File name:

driver_booster_setup.exe

Full analysis: https://app.any.run/tasks/743b84e2-2d7e-4bf6-9dd7-9bf379406dc0
Verdict: Malicious activity
Analysis date: September 21, 2025, 14:37:27
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-drop
delphi
inno
installer
evasion
arch-doc
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

E5C34E2835F39C6919AA75442736145A

SHA1:

04D0622F546DCD9E678F6096DA6C69C6801099ED

SHA256:

0AAB49B4A19C721C9416825428D9013F7DCB779F9B07D28095B94E33B07687DE

SSDEEP:

393216:/QdCu639ySqOKnUIhxQsZQdcm8Q2G8oJ//X:/QYu6NyLnrRedn87BoJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was injected by another process

      • explorer.exe (PID: 4772)

    • Runs injected code in another process

      • ICONPIN64.exe (PID: 2120)

    • Changes settings of System certificates

      • DriverBooster.exe (PID: 4648)

  • SUSPICIOUS

    • Launching a dropped file

      • driver_booster_setup.exe (PID: 3556)
      • driver_booster_setup.tmp (PID: 4748)
      • driver_booster_setup.exe (PID: 1632)
      • driver_booster_setup.exe (PID: 1944)
      • driver_booster_setup.tmp (PID: 2168)
      • HWiNFO.exe (PID: 6400)
      • HVCIFix.exe (PID: 3672)

    • Executable content was dropped or overwritten

      • driver_booster_setup.exe (PID: 3556)
      • driver_booster_setup.tmp (PID: 4748)
      • driver_booster_setup.exe (PID: 1632)
      • driver_booster_setup.exe (PID: 1944)
      • driver_booster_setup.tmp (PID: 2168)
      • HWiNFO.exe (PID: 6400)
      • HVCIFix.exe (PID: 3672)

    • Reads security settings of Internet Explorer

      • driver_booster_setup.tmp (PID: 7032)
      • driver_booster_setup.tmp (PID: 4748)
      • driver_booster_setup.tmp (PID: 2168)
      • DriverBooster.exe (PID: 6768)
      • DriverBooster.exe (PID: 4648)
      • AutoUpdate.exe (PID: 6232)
      • DismHost.exe (PID: 6228)
      • AutoUpdate.exe (PID: 3756)

    • Reads the Windows owner or organization settings

      • driver_booster_setup.tmp (PID: 4748)
      • driver_booster_setup.tmp (PID: 2168)

    • Searches for installed software

      • setup.exe (PID: 1232)
      • InstStat.exe (PID: 432)

    • Process drops SQLite DLL files

      • driver_booster_setup.tmp (PID: 2168)

    • Drops 7-zip archiver for unpacking

      • driver_booster_setup.tmp (PID: 2168)

    • Process drops legitimate windows executable

      • driver_booster_setup.tmp (PID: 2168)
      • HVCIFix.exe (PID: 3672)

    • Drops a system driver (possible attempt to evade defenses)

      • HWiNFO.exe (PID: 6400)

    • The process executes via Task Scheduler

      • DriverBooster.exe (PID: 4648)

    • Checks for external IP

      • svchost.exe (PID: 2200)

    • Adds/modifies Windows certificates

      • DriverBooster.exe (PID: 4648)

    • The process creates files with name similar to system file names

      • HVCIFix.exe (PID: 3672)
      • wermgr.exe (PID: 7180)
      • wermgr.exe (PID: 5400)
      • wermgr.exe (PID: 4624)

    • Detected use of alternative data streams (AltDS)

      • HVCIFix.exe (PID: 3672)

    • Starts a Microsoft application from unusual location

      • DismHost.exe (PID: 6228)

  • INFO

    • Create files in a temporary directory

      • driver_booster_setup.exe (PID: 3556)
      • driver_booster_setup.exe (PID: 1632)
      • driver_booster_setup.tmp (PID: 4748)
      • setup.exe (PID: 1232)
      • driver_booster_setup.exe (PID: 1944)
      • driver_booster_setup.tmp (PID: 2168)
      • HWiNFO.exe (PID: 6400)
      • CareScan.exe (PID: 4884)
      • ICONPIN64.exe (PID: 2120)
      • explorer.exe (PID: 4772)
      • HVCIFix.exe (PID: 3672)

