Joe Sandbox Cloud Basic Analysis Report
Edit tour

Windows Analysis Report
driver booster setup.exe

Overview

General Information

Sample Name:driver booster setup.exe
Analysis ID:1325003
MD5:d242a796ebc0219dc52b49b8f1d1af7a
SHA1:e1997d7f4561448f5a4eb67cc24613995eba176b
SHA256:dbde0fa5a6d41fb2fe920003b08fc9c46e7fc6f744e4781d41d4e69aec8388a2
Infos:

Detection

Score:21
Range:0 - 100
Whitelisted:false
Confidence:20%

Signatures

Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Uses 32bit PE files
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Sleep loop found (likely to delay execution)
Detected potential crypto function
Found dropped PE file which has not been started or loaded
PE file contains executable resources (Code or Archives)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Drops PE files
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Found detection on Joe Sandbox Cloud Basic
Queries keyboard layouts
Creates a process in suspended mode (likely to inject code)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox
Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior
Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")
Sample monitors window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook

Process Tree

  • System is w10x64
  • driver booster setup.exe (PID: 7572 cmdline: C:\Users\user\Desktop\driver booster setup.exe MD5: D242A796EBC0219DC52B49B8F1D1AF7A)
    • driver booster setup.tmp (PID: 7592 cmdline: "C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmp" /SL5="$2046E,25039561,139264,C:\Users\user\Desktop\driver booster setup.exe" MD5: 68B52A0B8E3D45BF3B520A0E7F16DAD1)
      • setup.exe (PID: 7692 cmdline: "C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe" "C:\Users\user\Desktop\driver booster setup.exe" /title="Driver Booster 9" /dbver=9.4.0.233 /eula="C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\EULA.rtf" /showlearnmore /pmtproduct /nochromepmt MD5: 6233816372E39E2E2D22787A649D0187)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\DBInstaller.exeJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
    C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
        00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmpJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          1.3.driver booster setup.tmp.75b0000.0.raw.unpackJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
            1.3.driver booster setup.tmp.75b0000.0.unpackJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
              2.0.setup.exe.400000.0.unpackJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security

                Sigma Signatures

                ⊘No Sigma rule has matched

                Snort Signatures

                ⊘No Snort rule has matched

                Joe Sandbox Signatures

                • • Compliance
                • • Networking
                • • System Summary
                • • Data Obfuscation
                • • Persistence and Installation Behavior
                • • Hooking and other Techniques for Hiding and Protection
                • • Malware Analysis System Evasion
                • • Anti Debugging
                • • HIPS / PFW / Operating System Protection Evasion

                Click to jump to signature section

                Show All Signature Results
                Source: driver booster setup.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpFile created: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\EULA.rtfJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpFile created: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\EULA.rtfJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpFile created: C:\Users\user\AppData\Local\Temp\Setup Log 2023-10-13 #001.txtJump to behavior
                Source: driver booster setup.exeStatic PE information: certificate valid
                Source: driver booster setup.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                Source: global trafficHTTP traffic detected: GET /infofiles/db/rmd/install_cfg_n.zlb HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*User-Agent: Mozilla/4.0Host: update.iobit.com
                Source: global trafficHTTP traffic detected: GET /infofiles/db/rmd/install_cfg_n.zlb HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*User-Agent: Mozilla/4.0Host: update.iobit.comRange: bytes=0-61494
                Source: global trafficHTTP traffic detected: GET /infofiles/db/rmd/install_cfg_n.zlb HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*User-Agent: Mozilla/4.0Host: update.iobit.comRange: bytes=61495-122989
                Source: global trafficHTTP traffic detected: GET /infofiles/db/rmd/install_cfg_n.zlb HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*User-Agent: Mozilla/4.0Host: update.iobit.comRange: bytes=184485-245978
                Source: global trafficHTTP traffic detected: GET /infofiles/db/rmd/install_cfg_n.zlb HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*User-Agent: Mozilla/4.0Host: update.iobit.comRange: bytes=122990-184484
                Source: global trafficHTTP traffic detected: GET /infofiles/ac/appver-ac.upt HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*User-Agent: Mozilla/4.0Host: update.iobit.com
                Source: global trafficHTTP traffic detected: GET /infofiles/itop/itopav.upt HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*User-Agent: Mozilla/4.0Host: update.iobit.com
                Source: global trafficHTTP traffic detected: GET /dl/img/inst/img_screenshot_ied.png HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*User-Agent: Mozilla/4.0Host: update.iobit.com
                Source: global trafficHTTP traffic detected: GET /dl/img/inst/logo_ied.png HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*User-Agent: Mozilla/4.0Host: update.iobit.com
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmpString found in binary or memory: "https://www.facebook.com/iobitsoft equals www.facebook.com (Facebook)
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: -https://www.facebook.com/sharer/sharer.php?u= equals www.facebook.com (Facebook)
                Source: setup.exe, 00000002.00000002.3523496114.00000000038CE000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000002.3520187161.0000000003285000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: HTTPS://WWW.ITOPVPN.COM/PRIVACY
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://ascstats.iobit.com/active.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: http://ascstats.iobit.com/multi_app/app_%S.php?action=insertU
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://ascstats.iobit.com/multi_app/app_db3promote.php?action=insert
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: http://ascstats.iobit.com/other/db_audstatus.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: http://ascstats.iobit.com/other/db_dchinststat.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://ascstats.iobit.com/other/db_driverinstall.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: http://ascstats.iobit.com/other/db_driverinstall_new.phpU
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://ascstats.iobit.com/other/db_extlink_download.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: http://ascstats.iobit.com/other/db_reservepmt.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: http://ascstats.iobit.com/other/db_reservepmt.phpU
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: http://ascstats.iobit.com/other/db_scanstats.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://ascstats.iobit.com/other/db_temp_download.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://ascstats.iobit.com/other/insert.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: http://ascstats.iobit.com/other/installer/insert.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: http://ascstats.iobit.com/other/installer/insert.phpU
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: http://ascstats.iobit.com/special/universal_db9.php?lang=%s&bws=%s
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: http://ascstats.iobit.com/usage_v2.php
                Source: driver booster setup.exe, 00000000.00000003.1652479052.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.exe, 00000000.00000003.1771213332.0000000006538000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1658893070.00000000032F0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1762790105.000000000732A000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://belazar.info/belsoft/
                Source: driver booster setup.exe, 00000000.00000003.1654814106.000000000671B000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.exe, 00000000.00000003.1656586475.000000007FE37000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
                Source: driver booster setup.exe, 00000000.00000003.1654814106.000000000671B000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.exe, 00000000.00000003.1656586475.000000007FE37000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
                Source: driver booster setup.tmp, 00000001.00000002.1767827932.000000000018F000.00000004.00000010.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1735638074.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, driver booster setup.exe, libssl-1_1.dll.1.dr, DriverBooster.exe.1.dr, DBInstaller.exe.1.dr, libcrypto-1_1.dll0.1.dr, libcrypto-1_1.dll.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
                Source: driver booster setup.tmp, 00000001.00000002.1767827932.000000000018F000.00000004.00000010.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1735638074.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, driver booster setup.exe, libssl-1_1.dll.1.dr, DriverBooster.exe.1.dr, DBInstaller.exe.1.dr, libcrypto-1_1.dll0.1.dr, libcrypto-1_1.dll.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
                Source: driver booster setup.exe, 00000000.00000003.1652479052.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.exe, 00000000.00000003.1772702580.0000000002232000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1658893070.00000000032F0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1762790105.000000000732A000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://counter-strike.com.ua/
                Source: driver booster setup.exe, libssl-1_1.dll.1.dr, DriverBooster.exe.1.dr, DBInstaller.exe.1.dr, libcrypto-1_1.dll0.1.dr, libcrypto-1_1.dll.1.drString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
                Source: driver booster setup.exe, libssl-1_1.dll.1.dr, DriverBooster.exe.1.dr, DBInstaller.exe.1.dr, libcrypto-1_1.dll0.1.dr, libcrypto-1_1.dll.1.drString found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
                Source: driver booster setup.exe, 00000000.00000003.1654814106.000000000671B000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.exe, 00000000.00000003.1656586475.000000007FE37000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
                Source: driver booster setup.tmp, 00000001.00000002.1767827932.000000000018F000.00000004.00000010.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1735638074.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, driver booster setup.exe, libssl-1_1.dll.1.dr, DriverBooster.exe.1.dr, DBInstaller.exe.1.dr, libcrypto-1_1.dll0.1.dr, libcrypto-1_1.dll.1.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
                Source: driver booster setup.tmp, 00000001.00000002.1767827932.000000000018F000.00000004.00000010.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1735638074.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, driver booster setup.exe, libssl-1_1.dll.1.dr, DriverBooster.exe.1.dr, DBInstaller.exe.1.dr, libcrypto-1_1.dll0.1.dr, libcrypto-1_1.dll.1.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
                Source: driver booster setup.exe, 00000000.00000003.1654814106.000000000671B000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.exe, 00000000.00000003.1656586475.000000007FE37000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
                Source: driver booster setup.exe, 00000000.00000003.1654814106.000000000671B000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.exe, 00000000.00000003.1656586475.000000007FE37000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
                Source: driver booster setup.exe, 00000000.00000003.1654814106.000000000671B000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.exe, 00000000.00000003.1656586475.000000007FE37000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
                Source: driver booster setup.exe, libssl-1_1.dll.1.dr, DriverBooster.exe.1.dr, DBInstaller.exe.1.dr, libcrypto-1_1.dll0.1.dr, libcrypto-1_1.dll.1.drString found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000002.3518294770.000000000285C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://forums.iobit.com/showthread.php?t=16792
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: http://idb.iobit.com
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.000000000283D000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000002.3518294770.00000000028A4000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://idb.iobit.com/check.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://iobit.info/rd/agreement
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: http://iobit.info/rd/faq
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://iobit.info/rd/privacy
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: http://jp.iobit.com/S
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: http://jp.iobit.com/SV
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: http://jp.iobit.com/rd/db-download-asc
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: http://jp.iobit.com/rd/db-download-isu
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: http://jp.iobit.com/support.html
                Source: driver booster setup.exe, libssl-1_1.dll.1.dr, DriverBooster.exe.1.dr, DBInstaller.exe.1.dr, libcrypto-1_1.dll0.1.dr, libcrypto-1_1.dll.1.drString found in binary or memory: http://ocsp.comodoca.com0
                Source: driver booster setup.tmp, 00000001.00000002.1767827932.000000000018F000.00000004.00000010.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1735638074.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, driver booster setup.exe, libssl-1_1.dll.1.dr, DriverBooster.exe.1.dr, DBInstaller.exe.1.dr, libcrypto-1_1.dll0.1.dr, libcrypto-1_1.dll.1.drString found in binary or memory: http://ocsp.digicert.com0A
                Source: driver booster setup.exe, 00000000.00000003.1654814106.000000000671B000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.exe, 00000000.00000003.1656586475.000000007FE37000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
                Source: driver booster setup.exe, 00000000.00000003.1654814106.000000000671B000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.exe, 00000000.00000003.1656586475.000000007FE37000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0O
                Source: driver booster setup.tmp, 00000001.00000002.1767827932.000000000018F000.00000004.00000010.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1735638074.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, driver booster setup.exe, libssl-1_1.dll.1.dr, DriverBooster.exe.1.dr, DBInstaller.exe.1.dr, libcrypto-1_1.dll0.1.dr, libcrypto-1_1.dll.1.drString found in binary or memory: http://ocsp.digicert.com0X
                Source: driver booster setup.exe, libssl-1_1.dll.1.dr, DriverBooster.exe.1.dr, DBInstaller.exe.1.dr, libcrypto-1_1.dll0.1.dr, libcrypto-1_1.dll.1.drString found in binary or memory: http://ocsp.sectigo.com0
                Source: driver booster setup.exe, libssl-1_1.dll.1.dr, DriverBooster.exe.1.dr, DBInstaller.exe.1.dr, libcrypto-1_1.dll0.1.dr, libcrypto-1_1.dll.1.drString found in binary or memory: http://s.symcb.com/universal-root.crl0
                Source: driver booster setup.exe, libssl-1_1.dll.1.dr, DriverBooster.exe.1.dr, DBInstaller.exe.1.dr, libcrypto-1_1.dll0.1.dr, libcrypto-1_1.dll.1.drString found in binary or memory: http://s.symcd.com06
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
                Source: setup.exe, 00000002.00000002.3518294770.00000000028A4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/e
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000003.1820494742.000000007F4D0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1822685552.000000007F4D0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1821403415.000000007F450000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1822067765.000000007F3D0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000002.3518294770.000000000282F000.00000004.00001000.00020000.00000000.sdmp, DBInstaller.exe.1.drString found in binary or memory: http://stats.iobit.com/multi_app.php?action=insert
                Source: setup.exe, 00000002.00000003.1820494742.000000007F4D0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1822685552.000000007F4D0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1821403415.000000007F450000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1822067765.000000007F3D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://stats.iobit.com/multi_app_new.php?action=insert
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: http://stats.iobit.com/share/db_share.php?action=get_id
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: http://stats.iobit.com/share/db_share.php?action=get_status
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: http://stats.iobit.com/share/db_share.php?action=share_via_email
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: http://stats.iobit.com/usage.php
                Source: driver booster setup.exe, libssl-1_1.dll.1.dr, DriverBooster.exe.1.dr, DBInstaller.exe.1.dr, libcrypto-1_1.dll0.1.dr, libcrypto-1_1.dll.1.drString found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
                Source: driver booster setup.exe, libssl-1_1.dll.1.dr, DriverBooster.exe.1.dr, DBInstaller.exe.1.dr, libcrypto-1_1.dll0.1.dr, libcrypto-1_1.dll.1.drString found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
                Source: driver booster setup.exe, libssl-1_1.dll.1.dr, DriverBooster.exe.1.dr, DBInstaller.exe.1.dr, libcrypto-1_1.dll0.1.dr, libcrypto-1_1.dll.1.drString found in binary or memory: http://ts-ocsp.ws.symantec.com0;
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: http://update.ioS
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: http://update.ioU
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: http://update.iobiS
                Source: setup.exe, 00000002.00000002.3527114420.0000000006282000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://update.iobit.PS
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: http://update.iobit.com/S
                Source: setup.exe, 00000002.00000002.3518294770.00000000027FA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://update.iobit.com/dl/img/inst/img_screenshot_ied.pngP
                Source: setup.exe, 00000002.00000002.3518294770.00000000027FA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://update.iobit.com/dl/img/inst/img_screenshot_isr.pngP
                Source: setup.exe, 00000002.00000002.3520187161.000000000318B000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://update.iobit.com/dl/img/inst/img_screenshot_s_isr.pnga
                Source: setup.exe, 00000002.00000002.3520187161.000000000318B000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://update.iobit.com/dl/img/inst/img_screenshot_s_vpn.pnga
                Source: setup.exe, 00000002.00000002.3518294770.00000000027FA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://update.iobit.com/dl/img/inst/img_screenshot_vpn.pngP
                Source: setup.exe, 00000002.00000002.3518294770.000000000282F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://update.iobit.com/dl/img/inst/logo_ied.pnga
                Source: setup.exe, 00000002.00000002.3518294770.000000000282F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://update.iobit.com/dl/img/inst/logo_isr.png
                Source: setup.exe, 00000002.00000002.3518294770.000000000282F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://update.iobit.com/dl/img/inst/logo_s_isr.png
                Source: setup.exe, 00000002.00000002.3518294770.000000000282F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://update.iobit.com/dl/img/inst/logo_s_vpn.png
                Source: setup.exe, 00000002.00000002.3518294770.000000000282F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://update.iobit.com/dl/img/inst/logo_vpn.pnga
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: http://update.iobit.com/infofiles/ac/appver-ac.uptU
                Source: setup.exe, 00000002.00000003.1820494742.000000007F4D0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1822685552.000000007F4D0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1821403415.000000007F450000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1822067765.000000007F3D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://update.iobit.com/infofiles/db/rmd/freeware-db.upt
                Source: setup.exe, 00000002.00000002.3518294770.00000000027FA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://update.iobit.com/infofiles/db/rmd/freeware-db.uptDFP
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: http://update.iobit.com/infofiles/db/rmd/freeware-db.uptU
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: http://update.iobit.com/infofiles/db/rmd/install_cfg_n.zlb
                Source: setup.exe, 00000002.00000002.3518294770.00000000027FA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://update.iobit.com/infofiles/db/rmd/install_cfg_n.zlbP
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.0000000002836000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://update.iobit.com/infofiles/db2/Freeware-db.upt
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.000000000282F000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://update.iobit.com/infofiles/db2/db2_free.upt
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.000000000282F000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://update.iobit.com/infofiles/db2/db2_oth.upt
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.000000000282F000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://update.iobit.com/infofiles/db2/db2_pro.upt
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: http://update.iobit.com/infofiles/db3/embhtml/update.upt
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.000000000282F000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://update.iobit.com/infofiles/db6/db6_pro.upt
                Source: setup.exe, 00000002.00000003.1820494742.000000007F4D0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1822685552.000000007F4D0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1821403415.000000007F450000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1822067765.000000007F3D0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000002.3518294770.000000000282F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://update.iobit.com/infofiles/itop/itopav.upt
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://updatestats.cd4o.com/api.php?act=update
                Source: EULA.rtf.1.drString found in binary or memory: http://www.7-zip.org/
                Source: driver booster setup.exe, 00000000.00000003.1652479052.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.exe, 00000000.00000003.1771213332.0000000006538000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1658893070.00000000032F0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1762790105.000000000732A000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.bernamegeh.net%1
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.00000000028A4000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://www.borland.com/namespaces/Types
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://www.cd4o.com/drivers/
                Source: setup.exe, 00000002.00000002.3518294770.00000000028A4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.cd4o.com/drivers/l
                Source: setup.exe, 00000002.00000002.3518294770.00000000028A4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.cd4o.com/drivers/ll
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://www.cd4o.com/drivers/wlst/v.json
                Source: driver booster setup.exe, 00000000.00000003.1654814106.000000000671B000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.exe, 00000000.00000003.1656586475.000000007FE37000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
                Source: driver booster setup.exe, 00000000.00000003.1652479052.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.exe, 00000000.00000003.1772702580.0000000002232000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1658893070.00000000032F0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1762790105.000000000732A000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.dk-soft.org/
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: http://www.google.com/search?source=hp&q=%s&meta=&aq=f&aqi=g10&aql=&oq=&gs_rfai=openSVWU
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: http://www.google.com/search?source=hp&q=%s&meta=&aq=f&aqi=g10&aql=&oq=&gs_rfai=openU
                Source: driver booster setup.exe, 00000000.00000003.1652479052.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.exe, 00000000.00000003.1772702580.0000000002232000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1764411809.0000000002360000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1658893070.00000000032F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.haysoft.org%1-k
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.00000000027FA000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://www.indyproject.org/
                Source: driver booster setup.exe, 00000000.00000003.1654814106.0000000006600000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.exe, 00000000.00000003.1656586475.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000000.1657364774.0000000000401000.00000020.00000001.01000000.00000004.sdmpString found in binary or memory: http://www.innosetup.com/
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: http://www.iobit.com
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.00000000028A4000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://www.iobit.com/
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.00000000028A4000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://www.iobit.com/cloud/db/index.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.00000000028A4000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://www.iobit.com/compare/db/index.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.00000000028A4000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://www.iobit.com/driver-booster-pro.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: http://www.iobit.com/en/privacy.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.00000000028A4000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://www.iobit.com/faq.php?product=db
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000002.3518294770.000000000285C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://www.iobit.com/goto.php?id=dbproregister
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.00000000028A4000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://www.iobit.com/goto.php?id=dbsurvey
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000002.3518294770.000000000285C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://www.iobit.com/goto.php?id=likefb01_DB
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000002.3518294770.000000000285C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://www.iobit.com/goto.php?id=plusgp01_DB
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: http://www.iobit.com/goto.php?id=plusgp01_DBU
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.00000000028A4000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://www.iobit.com/hotquestions-db.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.00000000028A4000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://www.iobit.com/install/db/index.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.00000000028A4000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://www.iobit.com/lostcode.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: http://www.iobit.com/process/show.php?r=%s&s=%sopenU
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.000000000283D000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: http://www.iobit.com/productfeedback.php?product=driver-booster
                Source: driver booster setup.exeString found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
                Source: EULA.rtf.1.drString found in binary or memory: http://www.openssl.org/
                Source: driver booster setup.tmp, 00000001.00000003.1735638074.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr, libcrypto-1_1.dll0.1.dr, libcrypto-1_1.dll.1.drString found in binary or memory: http://www.openssl.org/V
                Source: driver booster setup.exe, 00000000.00000003.1652479052.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.exe, 00000000.00000003.1772702580.0000000002232000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1764411809.0000000002360000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1658893070.00000000032F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.palkornel.hu/innosetup%1
                Source: driver booster setup.exe, 00000000.00000003.1654814106.0000000006600000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.exe, 00000000.00000003.1656586475.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000000.1657364774.0000000000401000.00000020.00000001.01000000.00000004.sdmpString found in binary or memory: http://www.remobjects.com/ps
                Source: driver booster setup.exe, libssl-1_1.dll.1.dr, DriverBooster.exe.1.dr, DBInstaller.exe.1.dr, libcrypto-1_1.dll0.1.dr, libcrypto-1_1.dll.1.drString found in binary or memory: https://d.symcb.com/cps0%
                Source: driver booster setup.exe, libssl-1_1.dll.1.dr, DriverBooster.exe.1.dr, DBInstaller.exe.1.dr, libcrypto-1_1.dll0.1.dr, libcrypto-1_1.dll.1.drString found in binary or memory: https://d.symcb.com/rpa0
                Source: driver booster setup.exe, libssl-1_1.dll.1.dr, DriverBooster.exe.1.dr, DBInstaller.exe.1.dr, libcrypto-1_1.dll0.1.dr, libcrypto-1_1.dll.1.drString found in binary or memory: https://d.symcb.com/rpa0.
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://forums.iobit.com/forum/driver-booster/driver-booster-7
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: https://forums.iobit.com/forum/driver-booster/driver-booster-9
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: https://gamebooster.itopvpn.com/eula.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: https://gamebooster.itopvpn.com/privacy.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: https://interface.iobit.com/db/goto.php?id=
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: https://interface.iobit.com/db/goto.php?id=S
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: https://interface.iobit.com/db/goto.php?id=dchinfoU
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: https://iotransfer.itopvpn.com/eula.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: https://iotransfer.itopvpn.com/privacy.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://jp.iobit.com/eula-db.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://jp.iobit.com/privacy.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://ru.iobit.com/eula-db.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://ru.iobit.com/privacy.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: https://s1.driverboosterscan.com
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://s1.driverboosterscan.com/worker.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: https://s2.driverboosterscan.com
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://s2.driverboosterscan.com/worker.php
                Source: driver booster setup.exe, libssl-1_1.dll.1.dr, DriverBooster.exe.1.dr, DBInstaller.exe.1.dr, libcrypto-1_1.dll0.1.dr, libcrypto-1_1.dll.1.drString found in binary or memory: https://sectigo.com/CPS0
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: https://twitter.com/intent/tweet?url=
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://twitter.com/iobitsoft
                Source: setup.exe, 00000002.00000002.3518294770.00000000028A4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/iobitsoftl
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: https://www.dashlane.com/?utm_source=iobi&utm_campaign=DBA&utm_medium=affiliate&utm_term=
                Source: driver booster setup.exe, 00000000.00000003.1654814106.000000000671B000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.exe, 00000000.00000003.1656586475.000000007FE37000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
                Source: EULA.rtf.1.drString found in binary or memory: https://www.hwinfo.com/download.php
                Source: DriverBooster.exe.1.drString found in binary or memory: https://www.iobit.com
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?U
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=%s
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=activateweb
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=activateweb-%d
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=bannerbuy
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=bannerbuybtm
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=boostasc
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=compare
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=db7prebanner
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=db7preinner
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=dbproduct
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=download
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=expired
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=expop
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=expopgveS
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=faq
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=feature
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=feedback
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=filerupt
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=forum
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=gacomp
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=gaexpired
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=garegion
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=help
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=helptranslate
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=htmlfailed
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=index
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=install
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=likefb
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=lostcode
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=multipcexpired
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=ncupdate
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=nosoundcrst
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=othupdate
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=proupdate
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=purchase
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=purchase-%d
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=regexpired
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=reggaexpired
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=regovermax
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=regovermaxga
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=regvermismatch
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=reinstall
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=revokedkey
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=trialbuy
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=trialbuy_14
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=unplug
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=update
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000002.3518294770.000000000285C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=usermanual
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/appgoto.php?to=vertoold
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/de/eula-db.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/de/privacy.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/dk/eula-db.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/dk/privacy.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: https://www.iobit.com/en/allfaq.php#a1d33d0dfec820b41b54430b50e96b5c
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: https://www.iobit.com/en/eula-db.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/en/eula-db.phpU
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: https://www.iobit.com/en/eula.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: https://www.iobit.com/en/eula.phpS
                Source: EULA.rtf.1.drString found in binary or memory: https://www.iobit.com/en/onlinefeedback.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/en/privacy.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/en/privacy.phpS
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: https://www.iobit.com/en/privacy.phpSV
                Source: EULA.rtf.1.drString found in binary or memory: https://www.iobit.com/en/sampleclaim.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/es/eula-db.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/es/privacy.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/feedback/db/feedback.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/fr/eula-db.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/fr/privacy.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/it/eula-db.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/it/privacy.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/nl/eula-db.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/nl/privacy.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/pl/eula-db.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/pl/privacy.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/pt/eula-db.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/pt/privacy.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/sv/eula-db.php
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drString found in binary or memory: https://www.iobit.com/sv/privacy.php
                Source: setup.exe, 00000002.00000002.3523496114.00000000037F2000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drString found in binary or memory: https://www.itopvpn.com/eula
                Source: setup.exe, 00000002.00000002.3523496114.00000000037F2000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.itopvpn.com/eula10d
                Source: setup.exe, 00000002.00000002.3523496114.00000000037F2000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.itopvpn.com/eula3c2
                Source: setup.exe, 00000002.00000002.3523496114.00000000037F2000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.itopvpn.com/eula48c
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000002.3523496114.00000000038CE000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3523496114.00000000037F2000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drString found in binary or memory: https://www.itopvpn.com/privacy
                Source: libcrypto-1_1.dll.1.drString found in binary or memory: https://www.openssl.org/docs/faq.html
                Source: unknownDNS traffic detected: queries for: update.iobit.com
                Source: global trafficHTTP traffic detected: GET /infofiles/db/rmd/install_cfg_n.zlb HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*User-Agent: Mozilla/4.0Host: update.iobit.com
                Source: global trafficHTTP traffic detected: GET /infofiles/db/rmd/install_cfg_n.zlb HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*User-Agent: Mozilla/4.0Host: update.iobit.comRange: bytes=0-61494
                Source: global trafficHTTP traffic detected: GET /infofiles/db/rmd/install_cfg_n.zlb HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*User-Agent: Mozilla/4.0Host: update.iobit.comRange: bytes=61495-122989
                Source: global trafficHTTP traffic detected: GET /infofiles/db/rmd/install_cfg_n.zlb HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*User-Agent: Mozilla/4.0Host: update.iobit.comRange: bytes=184485-245978
                Source: global trafficHTTP traffic detected: GET /infofiles/db/rmd/install_cfg_n.zlb HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*User-Agent: Mozilla/4.0Host: update.iobit.comRange: bytes=122990-184484
                Source: global trafficHTTP traffic detected: GET /infofiles/ac/appver-ac.upt HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*User-Agent: Mozilla/4.0Host: update.iobit.com
                Source: global trafficHTTP traffic detected: GET /infofiles/itop/itopav.upt HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*User-Agent: Mozilla/4.0Host: update.iobit.com
                Source: global trafficHTTP traffic detected: GET /dl/img/inst/img_screenshot_ied.png HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*User-Agent: Mozilla/4.0Host: update.iobit.com
                Source: global trafficHTTP traffic detected: GET /dl/img/inst/logo_ied.png HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*User-Agent: Mozilla/4.0Host: update.iobit.com
                Source: driver booster setup.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeCode function: 2_2_004F6E302_2_004F6E30
                Source: driver booster setup.tmp.0.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
                Source: driver booster setup.tmp.0.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                Source: driver booster setup.exe, 00000000.00000003.1654814106.000000000671B000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameshfolder.dll~/ vs driver booster setup.exe
                Source: driver booster setup.exe, 00000000.00000003.1656586475.000000007FE37000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameshfolder.dll~/ vs driver booster setup.exe
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeSection loaded: register.dllJump to behavior
                Source: driver booster setup.exeJoe Sandbox Cloud Basic: Detection: suspicious Score: 26 Threat Name: Analyzer: w10x64_raPerma Link
                Source: C:\Users\user\Desktop\driver booster setup.exeFile read: C:\Users\user\Desktop\driver booster setup.exeJump to behavior
                Source: C:\Users\user\Desktop\driver booster setup.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: unknownProcess created: C:\Users\user\Desktop\driver booster setup.exe C:\Users\user\Desktop\driver booster setup.exe
                Source: C:\Users\user\Desktop\driver booster setup.exeProcess created: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmp "C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmp" /SL5="$2046E,25039561,139264,C:\Users\user\Desktop\driver booster setup.exe"
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe "C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe" "C:\Users\user\Desktop\driver booster setup.exe" /title="Driver Booster 9" /dbver=9.4.0.233 /eula="C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\EULA.rtf" /showlearnmore /pmtproduct /nochromepmt
                Source: C:\Users\user\Desktop\driver booster setup.exeProcess created: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmp "C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmp" /SL5="$2046E,25039561,139264,C:\Users\user\Desktop\driver booster setup.exe" Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe "C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe" "C:\Users\user\Desktop\driver booster setup.exe" /title="Driver Booster 9" /dbver=9.4.0.233 /eula="C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\EULA.rtf" /showlearnmore /pmtproduct /nochromepmtJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpFile created: C:\Users\user\AppData\Local\ProgramsJump to behavior
                Source: C:\Users\user\Desktop\driver booster setup.exeFile created: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmpJump to behavior
                Source: classification engineClassification label: sus21.winEXE@5/57@1/1
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                Source: C:\Users\user\Desktop\driver booster setup.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMutant created: \Sessions\1\BaseNamedObjects\{066BAF58-22F1-4PQ6-BC2A-0731D99C8805}
                Source: driver booster setup.exeString found in binary or memory: /LOADINF="filename"
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeFile written: C:\Users\user\AppData\Local\Temp\Installerupt45212.0208855671.iniJump to behavior
                Source: Yara matchFile source: 1.3.driver booster setup.tmp.75b0000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.3.driver booster setup.tmp.75b0000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.0.setup.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, type: MEMORY
                Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\DBInstaller.exe, type: DROPPED
                Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe, type: DROPPED
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganizationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwnerJump to behavior
                Source: Window RecorderWindow detected: More than 3 window changes detected
                Source: driver booster setup.exeStatic file information: File size 25763240 > 1048576
                Source: driver booster setup.exeStatic PE information: certificate valid
                Source: driver booster setup.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeCode function: 2_2_004FBD4C push 004FBDA6h; ret 2_2_004FBD9E
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeCode function: 2_2_005101AC push ecx; mov dword ptr [esp], ecx2_2_005101B0
                Source: initial sampleStatic PE information: section name: .text entropy: 6.95668597868679
                Source: initial sampleStatic PE information: section name: .text entropy: 6.95668597868679
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpFile created: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\libcrypto-1_1.dllJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpFile created: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\RdZone.dllJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpFile created: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\_isetup\_setup64.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpFile created: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\libssl-1_1.dllJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpFile created: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpFile created: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\DBInstaller.exeJump to dropped file
                Source: C:\Users\user\Desktop\driver booster setup.exeFile created: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpFile created: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\DriverBooster.exeJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpFile created: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\libssl-1_1.dllJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpFile created: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\libcrypto-1_1.dllJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpFile created: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\EULA.rtfJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpFile created: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\EULA.rtfJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpFile created: C:\Users\user\AppData\Local\Temp\Setup Log 2023-10-13 #001.txtJump to behavior

