence_url: http://www.drivethelife.com/EULA.html
DriverTalent_setup.exe
hwang Create Directory C:\Users\admin\AppData\Local\Temp\Hot397E.tmp!
DriverTalent_setup.exe
hwang UnCompress EXT to C:\Users\admin\AppData\Local\Temp\Hot397E.tmp .
DriverTalent_setup.exe
hwang UnCompress successful.
DriverTalent_setup.exe
hwang Create Directory C:\Program Files\OSTotoSoft\DriverTalent!
DriverTalent_setup.exe
hwang UnCompress DATA to C:\Program Files\OSTotoSoft\DriverTalent .
DriverTalent_setup.exe
hwang UnCompress successful.
DriverTalent_setup.exe
hwang Copy C:\Users\admin\AppData\Local\Temp\Hot397E.tmp\DTInstUI.dll to C:\Program Files\OSTotoSoft\DriverTalent !
DriverTalent_setup.exe
hwang Copy C:\Users\admin\AppData\Local\Temp\Hot397E.tmp\AdModule.dll to C:\Program Files\OSTotoSoft\DriverTalent !
DriverTalent_setup.exe
hwang Copy C:\Users\admin\AppData\Local\Temp\Hot397E.tmp\substat.dll to C:\Program Files\OSTotoSoft\DriverTalent !