    • Checks supported languages

      • driver_booster_setup.exe (PID: 1632)
      • driver_booster_setup.tmp (PID: 4748)
      • driver_booster_setup.exe (PID: 3556)
      • driver_booster_setup.tmp (PID: 7032)
      • setup.exe (PID: 1232)
      • setup.exe (PID: 6508)
      • driver_booster_setup.exe (PID: 1944)
      • driver_booster_setup.tmp (PID: 2168)
      • unins000.exe (PID: 3488)
      • Passenger.exe (PID: 188)
      • RttHlp.exe (PID: 2040)
      • ScanDisp.exe (PID: 7096)
      • Scheduler.exe (PID: 2356)
      • HWiNFO.exe (PID: 6400)
      • Manta.exe (PID: 3504)
      • ScanWinUpd.exe (PID: 5468)
      • SetupHlp.exe (PID: 6760)
      • RttHlp.exe (PID: 2508)
      • DBDownloader.exe (PID: 6536)
      • DriverBooster.exe (PID: 6768)
      • DriverBooster.exe (PID: 4648)
      • Manta.exe (PID: 3112)
      • ProductStat3.exe (PID: 4232)
      • Backup.exe (PID: 2876)
      • AutoUpdate.exe (PID: 6232)
      • asrft.exe (PID: 4512)
      • AutoNts.exe (PID: 6948)
      • NoteIcon.exe (PID: 768)
      • ChangeIcon.exe (PID: 1096)
      • ProductStat3.exe (PID: 6356)
      • Manta.exe (PID: 4676)
      • RttHlp.exe (PID: 684)
      • CareScan.exe (PID: 4884)
      • AutoUpdate.exe (PID: 7124)
      • ICONPIN64.exe (PID: 2120)
      • InstStat.exe (PID: 432)
      • ScanWinUpd.exe (PID: 4012)
      • SetupHlp.exe (PID: 5884)
      • RttHlp.exe (PID: 4196)
      • HVCIFix.exe (PID: 3672)
      • AUpdate.exe (PID: 5824)
      • FaultFixes.exe (PID: 1704)
      • x64Proxy.exe (PID: 2292)
      • rma.exe (PID: 4012)
      • DismHost.exe (PID: 6228)
      • rma.exe (PID: 6404)
      • Boost.exe (PID: 1136)
      • DriverUpdate.exe (PID: 440)
      • Bugreport.exe (PID: 5188)
      • NoteIcon.exe (PID: 5284)
      • rma.exe (PID: 6680)
      • SetupHlp.exe (PID: 5904)
      • ChangeIcon.exe (PID: 6544)
      • AutoUpdate.exe (PID: 3756)
      • ProductStat3.exe (PID: 7732)
      • InstStat.exe (PID: 7824)
      • OfflineUpdater.exe (PID: 7564)
      • AUpdate.exe (PID: 7468)
      • DpInstX64.exe (PID: 7696)
      • DpInstX32.exe (PID: 8060)
      • ICONPIN64.exe (PID: 8168)
      • HWiNFO.exe (PID: 7248)
      • dpinst.exe (PID: 7916)
      • ICONPIN32.exe (PID: 4624)
      • dpinst.exe (PID: 2668)