                Hooking and other Techniques for Hiding and Protection

                barindex
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 4A189C value: E9 63 DB 0A 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 4A12A0 value: E9 7B DF 0A 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 49D078 value: E9 7B 63 0B 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 49D09C value: E9 DB 63 0B 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 49D0AC value: E9 6F 65 0B 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 49D068 value: E9 7B 67 0B 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 4C8090 value: E9 FF C9 09 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 4F664C value: E9 2B 58 06 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 50EB34 value: E9 F3 FB 04 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 50EA00 value: E9 9F FB 04 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 50E970 value: E9 1F FB 04 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 5101DC value: E9 FF E1 04 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 50F4C0 value: E9 17 F8 04 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 515B8C value: E9 BB 69 04 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 50E190 value: E9 DB 0B 05 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 4EFB70 value: E9 33 C3 06 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 51484C value: E9 23 77 04 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 4D8AE4 value: E9 5F DF 16 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 4D8A88 value: E9 EB D4 16 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 4D893C value: E9 43 AE 16 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 4D86B0 value: E9 DB B4 16 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 4D838C value: E9 FF CC 16 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 4DCBA4 value: E9 4F 35 15 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 4DCBE8 value: E9 6F 34 15 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 4DB4BC value: E9 AF DF 16 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 4DD378 value: E9 2B BF 16 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 4D82E4 value: E9 BF 0E 17 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 4DC820 value: E9 E7 DA 16 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 4DDA70 value: E9 1F BE 16 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 4D78D8 value: E9 13 29 17 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 4D7A48 value: E9 07 28 17 00 Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeMemory written: PID: 7692 base: 4FACD8 value: E9 4F 2E 15 00 Jump to behavior
                Source: C:\Users\user\Desktop\driver booster setup.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe TID: 7724Thread sleep time: -94550s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeThread sleep count: Count: 9455 delay: -10Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\libcrypto-1_1.dllJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\RdZone.dllJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\_isetup\_setup64.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\libssl-1_1.dllJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\DriverBooster.exeJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\libssl-1_1.dllJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\libcrypto-1_1.dllJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeWindow / User API: threadDelayed 9455Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpProcess information queried: ProcessInformationJump to behavior
                Source: driver booster setup.tmp, 00000001.00000003.1766637347.00000000007E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y
                Source: setup.exe, 00000002.00000002.3517345635.0000000000C6B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                Source: setup.exe, 00000002.00000002.3517345635.0000000000C6B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpProcess token adjusted: DebugJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe "c:\users\user\appdata\local\temp\is-mk7o5.tmp-dbinst\setup.exe" "c:\users\user\desktop\driver booster setup.exe" /title="driver booster 9" /dbver=9.4.0.233 /eula="c:\users\user\appdata\local\temp\is-mk7o5.tmp-dbinst\eula.rtf" /showlearnmore /pmtproduct /nochromepmt
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe "c:\users\user\appdata\local\temp\is-mk7o5.tmp-dbinst\setup.exe" "c:\users\user\desktop\driver booster setup.exe" /title="driver booster 9" /dbver=9.4.0.233 /eula="c:\users\user\appdata\local\temp\is-mk7o5.tmp-dbinst\eula.rtf" /showlearnmore /pmtproduct /nochromepmtJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe "C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe" "C:\Users\user\Desktop\driver booster setup.exe" /title="Driver Booster 9" /dbver=9.4.0.233 /eula="C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\EULA.rtf" /showlearnmore /pmtproduct /nochromepmtJump to behavior
                Source: driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drBinary or memory string: Progman

                Mitre Att&ck Matrix

                Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                Valid Accounts12
                Command and Scripting Interpreter                		1
                DLL Side-Loading                		12
                Process Injection                		1
                Masquerading                		1
                Credential API Hooking                		1
                Security Software Discovery                		Remote Services1
                Credential API Hooking                		Exfiltration Over Other Network Medium1
                Encrypted Channel                		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                Default AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
                DLL Side-Loading                		2
                Virtualization/Sandbox Evasion                		LSASS Memory2
                Virtualization/Sandbox Evasion                		Remote Desktop Protocol1
                Archive Collected Data                		Exfiltration Over Bluetooth1
                Ingress Tool Transfer                		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)12
                Process Injection                		Security Account Manager2
                Process Discovery                		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration2
                Non-Application Layer Protocol                		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)2
                Obfuscated Files or Information                		NTDS1
                Application Window Discovery                		Distributed Component Object ModelInput CaptureScheduled Transfer12
                Application Layer Protocol                		SIM Card SwapCarrier Billing Fraud
                Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
                Software Packing                		LSA Secrets2
                System Owner/User Discovery                		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                Replication Through Removable MediaLaunchdRc.commonRc.common1
                DLL Side-Loading                		Cached Domain Credentials2
                File and Directory Discovery                		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                External Remote ServicesScheduled TaskStartup ItemsStartup ItemsCompile After DeliveryDCSync11
                System Information Discovery                		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1325003 Sample: driver booster setup.exe Startdate: 13/10/2023 Architecture: WINDOWS Score: 21 27 update.iobit.com 2->27 29 cs833182181.wpc.etacdn.net 2->29 7 driver booster setup.exe 2 2->7         started        process3 file4 17 C:\Users\user\...\driver booster setup.tmp, PE32 7->17 dropped 10 driver booster setup.tmp 25 7->10         started        process5 file6 19 C:\Users\user\AppData\Local\...\setup.exe, PE32 10->19 dropped 21 C:\Users\user\AppData\...\libssl-1_1.dll, PE32 10->21 dropped 23 C:\Users\user\AppData\...\libcrypto-1_1.dll, PE32 10->23 dropped 25 6 other files (none is malicious) 10->25 dropped 13 setup.exe 52 10->13         started        process7 dnsIp8 31 cs833182181.wpc.etacdn.net 152.195.19.156, 49750, 49751, 49752 EDGECASTUS United States 13->31 33 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 13->33 signatures9

                Screenshots

                Download Video

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                ⊘No Antivirus matches

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s0%URL Reputationsafe
                http://ocsp.sectigo.com00%URL Reputationsafe
                http://www.innosetup.com/0%Avira URL Cloudsafe
                https://www.itopvpn.com/eula3c20%Avira URL Cloudsafe
                http://www.cd4o.com/drivers/ll0%Avira URL Cloudsafe
                http://www.haysoft.org%1-k0%Avira URL Cloudsafe
                http://updatestats.cd4o.com/api.php?act=update0%Avira URL Cloudsafe
                http://iobit.info/rd/faq0%Avira URL Cloudsafe
                https://s1.driverboosterscan.com/worker.php0%Avira URL Cloudsafe
                http://www.palkornel.hu/innosetup%10%Avira URL Cloudsafe
                http://iobit.info/rd/agreement0%Avira URL Cloudsafe
                http://www.indyproject.org/0%Avira URL Cloudsafe
                HTTPS://WWW.ITOPVPN.COM/PRIVACY0%Avira URL Cloudsafe
                http://update.iobiS0%Avira URL Cloudsafe
                http://www.cd4o.com/drivers/0%Avira URL Cloudsafe
                http://www.borland.com/namespaces/Types0%Avira URL Cloudsafe

                Domains and IPs

                Download Network PCAP: filtered – full

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                cs833182181.wpc.etacdn.net
                		152.195.19.156
                		truefalse
                  		unknown
                  update.iobit.com
                  		unknown
                  		unknownfalse
                    		high

                    Contacted URLs

                    NameMaliciousAntivirus DetectionReputation
                    http://update.iobit.com/dl/img/inst/logo_ied.pngfalse
                      		high
                      http://update.iobit.com/dl/img/inst/img_screenshot_ied.pngfalse
                        		high
                        http://update.iobit.com/infofiles/ac/appver-ac.uptfalse
                          		high
                          NameSourceMaliciousAntivirus DetectionReputation
                          https://www.iobit.com/it/eula-db.phpdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drfalse
                            		high
                            http://update.iobit.com/infofiles/db/rmd/freeware-db.uptsetup.exe, 00000002.00000003.1820494742.000000007F4D0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1822685552.000000007F4D0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1821403415.000000007F450000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1822067765.000000007F3D0000.00000004.00001000.00020000.00000000.sdmpfalse
                              		high
                              http://updatestats.cd4o.com/api.php?act=updatedriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://iobit.info/rd/faqdriver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drfalse
                              • Avira URL Cloud: safe
                              		unknown
                              https://www.iobit.com/appgoto.php?to=dbproductdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                		high
                                http://jp.iobit.com/support.htmldriver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drfalse
                                  		high
                                  http://www.indyproject.org/driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.00000000027FA000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://www.iobit.com/appgoto.php?to=fileruptdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                    		high
                                    https://www.iobit.com/appgoto.php?to=helptranslatedriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                      		high
                                      http://update.iobit.com/dl/img/inst/logo_s_vpn.pngsetup.exe, 00000002.00000002.3518294770.000000000282F000.00000004.00001000.00020000.00000000.sdmpfalse
                                        		high
                                        https://www.iobit.com/appgoto.php?to=indexdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                          		high
                                          http://idb.iobit.comdriver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drfalse
                                            		high
                                            http://update.iobit.com/infofiles/db2/db2_oth.uptdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.000000000282F000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                              		high
                                              https://www.iobit.com/en/eula.phpSdriver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drfalse
                                                		high
                                                http://www.openssl.org/EULA.rtf.1.drfalse
                                                  		high
                                                  https://twitter.com/intent/tweet?url=driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drfalse
                                                    		high
                                                    http://update.iobit.com/dl/img/inst/img_screenshot_s_vpn.pngasetup.exe, 00000002.00000002.3520187161.000000000318B000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://www.cd4o.com/drivers/llsetup.exe, 00000002.00000002.3518294770.00000000028A4000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://www.palkornel.hu/innosetup%1driver booster setup.exe, 00000000.00000003.1652479052.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.exe, 00000000.00000003.1772702580.0000000002232000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1764411809.0000000002360000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1658893070.00000000032F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://www.iobit.com/appgoto.php?to=feedbackdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                        		high
                                                        https://www.iobit.com/appgoto.php?to=unplugdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                          		high
                                                          http://www.innosetup.com/driver booster setup.exe, 00000000.00000003.1654814106.0000000006600000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.exe, 00000000.00000003.1656586475.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000000.1657364774.0000000000401000.00000020.00000001.01000000.00000004.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://s1.driverboosterscan.com/worker.phpdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://www.iobit.com/appgoto.php?to=ncupdatedriver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drfalse
                                                            		high
                                                            http://www.iobit.com/goto.php?id=plusgp01_DBUdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drfalse
                                                              		high
                                                              https://www.iobit.com/appgoto.php?to=revokedkeydriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                		high
                                                                https://www.iobit.com/nl/privacy.phpdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drfalse
                                                                  		high
                                                                  http://www.iobit.com/driver-booster-pro.phpdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.00000000028A4000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                    		high
                                                                    https://www.iobit.com/pl/privacy.phpdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drfalse
                                                                      		high
                                                                      https://www.iobit.com/appgoto.php?to=installdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                        		high
                                                                        http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0sdriver booster setup.exe, libssl-1_1.dll.1.dr, DriverBooster.exe.1.dr, DBInstaller.exe.1.dr, libcrypto-1_1.dll0.1.dr, libcrypto-1_1.dll.1.drfalse
                                                                        • URL Reputation: safe
                                                                        		unknown
                                                                        https://www.iobit.com/en/eula-db.phpUdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drfalse
                                                                          		high
                                                                          https://www.iobit.com/appgoto.php?to=bannerbuybtmdriver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drfalse
                                                                            		high
                                                                            https://jp.iobit.com/eula-db.phpdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drfalse
                                                                              		high
                                                                              https://www.iobit.com/appgoto.php?to=gacompdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                                		high
                                                                                https://www.iobit.com/appgoto.php?driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                                  		high
                                                                                  http://update.iobit.com/infofiles/db/rmd/install_cfg_n.zlbPsetup.exe, 00000002.00000002.3518294770.00000000027FA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://interface.iobit.com/db/goto.php?id=Sdriver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drfalse
                                                                                      		high
                                                                                      http://www.haysoft.org%1-kdriver booster setup.exe, 00000000.00000003.1652479052.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.exe, 00000000.00000003.1772702580.0000000002232000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1764411809.0000000002360000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1658893070.00000000032F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		low
                                                                                      http://jp.iobit.com/SVdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drfalse
                                                                                        		high
                                                                                        https://www.iobit.comDriverBooster.exe.1.drfalse
                                                                                          		high
                                                                                          https://www.itopvpn.com/eula3c2setup.exe, 00000002.00000002.3523496114.00000000037F2000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                          • Avira URL Cloud: safe
                                                                                          		unknown
                                                                                          http://ascstats.iobit.com/other/db_temp_download.phpdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                                            		high
                                                                                            http://jp.iobit.com/Sdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drfalse
                                                                                              		high
                                                                                              https://ru.iobit.com/eula-db.phpdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drfalse
                                                                                                		high
                                                                                                http://forums.iobit.com/showthread.php?t=16792driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000002.3518294770.000000000285C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                                                  		high
                                                                                                  https://www.iobit.com/appgoto.php?to=%sdriver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drfalse
                                                                                                    		high
                                                                                                    https://www.iobit.com/en/allfaq.php#a1d33d0dfec820b41b54430b50e96b5cdriver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drfalse
                                                                                                      		high
                                                                                                      https://www.iobit.com/es/privacy.phpdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drfalse
                                                                                                        		high
                                                                                                        https://twitter.com/iobitsoftdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                                                          		high
                                                                                                          http://update.iobit.com/dl/img/inst/logo_s_isr.pngsetup.exe, 00000002.00000002.3518294770.000000000282F000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://update.iobit.com/Sdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drfalse
                                                                                                              		high
                                                                                                              http://update.iobit.com/infofiles/db/rmd/freeware-db.uptDFPsetup.exe, 00000002.00000002.3518294770.00000000027FA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                http://www.iobit.com/goto.php?id=dbsurveydriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.00000000028A4000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                                                                  		high
                                                                                                                  https://www.iobit.com/pt/eula-db.phpdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drfalse
                                                                                                                    		high
                                                                                                                    http://iobit.info/rd/agreementdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                                                                    • Avira URL Cloud: safe
                                                                                                                    		unknown
                                                                                                                    http://update.iobiSdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drfalse
                                                                                                                    • Avira URL Cloud: safe
                                                                                                                    		unknown
                                                                                                                    https://www.iobit.com/appgoto.php?to=proupdatedriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                                                                      		high
                                                                                                                      http://jp.iobit.com/rd/db-download-ascdriver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drfalse
                                                                                                                        		high
                                                                                                                        http://www.cd4o.com/drivers/driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                                                                        • Avira URL Cloud: safe
                                                                                                                        		unknown
                                                                                                                        https://www.iobit.com/appgoto.php?to=usermanualdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000002.3518294770.000000000285C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                                                                          		high
                                                                                                                          http://ocsp.sectigo.com0driver booster setup.exe, libssl-1_1.dll.1.dr, DriverBooster.exe.1.dr, DBInstaller.exe.1.dr, libcrypto-1_1.dll0.1.dr, libcrypto-1_1.dll.1.drfalse
                                                                                                                          • URL Reputation: safe
                                                                                                                          		unknown
                                                                                                                          http://www.openssl.org/Vdriver booster setup.tmp, 00000001.00000003.1735638074.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr, libcrypto-1_1.dll0.1.dr, libcrypto-1_1.dll.1.drfalse
                                                                                                                            		high
                                                                                                                            https://www.iobit.com/sv/eula-db.phpdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drfalse
                                                                                                                              		high
                                                                                                                              http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupUdriver booster setup.exefalse
                                                                                                                                		high
                                                                                                                                https://www.iobit.com/appgoto.php?to=activateweb-%ddriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                                                                                  		high
                                                                                                                                  https://www.iobit.com/feedback/db/feedback.phpdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                                                                                    		high
                                                                                                                                    HTTPS://WWW.ITOPVPN.COM/PRIVACYsetup.exe, 00000002.00000002.3523496114.00000000038CE000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000002.3520187161.0000000003285000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                    		unknown
                                                                                                                                    https://www.iobit.com/appgoto.php?to=garegiondriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                                                                                      		high
                                                                                                                                      https://www.iobit.com/appgoto.php?to=vertoolddriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                                                                                        		high
                                                                                                                                        https://www.iobit.com/en/privacy.phpdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                                                                                          		high
                                                                                                                                          https://www.iobit.com/it/privacy.phpdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drfalse
                                                                                                                                            		high
                                                                                                                                            http://update.iobit.com/dl/img/inst/img_screenshot_vpn.pngPsetup.exe, 00000002.00000002.3518294770.00000000027FA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              http://stats.iobit.com/share/db_share.php?action=get_statusdriver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drfalse
                                                                                                                                                		high
                                                                                                                                                https://interface.iobit.com/db/goto.php?id=dchinfoUdriver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drfalse
                                                                                                                                                  		high
                                                                                                                                                  http://update.iobit.com/infofiles/db6/db6_pro.uptdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.000000000282F000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                                                                                                    		high
                                                                                                                                                    http://www.iobit.com/productfeedback.php?product=driver-boosterdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.000000000283D000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                                                                                                      		high
                                                                                                                                                      https://forums.iobit.com/forum/driver-booster/driver-booster-9driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drfalse
                                                                                                                                                        		high
                                                                                                                                                        http://www.borland.com/namespaces/Typesdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.00000000028A4000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                                        		unknown
                                                                                                                                                        https://forums.iobit.com/forum/driver-booster/driver-booster-7driver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drfalse
                                                                                                                                                          		high
                                                                                                                                                          https://www.iobit.com/appgoto.php?to=db7prebannerdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drfalse
                                                                                                                                                            		high
                                                                                                                                                            http://jp.iobit.com/rd/db-download-isudriver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drfalse
                                                                                                                                                              		high
                                                                                                                                                              http://ascstats.iobit.com/usage_v2.phpdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drfalse
                                                                                                                                                                		high
                                                                                                                                                                http://www.iobit.com/goto.php?id=likefb01_DBdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000002.3518294770.000000000285C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                                                                                                                  		high
                                                                                                                                                                  http://update.iobit.com/dl/img/inst/logo_vpn.pngasetup.exe, 00000002.00000002.3518294770.000000000282F000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    http://stats.iobit.com/share/db_share.php?action=share_via_emaildriver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://www.iobit.com/appgoto.php?to=downloaddriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://www.iobit.com/appgoto.php?to=db7preinnerdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drfalse
                                                                                                                                                                          		high
                                                                                                                                                                          http://ascstats.iobit.com/other/installer/insert.phpdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drfalse
                                                                                                                                                                            		high
                                                                                                                                                                            http://www.iobit.com/install/db/index.phpdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000002.3518294770.00000000028A4000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                                                                                                                              		high
                                                                                                                                                                              http://update.iobit.com/dl/img/inst/img_screenshot_isr.pngPsetup.exe, 00000002.00000002.3518294770.00000000027FA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                http://www.iobit.com/en/privacy.phpdriver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://www.openssl.org/docs/faq.htmllibcrypto-1_1.dll.1.drfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://www.iobit.com/dk/privacy.phpdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DBInstaller.exe.1.drfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://www.iobit.com/appgoto.php?to=boostascdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        http://www.iobit.com/goto.php?id=dbproregisterdriver booster setup.tmp, 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, driver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000002.3518294770.000000000285C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, DriverBooster.exe.1.dr, DBInstaller.exe.1.drfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          http://ascstats.iobit.com/other/db_reservepmt.phpdriver booster setup.tmp, 00000001.00000003.1751330587.0000000007A48000.00000004.00001000.00020000.00000000.sdmp, DriverBooster.exe.1.drfalse
                                                                                                                                                                                            		high

                                                                                                                                                                                            World Map of Contacted IPs

                                                                                                                                                                                            • No. of IPs < 25%
                                                                                                                                                                                            • 25% < No. of IPs < 50%
                                                                                                                                                                                            • 50% < No. of IPs < 75%
                                                                                                                                                                                            • 75% < No. of IPs

                                                                                                                                                                                            Public IPs

                                                                                                                                                                                            IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                            152.195.19.156
                                                                                                                                                                                            		cs833182181.wpc.etacdn.netUnited States
                                                                                                                                                                                            		15133EDGECASTUSfalse

                                                                                                                                                                                            General Information

                                                                                                                                                                                            Joe Sandbox Version:38.0.0 Ammolite
                                                                                                                                                                                            Analysis ID:1325003
                                                                                                                                                                                            Start date and time:2023-10-13 00:28:58 +02:00
                                                                                                                                                                                            Joe Sandbox Product:CloudBasic
                                                                                                                                                                                            Overall analysis duration:0h 7m 28s
                                                                                                                                                                                            Hypervisor based Inspection enabled:false
                                                                                                                                                                                            Report type:full
                                                                                                                                                                                            Cookbook file name:default.jbs
                                                                                                                                                                                            Analysis system description:Windows 10 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                            Run name:Run with higher sleep bypass
                                                                                                                                                                                            Number of analysed new started processes analysed:10
                                                                                                                                                                                            Number of new started drivers analysed:0
                                                                                                                                                                                            Number of existing processes analysed:0
                                                                                                                                                                                            Number of existing drivers analysed:0
                                                                                                                                                                                            Number of injected processes analysed:0
                                                                                                                                                                                            Technologies:
                                                                                                                                                                                            • HCA enabled
                                                                                                                                                                                            • EGA enabled
                                                                                                                                                                                            • AMSI enabled
                                                                                                                                                                                            Analysis Mode:default
                                                                                                                                                                                            Analysis stop reason:Timeout
                                                                                                                                                                                            Sample file name:driver booster setup.exe
                                                                                                                                                                                            Detection:SUS
                                                                                                                                                                                            Classification:sus21.winEXE@5/57@1/1
                                                                                                                                                                                            EGA Information:
                                                                                                                                                                                            • Successful, ratio: 100%
                                                                                                                                                                                            HCA Information:
                                                                                                                                                                                            • Successful, ratio: 100%
                                                                                                                                                                                            • Number of executed functions: 14
                                                                                                                                                                                            • Number of non-executed functions: 1
                                                                                                                                                                                            Cookbook Comments:
                                                                                                                                                                                            • Found application associated with file extension: .exe
                                                                                                                                                                                            • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
                                                                                                                                                                                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe
                                                                                                                                                                                            • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                            • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                            • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                            • VT rate limit hit for: driver booster setup.exe

                                                                                                                                                                                            Simulations

                                                                                                                                                                                            Behavior and APIs

                                                                                                                                                                                            TimeTypeDescription
                                                                                                                                                                                            00:30:54API Interceptor7349x Sleep call for process: setup.exe modified

                                                                                                                                                                                            Joe Sandbox View / Context

                                                                                                                                                                                            IPs

                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                            152.195.19.156driver_booster_setup.exeGet hashmaliciousRaccoon Stealer v2Browse
                                                                                                                                                                                            • update.iobit.com/dl/img/inst/logo_asc.png

                                                                                                                                                                                            Domains

                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                            cs833182181.wpc.etacdn.netdriver_booster_setup.exeGet hashmaliciousRaccoon Stealer v2Browse
                                                                                                                                                                                            • 152.195.19.156
                                                                                                                                                                                            kK8Eaw8zsl.exeGet hashmaliciousRedLineBrowse
                                                                                                                                                                                            • 152.199.20.140
                                                                                                                                                                                            3BPp5OFB7v.exeGet hashmaliciousRaccoon Stealer v2Browse
                                                                                                                                                                                            • 152.199.20.140
                                                                                                                                                                                            3BPp5OFB7v.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 152.199.20.140
                                                                                                                                                                                            42E07EA0F43BEC6913D6AC78FF74536695AE273CD28DB.exeGet hashmaliciousRedLineBrowse
                                                                                                                                                                                            • 152.199.20.140
                                                                                                                                                                                            driver_booster_setup.exeGet hashmaliciousRedLine XmrigBrowse
                                                                                                                                                                                            • 152.199.20.140
                                                                                                                                                                                            mKWphZ6Wlh.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 152.199.20.140
                                                                                                                                                                                            zxwzNpKx8Q.exeGet hashmaliciousClipboard HijackerBrowse
                                                                                                                                                                                            • 152.199.20.140
                                                                                                                                                                                            4BB96E7C641E9F343965704CF4E7327E4448B83FC97CF.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 152.199.20.140
                                                                                                                                                                                            dc422ed2_by_Libranalysis.exeGet hashmaliciousRaccoonBrowse
                                                                                                                                                                                            • 152.199.20.140

                                                                                                                                                                                            ASNs

                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                            EDGECASTUShttp://usps.micheckadress.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 152.195.33.23
                                                                                                                                                                                            Employee Handbook and Safety Manualdocx.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                            • 152.199.4.73
                                                                                                                                                                                            Remittance.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 152.199.4.44
                                                                                                                                                                                            http://gateway.ipfs.io/ipfs/bafybeierk2s2ggq6ik4fb7bojtk7574c623k6il6ilauof2em3twfwcdi4/m4fire_cham-ei98n.html#fr.dweber@chs-adphila.orgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 192.229.173.207
                                                                                                                                                                                            http://smtplink.usssa.com/ls/click?upn=WSslNwXrfTzmOiygdbhyJ3t7CDOcfhgBl-2B-2Fq7JL4-2ByqtyyXo5cYDdxn8A0VinP-2BVtHq-2FVJ1se3phjrq67r6nbphHhLw1sToYV3i4W2jaaIE-3D1dc5_WMf7rsf6kD6l7LM96TE0mF-2FnD3t2-2BZMyhwerTOCCBbSbnhA42OS1d1oRNQ-2F4Mreuz9hFOxWi2hJbNl50iWDQCCoSoTwR93cdcKDVsSISCZsm-2BL5IhXsL0w3VaDy-2B6QqA7UvRt2BwPJf-2BZkI-2Bekdw3nbmArCULTuLzWjb6ybyb-2BxLAJVoJZS5fLDDZa-2FWN-2FiIYNR0CMZ5E20cknpbptzwMkREsnkjIfv49YN2cjxNzFs-3DGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                            • 152.199.4.73
                                                                                                                                                                                            https://syswc3ar.page.link/jofZGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                            • 152.199.24.48
                                                                                                                                                                                            https://www.bing.com/ck/a?!&&p=7716aa06586b818fJmltdHM9MTY5Njk4MjQwMCZpZ3VpZD0xMTQ2MzEwYi00OGFhLTZjZmYtMTdmNC0yMjc3NDk4NzZkOTkmaW5zaWQ9NTEzMw&ptn=3&hsh=3&fclid=1146310b-48aa-6cff-17f4-227749876d99&u=a1aHR0cDovL3d3dy50YXR0ZXJlZHByZXNzLm9yZy9ibG9nLzIwMTkvOS8yOC9mcmVlc2lhLW1ja2Vl#tony.doyle@iaa.ieGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 152.199.4.44
                                                                                                                                                                                            payment.htmGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                            • 152.199.4.44
                                                                                                                                                                                            http://bing.com/ck/a?!&&p=1e98c9f9a35fbd79JmltdHM9MTY5NjIwNDgwMCZpZ3VpZD0xZTQzNThiOS1jYzA3LTY2MmEtMjQyNi00YjI5Y2QwZTY3MDgmaW5zaWQ9NTAwMw&GEJmAVfmaV&ptn=3&taUHGIFcLB&hsh=3&fclid=1e4358b9-cc07-662a-2426-4b29cd0e6708&djvferIukj&u=a1aHR0cHM6Ly9mcmVlbGFuY2Vyd2FsYS5jb20v#&&yygpKSi20tdPNzNNq8xLTq8oN69MM88vy7QoLNczMy3OLq8w0ysq1U+qKk3WBwA=?sadie.wegner@ennead.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                            • 152.199.4.73
                                                                                                                                                                                            https://bs.serving-sys.com/Serving/adServer.bs?cn=brd&ns=1&pli=1079576784&gdpr=$%7BGDPR%7D&gdprGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 152.195.19.202
                                                                                                                                                                                            Statement 8722.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                            • 152.199.4.44
                                                                                                                                                                                            OriginalMessage.txt.msgGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                            • 152.199.4.44
                                                                                                                                                                                            Check.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 152.199.4.33
                                                                                                                                                                                            https://rosmodem.wordpress.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                            • 152.199.5.184
                                                                                                                                                                                            inat-box-v13_(1).apkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 192.229.173.16
                                                                                                                                                                                            https://monograph.notesnook.com/65241010f9f9f90408727274/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                            • 152.199.24.185
                                                                                                                                                                                            https://faq-tbl50.powerappsportals.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                            • 152.199.4.44
                                                                                                                                                                                            https://drive.proton.me/urls/XXEJ1EJENR#eeYYN9hWb5e2Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                            • 152.199.24.185
                                                                                                                                                                                            http://ibef.org/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 192.229.163.25
                                                                                                                                                                                            https://bing.com/ck/a?!&&p=4da481f4776356b8JmltdHM9MTY5NTE2ODAwMCZpZ3VpZD0xZTQzNThiOS1jYzA3LTY2MmEtMjQyNi00YjI5Y2QwZTY3MDgmaW5zaWQ9NTAwMw&DxTCugGytf&ptn=3&qxRmSKvCaB&hsh=3&fclid=1e4358b9-cc07-662a-2426-4b29cd0e6708&WdfvBvSAHk&u=a1aHR0cHM6Ly93d3cuc2h1YmhrYW1uYWluc3RpdHV0ZS5jb20v#&&yygpKSi20tfPqsrOTMk2TUlLMSwtN803NykszNeryqpKSkmz0Csq1a9KzEnWBwA=?dHJlbnQuZGF3c29uQHNvdXRoc2lkZS5jb20=Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                            • 152.199.4.73

                                                                                                                                                                                            JA3 Fingerprints

                                                                                                                                                                                            ⊘No context

                                                                                                                                                                                            Dropped Files

                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\libcrypto-1_1.dllkK8Eaw8zsl.exeGet hashmaliciousRedLineBrowse
                                                                                                                                                                                              Driver.Booster.10.2.0.110.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                Driver.Booster.10.2.0.110.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  cdPUKIldlM.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    cdPUKIldlM.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      5YB5dKZ1Ow.exeGet hashmaliciousMinerDownloader, Raccoon Stealer v2Browse
                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmpdriver_booster_setup.exeGet hashmaliciousRaccoon Stealer v2Browse
                                                                                                                                                                                                          kK8Eaw8zsl.exeGet hashmaliciousRedLineBrowse
                                                                                                                                                                                                            42E07EA0F43BEC6913D6AC78FF74536695AE273CD28DB.exeGet hashmaliciousRedLineBrowse
                                                                                                                                                                                                              driver_booster_setup.exeGet hashmaliciousRedLine XmrigBrowse
                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\libssl-1_1.dllkK8Eaw8zsl.exeGet hashmaliciousRedLineBrowse
                                                                                                                                                                                                                  Driver.Booster.10.2.0.110.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    Driver.Booster.10.2.0.110.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      cdPUKIldlM.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        cdPUKIldlM.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                          5YB5dKZ1Ow.exeGet hashmaliciousMinerDownloader, Raccoon Stealer v2Browse

                                                                                                                                                                                                                            Created / dropped Files

                                                                                                                                                                                                                            C:\ProgramData\IObit\iobitpromotion.ini

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):96
                                                                                                                                                                                                                            Entropy (8bit):3.151681239868763
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3:Q+WliViyl+CRWLlYrylos2oECRWLlYrWv:Q+Wl7yE7RYrPsPE7RYrWv
                                                                                                                                                                                                                            MD5:7C8878D59BA801FC4CF5C465C6EF68F2
                                                                                                                                                                                                                            SHA1:B45710B17463D71FED9F3400843588EFFD6FA253
                                                                                                                                                                                                                            SHA-256:6481072B01B588D09E140E889B1CCEC0DC3DA5389B9B4BC2378C81A7404C30BD
                                                                                                                                                                                                                            SHA-512:5DE1036D76BAC830C667FE229C5FAE13360BB45604BD5F0D473B55F6A536372AFEBAE2BA7B23FF682C53E2A5A5FBAE9C67CEB0C69E3DDEB72A5EA129FDB20701
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                            Preview:..[.i.t.o.p.].....D.B._.I.n.s.t.a.l.l.=.5.........[.i.s.r.].....D.B._.I.n.s.t.a.l.l.=.4.........

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\ARABIC.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):25662
                                                                                                                                                                                                                            Entropy (8bit):4.274160990538764
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:8M+aq3VQCSM9hdGUNxHgN0s/2gnUQqH+j57hrF9fOciYplGVktV:8M+aq3VQWGUNxHgN0s/2T8rnmlVkf
                                                                                                                                                                                                                            MD5:66C22C15A964EDBF4D01E1E09E5D6F7D
                                                                                                                                                                                                                            SHA1:824AA831BD512F3532C6A5AF44196AB3505F4FD6
                                                                                                                                                                                                                            SHA-256:BF5E8A464EEB812A9BD2B3BAD7A22652FF8CC06886836ABE6613BECB5B01C723
                                                                                                                                                                                                                            SHA-512:5A10879525B5863574FEDCD248682C536CAB23C17EFA0684E7B634DCAA6A4D035EF61B4C013E7FB95B0175D6BAE93FE4D712ED0F0B4686E535B208B153C32B5F
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.'.D.9.1.(.J.).........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=...J.'.1.'.*. .'.D.*.+.(.J.*.....b.t.n.C.l.o.s.e...H.i.n.t.=.%.:.D.'.B.....b.t.n.M.i.n...H.i.n.t.=.*.5.:.J.1.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.A.4.D. .'.D.*.+.(.J.*.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.O.K.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.A.4.D. .*.+.(.J.*. .D.r.i.v.e.r. .B.o.o.s.t.e.r. .D.3.(.(. .:.J.1. .E.9.1.H.A... .3.J.-.'.H.D. .D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.9.'./.). .'.D.*.+.(.J.*. .*.D.B.'.&.J.K.'. .(.9./. .%.9.'./.). .'.D.*.4.:.J.D... .<.a.>.%.9.'./.). .'.D.*.4.:.J.D. .'.D.".F.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.*.E. .*.+.(.J.*. .D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .(.F.,.'.-.!. .'.D.1.,.'.!. .'.D.F.B.1. .A.H.B. .A.-.5. .'.D.".F.". .D.*.4.:.J.D.G.!.....l.b.l.S.u.c.c.T.i.t.l.e...C.a.p.t.i.o.n.=.'.C.*.E.D. .'.D.*.+.(.J.*.....b.t.n.S.u.c.c...C.a.p.t.i.o.n.=.'.D.A.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\CATALAN.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):28118
                                                                                                                                                                                                                            Entropy (8bit):3.555935773008558
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:aAPJnkixpMKfSUczYFM2bqaNScmg2rzHRfpcH5g7Qq31:rP64MK6tyqaNScmNFhcHe0ql
                                                                                                                                                                                                                            MD5:6C85D47DEE0DE129A09B2180F567E3E5
                                                                                                                                                                                                                            SHA1:5E2D9145152C863B636E1C5AD3CA6BE62877EE02
                                                                                                                                                                                                                            SHA-256:CF7250A08393BA25A38E4DA531666DBE5003D7AE960AF0913F67CE0E1F4C419B
                                                                                                                                                                                                                            SHA-512:8C5706D107AFC27E21762900421148886A7D05C680995BBE260A19F1E712484CB930217999B53801D34C6E2542AF0AADBFA0E76395EE8C814B5BFAA7F1D80E01
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.C.a.t.a.l...........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.O.p.c.i.j.e. .i.n.s.t.a.l.a.c.i.j.e.....b.t.n.C.l.o.s.e...H.i.n.t.=.T.a.n.c.a.....b.t.n.M.i.n...H.i.n.t.=.M.i.n.i.m.i.z.e.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.N.o. .s.'.h.a. .p.o.g.u.t. .c.o.m.p.l.e.t.a.r. .l.a. .i.n.s.t.a.l...l.a.c.i.......b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.D.'.a.c.o.r.d.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.N.o. .s.'.h.a. .p.o.g.u.t. .i.n.s.t.a.l...l.a.r. .D.r.i.v.e.r. .B.o.o.s.t.e.r. .p.e.r. .a.l.g.u.n.a. .r.a... .d.e.s.c.o.n.e.g.u.d.a... .D.r.i.v.e.r. .B.o.o.s.t.e.r. .p.r.o.v.a.r... .d.e. .r.e.i.n.s.t.a.l...l.a.r.-.s.e. .a.u.t.o.m...t.i.c.a.m.e.n.t. .d.e.s.p.r...s. .d.'.u.n. .r.e.i.n.i.c.i... .<.a.>.R.e.i.n.i.c.i.a.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .s.'.h.a. .i.n.s.t.a.l...l.a.t. .c.o.r.r.e.c.t.a.m.e.n.t.!. .F.e.s. .c.l.i.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\CHINESESIMP.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):14750
                                                                                                                                                                                                                            Entropy (8bit):5.280602775453444
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:dCfIM1SHQeUVqijXkKDuBBDHQ4tgkLOaeHCKqC/XwA8IdTaJrALNsSkdg:LMqma6kLOpHR/XwHIUJ2sSkdg
                                                                                                                                                                                                                            MD5:D418F4D7808F6F71D49404C5AFA88B90
                                                                                                                                                                                                                            SHA1:B30381FB1F09B95CB77F2CD50039AA2CB4C8929A
                                                                                                                                                                                                                            SHA-256:87FE44FFA6A852850C2557DB1B1AEE192F0F2E8ECFB6E0BB9779CE6F73BBB815
                                                                                                                                                                                                                            SHA-512:DE9B8C28B6684CE4D00D5BEC297048C7599A1BA50D6ED123978DD0AE4F96A9A340347237CC8C64432AD9C8E1800868BE3BB8601A40D00D15BAE4B11A3EEEE35C
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=..{SO-N.e........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=..[...y.....b.t.n.C.l.o.s.e...H.i.n.t.=.sQ.....b.t.n.M.i.n...H.i.n.t.=..g.\.S....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=..[.1Y%.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.nx.[....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=..V:N.N.f.S.V.[.1Y%..0D.r.i.v.e.r. .B.o.o.s.t.e.r..\(W./T.T.R.\...e.[..0<.a.>..zsS./T!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. ..[..b.R.0.p.Q.zsSkb.c.c...L.D.r.i.v.e.r. .B.o.o.s.t.e.r.......l.b.l.S.u.c.c.T.i.t.l.e...C.a.p.t.i.o.n.=..[..[.b....b.t.n.S.u.c.c...C.a.p.t.i.o.n.=..zsSkb.c....l.b.l.I.n.s.t.a.l.l...C.a.p.t.i.o.n.=.ck(W.[...........b.t.n.E.m.a.i.l...C.a.p.t.i.o.n.=.........b.t.n.E.m.a.i.l.V.a.l.i.d...C.a.p.t.i.o.n.=.........l.b.l.E.m.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.....I.O.b.i.t.5uP[.b.T.S._MQ9.<yir....l.b.l.B.o.o.k.T.i.t.l.e...C.a.p.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\CHINESETRAD.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):11310
                                                                                                                                                                                                                            Entropy (8bit):5.202329285270536
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:dnVCHBrY3biG0Hy8kNozuqZkqdb9r4jvyYpNvpF5CtQuhUth4pP5rU6JIaYocX:mOisrnKbByvyYjyUtuHFFcX
                                                                                                                                                                                                                            MD5:2A5D0ECFA6C3D27D913061F9FBAC58A9
                                                                                                                                                                                                                            SHA1:A2149D0C06E445A29E95D02BDC8642D9B19C36FB
                                                                                                                                                                                                                            SHA-256:662D4687136CA5032E19881D1F95F6C5F567CF9B15BD17BED9241682B4634F2B
                                                                                                                                                                                                                            SHA-512:0310CD2F7D6E0B86A094D31338B1A77407A75B3C5502A09DB6C040FEAF73187977EA14F6F1729668686E19E09B1123F98CE77AF8A941BFC2A04D7C8A5F789685
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.ck.-N.e........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=..[.x.......b.t.n.C.l.o.s.e...H.i.n.t.=........b.t.n.M.i.n...H.i.n.t.=..g.\.S....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=..[.1YWe....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=..x.[....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. ..V.p.N.f.S.V.[.1YWe.0 .D.r.i.v.e.r. .B.o.o.s.t.e.r. ..\(W..e_U.R._..R.Vf...e.[..0 .<.a.>..zsS..e_U.R!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. ..[..b.R!. ...c.N.N .[..zsS.c.c]. ..O.WL.!.....l.b.l.S.u.c.c.T.i.t.l.e...C.a.p.t.i.o.n.=..[..[.b....b.t.n.S.u.c.c...C.a.p.t.i.o.n.=..zsS.c.c....l.b.l.I.n.s.t.a.l.l...C.a.p.t.i.o.n.=.ck(W.[...........b.t.n.E.m.a.i.l...C.a.p.t.i.o.n.=.........b.t.n.E.m.a.i.l.V.a.l.i.d...C.a.p.t.i.o.n.=.........l.b.l.E.m.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=..... .I.O.b.i.t. ...P[1X.T.S._MQ...yir....