    • Reads the computer name

      • driver_booster_setup.tmp (PID: 4748)
      • driver_booster_setup.tmp (PID: 7032)
      • setup.exe (PID: 1232)
      • setup.exe (PID: 6508)
      • driver_booster_setup.tmp (PID: 2168)
      • unins000.exe (PID: 3488)
      • HWiNFO.exe (PID: 6400)
      • SetupHlp.exe (PID: 6760)
      • DriverBooster.exe (PID: 6768)
      • DriverBooster.exe (PID: 4648)
      • ProductStat3.exe (PID: 4232)
      • AutoUpdate.exe (PID: 6232)
      • NoteIcon.exe (PID: 768)
      • asrft.exe (PID: 4512)
      • CareScan.exe (PID: 4884)
      • ProductStat3.exe (PID: 6356)
      • InstStat.exe (PID: 432)
      • ScanWinUpd.exe (PID: 4012)
      • SetupHlp.exe (PID: 5884)
      • AUpdate.exe (PID: 5824)
      • HVCIFix.exe (PID: 3672)
      • DismHost.exe (PID: 6228)
      • Boost.exe (PID: 1136)
      • SetupHlp.exe (PID: 5904)
      • AutoUpdate.exe (PID: 3756)
      • DpInstX64.exe (PID: 7696)
      • DpInstX32.exe (PID: 8060)
      • dpinst.exe (PID: 7916)
      • dpinst.exe (PID: 2668)

    • Process checks computer location settings

      • driver_booster_setup.tmp (PID: 7032)
      • driver_booster_setup.tmp (PID: 4748)
      • driver_booster_setup.tmp (PID: 2168)
      • DriverBooster.exe (PID: 4648)
      • AutoUpdate.exe (PID: 6232)
      • DriverBooster.exe (PID: 6768)
      • AutoUpdate.exe (PID: 3756)

    • The sample compiled with english language support

      • driver_booster_setup.tmp (PID: 4748)
      • driver_booster_setup.tmp (PID: 2168)
      • HWiNFO.exe (PID: 6400)
      • HVCIFix.exe (PID: 3672)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 4772)
      • notepad.exe (PID: 7032)

    • Creates files or folders in the user directory

      • setup.exe (PID: 1232)
      • explorer.exe (PID: 4772)
      • DriverBooster.exe (PID: 4648)
      • AutoUpdate.exe (PID: 6232)
      • Backup.exe (PID: 2876)
      • InstStat.exe (PID: 432)
      • HVCIFix.exe (PID: 3672)
      • AUpdate.exe (PID: 5824)
      • Boost.exe (PID: 1136)
      • DpInstX64.exe (PID: 7696)
      • DpInstX32.exe (PID: 8060)

    • Creates files in the program directory

      • setup.exe (PID: 1232)
      • driver_booster_setup.tmp (PID: 2168)
      • RttHlp.exe (PID: 2040)
      • SetupHlp.exe (PID: 6760)
      • ProductStat3.exe (PID: 4232)
      • DriverBooster.exe (PID: 4648)
      • AutoUpdate.exe (PID: 6232)
      • HVCIFix.exe (PID: 3672)
      • explorer.exe (PID: 4772)

    • Reads the machine GUID from the registry

      • setup.exe (PID: 1232)
      • AutoUpdate.exe (PID: 6232)
      • asrft.exe (PID: 4512)
      • ICONPIN64.exe (PID: 2120)
      • InstStat.exe (PID: 432)
      • ScanWinUpd.exe (PID: 4012)
      • DriverBooster.exe (PID: 4648)
      • AUpdate.exe (PID: 5824)
      • DismHost.exe (PID: 6228)