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\CZECH.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):27720
                                                                                                                                                                                                                            Entropy (8bit):3.756905975011732
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:Hd8f0sPdU2NOnnx3U/0UA611UvLqfZLBlLjghpcbGT+JWOP5fHx7EvNq6snAsqty:K0+KpxEDSPhpcCT+Jhn6tsU9ZGcQL
                                                                                                                                                                                                                            MD5:3FB6592FDFC0784EF890BF81C4B755FE
                                                                                                                                                                                                                            SHA1:DDFFCEB5765EDF70C1B2071563CE1D46E0E45F3E
                                                                                                                                                                                                                            SHA-256:B732653CBB6A61503DA1BF88EB9953C96F12FCB0FA6263A7A7D9025746E85BAE
                                                                                                                                                                                                                            SHA-512:2E07D595CAE930F97234DE8157EC5418703B2438BBB4C1E64F52D78AF00A2017DCAB4CFD9A795307186D77DBCDDA8AFB153F8478FD60BB9036A2910381C71DCF
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=...e.a.t.i.n.a.........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.M.o.~.n.o.s.t.i. .i.n.s.t.a.l.a.c.e.....b.t.n.C.l.o.s.e...H.i.n.t.=.Z.a.v.Y...t.....b.t.n.M.i.n...H.i.n.t.=.M.i.n.i.m.a.l.i.z.o.v.a.t.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.I.n.s.t.a.l.a.c.e. .s.e.l.h.a.l.a.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.O.K.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .s.e. .n.e.p.o.d.a.Y.i.l.o. .z. .n.e.z.n...m...h.o. .d.o.v.o.d.u. .n.a.i.n.s.t.a.l.o.v.a.t... .D.r.i.v.e.r. .B.o.o.s.t.e.r. .s.e. .a.u.t.o.m.a.t.i.c.k.y. .p.o.k.u.s... .o. .r.e.i.n.s.t.a.l.a.c.i. .p.o. .r.e.s.t.a.r.t.u. .p.o.....t.a...e... .<.a.>.R.e.s.t.a.r.t.o.v.a.t. .n.y.n...!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .b.y.l. ...s.p...a.n... .n.a.i.n.s.t.a.l.o.v...n.!. .K.l.i.k.n...t.e. .n.a. .S.k.e.n.o.v.a.t. .n.y.n... .p.r.o. .s.p.u.a.t.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\DANISH.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):26490
                                                                                                                                                                                                                            Entropy (8bit):3.558289284000349
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:dzjlRa6GjBMi80mrgCXxMislQvoFVX/t2U92wXdzJqWMqy+Sgz5vkhzDUUzv5TBR:0KH/r7Ez9TMDMiDUUzVBL7wRZfJArB6U
                                                                                                                                                                                                                            MD5:6977AD9A449C36FD495C52E23419C9EC
                                                                                                                                                                                                                            SHA1:773AE2B6134DBDC388079CD023564EE741DB9E86
                                                                                                                                                                                                                            SHA-256:AE2A95882D8D3B0B2C861F82028EA18A07951EF9EC88A06E50A5B16F559F7657
                                                                                                                                                                                                                            SHA-512:30C07A0ECBF113B3C02107F325FDC58371CB23792611048DEF65158584C52F7491DEAFA795CF6EFCC1222206E97D85081D80DE1AB5EFC4AB773F48B583980906
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.D.a.n.s.k.........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.I.n.s.t.a.l.l.a.t.i.o.n.s.i.n.d.s.t.i.l.l.i.n.g.e.r.....b.t.n.C.l.o.s.e...H.i.n.t.=.L.u.k.....b.t.n.M.i.n...H.i.n.t.=.M.i.n.i.m...r.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.I.n.s.t.a.l.l.a.t.i.o.n. .m.i.s.l.y.k.k.e.d.e.s.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.O.K.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .k.u.n.n.e. .i.k.k.e. .i.n.s.t.a.l.l.e.r.e.s. .a.f. .u.k.e.n.d.t.e. ...r.s.a.g.e.r... .D.r.i.v.e.r. .B.o.o.s.t.e.r. .v.i.l. .f.o.r.s...g.e. .a.t. .g.e.n.i.n.s.t.a.l.l.e.r.e. .a.u.t.o.m.a.t.i.s.k. .e.f.t.e.r. .g.e.n.s.t.a.r.t... .<.a.>.g.e.n.s.t.a.r.t. .n.u.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .e.r. .b.l.e.v.e.t. .i.n.s.t.a.l.l.e.r.e.t.!. .K.l.i.k. .p... .".S.k.a.n. .n.u.". .f.o.r. .a.t. .k...r.e. .d.e.t.!.....l.b.l.S.u.c.c.T.i.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\DUTCH.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):27764
                                                                                                                                                                                                                            Entropy (8bit):3.511383352454276
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:rBaR2/FBdf2d68sCCGGuuFWGU2aukD7S5SkSWrNRm/L:rBaR+FLi68sCCf3kwaJ70hSWrNRy
                                                                                                                                                                                                                            MD5:A7D15F5A3805FBD9BAA3F20098702FB4
                                                                                                                                                                                                                            SHA1:2481A00FF1F754FB738711B098DB1569C88C8630
                                                                                                                                                                                                                            SHA-256:9EEC5BCEA4EF5138D333A18E220DE2A145B90FC5EED4A54B9A42F9F1C5A6FB8D
                                                                                                                                                                                                                            SHA-512:3B22C58747D13AD9A163D5A4B6C7DFB883DCA5163C03BD9371CDE5CB82E831655681B22CC13A53118E71CD7174EA78411B189A91D791037A299A1CE2AF91ADB3
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.N.e.d.e.r.l.a.n.d.s.........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.O.p.t.i.e.s.....b.t.n.C.l.o.s.e...H.i.n.t.=.S.l.u.i.t.e.n.....b.t.n.M.i.n...H.i.n.t.=.M.i.n.i.m.a.l.i.s.e.r.e.n.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.I.n.s.t.a.l.l.a.t.i.e. .m.i.s.l.u.k.t.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.O.K.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.D.e. .i.n.s.t.a.l.l.a.t.i.e. .v.a.n. .D.r.i.v.e.r. .B.o.o.s.t.e.r. .i.s. .o.m. .o.n.b.e.k.e.n.d.e. .r.e.d.e.n. .m.i.s.l.u.k.t... .D.r.i.v.e.r. .B.o.o.s.t.e.r. .z.a.l. .p.r.o.b.e.r.e.n. .o.m. .a.u.t.o.m.a.t.i.s.c.h. .t.e. .h.e.r.i.n.s.t.a.l.l.e.r.e.n. .n.a. .h.e.t. .h.e.r.s.t.a.r.t.e.n... .<.a.>.N.u. .h.e.r.s.t.a.r.t.e.n.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.e. .i.n.s.t.a.l.l.a.t.i.e. .v.a.n. .D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .i.s. .g.e.l.u.k.t.!. .K.l.i.k. .o.p. .S.c.a.n.n.e.n. .o.m. .h.e.t. .t.e. .d.r.a.a.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\ENGLISH.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):25570
                                                                                                                                                                                                                            Entropy (8bit):3.570170330494481
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:go29TyOPSPklC9AvzwVSM0nZYRWv3xjrba:go8TyOPSP+C9ezwVSMYlva
                                                                                                                                                                                                                            MD5:4EE8BE1F8BAC829DCE7415BBAE08293D
                                                                                                                                                                                                                            SHA1:51D7F3CBCD077D57EC0E19439387ADE2702F63A5
                                                                                                                                                                                                                            SHA-256:193BE7957932D7004D0A03CF4169A1EE63398FC4B0DCB618CCB7341D4F019826
                                                                                                                                                                                                                            SHA-512:076F4E7319C923B9B390B1FE0260D249864E28A2CD9039F814D1D7E0FB8739DF8E6E2AEEE9A70A31C47288EC5E37A4D66182E4034DFD7A5CB508A0B97D672831
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.E.n.g.l.i.s.h.........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.I.n.s.t.a.l.l. .O.p.t.i.o.n.s.....b.t.n.C.l.o.s.e...H.i.n.t.=.C.l.o.s.e.....b.t.n.M.i.n...H.i.n.t.=.M.i.n.i.m.i.z.e.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.I.n.s.t.a.l.l.a.t.i.o.n. .F.a.i.l.e.d.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.O.K.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .f.a.i.l.e.d. .t.o. .i.n.s.t.a.l.l. .f.o.r. .a.n. .u.n.k.n.o.w.n. .r.e.a.s.o.n... .D.r.i.v.e.r. .B.o.o.s.t.e.r. .w.i.l.l. .t.r.y. .t.o. .r.e.i.n.s.t.a.l.l. .a.u.t.o.m.a.t.i.c.a.l.l.y. .a.f.t.e.r. .r.e.b.o.o.t... .<.a.>.R.e.b.o.o.t. .n.o.w.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .h.a.s. .b.e.e.n. .i.n.s.t.a.l.l.e.d. .s.u.c.c.e.s.s.f.u.l.l.y.!. .P.l.e.a.s.e. .c.l.i.c.k. .S.c.a.n. .N.o.w. .t.o. .r.u.n. .i.t.!.....l.b.l.S.u.c.c.T.i.t.l.e...C.a.p.t.i.o.n.=.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\FINNISH.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):27172
                                                                                                                                                                                                                            Entropy (8bit):3.5266843960899203
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:768:q66ZlDyNaWaRFlh01qu6nYcBvIUBq/pQ44BMsU:n6iaRFDnYcBvIUBq/pQ44BMsU
                                                                                                                                                                                                                            MD5:CAFFF342C906511A165A7C7BA60FF96C
                                                                                                                                                                                                                            SHA1:28DF2B3C45A6AD91A84991F92034668C53D24DAC
                                                                                                                                                                                                                            SHA-256:0F864BD726B9A999DBAD6E3AFD48FB41B80B7C6C9C5D222C31491121A46685C0
                                                                                                                                                                                                                            SHA-512:533F5EE91989C5F0A02D2AB7835A897A7D0ECAA4C3A005F47E62B2DF3DB868F0CC4111BED1CD459F5B148D2E3B3E8E5E8C8FB605B37D5EB4C0D5F67EFC47222A
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.S.u.o.m.i.........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.A.s.e.n.n.u.s.v.a.i.h.t.o.e.h.d.o.t.....b.t.n.C.l.o.s.e...H.i.n.t.=.S.u.l.j.e.....b.t.n.M.i.n...H.i.n.t.=.P.i.e.n.e.n.n.......l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.A.s.e.n.n.u.s. .e.p...o.n.n.i.s.t.u.i.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.O.K.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .-.a.s.e.n.n.u.s. .e.p...o.n.n.i.s.t.u.i. .t.u.n.t.e.m.a.t.t.o.m.a.s.t.a. .s.y.y.s.t..... .D.r.i.v.e.r. .B.o.o.s.t.e.r. .y.r.i.t.t..... .a.s.e.n.t.u.a. .a.u.t.o.m.a.a.t.t.i.s.e.s.t.i. .u.u.d.e.l.l.e.e.n.k...y.n.n.i.s.t.y.k.s.e.n. .j...l.k.e.e.n... .<.a.>.K...y.n.n.i.s.t... .u.u.d.e.l.l.e.e.n.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .o.n. .a.s.e.n.n.e.t.t.u. .o.n.n.i.s.t.u.n.e.e.s.t.i.!. .O.l.e. .h.y.v... .j.a. .v.a.l.i.t.s.e. .S.k.a.n.n.a.a. .n.y.t.!.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\FRENCH.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):29902
                                                                                                                                                                                                                            Entropy (8bit):3.5306365995720674
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:768:ArkcdQGbgHhkPS/776kQy52x7+QN+o6pGk:ArkcukPS/7Wki716pGk
                                                                                                                                                                                                                            MD5:CF5A8902E41B2F136609F70B972F9B8F
                                                                                                                                                                                                                            SHA1:D0B59C62ED2F0DF9BC1B136B4E4FE1ED96ABE0BD
                                                                                                                                                                                                                            SHA-256:7F41026419CC5981C27288057307388FA39D0F59D76CF540AE13C942CCF5D2DB
                                                                                                                                                                                                                            SHA-512:85F1FFA2C9262E987693330A5C400573B855FFFC2698B15EFEDDB4E9FF99D5393A6D26C5925E6433B3708B776D41611A991CAA96EBF896ED5B9910E6AD9074E8
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.F.r.a.n...a.i.s.........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.O.p.t.i.o.n.s. .d.'.I.n.s.t.a.l.l.a.t.i.o.n.....b.t.n.C.l.o.s.e...H.i.n.t.=.F.e.r.m.e.r.....b.t.n.M.i.n...H.i.n.t.=.M.i.n.i.m.i.z.e.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.L.'.i.n.s.t.a.l.l.a.t.i.o.n. .a. ...c.h.o.u.......b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.O.K.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=...c.h.e.c. .d.e. .l.'.i.n.s.t.a.l.l.a.t.i.o.n. .d.e. .D.r.i.v.e.r. .B.o.o.s.t.e.r. .p.o.u.r. .u.n.e. .r.a.i.s.o.n. .i.n.c.o.n.n.u.e... .D.r.i.v.e.r. .B.o.o.s.t.e.r. .v.a. .e.s.s.a.y.e.r. .d.e. .r...i.n.s.t.a.l.l.e.r. .a.u.t.o.m.a.t.i.q.u.e.m.e.n.t. .a.p.r...s. .l.e. .r.e.d...m.a.r.r.a.g.e... .<.a.>.R.e.d...m.a.r.r.e.r. .m.a.i.n.t.e.n.a.n.t.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .a. ...t... .i.n.s.t.a.l.l... .a.v.e.c. .s.u.c.c...s.!. .V.e.u.i.l.l.e.z. .c.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\GEORGIAN.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):23956
                                                                                                                                                                                                                            Entropy (8bit):4.365515221007151
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:W3Hu4Csebm3js0sbor69V/ONll0Fh8b4CU1:gHu4CseyjV2Ey/ONll04A
                                                                                                                                                                                                                            MD5:8AD24341309BC4C11299D5673DFA57CF
                                                                                                                                                                                                                            SHA1:1286347B4A479D865A7253E6B8FA94AA3D9C7812
                                                                                                                                                                                                                            SHA-256:AF6FB558313BA10C3811705398ACC7CDE3A0A8DFED412EDE3CAE29BD1236FFFA
                                                                                                                                                                                                                            SHA-512:F65991C7A7FF22B709939A659D9A869ADC2E3DF34E5367B3BB974C10B585DB950874E4EEC9B82241A69A192F8702134AE43E7806D3C2423CB8B787E0D89D4571
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.......................[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=................... ...........................b.t.n.C.l.o.s.e...H.i.n.t.=...................b.t.n.M.i.n...H.i.n.t.=...................l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=....... ...................b.t.n.F.a.i.l...C.a.p.t.i.o.n.=...............r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. ....... ............... ............. ................. ............. .D.r.i.v.e.r. .B.o.o.s.t.e.r.-..... ............... ................. ....................... ......................... ............... .<.a.>.......................!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. ..................... ...............!. ............. ................. ..................... .....................!.....l.b.l.S.u.c.c.T.i.t.l.e...C.a.p.t.i.o.n.=...............

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\GERMAN.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):20764
                                                                                                                                                                                                                            Entropy (8bit):3.5523499997783388
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:P7tfFPZ8/tKLsdwD2fHowGQnE+rKG/OwlAJ015zLoqsjwqHkYOeFhSmb:PBFZ8/tPdw6foQnE+rKG/OwlH4jlEYxt
                                                                                                                                                                                                                            MD5:2344C3B096A5F0E6E0519DB3C3EF39F6
                                                                                                                                                                                                                            SHA1:2F1C7673D441F7172097A7DFD53A2597A1239633
                                                                                                                                                                                                                            SHA-256:D65E1014965A6537FE9B4D6A4AD2FBFD39966746533CF0FFDD5CF060CCAA22A8
                                                                                                                                                                                                                            SHA-512:F343BD48ABDDC7295FCBF98BA7266BF74A9D42760A55DAD411CC4EAD4E411EED8D1DCF594C8F645FCA38EB594FCDA4A5B0CF4C71FD4FB831EB44F93C483669DA
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.D.e.u.t.s.c.h.........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.I.n.s.t.a.l.l.i.e.r.-.O.p.t.i.o.n.e.n.....b.t.n.C.l.o.s.e...H.i.n.t.=.S.c.h.l.i.e...e.n.....b.t.n.M.i.n...H.i.n.t.=.M.i.n.i.m.i.e.r.e.n.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.I.n.s.t.a.l.l.a.t.i.o.n. .g.e.s.c.h.e.i.t.e.r.t.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.O.K.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.D.r.i.v.e.r.-.B.o.o.s.t.e.r.-.I.n.s.t.a.l.l.a.t.i.o.n. .i.s.t. .a.u.s. .u.n.b.e.k.a.n.n.t.e.m. .G.r.u.n.d. .g.e.s.c.h.e.i.t.e.r.t... .N.a.c.h. .N.e.u.s.t.a.r.t. .w.i.r.d. .v.e.r.s.u.c.h.t.,. .D.r.i.v.e.r.-.B.o.o.s.t.e.r. .a.u.t.o.m.a.t.i.s.c.h. .z.u. .r.e.i.n.s.t.a.l.l.i.e.r.e.n... .<.a.>.J.e.t.z.t. .n.e.u. .s.t.a.r.t.e.n.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r.-.B.o.o.s.t.e.r. .%.s. .w.u.r.d.e. .e.r.f.o.g.r.e.i.c.h. .i.n.s.t.a.l.l.i.e.r.t.!. .Z.u.m. .A.u.s.f...h.r.e.n. .b.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\GREEK.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):30726
                                                                                                                                                                                                                            Entropy (8bit):4.405878266603618
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:e58dc/Tf6my1XHkUAhY/BW5E5Ca7nxEBUXXvzfaqpZxDv2I4ZCUQrkQrG6dJGG6+:u8deE5r7x/vZuqJg81p7
                                                                                                                                                                                                                            MD5:E7C282FB104E7A9B892C44681CFAF510
                                                                                                                                                                                                                            SHA1:5D47A616C4C991054F3EBB9A8358DA5439ED48BC
                                                                                                                                                                                                                            SHA-256:7324360E781D87066CC0A3E471C97A6C93FE92DAE8BC680F8189A44536DA95DB
                                                                                                                                                                                                                            SHA-512:56B849D18F42838333BDA1FD66ABE1155C3FF9E2B0FD54F43F804910102BD082720DF3133C6D0889E3B4FB2B0D7B6A765D2B03FAF2B93E1BA7C87CC5E5FAE386
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.........................[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=................. .............................b.t.n.C.l.o.s.e...H.i.n.t.=.....................b.t.n.M.i.n...H.i.n.t.=.................................l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=... ....................... ...................b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.O.K.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=..... .D.r.i.v.e.r. .B.o.o.s.t.e.r. ............... ..... ......................... ....... ............... ............... ........... ..... .D.r.i.v.e.r. .B.o.o.s.t.e.r. ..... ....................... ..... ................................. ................. ......... ....... ........................... .<.a.>......................... .........!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=..... .D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. ........................... ..... .................!. ...

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\HEBREW.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):23238
                                                                                                                                                                                                                            Entropy (8bit):4.377434809697662
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:tLmM2QPS1S/XiTh2BtOvaTnDHvjmcRJiikFPCrXNcMvBVU1:tL727fMyvaTn7vu6rXNc8BY
                                                                                                                                                                                                                            MD5:C36EBAA016F246B1A945C5AC7E4E9AEF
                                                                                                                                                                                                                            SHA1:DC88AB3FE0E35A996CC993BD3408BA128BA90039
                                                                                                                                                                                                                            SHA-256:75293D3C0B080F1609F221410232B93401494F96DF9D8A5EA08334CC386A53EC
                                                                                                                                                                                                                            SHA-512:FAA5A3CE603585CAFD542761DD704AB6171E9B7FEB8B79E321D3FAEE8C7635094C17CC463E75D2DDC54F11DD8AC73E71AB27EC864567C417304FDD57F2FB1D50
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=...................[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=................. ...............b.t.n.C.l.o.s.e...H.i.n.t.=...............b.t.n.M.i.n...H.i.n.t.=...............l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=............. ...............b.t.n.F.a.i.l...C.a.p.t.i.o.n.=...............r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=........... ..... ........... .............-........... ......... ............... ............. ........... ......... ............. ......... ........... ............... ......... ............. .<.a.>........... .......!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=......... ............. .%.s. ........... .............!. ....... ....... ..... ......... ........... ....... ........... .........!.....l.b.l.S.u.c.c.T.i.t.l.e...C.a.p.t.i.o.n.=............. ...................b.t.n.S.u.c.c...C.a.p.t.i.o.n.=........... ...........l.b.l.I.n.s.t.a.l.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\HUNGARIAN.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):26186
                                                                                                                                                                                                                            Entropy (8bit):3.6909888525091836
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:768:t0RXjx+xQqYNjDxBbhHN9uAkQD6yqvUQ7tGg6ug/J:t0RXjkWvjD3duAkQD6yqvUQEg6ug/J
                                                                                                                                                                                                                            MD5:60C98BBA438300FFFEC8F207727B1767
                                                                                                                                                                                                                            SHA1:88970D36F763B9EFE88A992D733B9F2F6F15E3C5
                                                                                                                                                                                                                            SHA-256:E6B595F8530AC68E169BA9E2E996D50C083A8BC4697440AB381114DAB8DE96ED
                                                                                                                                                                                                                            SHA-512:B526FAD863BBBBD737D6C9778DE8EA7F7D1CD64470740A354A6DDBA18529594C8519CE0E115248594CE8AF62BA10A6C7CE5FF98CCEBAF0C177CC25CE31BDD7C3
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.M.a.g.y.a.r.........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.O.p.c.i...k. .t.e.l.e.p...t...s.e.....b.t.n.C.l.o.s.e...H.i.n.t.=.B.e.z...r...s.....b.t.n.M.i.n...H.i.n.t.=.M.i.n.i.m.a.l.i.z...l...s.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.T.e.l.e.p...t...s. .s.i.k.e.r.t.e.l.e.n.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.O.K.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.A. .D.r.i.v.e.r. .B.o.o.s.t.e.r. .t.e.l.e.p...t...s.e. .s.i.k.e.r.t.e.l.e.n. .i.s.m.e.r.e.t.l.e.n. .o.k.b...l... .A. .D.r.i.v.e.r. .B.o.o.s.t.e.r. .m.e.g.p.r...b...l.j.a. .a.z. ...j.r.a.t.e.l.e.p...t...s.t. .a.z. ...j.r.a.i.n.d...t...s. .u.t...n... .<.a.>...j.r.a.i.n.d...t...s. .m.o.s.t.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .s.i.k.e.r.e.s.e.n. .t.e.l.e.p...t...s.r.e. .k.e.r...l.t.!. .K...r.j...k. .k.a.t.t.i.n.t.s.o.n. .a.z. .".E.l.l.e.n.Q.r.z...s.". .g.o.m.b.r.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\INDONESIAN.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):26844
                                                                                                                                                                                                                            Entropy (8bit):3.5204156582973387
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:xr2NmGqSB18YLxvARnjqvUbfsbKdnXKkRm0WPFSueKAB+SxgNQwT/uXvd4RV1:xGqQCYLqmGnakRmHPFPutgx/uXvd4Rn
                                                                                                                                                                                                                            MD5:D305A31904821B36031B69E1A4B219DD
                                                                                                                                                                                                                            SHA1:B4DF3D363ACC56222B6B65464825F688CEF23A45
                                                                                                                                                                                                                            SHA-256:FCE00AFF49D22FD2879AFAE93DC64A9C6783A8BBB754FB575960704B7D893F22
                                                                                                                                                                                                                            SHA-512:822A1A21B98E77C0A452C482C88953E61EFAC30D43F4C954C6239BBB71106A700ABF28E70FA8419BBE7E22255A6FDEEBB794FB1DB9DC84A6C7544EE73D8FEA01
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.I.n.d.o.n.e.s.i.a.........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.P.i.l.i.h.a.n. .P.e.m.a.s.a.n.g.a.n.....b.t.n.C.l.o.s.e...H.i.n.t.=.T.u.t.u.p.....b.t.n.M.i.n...H.i.n.t.=.M.i.n.i.m.a.l.k.a.n.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.P.e.m.a.s.a.n.g.a.n. .G.a.g.a.l.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.O.K.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .g.a.g.a.l. .d.i.p.a.s.a.n.g. .k.a.r.e.n.a. .a.l.a.s.a.n. .y.a.n.g. .t.i.d.a.k. .d.i.k.e.t.a.h.u.i... .D.r.i.v.e.r. .B.o.o.s.t.e.r. .a.k.a.n. .m.e.n.c.o.b.a. .m.e.m.a.s.a.n.g. .u.l.a.n.g. .s.e.c.a.r.a. .o.t.o.m.a.t.i.s. .s.e.t.e.l.a.h. .r.e.b.o.o.t... .<.a.>.R.e.b.o.o.t. .s.e.k.a.r.a.n.g.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .b.e.r.h.a.s.i.l. .d.i.i.p.a.s.a.n.g.!. .S.i.l.a.k.a.n. .k.l.i.k. .P.i.n.d.a.i. .S.e.k.a.r.a.n.g. .u.n.t.u.k. .m.e.n.j.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\ITALIAN.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):28798
                                                                                                                                                                                                                            Entropy (8bit):3.4813825738918878
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:xNMjFF4gpKYHxFsfLNGxSUQpvWaDJvDPuJ8f97zOdTOCNYLBj:7MjF7bRiT4xRQpvRlZVaTPYL1
                                                                                                                                                                                                                            MD5:90721114018DBEB8B3AC62B7556712F1
                                                                                                                                                                                                                            SHA1:5D0622C8EFFFE34D25739AD732D1BB9973B2935C
                                                                                                                                                                                                                            SHA-256:C8C86DF36BD5C03E6C9E81C0CF73E4566064D31C4FFCD3BAC6606A866D944A75
                                                                                                                                                                                                                            SHA-512:42948C9C42E07648D51A3A32DCAABC340CE51C6EBFE45CD0EC22243494B9C9118EE0C13FE55CC130DCD16CE8F333D5CBB5D90738B32E5CFC8429082812E78B2B
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.I.t.a.l.i.a.n.o.........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.O.p.z.i.o.n.i. .d.i. .i.n.s.t.a.l.l.a.z.i.o.n.e.....b.t.n.C.l.o.s.e...H.i.n.t.=.C.h.i.u.d.i.....b.t.n.M.i.n...H.i.n.t.=.M.i.n.i.m.i.z.z.a.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.I.n.s.t.a.l.l.a.z.i.o.n.e. .f.a.l.l.i.t.a.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.O.K.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.P.e.r. .u.n. .m.o.t.i.v.o. .s.c.o.n.o.s.c.i.u.t.o. .l.'.i.n.s.t.a.l.l.a.z.i.o.n.e. .d.i. .D.r.i.v.e.r. .B.o.o.s.t.e.r. .n.o.n. ... .r.i.u.s.c.i.t.a... .D.o.p.o. .i.l. .r.i.a.v.v.i.o. .D.r.i.v.e.r. .B.o.o.s.t.e.r. .t.e.n.t.e.r... .d.i. .r.e.i.n.s.t.a.l.l.a.r.s.i. .a.u.t.o.m.a.t.i.c.a.m.e.n.t.e... .<.a.>.R.i.a.v.v.i.a. .o.r.a.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. ... .s.t.a.t.o. .i.n.s.t.a.l.l.a.t.o. .c.o.n. .s.u.c.c.e.s.s.o.!. .F.a.r.e. .c.l.i.c. .s.u.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\JAPANESE.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):18288
                                                                                                                                                                                                                            Entropy (8bit):5.122201172622799
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:ocxzTSK+Bolkogde0MiTBhDXx5nrP+zRBgZb6:ocxzTIe0MiTBjprcvGu
                                                                                                                                                                                                                            MD5:F475DAF06CF07C7A5FA499B873A6C1EE
                                                                                                                                                                                                                            SHA1:9C0A634E780B90FDA8BF2250D2074A8B1754B6E0
                                                                                                                                                                                                                            SHA-256:3DC71C94786940E7F6D1F2A16309BB67237C54BA47A18E9E6650FF2BA1171322
                                                                                                                                                                                                                            SHA-512:7B67AC451DA5C3A21CE761B8D46FDD781294DF95E7A64C50A0DA375371302F3AFE7FA813E2F6D4B841D3371D0402046B2AA1BA94802EA3E785CB4CF2C2ACDB45
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=..e,g..........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=..0.0.0.0.0.0.0.0.0.0.0....b.t.n.C.l.o.s.e...H.i.n.t.=...X0.0....b.t.n.M.i.n...H.i.n.t.=..g.\.S....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=..0.0.0.0.0.0g0M0~0[0.0g0W0_0....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.O.K.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=..N.fj0.t1uk0.0.0 .D.r.i.v.e.r. .B.o.o.s.t.e.r. ..0.0.0.0.0.0.0g0M0~0[0.0g0W0_0.0P.C..0.Qw..RY0.0h0..R.vk0.Q.0.0.0.0.0.0.0f..0~0Y0.0<.a.>..Qw..RY0.0<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .L0.0.0.0.0.0.0U0.0~0W0_0.0[..0.0.0.0]..0.0.0.0.0Y0.0h0w..RW0~0Y0.0....l.b.l.S.u.c.c.T.i.t.l.e...C.a.p.t.i.o.n.=..0.0.0.0.0.0L0.[.NW0~0W0_0....b.t.n.S.u.c.c...C.a.p.t.i.o.n.=..0.0.0.0....l.b.l.I.n.s.t.a.l.l...C.a.p.t.i.o.n.=..0.0.0.0.0.0-N..........b.t.n.E.m.a.i.l...C.a.p.t.i.o.n.=.....Y0.0....b.t.n.E.m.a.i.l.V.a.l.i.d...C.a.p.t.i.o.n.=.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\KOREAN.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):18116
                                                                                                                                                                                                                            Entropy (8bit):5.184451654358166
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:XmyI4opBjLHBmrD0qrn3n1hteRBbBHUcXb/e5B:w4ofPhmpr31htqDmT
                                                                                                                                                                                                                            MD5:7EA1E03FA12CD0DB42578A5B4BAFC7F6
                                                                                                                                                                                                                            SHA1:2BD8DD92D8103E78128791637898663F79989177
                                                                                                                                                                                                                            SHA-256:0C1A3ADA9529FB261F7C5A24D7206380CE2ED150C37D31022524CF600B56DB55
                                                                                                                                                                                                                            SHA-512:437CD5B9E9CBE4FCB3E5752546552B78AD9DC69164AADEBF09F0965DBEDF703201326CA5435E3C2B57F3BA3A291536088DB119693647E7853EAD173279125FDF
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.\.m...........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.$.X. .5.X.....b.t.n.C.l.o.s.e...H.i.n.t.=..0.....b.t.n.M.i.n...H.i.n.t.=.\..T.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.$.X. ...(.(.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.U.x.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.L. ... .... ...x.<.\. .D.r.i.v.e.r. .B.o.o.s.t.e.r.X. .$.X... ...(.......... ...... ..... ....<.\. .D.r.i.v.e.r. .B.o.o.s.t.e.r.X. .$.X.|. ......i..... .<.a.>..... ......!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .....t. .1.....<.\. .$.X........!. ....X.$.t. ..... .....|. ...t.8.........l.b.l.S.u.c.c.T.i.t.l.e...C.a.p.t.i.o.n.=.$.X. .D..(.....b.t.n.S.u.c.c...C.a.p.t.i.o.n.=..... .........l.b.l.I.n.s.t.a.l.l...C.a.p.t.i.o.n.=.$.X. .............b.t.n.E.m.a.i.l...C.a.p.t.i.o.n.=.l......b.t.n.E.m.a.i.l.V.a.l.i.d...C.a.p.t.i.o.n.=.l......l.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\LATVIAN.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):15560
                                                                                                                                                                                                                            Entropy (8bit):3.675737337213521
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:dWkBkdDlkytNKUmGkUaHIaZUqBg9M32/CTXwp6TkX+Md8R8O8bI7X4QhWVY9N6iQ:F95HZUh9TJIkXBd8R89bIjfWVY+iW/1
                                                                                                                                                                                                                            MD5:FB31ADF03BCCDFD85C2723A39AD8B5A4
                                                                                                                                                                                                                            SHA1:2CECA3030D66C99655E85036FB13FE1494A8E240
                                                                                                                                                                                                                            SHA-256:15E145C8651098ED4E7C81285BBB8316EB200E550963EAF80B6BD55290A5BC79
                                                                                                                                                                                                                            SHA-512:E05D8F2A3B3FD44CD8148C0E4E61B04EBF26AC53CBBE2887624C628EBE20359E4E2C7EC7D8455F32990F2C63ECFAAD309548C9C66F05649DD28A3087E4F1C5BE
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.L.a.t.v.i.e.a.u.........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.I.n.s.t.a.l...a.a.n.a.s. .o.p.c.i.j.a.s.....b.t.n.C.l.o.s.e...H.i.n.t.=.A.i.z.v...r.t.....b.t.n.M.i.n...H.i.n.t.=.S.a.k.<.a.u.t.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.I.n.s.t.a.l...a.a.n.a. .n.e.i.z.d.e.v...s.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.L.a.b.i.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .n.a.v. .i.n.s.t.a.l...j.i.e.s. .n.e.z.i.n...m.u. .i.e.m.e.s.l.u. .d...<... .D.r.i.v.e.r. .B.o.o.s.t.e.r. .m...#.i.n...s. .p...r.i.n.s.t.a.l...t.i.e.s. .a.u.t.o.m...t.i.s.k.i. .p...c. .a.t.s...k.n...a.a.n.a.s... .<.a.>.P...r.s.t.a.r.t...j.i.e.t. .t.k.l.+.t.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .i.r. .v.e.i.k.s.m.+.g.i. .i.n.s.t.a.l...t.s.!. .L.k.d.z.u.,. .n.o.k.l.i.k.a.7.i.n.i.e.t. .u.z. .'.S.k.e.n...t. .t.k.l.+.t.'.,. .l.a.i. .

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\MALAY.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):28330
                                                                                                                                                                                                                            Entropy (8bit):3.488189171127687
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:3qWDGy0DXovV6P0ZKOfRlCrIs2pBD32X695+Qgyjr1B9/j6/5jDvL1:XGyQovvpgrIs2vD+6dBljK5jDv5
                                                                                                                                                                                                                            MD5:D4BDF9845E3B915C53DA52E84869A6A1
                                                                                                                                                                                                                            SHA1:569C7237C95B713F5760234AAC0C7240CD6103C2
                                                                                                                                                                                                                            SHA-256:49EADCC632295749245E5D11D5C1319692DA0AC31CF7FC323B6BA919E9585563
                                                                                                                                                                                                                            SHA-512:874C5D5658AF985528BC1E187C7704C15125BDFC6947100AB4507CC2AFA6E5EC0F7E2194E5C4A52C8E451E44AA6379155A9833D3D8B8FE3CB980D0E72A7BB322
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.B.a.h.a.s.a. .M.a.l.a.y.s.i.a.........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.P.i.l.i.h.a.n. .P.e.m.a.s.a.n.g.a.n.....b.t.n.C.l.o.s.e...H.i.n.t.=.T.u.t.u.p.....b.t.n.M.i.n...H.i.n.t.=.M.i.n.i.m.u.m.k.a.n.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.P.e.m.a.s.a.n.g.a.n. .G.a.g.a.l.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.O.K.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .g.a.g.a.l. .d.i.p.a.s.a.n.g. .a.t.a.s. .s.e.b.a.b. .y.a.n.g. .t.i.d.a.k. .d.i.k.e.t.a.h.u.i... .D.r.i.v.e.r. .B.o.o.s.t.e.r. .a.k.a.n. .c.u.b.a. .d.i.p.a.s.a.n.g. .s.e.m.u.l.a. .s.e.c.a.r.a. .a.u.t.o.m.a.t.i.k. .s.e.l.e.p.a.s. .P.C. .d.i.m.u.l.a.k.a.n. .s.e.m.u.l.a... .<.a.>.M.u.l.a. .s.e.m.u.l.a. .s.e.k.a.r.a.n.g.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .b.e.r.j.a.y.a. .d.i.p.a.s.a.n.g.!. .S.i.l.a. .k.l.i.k. .I.m.b.a.s. .S.e.k.a.r.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\NORWEGIAN.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):26592
                                                                                                                                                                                                                            Entropy (8bit):3.532850241132255
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:2G5ywjLYBH5hmhMMtK9bmdj8hQdyyWZOSm3jfWvNpb2F:2G+rbmdjWNUq6
                                                                                                                                                                                                                            MD5:1898BEDB2D0CB05464D5C43F346EE8EC
                                                                                                                                                                                                                            SHA1:E7A1E9AC7C877BF80EA4456C5C81FF8567146A38
                                                                                                                                                                                                                            SHA-256:3529F30834F413B4E0BD0DAC4F6F198BE098C78DB7D31784265342D2A7593EBE
                                                                                                                                                                                                                            SHA-512:3884F61A107F587674EB3673B770FE012EF2409D385CC9E85B3738C5F033B7AFEC5621B2202945B50F736CCE6ADB6EE498B190BAD4785D7EE7E38416FDE500B9
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.N.o.r.s.k.........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.I.n.s.t.a.l.l.a.s.j.o.n.s. .V.a.l.g.....b.t.n.C.l.o.s.e...H.i.n.t.=.L.u.k.k.....b.t.n.M.i.n...H.i.n.t.=.M.i.n.i.m.e.r.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.I.n.s.t.a.l.l.a.s.j.o.n.e.n. .f.e.i.l.e.t.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.O.K.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .i.n.s.t.a.l.l.a.s.j.o.n.e.n. .m.i.s.l.y.k.t.e.s. .g.r.u.n.n.e.t. .u.k.j.e.n.t.e. ...r.s.a.k.e.r... .D.r.i.v.e.r. .B.o.o.s.t.e.r. .v.i.l. .a.u.t.o.m.a.t.i.s.k. .f.o.r.s...k.e. ... .i.n.s.t.a.l.l.e.r.e. .p... .n.y.t.t. .e.t.t.e.r. .n.e.s.t.e. .r.e.s.t.a.r.t... .<.a.>.R.e.b.o.o.t. .N.o.w.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .h.a.r. .b.l.i.t.t. .r.i.k.t.i.g. .i.n.s.t.a.l.l.e.r.t.!. .V.e.n.n.l.i.g.s.t. .t.r.y.k.k. .S.k.a.n.n. .N... .f.o.r. ... .s.t.a.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\PERSIAN.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):25610
                                                                                                                                                                                                                            Entropy (8bit):4.202282415026502
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:768:FbQpI2n0ClRSAVeORt1IPL3pm+a02TNWggyqaPg3Lqhsy91d6:ZQfxhVeSIvQWaTqoy
                                                                                                                                                                                                                            MD5:915DB92B92F01A94245FCB2B82C242E6
                                                                                                                                                                                                                            SHA1:1DF1C213A269F65ED801172896A4AE3A678FD165
                                                                                                                                                                                                                            SHA-256:729FFF2D3E9738C782777872F1D1FB16E115AC3E1C0F54715F17C84E18440C7A
                                                                                                                                                                                                                            SHA-512:1C36275AF4AE5BBF9F91BB0D93D2CCE335E879454F2DDB1C40063D539CF8E6D13367D8544757BCC76E79ADD373104210C4396791F1AC02A4B2CB048DD304EB51
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.~.'.1.3...........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=...2...F.G. .G.'... .F.5.(.....b.t.n.C.l.o.s.e...H.i.n.t.=.(.3.*.F.....b.t.n.M.i.n...H.i.n.t.=...H..... ...1./.F.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.4...3.*. ./.1. .F.5.(. .(.1.F.'.E.G.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.*.'...../.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.(.1.F.'.E.G. .(.G. ./.D.'...D. .F.'.E.4...5... .*.H.'.F.'..... .F.5.(. .4./.F. .1.'. .F./.'.1./... .(.1.F.'.E.G. .(.1.'... .F.5.(. ./.H.(.'.1.G. .(.9./. .'.2. .1.'.G. .'.F./.'.2... .E.,././. .3.'.E.'.F.G. .*.D.'.4. ...H.'.G./. ...1./. .<.a.>.1.'.G. .'.F./.'.2... .E.,././.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.(.1.F.'.E.G. .(.'. .E.H.A.B...*. .F.5.(. .4./... ...H.'.G.4.E.F./...E. .(.1.'... ...'.H.4. ...1./.F. ...D..... ...F.../.....l.b.l.S.u.c.c.T.i.t.l.e...C.a.p.t.i.o.n.=.F.5.(. .*...E...D. .4./.....b.t.n.S.u.c.c...C.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\POLISH.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):28376
                                                                                                                                                                                                                            Entropy (8bit):3.7230128965657943
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:768:oaUsddu2EsboSJ2hA0BpYYi6hfOvi2nxdpQPS:lUsRJ2hPuYJS
                                                                                                                                                                                                                            MD5:EC8CE5C384500FF223FF0D55B32D8FC1
                                                                                                                                                                                                                            SHA1:DDC7037AE7571C949E1106D01FBDC8E7D33EF086
                                                                                                                                                                                                                            SHA-256:62FA564A42BC3DC9E7FC238EE1E7C13AAEDE3FA13A718D0395FDA812E33051A7
                                                                                                                                                                                                                            SHA-512:DD3554FFF0D08E092C6EA4480B3AC6F194500E75D3CF112FBEA7F862AB7C33408269F20C80ACAFBF26367CD3D8C994DB11218F5BA8D40BB955EEFC3BAC4F38CB
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.P.o.l.s.k.i.........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.O.p.c.j.e. .i.n.s.t.a.l.a.c.j.i.....b.t.n.C.l.o.s.e...H.i.n.t.=.Z.a.m.k.n.i.j.....b.t.n.M.i.n...H.i.n.t.=.M.i.n.i.m.a.l.i.z.u.j.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.I.n.s.t.a.l.a.c.j.a. .n.i.e. .p.o.w.i.o.d.B.a. .s.i.......b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.O.K.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.I.n.s.t.a.l.a.c.j.a. .D.r.i.v.e.r. .B.o.o.s.t.e.r. .n.i.e. .p.o.w.i.o.d.B.a. .s.i... .z. .n.i.e.z.n.a.n.e.j. .p.r.z.y.c.z.y.n.y... .P.o. .p.o.n.o.w.n.y.m. .u.r.u.c.h.o.m.i.e.n.i.u. .k.o.m.p.u.t.e.r.a. .D.r.i.v.e.r. .B.o.o.s.t.e.r. .p.o.d.e.j.m.i.e. .p.r...b... .p.o.n.o.w.n.e.j. .i.n.s.t.a.l.a.c.j.i... .<.a.>.U.r.u.c.h.o.m. .p.o.n.o.w.n.i.e. .t.e.r.a.z.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .z.o.s.t.a.B. .p.o.m.y.[.l.n.i.e. .z.a.i.n.s.t.a.l.o.w.a.n.y.!. .