    • Manual execution by a user

      • setup.exe (PID: 6656)
      • setup.exe (PID: 6508)
      • unins000.exe (PID: 3488)
      • Passenger.exe (PID: 188)
      • Passenger.exe (PID: 2580)
      • ScanDisp.exe (PID: 7096)
      • Scheduler.exe (PID: 2356)
      • Manta.exe (PID: 3504)
      • RttHlp.exe (PID: 2040)
      • Manta.exe (PID: 7152)
      • ScanWinUpd.exe (PID: 1100)
      • ScanWinUpd.exe (PID: 5468)
      • DBDownloader.exe (PID: 6536)
      • DriverBooster.exe (PID: 6768)
      • Backup.exe (PID: 6408)
      • Backup.exe (PID: 2876)
      • AutoNts.exe (PID: 3160)
      • AutoNts.exe (PID: 6948)
      • CareScan.exe (PID: 2220)
      • CareScan.exe (PID: 4884)
      • FaultFixes.exe (PID: 3756)
      • FaultFixes.exe (PID: 1704)
      • notepad.exe (PID: 7032)
      • rma.exe (PID: 6404)
      • Boost.exe (PID: 4012)
      • Boost.exe (PID: 1136)
      • DriverUpdate.exe (PID: 440)
      • Bugreport.exe (PID: 5188)
      • NoteIcon.exe (PID: 5284)
      • SetupHlp.exe (PID: 6004)
      • ChangeIcon.exe (PID: 2232)
      • ChangeIcon.exe (PID: 6544)
      • SetupHlp.exe (PID: 5904)
      • DriverUpdate.exe (PID: 4680)
      • AutoUpdate.exe (PID: 3756)
      • AutoUpdate.exe (PID: 6680)
      • wermgr.exe (PID: 4624)
      • wermgr.exe (PID: 7180)
      • wermgr.exe (PID: 5400)
      • InstStat.exe (PID: 7764)
      • InstStat.exe (PID: 7824)
      • OfflineUpdater.exe (PID: 7564)
      • DpInstX64.exe (PID: 7648)
      • AUpdate.exe (PID: 7468)
      • AUpdate.exe (PID: 7420)
      • OfflineUpdater.exe (PID: 7512)
      • DpInstX64.exe (PID: 7696)
      • ProductStat3.exe (PID: 7732)
      • DpInstX32.exe (PID: 8012)
      • DpInstX32.exe (PID: 8060)
      • ICONPIN64.exe (PID: 8168)
      • HWiNFO.exe (PID: 7200)
      • HWiNFO.exe (PID: 7248)
      • ICONPIN32.exe (PID: 4624)
      • dpinst.exe (PID: 7868)
      • dpinst.exe (PID: 7916)
      • dpinst.exe (PID: 7280)
      • dpinst.exe (PID: 2668)

    • Compiled with Borland Delphi (YARA)

      • setup.exe (PID: 1232)
      • driver_booster_setup.exe (PID: 1944)
      • driver_booster_setup.tmp (PID: 2168)
      • unins000.exe (PID: 3488)
      • slui.exe (PID: 6676)
      • AutoUpdate.exe (PID: 6232)
      • notepad.exe (PID: 7032)
      • dpinst.exe (PID: 7916)

    • Detects InnoSetup installer (YARA)

      • driver_booster_setup.exe (PID: 1944)
      • driver_booster_setup.tmp (PID: 2168)
      • unins000.exe (PID: 3488)

    • The sample compiled with arabic language support

      • driver_booster_setup.tmp (PID: 2168)

    • Creates a software uninstall entry

      • driver_booster_setup.tmp (PID: 2168)

    • Reads CPU info

      • DriverBooster.exe (PID: 4648)

    • Reads the software policy settings

      • DriverBooster.exe (PID: 4648)
      • DismHost.exe (PID: 6228)
      • slui.exe (PID: 6676)

    • Checks proxy server information

      • DriverBooster.exe (PID: 4648)
      • slui.exe (PID: 6676)

    • Reads Environment values

      • DismHost.exe (PID: 6228)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (42.6)
.exe | Win16/32 Executable Delphi generic (19.5)
.exe | Generic Win/DOS Executable (18.9)
.exe | DOS Executable Generic (18.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:06:14 13:27:46+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 66560
InitializedDataSize: 71680
UninitializedDataSize: -
EntryPoint: 0x1181c
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 13.0.0.138
ProductVersionNumber: 13.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: IObit
FileDescription: Driver Booster 13 Setup
FileVersion: 13.0.0.138
LegalCopyright: © IObit. All rights reserved.
ProductName: Driver Booster 13
ProductVersion: 13.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
250
Monitored processes
98
Malicious processes
5
Suspicious processes
3