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\PORTUGUESEPTBR.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):27956
                                                                                                                                                                                                                            Entropy (8bit):3.5484469572709125
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:P2jqiSft+0WcvO3jZuuaivPAg3KGrvycb:P2jZSltWcvO3jZuFPe7byA
                                                                                                                                                                                                                            MD5:415D1F49DEBEC0130006611756BF0378
                                                                                                                                                                                                                            SHA1:34CE76E25CB646F2C4ADF619CFFAF877AEB166BA
                                                                                                                                                                                                                            SHA-256:6DC9C7EE5BAC0E6DE561F49C9B38C15A09FC151220940B4320AFFAD21D8F7ED0
                                                                                                                                                                                                                            SHA-512:98B89684A4D1AE3248A18991A7D8C184E0722E625EDD8AFC3407674E8107F7C922BEEF038BD621D9E943D3BCD89E3A5A2EBCE37A607E0EBD1C8562456540B998
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.P.o.r.t.u.g.u...s. .(.B.r.a.s.i.l.).........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.O.p.....e.s. .d.e. .I.n.s.t.a.l.a.....o.....b.t.n.C.l.o.s.e...H.i.n.t.=.F.e.c.h.a.r.....b.t.n.M.i.n...H.i.n.t.=.M.i.n.i.m.i.z.a.r.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.F.a.l.h.a. .n.a. .I.n.s.t.a.l.a.....o.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.O.K.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.F.a.l.h.a. .a.o. .i.n.s.t.a.l.a.r. .o. .D.r.i.v.e.r. .B.o.o.s.t.e.r. .p.o.r. .u.m. .m.o.t.i.v.o. .d.e.s.c.o.n.h.e.c.i.d.o... .O. .D.r.i.v.e.r. .B.o.o.s.t.e.r. .t.e.n.t.a.r... .r.e.i.n.s.t.a.l.a.r. .a.u.t.o.m.a.t.i.c.a.m.e.n.t.e. .a.p...s. .r.e.i.n.i.c.i.a.r... .<.a.>.R.e.i.n.i.c.i.a.r. .a.g.o.r.a.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.O. .D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .i.n.s.t.a.l.a.d.o. .c.o.m. .s.u.c.e.s.s.o.!. .P.o.r. .f.a.v.o.r.,. .c.l.i.q.u.e. .e.m. .V.e.r.i.f.i.c.a.r.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\PORTUGUESEPTPT.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):28830
                                                                                                                                                                                                                            Entropy (8bit):3.5371066478069895
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:duhn28k4AepH5qj3nawG1FmmyTanJmrFIfsN/daxh0xT2kDCeG/Mwpj7zT6L8dPd:cdqjX4fsNuoT2kDCeeMwI2PbbUJ+JcO
                                                                                                                                                                                                                            MD5:131F1009278C5BBA50F4EBD66EE439AA
                                                                                                                                                                                                                            SHA1:B6A35CE2AB9776A6484B49BD692BD26BD9B9136D
                                                                                                                                                                                                                            SHA-256:F5B651241DD212104A2961B05EF207CF3156C8A5ADEAEE6267E5E400A88B5A07
                                                                                                                                                                                                                            SHA-512:C787731B252E0D87A2B94AA6ABEF318EDD825A27663A6D861564FA9D484B726646BF563768C2A7D1BFDB1F69CA3ADFEC26D18C3AF099DE57A88DFB708D732307
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.P.o.r.t.u.g.u...s. .(.P.o.r.t.u.g.a.l.).........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.O.p.....e.s. .d.e. .I.n.s.t.a.l.a.....o.....b.t.n.C.l.o.s.e...H.i.n.t.=.F.e.c.h.a.r.....b.t.n.M.i.n...H.i.n.t.=.M.i.n.i.m.i.z.a.r.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.A. .i.n.s.t.a.l.a.....o. .f.a.l.h.o.u.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.O.K.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.O. .D.r.i.v.e.r. .B.o.o.s.t.e.r. .n...o. .f.o.i. .i.n.s.t.a.l.a.d.o. .p.o.r. .u.m. .m.o.t.i.v.o. .d.e.s.c.o.n.h.e.c.i.d.o... .O. .D.r.i.v.e.r. .B.o.o.s.t.e.r. .t.e.n.t.a.r... .r.e.i.n.s.t.a.l.a.r.-.s.e. .a.u.t.o.m.a.t.i.c.a.m.e.n.t.e. .a.p...s. .a. .r.e.i.n.i.c.i.a.l.i.z.a.....o... .<.a.>.R.e.i.n.i.c.i.e. .a.g.o.r.a.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.O. .D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .f.o.i. .i.n.s.t.a.l.a.d.o. .c.o.m. .s.u.c.e.s.s.o.!. .P.o.r. .f.a.v.o.r.,. .c.l.i.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\ROMANIAN.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):28480
                                                                                                                                                                                                                            Entropy (8bit):3.653157203507544
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:E25MeCuMRtAC54hGjow4zGNO7c5qhUjtmSVnbtbcCYk4TcsZM9:l5MVuMRtAC54Bw4SNOw5qhYrnxI/TZS
                                                                                                                                                                                                                            MD5:7697444AC945DB4A0D814E6488241D96
                                                                                                                                                                                                                            SHA1:185DF2FD6E045F581C3AC8C4DF07B2C28044CCB2
                                                                                                                                                                                                                            SHA-256:630544714AFA4E3BFE78BA94CA0F1A452C8EBE83FA5D262A28A5E27274CFBC20
                                                                                                                                                                                                                            SHA-512:1522B91E8A2A9A9362F5EDA08EF7AD04DB0F39E532799D9AEEEC71B2F2EFA84A1A20BD92FF868C52FB0D2D0174CAED5F6E2CDB5B8F050A3ECAFFA37E2B620434
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.R.o.m...n...........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.O.p...i.u.n.i. .d.e. .i.n.s.t.a.l.a.r.e.....b.t.n.C.l.o.s.e...H.i.n.t.=...n.c.h.i.d.e.r.e.....b.t.n.M.i.n...H.i.n.t.=.M.i.c...o.r.a.r.e.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.I.n.s.t.a.l.a.r.e. .e...u.a.t.......b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.O.K.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .n.u. .a. .p.u.t.u.t. .f.i. .i.n.s.t.a.l.a.t. .d.i.n.t.r.-.u.n. .m.o.t.i.v. .n.e.c.u.n.o.s.c.u.t... .D.r.i.v.e.r. .B.o.o.s.t.e.r. .v.a. .r.e...n.c.e.r.c.a. .i.n.s.t.a.l.a.r.e.a. .d.u.p... .r.e.p.o.r.n.i.r.e.a. .s.i.s.t.e.m.u.l.u.i... .<.a.>.R.e.p.o.r.n.i.r.e. .a.c.u.m.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .a. .f.o.s.t. .i.n.s.t.a.l.a.t. .c.o.r.e.c.t.!. .A.p...s.a...i. .p.e. ...S.c.a.n.a.r.e. .a.c.u.m... .p.e.n.t.r.u. .a.-.l. .e.x.e.c.u.t.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\RUSSIAN.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):26756
                                                                                                                                                                                                                            Entropy (8bit):4.258872807219822
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:dqMJ9Yv19Ff+9WuU9GH3Qmy6W9Snt9h97Xmy74Ov8cyYDcQb62Gt7ogg14/Hv+Om:K9NYWm2WjWUX13/GH5eYZVNMskTSKv
                                                                                                                                                                                                                            MD5:A0343BBA7969006C7817C6038EEC40F0
                                                                                                                                                                                                                            SHA1:459B9E7C18FD76ACCEAF21F75E392657B034A86D
                                                                                                                                                                                                                            SHA-256:153EC7CF24FCC72D39A7F847E17014B75C26A25284FBB1254603F9CBAA807B44
                                                                                                                                                                                                                            SHA-512:4CE7CB068237844BA08F6723DA807578C103714B4CE84E724BB115FB7AE93596B321A168F2138C6FB38AE1C1DC2468CFC83263851E31CE1D8C49D6DC9C8606D7
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=. .C.A.A.:.8.9.........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=...0.@.8.0.=.B.K. .C.A.B.0.=.>.2.:.8.....b.t.n.C.l.o.s.e...H.i.n.t.=...0.:.@.K.B.L.....b.t.n.M.i.n...H.i.n.t.=.!.:.@.K.B.L.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.#.A.B.0.=.>.2.:.0. .=.5. .2.K.?.>.;.=.5.=.0.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.........r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=...>. .=.5.8.7.2.5.A.B.=.>.9. .?.@.8.G.8.=.5. .=.5. .C.4.0.;.>.A.L. .C.A.B.0.=.>.2.8.B.L. .D.r.i.v.e.r. .B.o.o.s.t.e.r... ...>.?.K.B.:.0. .?.>.2.B.>.@.=.>.9. .C.A.B.0.=.>.2.:.8. .1.C.4.5.B. .0.2.B.>.<.0.B.8.G.5.A.:.8. .?.@.>.8.7.2.5.4.5.=.0. .?.>.A.;.5. .?.5.@.5.7.0.3.@.C.7.:.8... .<.a.>...5.@.5.7.0.3.@.C.7.8.B.L. .A.5.9.G.0.A.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.#.A.B.0.=.>.2.:.0. .D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .C.A.?.5.H.=.>. .7.0.2.5.@.H.5.=.0.!. ...0.6.<.8.B.5. .!.:.0.=.8.@.>.2.0.B.L. .G.B.>.1.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\SERBIANCYRILLIC.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):27112
                                                                                                                                                                                                                            Entropy (8bit):4.2477258408199505
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:Kt4VM2TdJh3kDZ1td1M4nCTyorxMDp7Dn6njWVr1R8a1:G4qxZ1td1M4ncPgdDn6no/1
                                                                                                                                                                                                                            MD5:2E463B4F8788CF89065492CD9697A16F
                                                                                                                                                                                                                            SHA1:59F81B536695A373A62B9EDBF74AD0015D6598D8
                                                                                                                                                                                                                            SHA-256:45127657A22EE3213888A3D2514568DC23B9EE55371AB74DF51A6534A57C775B
                                                                                                                                                                                                                            SHA-512:1FDFB646B5C0244B5390962628C84DB452AEF667E24C0A76FE6D1DD05476A889CCB4042409D58D781C78BF2E7A3FD54A2D04DA4F42567F220ACF0126C58CA8A3
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.!.@.?.A.:.8.........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=...?.F.8.X.5. .8.=.A.B.0.;.0.F.8.X.5.....b.t.n.C.l.o.s.e...H.i.n.t.=...B.:.0.6.8.....b.t.n.M.i.n...H.i.n.t.=.M.i.n.i.m.i.z.e.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=...=.A.B.0.;.0.F.8.X.0. .X.5. .=.5.C.A.?.5.;.0.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.#. .@.B.5.4.C.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=...=.A.B.0.;.0.F.8.X.0. .D.r.i.v.e.r. .B.o.o.s.t.e.r.-.0. .X.5. .=.5.C.A.?.5.;.0. .7.1.>.3. .=.5.?.>.7.=.0.B.>.3. .@.0.7.B.;.>.3.0... .D.r.i.v.e.r. .B.o.o.s.t.e.r. .[.5. .A.5. .?.>.:.C.H.0.B.8. .0.C.B.>.<.0.B.A.:.8. .@.5.8.=.A.B.0.;.8.@.0.B.8. .=.0.:.>.=. .?.>.=.>.2.=.>.3. .?.>.:.@.5.B.0.Z.0... .<.a.>...>.=.>.2.>. .?.>.:.@.5.=.8.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .X.5. .C.A.?.5.H.=.>. .8.=.A.B.0.;.8.@.0.=.!. ...;.8.:.=.8.B.5. .=.0. .!.0.4.0. .A.:.5.=.8.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\SERBIANLATIN.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):27320
                                                                                                                                                                                                                            Entropy (8bit):3.5893975539259744
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:768:00vKU8gRrq0cgVUhyVtvRz6m97Z86rPTaj:7KGVUhL+S
                                                                                                                                                                                                                            MD5:A988660806F3665FDC817B8C31A5B7C1
                                                                                                                                                                                                                            SHA1:D83017862206FA887DC6A0540CF5E5B75C6F4FEF
                                                                                                                                                                                                                            SHA-256:87E159233E7C60B8F6C9233CABBA34AF3B3320599E60AB2AB57BB60507982538
                                                                                                                                                                                                                            SHA-512:CB038D4A164DB22B28B94F0A9F59891B212365991257128D219AF84F9AABB0E3A13976785834053A18ED9279A3FB68C4CCFE8F85E23BBAAFF6D95D517BED9705
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.S.r.p.s.k.i.........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.O.p.c.i.j.e. .i.n.s.t.a.l.a.c.i.j.e.....b.t.n.C.l.o.s.e...H.i.n.t.=.O.t.k.a.~.i.....b.t.n.M.i.n...H.i.n.t.=.M.i.n.i.m.i.z.e.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.I.n.s.t.a.l.a.c.i.j.a. .j.e. .n.e.u.s.p.e.l.a.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.U. .r.t.e.d.u.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.I.n.s.t.a.l.a.c.i.j.a. .D.r.i.v.e.r. .B.o.o.s.t.e.r.-.a. .j.e. .n.e.u.s.p.e.l.a. .z.b.o.g. .n.e.p.o.z.n.a.t.o.g. .r.a.z.t.l.o.g.a... .D.r.i.v.e.r. .B.o.o.s.t.e.r. ...e. .s.e. .p.o.k.u.a.a.t.i. .a.u.t.o.m.a.t.s.k.i. .r.e.i.n.s.t.a.l.i.r.a.t.i. .n.a.k.o.n. .p.o.n.o.v.n.o.g. .p.o.k.r.e.t.a.n.j.a... .<.a.>.P.o.n.o.v.o. .p.o.k.r.e.n.i.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .j.e. .u.s.p.e.a.n.o. .i.n.s.t.a.l.i.r.a.n.!. .K.l.i.k.n.i.t.e. .n.a. .S.a.d.a. .s.k.e.n.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\SLOVAK.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):29114
                                                                                                                                                                                                                            Entropy (8bit):3.7135742260116493
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:aCf7XB2c2JLlnfhHS/xJEL20ubOAdftpT3pr5gQcg9hwO/1NMhJ6M0f38uwTeG8f:aCfilZ9ubv9HwOohJ6M0f4TeN
                                                                                                                                                                                                                            MD5:1B33D75F4B7D0C131AB2CEF77BE18880
                                                                                                                                                                                                                            SHA1:A7C6FB58B850300BDC4059D7F3651CE2C13FA1ED
                                                                                                                                                                                                                            SHA-256:A751FF68FB30BCFA6BCDD9DEA037774CB7C87FE07AE396A92430AAC0D82BD815
                                                                                                                                                                                                                            SHA-512:727A6410DED54AE604EA0A6B71B3C4E65AE3F7DCAE950A65ADC89CC45B9DCADFA4C960C4BE1C3CF35BB6E3BF053141103B8830A9414ECA9032F972A017CF82CF
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.S.l.o.v.e.n.s.k... .(.s.l.o.v.a.k.).........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.M.o.~.n.o.s.t.i. .i.n.a.t.a.l...c.i.e.....b.t.n.C.l.o.s.e...H.i.n.t.=.Z.a.t.v.o.r.i.e.....b.t.n.M.i.n...H.i.n.t.=.M.i.n.i.m.a.l.i.z.o.v.a.e.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.I.n.a.t.a.l...c.i.a. .z.l.y.h.a.l.a.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.O.K.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .s.a. .n.e.p.o.d.a.r.i.l.o. .n.a.i.n.a.t.a.l.o.v.a.e. .z. .n.e.z.n...m.e.h.o. .d...v.o.d.u... .P.r.o.g.r.a.m. .D.r.i.v.e.r. .B.o.o.s.t.e.r. .s.a. .s...m. .p.o. .r.e.a.t.a.r.t.o.v.a.n... .P.C. .a.u.t.o.m.a.t.i.c.k.y. .p.o.k...s.i. .p.r.e.i.n.a.t.a.l.o.v.a.e... .<.a.>.R.e.a.t.a.r.t.o.v.a.e. .t.e.r.a.z. .!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .b.o.l. ...s.p.e.a.n.e. .n.a.i.n.a.t.a.l.o.v.a.n...!. .K.l.i.k.n.i.t.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\SLOVENIAN.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):27752
                                                                                                                                                                                                                            Entropy (8bit):3.585961584104976
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:ZEq/oGyYy/OH9f6RkuNhljDoWZx1QTa8AeHdHuqHXBjTIv1:ZEq/4EuZx1QTa8FBXBgt
                                                                                                                                                                                                                            MD5:6C464B06A87F5499FD2B00D345BCEFCD
                                                                                                                                                                                                                            SHA1:A268C76928C7EB94EAEBE6CF670312BBCDA10307
                                                                                                                                                                                                                            SHA-256:78F0ADF02DAC80F348F16B9AA1DE2BB0E34AC8162E609316FD3C8CFF29B3864A
                                                                                                                                                                                                                            SHA-512:C4251C2ABF9D23BDCE35C6A9B664F7267C3F035061B8715A03268FAE054BC970274F9AD0284FAADACDB795F3EF1CA133C3710DCC8988D3E4FF241AD9632BF06C
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.S.l.o.v.e.n.a...i.n.a.........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.M.o.~.n.o.s.t.i. .n.a.m.e.s.t.i.t.v.e.....b.t.n.C.l.o.s.e...H.i.n.t.=.Z.a.p.r.i.....b.t.n.M.i.n...H.i.n.t.=.M.i.n.i.m.i.z.i.r.a.j.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.N.a.m.e.s.t.i.t.e.v. .n.i. .u.s.p.e.l.a.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.V. .r.e.d.u.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .n.i. .u.s.p.e.l. .n.a.m.e.s.t.i.t.i. .i.z. .n.e.z.n.a.n.e.g.a. .r.a.z.l.o.g.a... .D.r.i.v.e.r. .B.o.o.s.t.e.r. .s.e. .b.o. .p.o. .p.o.n.o.v.n.e.m. .z.a.g.o.n.u. .s.a.m.o.d.e.j.n.o. .p.o.n.o.v.n.o. .n.a.m.e.s.t.i.l... .<.a.>.Z.n.o.v.a. .z.a.~.e.n.i.t.e. .r.a...u.n.a.l.n.i.k.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.G.o.n.i.l.n.i.k. .g.o.n.i.l.n.i.k.a. .%.s. .j.e. .b.i.l. .u.s.p.e.a.n.o. .n.a.m.e.a...e.n.!. ...e. .~.e.l.i.t.e. .z.a.g.n.a.t.i. .i.,. .k.l.i.k.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\SPANISH.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):28644
                                                                                                                                                                                                                            Entropy (8bit):3.5337383997862886
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:SzNXSUf4kE4coE6LF5BCpb5dziTlAsntKw+BKl:SzlHwP4coE0cOZA8tKwY8
                                                                                                                                                                                                                            MD5:D46A1EA3A2A68B83872743852115F4A9
                                                                                                                                                                                                                            SHA1:56EF966A3BD09C8E2549B2B80535C9EE2D867CA4
                                                                                                                                                                                                                            SHA-256:E746862197EAE15BDA7EB7515B65CA7DD60BAD36A5F7B7D24664A61950B01FB3
                                                                                                                                                                                                                            SHA-512:E0699BA43346491603F410124B834A1420E6B5CD13D114FC77F62AE45B0C26AA179B9F705E9B7EEC5BC4AF17A1F5314CB053627110425F5867163566A2F478CD
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.E.s.p.a...o.l.........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.O.p.c.i.o.n.e.s. .d.e. .I.n.s.t.a.l.a.c.i...n.....b.t.n.C.l.o.s.e...H.i.n.t.=.C.e.r.r.a.r.....b.t.n.M.i.n...H.i.n.t.=.M.i.n.i.m.i.z.a.r.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.F.a.l.l.o. .d.e. .i.n.s.t.a.l.a.c.i...n.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.O.K.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .f.a.l.l... .a.l. .i.n.s.t.a.l.a.r.s.e. .d.e.b.i.d.o. .a. .u.n.a. .r.a.z...n. .d.e.s.c.o.n.o.c.i.d.a... .D.r.i.v.e.r. .B.o.o.s.t.e.r. .i.n.t.e.n.t.a.r... .r.e.i.n.s.t.a.l.a.r.s.e. .a.u.t.o.m...t.i.c.a.m.e.n.t.e. .l.u.e.g.o. .d.e.l. .r.e.i.n.i.c.i.o... .<.a.>...R.e.i.n.i.c.i.a.r. .a.h.o.r.a.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=...D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .h.a. .s.i.d.o. .i.n.s.t.a.l.a.d.o. .s.a.t.i.s.f.a.c.t.o.r.i.a.m.e.n.t.e.!. ...P.o.r. .f.a.v.o.r.,. .

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\SWEDISH.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):26488
                                                                                                                                                                                                                            Entropy (8bit):3.5725576608122607
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:W8KR9icK8rXMHeoUzIVlzdglt53uYZY86P8:kRLMHRO/sELL
                                                                                                                                                                                                                            MD5:8C48C387D4325348E9CF6D21497432EC
                                                                                                                                                                                                                            SHA1:25BBA5B46B260342CE88569B364E5B29A124D7A8
                                                                                                                                                                                                                            SHA-256:2FCF96724574BBC4797B7BB82D6F8614048FF8ECEE2854DA4E81F34E9D06E764
                                                                                                                                                                                                                            SHA-512:DB4B5D40CDEA7671B9AB2E0E5903F0E1FAB4B6121BB4268C5806226D18DBB8B840601FC8D85DD84BACEBC1E045C05132B64F1ECB9C78368855F442F0BB701B18
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.S.v.e.n.s.k.a.........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.I.n.s.t.a.l.l.e.r.a. .a.l.t.e.r.n.a.t.i.v.....b.t.n.C.l.o.s.e...H.i.n.t.=.A.v.s.l.u.t.a.....b.t.n.M.i.n...H.i.n.t.=.M.i.n.i.m.e.r.a.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.I.n.s.t.a.l.l.a.t.i.o.n.e.n. .m.i.s.s.l.y.c.k.a.d.e.s.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.O.K.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .m.i.s.s.l.y.c.k.a.d.e.s.,. .a.v. .n...g.o.n. .o.b.e.k.a.n.t. .a.n.l.e.d.n.i.n.g.,. .a.t.t. .i.n.s.t.a.l.l.e.r.a. .o.c.h. .k.o.m.m.e.r. .a.t.t.,. .a.u.t.o.m.a.t.i.s.k.t.,. .f...r.s...k.a. .g...r.a. .d.e.t. .i.g.e.n. .e.f.t.e.r. .e.n. .o.m.s.t.a.r.t... .<.a.>.V.i.l.l. .d.u. .s.t.a.r.t.a. .o.m. .n.u.?.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .h.a.r. .i.n.s.t.a.l.l.e.r.a.t.s.!. .K.l.i.c.k.a. .p... .S.k.a.n.n.a. .n.u.,. .f...r.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\TURKISH.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):27504
                                                                                                                                                                                                                            Entropy (8bit):3.704526651002212
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:xf5oku0CMB+hSfbqMLixsJwWT66omXzfNRdYppfuVzK:xf5op0/Bb+MewwWT6BppWVm
                                                                                                                                                                                                                            MD5:DA7AB2397D246B94D063407658A84E67
                                                                                                                                                                                                                            SHA1:5B806790FFC8C0A98C2EDB424AE4D94E0B6326D9
                                                                                                                                                                                                                            SHA-256:1927C462429431E992AB291492780CB874CB0E7488A09AA29AA0D87F6E3CE88A
                                                                                                                                                                                                                            SHA-512:B45B9529812CFEC24967F3CE0D9EFD38FD2F61431C5207CECB2F340B6FA5A4D8D724E3FA87CF4BE9106752554EB5195D015177C1EFC4629010AAD7AE8B92774B
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.T...r.k...e.........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.K.u.r.u.l.u.m. .S.e...e.n.e.k.l.e.r.i.....b.t.n.C.l.o.s.e...H.i.n.t.=.K.a.p.a.t.....b.t.n.M.i.n...H.i.n.t.=.K.......l.t.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.K.u.r.u.l.u.m. .b.a._.a.r.1.s.1.z.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.T.a.m.a.m.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .k.u.r.u.l.u.m.u. .b.i.l.i.n.m.e.y.e.n. .b.i.r. .s.e.b.e.p.t.e.n. .b.a._.a.r.1.s.1.z... .Y.e.n.i.d.e.n. ...n.y...k.l.e.m.e. .s.o.n.r.a.s.1. .D.r.i.v.e.r. .B.o.o.s.t.e.r. .t.e.k.r.a.r. .k.u.r.u.l.m.a.y.1. .o.t.o.m.a.t.i.k.m.a.n. .d.e.n.e.y.e.c.e.k.t.i.r... .<.a.>.^.i.m.d.i. ...n.y...k.l.e.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. .b.a._.a.r.1.y.l.a. .k.u.r.u.l.d.u.!. .O.n.u. ...a.l.1._.t.1.r.m.a.k. .i...i.n. .^.i.m.d.i. .T.a.r.a. .t.1.k.l.a.y.1.n.!...

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\UKRAINIAN.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):25866
                                                                                                                                                                                                                            Entropy (8bit):4.3173673512631625
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:dyMd32T4i6Ntorgie+qt+3DyXNvz17rGhGGg+UsvFPrgm9ZidHiOVak46SlwXYMa:48p+qt+udxDNqj6SlfNYY91
                                                                                                                                                                                                                            MD5:0117AEAA85E9BB792C58E45727A400CC
                                                                                                                                                                                                                            SHA1:216C5D631DED522D6AE0B9C6093819645CF2E6B8
                                                                                                                                                                                                                            SHA-256:6E90FD2F7E76BF7D2940FD4BA74E47B2846CAAF70E21996BAE5F681F92B041B6
                                                                                                                                                                                                                            SHA-512:FBA52AE2F2481A958E297E538CCEC82CFACCC32C06BD4ACA9E00EBE7FF2FE832D446A02DF5678801B2123A1204A98B21567F644A0A3E677E242444568DD77910
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.#.:.@.0.W.=.A.L.:.0.........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=...A.B.0.=.>.2.8.B.8. .?.0.@.0.<.5.B.@.8.....b.t.n.C.l.o.s.e...H.i.n.t.=...0.:.@.8.B.8.....b.t.n.M.i.n...H.i.n.t.=...3.>.@.=.C.B.8.....l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=...5. .2.4.0.;.>.A.L. .2.A.B.0.=.>.2.8.B.8.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.O.K.V.....r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .=.5. .2.4.0.;.>.A.L. .V.=.A.B.0.;.N.2.0.B.8. .?.>. .=.5.2.V.4.>.<.V.9. .?.@.8.G.8.=.V...D.r.i.v.e.r. .B.o.o.s.t.e.r. .A.?.@.>.1.C.T. .0.2.B.>.<.0.B.8.G.=.>. .?.>.2.B.>.@.8.B.8. .C.A.B.0.=.>.2.:.C. .?.V.A.;.O. .?.5.@.5.7.0.2.0.=.B.0.6.5.=.=.O... .<.a.>...5.@.5.7.0.2.0.=.B.0.6.8.B.8. .7.0.@.0.7.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .1.C.2. .C.A.?.V.H.=.>. .2.A.B.0.=.>.2.;.5.=.8.9.!...C.4.L. .;.0.A.:.0.,.=.0.B.8.A.=.V.B.L. .:.=.>.?.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\1697157002\VIETNAMESE.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):27526
                                                                                                                                                                                                                            Entropy (8bit):4.065606059204402
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:sNAsxHubp1maA9VWwkzB+H4dRCqWw1ExLJK:kAsxHubpbA9VWwkzBZF1ExLA
                                                                                                                                                                                                                            MD5:1257D201538B0CE599BB4902ED9D622F
                                                                                                                                                                                                                            SHA1:50DC764D00F0A3FF4F6C7310C498C06F5CB74E96
                                                                                                                                                                                                                            SHA-256:64F1652B24680C3D3D0FDAC16B66E06904D69BD7FB86A4518B6259B3838E33F2
                                                                                                                                                                                                                            SHA-512:4A74E55A3DCDB2179C547494A659F06BDBD8FAAC144B51B4738094A152B1E07E275033C5E3FE2D4B10A83E1E8FE7B80F484AA9CFA027972E65AF7F3F9CFF6B13
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....D.i.s.p.l.a.y.N.a.m.e.=.T.i...n.g. .V.i...t.........[.I.n.s.t.a.l.l.e.r._.D.B._.I.n.s.t.a.l.r.e.].....r.d.l.b.l.I.n.s.t.M.a.i.n.T.i.t.l.e...C.a.p.t.i.o.n.=.C...c. .t...y. .c.h...n. .c...i. .....t.....b.t.n.C.l.o.s.e...H.i.n.t.=.....n.g.....b.t.n.M.i.n...H.i.n.t.=.T.h.u. .n.h.......l.b.l.F.a.i.l.T.i.t.l.e...C.a.p.t.i.o.n.=.I.n.s.t.a.l.l.a.t.i.o.n. .f.a.i.l.e.d.....b.t.n.F.a.i.l...C.a.p.t.i.o.n.=.....n.g. .......r.d.h.t.m.l.b.l.R.e.b.o.o.t...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .k.h...n.g. .t.h... .......c. .c...i. .....t. .d.o. .l... .d.o. .c.h...a. .r..... .D.r.i.v.e.r. .B.o.o.s.t.e.r. .s... .t.h... .c...i. .....t. .l...i. .s.a.u. .k.h.i. .m...y. .t...n.h. .k.h...i. .....n.g. .l...i... .<.a.>.K.h...i. .....n.g. .l...i. .n.g.a.y.!.<./.a.>.....l.b.l.S.u.c.c.S.u.b.T.i.t.l.e...C.a.p.t.i.o.n.=.D.r.i.v.e.r. .B.o.o.s.t.e.r. .%.s. ..... .......c. .c...i. .....t. .t.h...n.h. .c...n.g.!. .H...y. .n.h...n. .Q.u...t. .n.g.a.y. ..... .c.h...y. .n...!.....l.b.l.S.u.c.c.T.i.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\Installerupt45212.0208579051.zlb

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:zlib compressed data
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):245978
                                                                                                                                                                                                                            Entropy (8bit):7.964481904117638
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:6144:JwyLQMR31gzKclN6byOqAdXfgD9dqw1oXhhayD4xxrGoB:NEeWN6b7uwXhh3D4x
                                                                                                                                                                                                                            MD5:4A28FA0322B766DFC423A9517B2DF761
                                                                                                                                                                                                                            SHA1:95565F4045934C71703355EA3B117171F6D15E0E
                                                                                                                                                                                                                            SHA-256:E321AD7B18B3542722A75FD6DA0B26D349C1DAA89000E6FCB9F5974422248FAC
                                                                                                                                                                                                                            SHA-512:813A8037E17AAAE4B20251CABD08B34C398D81E80BBB6DFE16A29BC72752024289F066368F7FE6BD4B8C48D201AA70A373E42271FC8C0843E7CB8B60BE699DF9
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:x..W.+Q...g...z'..N...{.n.@..&...%.4.....s.!...M..+v......o...N..............n.......w.~G|!_....O....g_.....LC..........a./..._w{G./..j..|'.{..o-...{._.<........G...u.{....g?..?.........^.w.........w'i.v.._.f.....3v.l_..>...T|?{.....5...].b..../`......66.!....j..v..om.2v...cW=.U.v..}..{..v...+i=...........|._...3..og.i.F....w..........k.+.9.6.I../j...'W...3..5..;..~;.....R...^..0..8>h...K.:..\..I^.:c{W.Y.Zv...}../.}................1I..}...z7j.......?-....}3b..K#.......~:...>.[_.ha.^........2............1.}Z.k..gE...}{e.....O.6V;..`....v..J.+L.E/.f..o.3...]3`sc.}.9w....wN\-eG&.,/.mW.....){7g#Tb...U..E...;..~l...$.D.X..oe./...}.e.R.N..{...>c..v?...d.W..fE..........=0R.......c4.#{.dm.J.Y+.6.....i...^.6i...S....3s4.G.W...Y...I.^..c........p.ju..4..l./.R...n..?b...G.c./}^`.5l...O...}.j.....y.}k....Y.....6...v..>.1/..q;{...o6.{Q.V.......3FzD.l.U..`'.v............o...;nWjp.f..z..|.''.dH.T.k..d.J2.s.V....O..5.B..b,.....zaf..

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\Installerupt45212.0208855671.ini

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with very long lines (24754), with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):517392
                                                                                                                                                                                                                            Entropy (8bit):4.009287980336804
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:12288:DiJ3yChDe4aaaRsfTNGuF681Vx0IfgYXOxMx6:o3841683E
                                                                                                                                                                                                                            MD5:68763B593385282F7E8201983AC53249
                                                                                                                                                                                                                            SHA1:02AFB751BC434F3932AD294974100A8B4D38164C
                                                                                                                                                                                                                            SHA-256:B9A7CF064830D760435E16BE091C5844DBD6F6451D4B97B3A5AD2EF0E80D0E1A
                                                                                                                                                                                                                            SHA-512:EEFA09B15E92E52C99C965664CE09CEF2BB4C8A37E382B5399722070B9B5271EEBC03412177BA330617DB864F1A1734D7CA82E44D09787EA8AB2BADD06CFB4DD
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.M.a.i.n.].....V.e.r.s.i.o.n.=.2.0.2.2.0.3.2.3.1.6.2.3.0.0.............[.O.r.d.e.r.].....W._.o.r.d.e.r.=.i.t.o.p.;.i.s.r.;.i.d.r.;.a.s.c.....A.w._.o.r.d.e.r.=.i.e.d.;.i.d.r.;.a.s.c.;.p.d.f.;.i.u.;.i.s.u.;.i.m.f.;.s.d.;.d.p.m.........S.h.w._.n.e.x.t.=.1.....S.h.w._.n.e.x.t._.d.e.e.p.=.1.....E._.O.r.d.e.r.=.i.T.o.p.;.A.S.C.;.e.b.o.o.k.....S.h.w._.S.t.y.l.e.=.e.J.z.t.n.e.m.u.L.c.d.x.p.e.N.Z./.N.s.N.1.J.h.V.1.f.9.q.f.I.l.G.g.9.B.k.S.R.A.l.C.i.L.d.s.t.v.w.u./.f.e.8.a.2.V.+.9.z.L.O.5.F.U.S.7.J.V.u.D.j.k.O.X.u.o.y.s.q.M.j.F.i.x.Y.s.j./.i.H.+.K.3.8.W.v.4.t./.j.q./.h.z.f.B.N./.i.l.8.+.X.v.m.f.j.5.9.f.x.m./.j.2./.h.j.f.B.0./.y.3.e./.f.X.z.q.u.8.e./.3.8.Y.f.4.t.e.P.v./.4.p./.v.n.x.8.y.+.P.7./.z.h.8.e.r.7.7.z.+.v.8.R.+.P././.7.7.4.9.V.v.H.+./.+./.P.H.O.H.+.q.r.3.z.4.+.9.X.8.f.7.z.z././.h./.R.x.p.z.X.+.k.P.e./.6.v.4.x.e.P./.X.+.f.v.z./.f.b.K.D.H.l.v.+.7.x.+.5.i.f./.M.3.j.3.f./.z.+.P.6.X.f.f.q.X.j.3.f././.L.j.6.l.3.3.2.t.z.n.e.9.z./.Z.R.v.P.4.R.P./.4.Z.B.d.D./.G.d.+.9.s.+.P.E.X.y.d.n./.z.9.4.7.e.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\MalwareCfg.ini

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):336
                                                                                                                                                                                                                            Entropy (8bit):3.4832150897175684
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:6:Q+Yy9U+GjHJ9DKlXtqLDGqv9qCrTyRqI3ulaqT0imlyIeqI3ulaqT0G:Q+YbpjHJRK9oLBvYsTy8RlZT3INRlZTJ
                                                                                                                                                                                                                            MD5:5E226028A0FD9E7E2205709D1948BC0E
                                                                                                                                                                                                                            SHA1:6003B9EBE43F9A573C08B7391F4EC9EC65FC1BE3
                                                                                                                                                                                                                            SHA-256:B3245F81CEA619004A603465CF32FAD64EF67E771884EDDC202C64B207FADC7F
                                                                                                                                                                                                                            SHA-512:936D507689A78E49C280FA0EC3BF604CD0799A391CFFF786F8E0F2D391106C21D2A410AEDAB71468E1275A0EF82973EE9032C855438E287E126170BB0A453E68
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.P._.M.c.A.f.e.e.].....D.i.s.p.l.a.y.N.a.m.e.=.(.(.'.M.c.A.f.e.e.'. .&. .(.'.A.n.t.i.V.i.r.u.s.'. .|. .'.S.e.c.u.r.i.t.y.'. .|. .'.P.r.o.t.e.c.t.i.o.n.'. .|. .'.L.i.v.e.S.a.f.e.'. .|. .'.F.i.r.e.w.a.l.l.'. .|. .'.V.P.N.'.).). .|. .(.'..KQ.'.). .|. .(.'.B.T. .N.e.t.P.r.o.t.e.c.t.'. .|. .'.F.i.r.e.w.a.l.l.'. .|. .'.V.P.N.'.).).....

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\Setup Log 2023-10-13 #001.txt

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmp
                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):1994
                                                                                                                                                                                                                            Entropy (8bit):5.320693282098597
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:48:HDVuXMQqvfFBOBic4MWc8/w2KtlUlEr/Vla4/9sZjjbXaN:j0N7S/aBB0e
                                                                                                                                                                                                                            MD5:239E5FCE8CFFB5C47F3DEFFC3847216B
                                                                                                                                                                                                                            SHA1:44E365662D822232B443B9FC386B95F24D535D3A
                                                                                                                                                                                                                            SHA-256:CD504E550B158A5B7401B1D5BC01C6D7D190C0709EA4F7029E0D03BA6F8B9F88
                                                                                                                                                                                                                            SHA-512:F307DF5894AC3A004DA2E0FDB0AC8CFE4F6CE778A4B37EAA8694C2681BB4C15F4515B99F50AB712BFF2BB39E981E292D2B51217CB37A31367AAA7F3DE908A837
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:.2023-10-13 00:29:48.354 Log opened. (Time zone: UTC+02:00)..2023-10-13 00:29:48.354 Setup version: Inno Setup version 5.5.9 (u)..2023-10-13 00:29:48.354 Original Setup EXE: C:\Users\user\Desktop\driver booster setup.exe..2023-10-13 00:29:48.354 Setup command line: /SL5="$2046E,25039561,139264,C:\Users\user\Desktop\driver booster setup.exe" ..2023-10-13 00:29:48.354 Windows version: 10.0.19045 (NT platform: Yes)..2023-10-13 00:29:48.354 64-bit Windows: Yes..2023-10-13 00:29:48.354 Processor architecture: x64..2023-10-13 00:29:48.354 User privileges: Administrative..2023-10-13 00:29:48.761 64-bit install mode: No..2023-10-13 00:29:48.792 Created temporary directory: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp..2023-10-13 00:29:48.792 Extracting temporary file: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\RdZone.dll..2023-10-13 00:29:50.573 Extracting temporary file: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\Inno_English.lng..2023-10-13 00:29:52.229

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\appver-ac.ini

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            File Type:Generic INItialization configuration [Product_P]
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):851
                                                                                                                                                                                                                            Entropy (8bit):4.841142860694848
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:12:tMEGcL4YnQ2cig2W0wNm1dLCykeW9ZpHbyQGBELMJjj3ELw4xB2ydqFWmG+5LcLr:tAcBz9g2hLDo/9bCaod0cVGqWuE6Std3
                                                                                                                                                                                                                            MD5:288B66460D96797E7F6FE800C0C2890B
                                                                                                                                                                                                                            SHA1:8AD8C9AB0657D28B0BB31E971EDFCA7EEC4C1CB4
                                                                                                                                                                                                                            SHA-256:4C41D4B4DDD00B2F0E400564C98502FB49E3EDC9019CBCF1FE0E3D7C1199AD6A
                                                                                                                                                                                                                            SHA-512:3FF52231C98260D155A6C265F385E25B3EB6216021F46A7AA28234297759903D80F70E3D017DBB6F93CFBECBEB0A26489DBA7D253A4B4207CD5909E6CF711761
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:[appversion]..asc=16.6.0.259..db=10.6.0.141..iu=13.0.0.13..imf=10.4.0.1104..ascu=16.2.0.18..sd=9.0.0.307..iot=4.3.1.1561..isu=6.1.0.10..sm8=6.0.0.2..smgb=5.2.4.643..itop=5.0.0.4785..isr=4.1.0.889..ivb=3.1.0.255..ipb=3.2.0.275..idr=3.6.0.112..dpm=1.4.0.14..pdf=3.5.0.18..ied=2.1.0.38....[Product_P]..Comparadight=1..ActionCenter_Comparadight=2..ASC_version=16.6.0.259..ASCU_version=16.3.0.30..DB_version=11.0.0.21..FP_version=3.0.2.2135..IMF_version=10.4.0.1104..IU_version=13.1.0.3..IOT_version=4.3.1.1561..ISU_version=6.1.0.10..itop_version=5.0.0.4785..vpn_version=4.5.1.4190..IVC_version=1.0.1.2606..SD_version=9.1.0.319..SGB_version=3.1.1.151..SM8_version=6.0.0.2..SMGB_version=5.2.4.643..ISR_version=4.2.0.1086..IVB_version=3.0.0.246..IPB_version=3.2.0.275..IDR_version=4.0.0.475..DPM_version=1.4.0.14..PDF_version=3.5.0.18..IED_version=2.1.0.34..

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmp

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\driver booster setup.exe
                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):1214488
                                                                                                                                                                                                                            Entropy (8bit):6.438087745093695
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:24576:YtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5t5Tx9Bc:oqTytRFk6ek1BM
                                                                                                                                                                                                                            MD5:68B52A0B8E3D45BF3B520A0E7F16DAD1
                                                                                                                                                                                                                            SHA1:E50408326EAFB5CA8ADC70DB29C33B64E25BBBBD
                                                                                                                                                                                                                            SHA-256:B409D6D6F8896DC2AFD1774479C741CA253C0E9B4732DAAA08AF84AA9C96888B
                                                                                                                                                                                                                            SHA-512:B8E0B486E2B9652831EB8EFE48CF9575EEF49204E827A64D69AE7C9C30304B2D98A66C28F1072FE8596847C15F13BBF7EC39D7708684FF64051BBAE7ED063FAF
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Joe Sandbox View:
                                                                                                                                                                                                                            • Filename: driver_booster_setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: kK8Eaw8zsl.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: 42E07EA0F43BEC6913D6AC78FF74536695AE273CD28DB.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: driver_booster_setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W.....................H......l........ ....@..................................?....@......@..............................@8...0..@............F...B................................... .......................................................text............................... ..`.itext.............................. ..`.data...h0... ...2..................@....bss.....a...`.......0...................idata..@8.......:...0..............@....tls....<............j...................rdata....... .......j..............@..@.rsrc...@....0.......l..............@..@....................................@..@........................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\EULA.rtf

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmp
                                                                                                                                                                                                                            File Type:Rich Text Format data, version 1, ANSI, code page 936, default language ID 1033
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):28929
                                                                                                                                                                                                                            Entropy (8bit):4.958889426409976
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:768:iR+/X/Dgt2fqfXV0P6pKs06PVxz0dYNvac/CowBqK1t27eE8BK:iRODdfO08xz0dYNvtqzqK1U7eJK
                                                                                                                                                                                                                            MD5:B0381F0BA7EAD83EA3BD882C1DE4CD48
                                                                                                                                                                                                                            SHA1:C740F811623061595D76FCE2EBB4E69D34316F3B
                                                                                                                                                                                                                            SHA-256:44BC9472169403484A0D384F1CA81989EF7E4B07441758E8A0110078933CBCB5
                                                                                                                                                                                                                            SHA-512:6CFB8BC562D22843D043411720DB97D0B4CBAC96A20983D83D19E59B8428EC202F2532CC5AF254438DC34FCA4161ABBD3F6BAC8D397590E41B6D41E60700E78A
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:{\rtf1\ansi\ansicpg936\deff0\nouicompat\deflang1033\deflangfe2052{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\fnil\fprq2\fcharset134 \'cb\'ce\'cc\'e5;}}..{\colortbl ;\red34\green34\blue34;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17134}{\info{\horzdoc}{\*\lchars (?[\'7b}{\*\fchars !),.:\'3b?D]\'7d}}..{\*\mmathPr\mdispDef1\mwrapIndent1440 }\viewkind4\uc1 ..\pard\nowidctlpar\cf1\kerning2\f0\fs24\par....\pard\nowidctlpar\sa240\qc\cf0\b\fs20 DRIVER BOOSTER END USER LICENSE AGREEMENT\par....\pard\nowidctlpar\sa240\qj\b0 PLEASE READ THIS AGREEMENT CAREFULLY BEFORE CONTINUING WITH THE DOWNLOAD AND INSTALLATION OF THE SOFTWARE PROGRAM IDENTIFIED ABOVE AND ANY ASSOCIATED SOFTWARE COMPONENTS, MEDIA, PRINTED MATERIALS OR OTHER RELATED ELECTRONIC DOCUMENTATION (COLLECTIVELY, THE \ldblquote PRODUCT\rdblquote ). TO COMPLETE YOUR ORDER FOR THE PRODUCT YOU\rquote VE REQUESTED, YOU MUST FIRST ACCEPT THE TERMS AND CONDITIONS OF THIS AGREEMENT. \caps By doing so, or otherwise inst

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\libcrypto-1_1.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmp
                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):1736280
                                                                                                                                                                                                                            Entropy (8bit):7.034753943913826
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:49152:p7Nc3UvQ/qpyr0khPsFCMsTPcOcuU1CPwDv3uF0jaA5ElVe:p7NtvQ/qpyr0khU8MOcB1CPwDv3uF0jn
                                                                                                                                                                                                                            MD5:8A6759650B50F7B2CF3D067F4FADA0E2
                                                                                                                                                                                                                            SHA1:ECD73AB3608AC1BADBDF8B5A63839327151BFA78
                                                                                                                                                                                                                            SHA-256:F546870C1CA7BD3E1EE2620CD315A8B5436403FA2B3994CE4C62D5C54BF3CFD9
                                                                                                                                                                                                                            SHA-512:03C4B9AA44B6970D859047043536536873C2BBD2DE144B237FF28ACF457DAEDB073F6BD714E5D777A47EC2C6A24A93DEB607DDD4BF7C03B896FFB16A2BD6A95A
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Joe Sandbox View:
                                                                                                                                                                                                                            • Filename: kK8Eaw8zsl.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: Driver.Booster.10.2.0.110.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: Driver.Booster.10.2.0.110.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: cdPUKIldlM.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: cdPUKIldlM.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: 5YB5dKZ1Ow.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............t...t...t.......t.......t.......t.r=....t...u.?.t...t...t......t......t.......t......t.Rich..t.........................PE..L.....X...........!................K....................................................@.........................`S..:....%..d....................8..XF...........................................L..@............... ............................text............................... ..`.rdata...P.......R..................@..@.data...(....@...\..."..............@....rsrc................~..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\libssl-1_1.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmp
                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):363104
                                                                                                                                                                                                                            Entropy (8bit):6.5328573889662165
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:6144:8r/EgJhmcR8XEeQHSjQ3B9ctiQl0YiwQwOazjVHrztI86pgz87+T03M6bvP/I8Kn:I/ECmceXEeQHSjQ3B9ctiq0YiwQnazj1
                                                                                                                                                                                                                            MD5:34F05CACF5BA6C1C4A238CA633B3605E
                                                                                                                                                                                                                            SHA1:8BA972F24D500B03F0A74EA356AA2743F8F68312
                                                                                                                                                                                                                            SHA-256:8942690BB7C79F35AD142C65F7480E9E6AA78D2447220E9BEFA4BCC1E876D32F
                                                                                                                                                                                                                            SHA-512:CB758ACC2D48873A67D5DB1F3B92D462C84D11134B5C5AECFD6CA29095DBE59DFC6516D9A70BEC64271FA1AB14C6811DE2196BC81319B7D9227C46EDAA4DE7BA
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Joe Sandbox View:
                                                                                                                                                                                                                            • Filename: kK8Eaw8zsl.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: Driver.Booster.10.2.0.110.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: Driver.Booster.10.2.0.110.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: cdPUKIldlM.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: cdPUKIldlM.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: 5YB5dKZ1Ow.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........oJ..<J..<J..<..2<H..<G..<P..<G.&<^..<G..<"..<7.$<I..<J..<...<7..<m..<7.%<K..<G."<K..<7.'<K..<RichJ..<................PE..L.....X...........!................/.....................................................@..........................x...2......<....P...............D..`F...`..|0...................................u..@............................................text...r........................... ..`.rdata...(.......*..................@..@.data....b.......D..................@....rsrc........P......................@..@.reloc..|0...`...2..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmp
                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):6075480
                                                                                                                                                                                                                            Entropy (8bit):6.802031220359766
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:98304:qgiatH9MPwmEEJZ59U7BohO9o6QseyRBRCS/Hy:XiqFE/5aihOhQseyRN/Hy
                                                                                                                                                                                                                            MD5:6233816372E39E2E2D22787A649D0187
                                                                                                                                                                                                                            SHA1:7A057D66B0F64C9C5DF3B05B4DE72C3939BA2A99
                                                                                                                                                                                                                            SHA-256:B69DED867D718086795FE5FF3E7910704BBFA40316DF9756BD3364C9729CD74F
                                                                                                                                                                                                                            SHA-512:3CA2E9C5F0B14B85C6E455016B198426EF57065EEAC8325D22CAF28D74005B7503F7CD7F3840B21511FA2B780D50541A19D4AA4C0C538F4CC0C981CE1B54C0B3
                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                            Yara Hits:
                                                                                                                                                                                                                            • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe, Author: Joe Security
                                                                                                                                                                                                                            Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...h..b..................3...(......3.......3...@..........................Pd.......\..........@...................`>.R.....>.$L....A..."..........n\.XF....>...............................>.......................>..............................text....~3.......3................. ..`.itext...(....3..*....3............. ..`.data...<.....3.......3.............@....bss.........6......j6..................idata..$L....>..N...j6.............@....edata..R....`>.......6.............@..@.tls....T....p>.......6..................rdata........>.......6.............@..@.reloc........>.......6.............@..B.rsrc....."...A..."...9.............@..@.............Pd......n\.............@..@........................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\DBInstaller.exe

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmp
                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):6075480
                                                                                                                                                                                                                            Entropy (8bit):6.802031220359766
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:98304:qgiatH9MPwmEEJZ59U7BohO9o6QseyRBRCS/Hy:XiqFE/5aihOhQseyRN/Hy
                                                                                                                                                                                                                            MD5:6233816372E39E2E2D22787A649D0187
                                                                                                                                                                                                                            SHA1:7A057D66B0F64C9C5DF3B05B4DE72C3939BA2A99
                                                                                                                                                                                                                            SHA-256:B69DED867D718086795FE5FF3E7910704BBFA40316DF9756BD3364C9729CD74F
                                                                                                                                                                                                                            SHA-512:3CA2E9C5F0B14B85C6E455016B198426EF57065EEAC8325D22CAF28D74005B7503F7CD7F3840B21511FA2B780D50541A19D4AA4C0C538F4CC0C981CE1B54C0B3
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Yara Hits:
                                                                                                                                                                                                                            • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\DBInstaller.exe, Author: Joe Security
                                                                                                                                                                                                                            Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...h..b..................3...(......3.......3...@..........................Pd.......\..........@...................`>.R.....>.$L....A..."..........n\.XF....>...............................>.......................>..............................text....~3.......3................. ..`.itext...(....3..*....3............. ..`.data...<.....3.......3.............@....bss.........6......j6..................idata..$L....>..N...j6.............@....edata..R....`>.......6.............@..@.tls....T....p>.......6..................rdata........>.......6.............@..@.reloc........>.......6.............@..B.rsrc....."...A..."...9.............@..@.............Pd......n\.............@..@........................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\DriverBooster.exe

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmp
                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):8662112
                                                                                                                                                                                                                            Entropy (8bit):6.992204809201161
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:98304:qDV1fCBZ0JnqqNwbNFIdSpjh9NYxC06kqnXjcIvLGeSXZyR:01KinqqNwZ2SpCxr6kezcIT95
                                                                                                                                                                                                                            MD5:0DABD43B4102239F14958E7398BE16BA
                                                                                                                                                                                                                            SHA1:CABAEC0C5660B13331B955B08ACBD9BAF4E787F6
                                                                                                                                                                                                                            SHA-256:2454CA1CC2E1618C6685B3CD7769828FA981722AD469B75010B7E821CD7C5510
                                                                                                                                                                                                                            SHA-512:BFBF2CA259C3099F6818D638582AA09C55FEF2ECC9B86E85B1FFB96F6DE458533D462912084FF0902D39CA79BFE31FD4C82636CE5CDFD357D27A190C75275D5E
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L..._..b..................=..:F.....|.=.......=...@..........................p.......2...........@............................C.l.....E..A............`F....................................E.....................\.C..*...........................text....}=......~=................. ..`.itext...(....=..*....=............. ..`.data........=.......=.............@....bss....`8...`@......@@..................idata..l.....C......@@.............@....tls..........E......FB..................rdata........E......FB.............@..@.rsrc....A...E...A..HB.............@..@....................H..............@..@........................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\EULA.rtf

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmp
                                                                                                                                                                                                                            File Type:Rich Text Format data, version 1, ANSI, code page 936, default language ID 1033
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):28929
                                                                                                                                                                                                                            Entropy (8bit):4.958889426409976
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:768:iR+/X/Dgt2fqfXV0P6pKs06PVxz0dYNvac/CowBqK1t27eE8BK:iRODdfO08xz0dYNvtqzqK1U7eJK
                                                                                                                                                                                                                            MD5:B0381F0BA7EAD83EA3BD882C1DE4CD48
                                                                                                                                                                                                                            SHA1:C740F811623061595D76FCE2EBB4E69D34316F3B
                                                                                                                                                                                                                            SHA-256:44BC9472169403484A0D384F1CA81989EF7E4B07441758E8A0110078933CBCB5
                                                                                                                                                                                                                            SHA-512:6CFB8BC562D22843D043411720DB97D0B4CBAC96A20983D83D19E59B8428EC202F2532CC5AF254438DC34FCA4161ABBD3F6BAC8D397590E41B6D41E60700E78A
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:{\rtf1\ansi\ansicpg936\deff0\nouicompat\deflang1033\deflangfe2052{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\fnil\fprq2\fcharset134 \'cb\'ce\'cc\'e5;}}..{\colortbl ;\red34\green34\blue34;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17134}{\info{\horzdoc}{\*\lchars (?[\'7b}{\*\fchars !),.:\'3b?D]\'7d}}..{\*\mmathPr\mdispDef1\mwrapIndent1440 }\viewkind4\uc1 ..\pard\nowidctlpar\cf1\kerning2\f0\fs24\par....\pard\nowidctlpar\sa240\qc\cf0\b\fs20 DRIVER BOOSTER END USER LICENSE AGREEMENT\par....\pard\nowidctlpar\sa240\qj\b0 PLEASE READ THIS AGREEMENT CAREFULLY BEFORE CONTINUING WITH THE DOWNLOAD AND INSTALLATION OF THE SOFTWARE PROGRAM IDENTIFIED ABOVE AND ANY ASSOCIATED SOFTWARE COMPONENTS, MEDIA, PRINTED MATERIALS OR OTHER RELATED ELECTRONIC DOCUMENTATION (COLLECTIVELY, THE \ldblquote PRODUCT\rdblquote ). TO COMPLETE YOUR ORDER FOR THE PRODUCT YOU\rquote VE REQUESTED, YOU MUST FIRST ACCEPT THE TERMS AND CONDITIONS OF THIS AGREEMENT. \caps By doing so, or otherwise inst