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Program Files (x86)\IObit\Driver Booster\13.0.0\Passenger.exe" C:\Program Files (x86)\IObit\Driver Booster\13.0.0\Passenger.exe
explorer.exe
User:
admin
Company:
IObit
Integrity Level:
HIGH
Description:
The Passenger
Exit code:
0
Version:
12.0.0.215
Modules
Images
c:\program files (x86)\iobit\driver booster\13.0.0\passenger.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
432"C:\Program Files (x86)\IObit\Driver Booster\13.0.0\InstStat.exe" /install db13C:\Program Files (x86)\IObit\Driver Booster\13.0.0\InstStat.exe
driver_booster_setup.tmp
User:
admin
Company:
IObit
Integrity Level:
HIGH
Description:
Driver Booster InstStat
Exit code:
0
Version:
13.0.0.22
Modules
Images
c:\program files (x86)\iobit\driver booster\13.0.0\inststat.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
440"C:\Program Files (x86)\IObit\Driver Booster\13.0.0\DriverUpdate.exe" C:\Program Files (x86)\IObit\Driver Booster\13.0.0\DriverUpdate.exe
explorer.exe
User:
admin
Company:
IObit
Integrity Level:
HIGH
Description:
Driver Booster Driver Update
Exit code:
0
Version:
12.0.0.37
Modules
Images
c:\program files (x86)\iobit\driver booster\13.0.0\driverupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
684"C:\Program Files (x86)\IObit\Driver Booster\13.0.0\RttHlp.exe" /cntC:\Program Files (x86)\IObit\Driver Booster\13.0.0\RttHlp.exe—DriverBooster.exe
User:
admin
Company:
IObit
Integrity Level:
HIGH
Description:
IObit RttHlp
Exit code:
0
Version:
13.0.0.4
Modules
Images
c:\program files (x86)\iobit\driver booster\13.0.0\rtthlp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
768"C:\Program Files (x86)\IObit\Driver Booster\13.0.0\NoteIcon.exe" "C:\Program Files (x86)\IObit\Driver Booster\13.0.0\DriverBooster.exe"C:\Program Files (x86)\IObit\Driver Booster\13.0.0\NoteIcon.exe
DriverBooster.exe
User:
admin
Company:
IObit
Integrity Level:
HIGH
Description:
IObit NoteIcon
Exit code:
0
Version:
4.3.0.7
Modules
Images
c:\program files (x86)\iobit\driver booster\13.0.0\noteicon.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
1096"C:\Program Files (x86)\IObit\Driver Booster\13.0.0\ChangeIcon.exe" /0 "C:\Program Files (x86)\IObit\Driver Booster\13.0.0\Icons\Main\"C:\Program Files (x86)\IObit\Driver Booster\13.0.0\ChangeIcon.exe
DriverBooster.exe
User:
admin
Company:
IObit.
Integrity Level:
HIGH
Description:
ChangeIcon
Exit code:
0
Version:
1.0.0.189
Modules
Images
c:\program files (x86)\iobit\driver booster\13.0.0\changeicon.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\oleaut32.dll
c:\windows\syswow64\msvcp_win.dll
1100"C:\Program Files (x86)\IObit\Driver Booster\13.0.0\ScanWinUpd.exe" C:\Program Files (x86)\IObit\Driver Booster\13.0.0\ScanWinUpd.exe—explorer.exe
User:
admin
Company:
IObit
Integrity Level:
MEDIUM
Description:
IObit ScanWinUpd
Exit code:
3221226540
Version:
12.0.0.31
Modules
Images
c:\program files (x86)\iobit\driver booster\13.0.0\scanwinupd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1136"C:\Program Files (x86)\IObit\Driver Booster\13.0.0\Boost.exe" C:\Program Files (x86)\IObit\Driver Booster\13.0.0\Boost.exe
explorer.exe
User:
admin
Company:
IObit
Integrity Level:
HIGH
Description:
Driver Booster
Exit code:
0
Version:
11.0.0.0
Modules
Images
c:\program files (x86)\iobit\driver booster\13.0.0\boost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
1232"C:\Users\admin\AppData\Local\Temp\is-KGJ6O.tmp-dbinst\setup.exe" "C:\Users\admin\Desktop\driver_booster_setup.exe" /title="Driver Booster 13" /dbver=13.0.0.138 /eula="C:\Users\admin\AppData\Local\Temp\is-KGJ6O.tmp-dbinst\EULA.rtf" /showlearnmore /pmtproduct /nochromepmt /runuptC:\Users\admin\AppData\Local\Temp\is-KGJ6O.tmp-dbinst\setup.exe
driver_booster_setup.tmp
User:
admin
Company:
IObit
Integrity Level:
HIGH
Description:
Driver Booster Installer
Version:
12.0.0.109
Modules
Images
c:\users\admin\appdata\local\temp\is-kgj6o.tmp-dbinst\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1632"C:\Users\admin\Desktop\driver_booster_setup.exe" /SPAWNWND=$70324 /NOTIFYWND=$C02F6 C:\Users\admin\Desktop\driver_booster_setup.exe
driver_booster_setup.tmp
User:
admin
Company:
IObit
Integrity Level:
HIGH
Description:
Driver Booster 13 Setup
Exit code:
1
Version:
13.0.0.138
Modules
Images
c:\users\admin\desktop\driver_booster_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
Total events
173 339
Read events
172 952
Write events
372
Delete events
15

Modification events

(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000080328
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000060302
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
(PID) Process:(4772) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
02020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(4772) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
040000000000000003000000110000000E000000100000000F0000000C0000000D0000000B000000050000000A000000090000000800000001000000070000000600000002000000FFFFFFFF
(PID) Process:(4772) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4
Operation:writeName:MRUListEx
Value:
040000000000000003000000050000000200000001000000FFFFFFFF
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar
Operation:writeName:Locked
Value:
1
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Ribbon
Operation:writeName:MinimizedStateTabletModeOff
Value:
0
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Ribbon
Operation:writeName:QatItems
Value:
3C7369713A637573746F6D554920786D6C6E733A7369713D22687474703A2F2F736368656D61732E6D6963726F736F66742E636F6D2F77696E646F77732F323030392F726962626F6E2F716174223E3C7369713A726962626F6E206D696E696D697A65643D2266616C7365223E3C7369713A71617420706F736974696F6E3D2230223E3C7369713A736861726564436F6E74726F6C733E3C7369713A636F6E74726F6C206964513D227369713A3136313238222076697369626C653D2266616C73652220617267756D656E743D223022202F3E3C7369713A636F6E74726F6C206964513D227369713A3136313239222076697369626C653D2266616C73652220617267756D656E743D223022202F3E3C7369713A636F6E74726F6C206964513D227369713A3132333532222076697369626C653D2266616C73652220617267756D656E743D223022202F3E3C7369713A636F6E74726F6C206964513D227369713A3132333834222076697369626C653D22747275652220617267756D656E743D223022202F3E3C7369713A636F6E74726F6C206964513D227369713A3132333336222076697369626C653D22747275652220617267756D656E743D223022202F3E3C7369713A636F6E74726F6C206964513D227369713A3132333537222076697369626C653D2266616C73652220617267756D656E743D223022202F3E3C2F7369713A736861726564436F6E74726F6C733E3C2F7369713A7161743E3C2F7369713A726962626F6E3E3C2F7369713A637573746F6D55493E
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser
Operation:writeName:ITBar7Layout
Value:
13000000000000000000000020000000100000000000000001000000010700005E01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000008038E
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
Executable files
222
Suspicious files
53
Text files
313
Unknown types
0

Dropped files

PID
Process
Filename
Type
4748driver_booster_setup.tmpC:\Users\admin\AppData\Local\Temp\is-KGJ6O.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
4772explorer.exeC:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.datbinary
MD5:E49C56350AEDF784BFE00E444B879672
SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E
3556driver_booster_setup.exeC:\Users\admin\AppData\Local\Temp\is-8PLKO.tmp\driver_booster_setup.tmpexecutable
MD5:048F89F1BE0CE17F10350B121C08B6BD
SHA256:8DFC033FF5A1EBAC9282F15F14AB048B73FB058FEC927A1F5D188A359315C6EB
1632driver_booster_setup.exeC:\Users\admin\AppData\Local\Temp\is-661QM.tmp\driver_booster_setup.tmpexecutable
MD5:048F89F1BE0CE17F10350B121C08B6BD
SHA256:8DFC033FF5A1EBAC9282F15F14AB048B73FB058FEC927A1F5D188A359315C6EB
4748driver_booster_setup.tmpC:\Users\admin\AppData\Local\Temp\is-KGJ6O.tmp\Inno_English.lngtext
MD5:4014E584F7EB5936A6D2B8B75ADE700F
SHA256:5ACF921D2B7D33D5FC9AB02569BE5F46B5F3CF8656BF1C245F2F61F55529BB3B
4748driver_booster_setup.tmpC:\Users\admin\AppData\Local\Temp\is-KGJ6O.tmp\Icon_1.bmpimage
MD5:7651F72266FA440C50C08309021DB68F
SHA256:652F8E7B89CC7823F11F5515BE2B07B370DC9760F324EAD2D5A2B4E05ADFDF0D
4748driver_booster_setup.tmpC:\Users\admin\AppData\Local\Temp\is-KGJ6O.tmp\DriverBooster.exeexecutable
MD5:B1FCCEACCE78392EE8BAF7E69C1E5C3C
SHA256:D28ECB37D964224C8DCDFAA074C0FBF71C1CF525AB971E58F4E68AB423E46015
4748driver_booster_setup.tmpC:\Users\admin\AppData\Local\Temp\is-KGJ6O.tmp\EULA.rtftext
MD5:B0381F0BA7EAD83EA3BD882C1DE4CD48
SHA256:44BC9472169403484A0D384F1CA81989EF7E4B07441758E8A0110078933CBCB5
4748driver_booster_setup.tmpC:\Users\admin\AppData\Local\Temp\is-KGJ6O.tmp\DBInstaller.exeexecutable
MD5:150DED5F2FAA13A272D5DDC9F54E9A34
SHA256:19CA841AB205BCF886EF002605C2FB79E8B6D08296F6E146608D1AB3B826A8DF
4748driver_booster_setup.tmpC:\Users\admin\AppData\Local\Temp\is-KGJ6O.tmp-dbinst\libcrypto-1_1.dllexecutable
MD5:902385503375A1C52787E2C88895E030
SHA256:078D662AF771A3B93C44415447294DB364E22710CEDC274B685EC639783AC928
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
90
TCP/UDP connections
103
DNS requests
30
Threats
57

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.32.238.112:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
—
—
GET
200
2.16.10.170:443
https://update.iobit.com/infofiles/itop/itopav.upt
unknown
text
336 b
unknown
—
—
GET
200
23.32.238.112:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
NL
binary
814 b
whitelisted
—
—
GET
206
2.16.10.186:443
https://update.iobit.com/infofiles/db/rmd/install_cfg_n.zlb
unknown
binary
149 Kb
unknown
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
NL
binary
814 b
whitelisted
—
—
GET
206
2.16.10.186:443
https://update.iobit.com/infofiles/db/rmd/install_cfg_n.zlb
unknown
binary
149 Kb
unknown
—
—
GET
206
2.16.10.170:443
https://update.iobit.com/infofiles/db/rmd/install_cfg_n.zlb
unknown
binary
149 Kb
unknown
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
NL
binary
814 b
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.32.238.112:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
23.32.238.112:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.32.238.112:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.32.238.112:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 172.217.18.14
whitelisted
crl.microsoft.com
  • 23.32.238.112
  • 23.32.238.107
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
login.live.com
  • 40.126.31.131
  • 20.190.159.73
  • 40.126.31.1
  • 40.126.31.67
  • 40.126.31.3
  • 20.190.159.0
  • 20.190.159.130
  • 20.190.159.75
whitelisted
update.iobit.com
  • 2.16.10.170
  • 2.16.10.186
  • 2.16.168.117
  • 2.16.168.116
  • 2.16.168.109
whitelisted
stats.iobit.com
  • 54.82.110.90
  • 52.0.39.5
  • 3.220.4.182
unknown
client.wns.windows.com
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 74.179.77.204
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
Process
Message
setup.exe
time1
setup.exe
doFinshedEvent_Freeware 0
setup.exe
time3
setup.exe
Order: itop
setup.exe
ProductVersion: 13.0.0.138
setup.exe
Chk_ver_min
setup.exe
Chk_ver_max
setup.exe
CheckSameVerList
setup.exe
CheckLicense
setup.exe
chk_os_ver 110;100;63;62;61
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
driver_booster_setup.exe