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\Icon_1.bmp

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmp
                                                                                                                                                                                                                            File Type:PC bitmap, Windows 3.x format, 48 x 48 x 24, image size 6912, resolution 3780 x 3780 px/m, cbSize 6966, bits offset 54
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):6966
                                                                                                                                                                                                                            Entropy (8bit):2.874657099356725
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:24:Or62PgH7ucaKhtmN2MbXpzWtKy4o5RRzfqwxNj9Z2S6CtAKgTCut:oP41a/lb5zWtKy4oVC/KET
                                                                                                                                                                                                                            MD5:7651F72266FA440C50C08309021DB68F
                                                                                                                                                                                                                            SHA1:B5D06853764AA87AEC1355D514F77AE4AA1C56BB
                                                                                                                                                                                                                            SHA-256:652F8E7B89CC7823F11F5515BE2B07B370DC9760F324EAD2D5A2B4E05ADFDF0D
                                                                                                                                                                                                                            SHA-512:46B17F666AC30409937A7CB39D4239447FB83528728CFA5A8FC32AB213A6E87292B319BC54EE6CF86C81FD096F1F8EF0D18090D515C9DB434744CE7819234970
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:BM6.......6...(...0...0............................... )))444777777777777777777777777777777777777777777777777777777777777777777777777777777777///$$$ %%%RRR.............................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\Inno_English.lng

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmp
                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):8996
                                                                                                                                                                                                                            Entropy (8bit):3.4905909122949415
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:iqmQj8laakkwGasGamaEMaNaNavaYaPaYapaYa5MMaYaqMaYayajaMMaNa/a/aLA:iqmQYYmcs7bExQQyFSF0F5MxFqxFveMH
                                                                                                                                                                                                                            MD5:4014E584F7EB5936A6D2B8B75ADE700F
                                                                                                                                                                                                                            SHA1:4A4B6017C27727AADB8E3726805CDFAB11E97FB1
                                                                                                                                                                                                                            SHA-256:5ACF921D2B7D33D5FC9AB02569BE5F46B5F3CF8656BF1C245F2F61F55529BB3B
                                                                                                                                                                                                                            SHA-512:F9B8B8CA6C2E52BB8AA29C1D313874F5F66672838530D2D6F8075EC4C53132A5B195ADE82105F831E4151CE317F174BA27026800AB4C6C8F67521A3C0EEA1693
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..[.I.n.n.o._.F.r.e.e.w.a.r.e.D.o.w.n.l.o.a.d.e.r.].....M._.N.e.t.E.r.r.o.r.=.T.h.e. .I.n.t.e.r.n.e.t. .c.o.n.n.e.c.t.i.o.n. .h.a.s. .t.i.m.e.d. .o.u.t... .P.l.e.a.s.e. .t.r.y. .a.g.a.i.n. .l.a.t.e.r.......M._.D.o.w.n.l.o.a.d.A.g.a.i.n.=.T.h.e. .s.e.t.u.p. .f.i.l.e.s. .a.r.e. .n.o.t. .d.o.w.n.l.o.a.d.e.d. .c.o.m.p.l.e.t.e.l.y. .d.u.e. .t.o. .n.e.t.w.o.r.k. .t.r.a.f.f.i.c... .D.o. .y.o.u. .w.a.n.t. .t.o. .d.o.w.n.l.o.a.d. .a.g.a.i.n.?.....M._.T.r.y.I.t.L.a.t.e.r.=.G.e.t.t.i.n.g. .d.o.w.n.l.o.a.d. .i.n.f.o.r.m.a.t.i.o.n. .f.a.i.l.e.d.,. .p.l.e.a.s.e. .t.r.y. .a.g.a.i.n. .l.a.t.e.r.......M._.I.n.s.t.a.l.l.F.i.n.i.s.h.e.d.=.%.s. .i.n.s.t.a.l.l.a.t.i.o.n. .f.i.n.i.s.h.e.d.......M._.D.o.w.n.l.o.a.d.F.a.i.l.e.d.=.%.s. .d.o.w.n.l.o.a.d. .f.a.i.l.e.d.......M._.S.u.r.e.C.a.n.c.e.l.A.l.l.=.A.r.e. .y.o.u. .s.u.r.e. .y.o.u. .w.a.n.t. .t.o. .c.a.n.c.e.l. .a.l.l. .d.o.w.n.l.o.a.d. .t.a.s.k.s.?.....M._.H.a.v.e.I.n.s.t.a.l.l.A.l.l.=.Y.o.u. .h.a.v.e. .a.l.r.e.a.d.y. .i.n.s.t.a.l.l.e.d. .a.l.l. .t.h.e.s.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\RdZone.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmp
                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):163328
                                                                                                                                                                                                                            Entropy (8bit):6.127667524027538
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3072:acOnBokHp4IPlte0vmFNoakg8KicRdb3sA888888888888W88888888888H:acO/HNtZ/LcnTZ888888888888W8888E
                                                                                                                                                                                                                            MD5:F8A1EF0E765FDD04668C96AEB9E27EF3
                                                                                                                                                                                                                            SHA1:57ADC35A38E4D7A57588A0BD09024BD0C1072D95
                                                                                                                                                                                                                            SHA-256:EAC93CA567A74199DACB8063907360FEAD16440278F224B5A42645DBF7D3369E
                                                                                                                                                                                                                            SHA-512:B0F24037343003A8189AA424FC1FFB8C24C3C061F5DB52026784CAF0F816576BE310E9ED808951C4CFCF397CD3F4C43A93138BCC72AE81A9EEAC0984B28D9F6C
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......P.........................................@.................................4................................0....... .......`.......................@..\...................................................."...............................text............................... ..`.itext.............................. ..`.data...4...........................@....bss....tN...............................idata....... ......................@....edata.......0......................@..@.reloc..\....@... ..................@..B.rsrc........`......................@..@.....................~..............@..@........................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\_isetup\_setup64.tmp

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmp
                                                                                                                                                                                                                            File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):6144
                                                                                                                                                                                                                            Entropy (8bit):4.720366600008286
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
                                                                                                                                                                                                                            MD5:E4211D6D009757C078A9FAC7FF4F03D4
                                                                                                                                                                                                                            SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                                                                                                                                                                                                                            SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                                                                                                                                                                                                                            SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\libcrypto-1_1.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmp
                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):1736280
                                                                                                                                                                                                                            Entropy (8bit):7.034753943913826
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:49152:p7Nc3UvQ/qpyr0khPsFCMsTPcOcuU1CPwDv3uF0jaA5ElVe:p7NtvQ/qpyr0khU8MOcB1CPwDv3uF0jn
                                                                                                                                                                                                                            MD5:8A6759650B50F7B2CF3D067F4FADA0E2
                                                                                                                                                                                                                            SHA1:ECD73AB3608AC1BADBDF8B5A63839327151BFA78
                                                                                                                                                                                                                            SHA-256:F546870C1CA7BD3E1EE2620CD315A8B5436403FA2B3994CE4C62D5C54BF3CFD9
                                                                                                                                                                                                                            SHA-512:03C4B9AA44B6970D859047043536536873C2BBD2DE144B237FF28ACF457DAEDB073F6BD714E5D777A47EC2C6A24A93DEB607DDD4BF7C03B896FFB16A2BD6A95A
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............t...t...t.......t.......t.......t.r=....t...u.?.t...t...t......t......t.......t......t.Rich..t.........................PE..L.....X...........!................K....................................................@.........................`S..:....%..d....................8..XF...........................................L..@............... ............................text............................... ..`.rdata...P.......R..................@..@.data...(....@...\..."..............@....rsrc................~..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp\libssl-1_1.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmp
                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):363104
                                                                                                                                                                                                                            Entropy (8bit):6.5328573889662165
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:6144:8r/EgJhmcR8XEeQHSjQ3B9ctiQl0YiwQwOazjVHrztI86pgz87+T03M6bvP/I8Kn:I/ECmceXEeQHSjQ3B9ctiq0YiwQnazj1
                                                                                                                                                                                                                            MD5:34F05CACF5BA6C1C4A238CA633B3605E
                                                                                                                                                                                                                            SHA1:8BA972F24D500B03F0A74EA356AA2743F8F68312
                                                                                                                                                                                                                            SHA-256:8942690BB7C79F35AD142C65F7480E9E6AA78D2447220E9BEFA4BCC1E876D32F
                                                                                                                                                                                                                            SHA-512:CB758ACC2D48873A67D5DB1F3B92D462C84D11134B5C5AECFD6CA29095DBE59DFC6516D9A70BEC64271FA1AB14C6811DE2196BC81319B7D9227C46EDAA4DE7BA
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........oJ..<J..<J..<..2<H..<G..<P..<G.&<^..<G..<"..<7.$<I..<J..<...<7..<m..<7.%<K..<G."<K..<7.'<K..<RichJ..<................PE..L.....X...........!................/.....................................................@..........................x...2......<....P...............D..`F...`..|0...................................u..@............................................text...r........................... ..`.rdata...(.......*..................@..@.data....b.......D..................@....rsrc........P......................@..@.reloc..|0...`...2..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            Static File Info

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                            Entropy (8bit):7.999555000014516
                                                                                                                                                                                                                            TrID:
                                                                                                                                                                                                                            • Win32 Executable (generic) a (10002005/4) 99.94%
                                                                                                                                                                                                                            • Win16/32 Executable Delphi generic (2074/23) 0.02%
                                                                                                                                                                                                                            • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                            • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                            File name:driver booster setup.exe
                                                                                                                                                                                                                            File size:25'763'240 bytes
                                                                                                                                                                                                                            MD5:d242a796ebc0219dc52b49b8f1d1af7a
                                                                                                                                                                                                                            SHA1:e1997d7f4561448f5a4eb67cc24613995eba176b
                                                                                                                                                                                                                            SHA256:dbde0fa5a6d41fb2fe920003b08fc9c46e7fc6f744e4781d41d4e69aec8388a2
                                                                                                                                                                                                                            SHA512:03a2316181eca7409a92a193eb9433bda477172df8cebfb2209bd2fe0e22e4f195f33908b6a03706fb1adf2326c2e79b3c68e9721ba258b3ec2607864675399b
                                                                                                                                                                                                                            SSDEEP:393216:kPYa1RFe9qJ1F6zLBYLOduoN4vnblXusa8HkNPsFY1Rn2eq3c3qKicETQNVSzuSV:TczeEUBg4z4vJe4UPseRn2edqKicP0P
                                                                                                                                                                                                                            TLSH:414733C4B3973033E171487161F2AB911C5A9CF72EF2A59B5E3CE60E16B428A8D3159F
                                                                                                                                                                                                                            File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

                                                                                                                                                                                                                            File Icon

                                                                                                                                                                                                                            Icon Hash:02546581b1b1f069

                                                                                                                                                                                                                            Static PE Info

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Entrypoint:0x4117dc
                                                                                                                                                                                                                            Entrypoint Section:.itext
                                                                                                                                                                                                                            Digitally signed:true
                                                                                                                                                                                                                            Imagebase:0x400000
                                                                                                                                                                                                                            Subsystem:windows gui
                                                                                                                                                                                                                            Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                                                                                                                                                                                                                            DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                            Time Stamp:0x57051F88 [Wed Apr 6 14:39:04 2016 UTC]
                                                                                                                                                                                                                            TLS Callbacks:
                                                                                                                                                                                                                            CLR (.Net) Version:
                                                                                                                                                                                                                            OS Version Major:5
                                                                                                                                                                                                                            OS Version Minor:0
                                                                                                                                                                                                                            File Version Major:5
                                                                                                                                                                                                                            File Version Minor:0
                                                                                                                                                                                                                            Subsystem Version Major:5
                                                                                                                                                                                                                            Subsystem Version Minor:0
                                                                                                                                                                                                                            Import Hash:20dd26497880c05caed9305b3c8b9109

                                                                                                                                                                                                                            Authenticode Signature

                                                                                                                                                                                                                            Signature Valid:true
                                                                                                                                                                                                                            Signature Issuer:CN=Sectigo RSA Code Signing CA, O=Sectigo Limited, L=Salford, S=Greater Manchester, C=GB
                                                                                                                                                                                                                            Signature Validation Error:The operation completed successfully
                                                                                                                                                                                                                            Error Number:0
                                                                                                                                                                                                                            Not Before, Not After
                                                                                                                                                                                                                            • 25/03/2021 00:00:00 24/03/2024 23:59:59
                                                                                                                                                                                                                            Subject Chain
                                                                                                                                                                                                                            • CN="IObit CO., LTD", O="IObit CO., LTD", STREET=45 Renmin South Road, STREET="No. 605, 6th Floor, Unit 1, Building 1", L=Chengdu Shi, S=Sichuan Sheng, PostalCode=610042, C=CN
                                                                                                                                                                                                                            Version:3
                                                                                                                                                                                                                            Thumbprint MD5:8AD2A09EBDD6E8444414E1FFE7FC9683
                                                                                                                                                                                                                            Thumbprint SHA-1:145D90AD3134C665246DC1C93CD3E2D8C69E9231
                                                                                                                                                                                                                            Thumbprint SHA-256:12DBEE7AA5DBB550CEEDC6172E5C34BA577759D8926AAFF08A781552B7FABDE9
                                                                                                                                                                                                                            Serial:008BA1F172FD50BA8D4C11B74FFAC8A282
                                                                                                                                                                                                                            Instruction
                                                                                                                                                                                                                            push ebp
                                                                                                                                                                                                                            mov ebp, esp
                                                                                                                                                                                                                            add esp, FFFFFFA4h
                                                                                                                                                                                                                            push ebx
                                                                                                                                                                                                                            push esi
                                                                                                                                                                                                                            push edi
                                                                                                                                                                                                                            xor eax, eax
                                                                                                                                                                                                                            mov dword ptr [ebp-3Ch], eax
                                                                                                                                                                                                                            mov dword ptr [ebp-40h], eax
                                                                                                                                                                                                                            mov dword ptr [ebp-5Ch], eax
                                                                                                                                                                                                                            mov dword ptr [ebp-30h], eax
                                                                                                                                                                                                                            mov dword ptr [ebp-38h], eax
                                                                                                                                                                                                                            mov dword ptr [ebp-34h], eax
                                                                                                                                                                                                                            mov dword ptr [ebp-2Ch], eax
                                                                                                                                                                                                                            mov dword ptr [ebp-28h], eax
                                                                                                                                                                                                                            mov dword ptr [ebp-14h], eax
                                                                                                                                                                                                                            mov eax, 00410144h
                                                                                                                                                                                                                            call 00007FDB8109CFADh
                                                                                                                                                                                                                            xor eax, eax
                                                                                                                                                                                                                            push ebp
                                                                                                                                                                                                                            push 00411EBEh
                                                                                                                                                                                                                            push dword ptr fs:[eax]
                                                                                                                                                                                                                            mov dword ptr fs:[eax], esp
                                                                                                                                                                                                                            xor edx, edx
                                                                                                                                                                                                                            push ebp
                                                                                                                                                                                                                            push 00411E7Ah
                                                                                                                                                                                                                            push dword ptr fs:[edx]
                                                                                                                                                                                                                            mov dword ptr fs:[edx], esp
                                                                                                                                                                                                                            mov eax, dword ptr [00415B48h]
                                                                                                                                                                                                                            call 00007FDB810A56F3h
                                                                                                                                                                                                                            call 00007FDB810A5242h
                                                                                                                                                                                                                            cmp byte ptr [00412ADCh], 00000000h
                                                                                                                                                                                                                            je 00007FDB810A81EEh
                                                                                                                                                                                                                            call 00007FDB810A5808h
                                                                                                                                                                                                                            xor eax, eax
                                                                                                                                                                                                                            call 00007FDB8109B045h
                                                                                                                                                                                                                            lea edx, dword ptr [ebp-14h]
                                                                                                                                                                                                                            xor eax, eax
                                                                                                                                                                                                                            call 00007FDB810A228Bh
                                                                                                                                                                                                                            mov edx, dword ptr [ebp-14h]
                                                                                                                                                                                                                            mov eax, 00418658h
                                                                                                                                                                                                                            call 00007FDB8109B61Ah
                                                                                                                                                                                                                            push 00000002h
                                                                                                                                                                                                                            push 00000000h
                                                                                                                                                                                                                            push 00000001h
                                                                                                                                                                                                                            mov ecx, dword ptr [00418658h]
                                                                                                                                                                                                                            mov dl, 01h
                                                                                                                                                                                                                            mov eax, dword ptr [0040C04Ch]
                                                                                                                                                                                                                            call 00007FDB810A2BA2h
                                                                                                                                                                                                                            mov dword ptr [0041865Ch], eax
                                                                                                                                                                                                                            xor edx, edx
                                                                                                                                                                                                                            push ebp
                                                                                                                                                                                                                            push 00411E26h
                                                                                                                                                                                                                            push dword ptr fs:[edx]
                                                                                                                                                                                                                            mov dword ptr fs:[edx], esp
                                                                                                                                                                                                                            call 00007FDB810A5766h
                                                                                                                                                                                                                            mov dword ptr [00418664h], eax
                                                                                                                                                                                                                            mov eax, dword ptr [00418664h]
                                                                                                                                                                                                                            cmp dword ptr [eax+0Ch], 01h
                                                                                                                                                                                                                            jne 00007FDB810A822Ah
                                                                                                                                                                                                                            NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x190000xe04.idata
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x1c0000xf648.rsrc
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x188d7500x4658
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_TLS0x1b0000x18.rdata
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IAT0x193040x214.idata
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                            Sections

                                                                                                                                                                                                                            NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                            .text0x10000xf2440xf400False0.5481717469262295data6.3752135040515485IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                            .itext0x110000xf640x1000False0.55859375data5.732200666157372IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                            .data0x120000xc880xe00False0.2533482142857143data2.2967209087898324IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                            .bss0x130000x56bc0x0False0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                            .idata0x190000xe040x1000False0.321533203125data4.597812557707959IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                            .tls0x1a0000x80x0False0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                            .rdata0x1b0000x180x200False0.05078125data0.2044881574398449IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                            .rsrc0x1c0000xf6480xf800False0.3435767389112903data5.2407304254498515IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                            NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                            RT_ICON0x1c47c0xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishUnited States0.6633795309168443
                                                                                                                                                                                                                            RT_ICON0x1d3240x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishUnited States0.8199458483754513
                                                                                                                                                                                                                            RT_ICON0x1dbcc0x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishUnited States0.5859826589595376
                                                                                                                                                                                                                            RT_ICON0x1e1340x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States0.5922199170124481
                                                                                                                                                                                                                            RT_ICON0x206dc0x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.7772045028142589
                                                                                                                                                                                                                            RT_ICON0x217840x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.7198581560283688
                                                                                                                                                                                                                            RT_STRING0x21bec0x68data0.6538461538461539
                                                                                                                                                                                                                            RT_STRING0x21c540xd4data0.5283018867924528
                                                                                                                                                                                                                            RT_STRING0x21d280xa4data0.6524390243902439
                                                                                                                                                                                                                            RT_STRING0x21dcc0x2acdata0.45614035087719296
                                                                                                                                                                                                                            RT_STRING0x220780x34cdata0.4218009478672986
                                                                                                                                                                                                                            RT_STRING0x223c40x294data0.4106060606060606
                                                                                                                                                                                                                            RT_RCDATA0x226580x82e8dataEnglishUnited States0.11261637622344235
                                                                                                                                                                                                                            RT_RCDATA0x2a9400x10data1.5
                                                                                                                                                                                                                            RT_RCDATA0x2a9500x150data0.8392857142857143
                                                                                                                                                                                                                            RT_RCDATA0x2aaa00x2cdata1.2045454545454546
                                                                                                                                                                                                                            RT_GROUP_ICON0x2aacc0x5adataEnglishUnited States0.7
                                                                                                                                                                                                                            RT_VERSION0x2ab280x4f4dataEnglishUnited States0.2973186119873817
                                                                                                                                                                                                                            RT_MANIFEST0x2b01c0x62cXML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.4240506329113924
                                                                                                                                                                                                                            DLLImport
                                                                                                                                                                                                                            oleaut32.dllSysFreeString, SysReAllocStringLen, SysAllocStringLen
                                                                                                                                                                                                                            advapi32.dllRegQueryValueExW, RegOpenKeyExW, RegCloseKey
                                                                                                                                                                                                                            user32.dllGetKeyboardType, LoadStringW, MessageBoxA, CharNextW
                                                                                                                                                                                                                            kernel32.dllGetACP, Sleep, VirtualFree, VirtualAlloc, GetSystemInfo, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenW, lstrcpynW, LoadLibraryExW, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetCommandLineW, FreeLibrary, FindFirstFileW, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle, CloseHandle
                                                                                                                                                                                                                            kernel32.dllTlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleW
                                                                                                                                                                                                                            user32.dllCreateWindowExW, TranslateMessage, SetWindowLongW, PeekMessageW, MsgWaitForMultipleObjects, MessageBoxW, LoadStringW, GetSystemMetrics, ExitWindowsEx, DispatchMessageW, DestroyWindow, CharUpperBuffW, CallWindowProcW
                                                                                                                                                                                                                            kernel32.dllWriteFile, WideCharToMultiByte, WaitForSingleObject, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, SizeofResource, SignalObjectAndWait, SetLastError, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, RemoveDirectoryW, ReadFile, MultiByteToWideChar, LockResource, LoadResource, LoadLibraryW, GetWindowsDirectoryW, GetVersionExW, GetVersion, GetUserDefaultLangID, GetThreadLocale, GetSystemInfo, GetSystemDirectoryW, GetStdHandle, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetLastError, GetFullPathNameW, GetFileSize, GetFileAttributesW, GetExitCodeProcess, GetEnvironmentVariableW, GetDiskFreeSpaceW, GetCurrentProcess, GetCommandLineW, GetCPInfo, InterlockedExchange, InterlockedCompareExchange, FreeLibrary, FormatMessageW, FindResourceW, EnumCalendarInfoW, DeleteFileW, CreateProcessW, CreateFileW, CreateEventW, CreateDirectoryW, CloseHandle
                                                                                                                                                                                                                            advapi32.dllRegQueryValueExW, RegOpenKeyExW, RegCloseKey, OpenProcessToken, LookupPrivilegeValueW
                                                                                                                                                                                                                            comctl32.dllInitCommonControls
                                                                                                                                                                                                                            kernel32.dllSleep
                                                                                                                                                                                                                            advapi32.dllAdjustTokenPrivileges

                                                                                                                                                                                                                            Possible Origin

                                                                                                                                                                                                                            Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                            EnglishUnited States

                                                                                                                                                                                                                            Network Behavior

                                                                                                                                                                                                                            Download Network PCAP: filtered – full

                                                                                                                                                                                                                            Network Port Distribution

                                                                                                                                                                                                                            • Total Packets: 199
                                                                                                                                                                                                                            • • 80 (HTTP)
                                                                                                                                                                                                                            • • 53 (DNS)
                                                                                                                                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                            Oct 13, 2023 00:30:03.437117100 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:03.598671913 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:03.598973036 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.581084013 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.742301941 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.743108034 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.743149042 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.743191957 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.743235111 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.743328094 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.743365049 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.743396044 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.743442059 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.743478060 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.743544102 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.743630886 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.743668079 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.743777990 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.743824959 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.743863106 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.746845961 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.746934891 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.746974945 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.750602961 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.750653982 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.750694036 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.754467010 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.754507065 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.754549980 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.756150007 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.756196976 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.758151054 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.758205891 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.758235931 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.758272886 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.761946917 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.761997938 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.762026072 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.762059927 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.765746117 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.765784025 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.765804052 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.765826941 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.769516945 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.769567966 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.769586086 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.769620895 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.771770000 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.772078991 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.772614002 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.772819996 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.773261070 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.773297071 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.773324966 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.773359060 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.777107954 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.777141094 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.777235985 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.777267933 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.780853033 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.780888081 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.780915976 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.780950069 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.904356003 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.904397964 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.904505968 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.904506922 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.906205893 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.906251907 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.906261921 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.906301975 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.909986973 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.910029888 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.910043955 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.910151958 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.913902998 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.913960934 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.913979053 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.914016008 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.917196035 CEST8049750152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.917258024 CEST4975080192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.932976007 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.933104038 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.933116913 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.933186054 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.933773041 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.933856964 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.933958054 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.934000969 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.964519978 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.964570999 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.964673042 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.964751959 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.125797987 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.125818014 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.125858068 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.125875950 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.126524925 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.126636982 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.126653910 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.126733065 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.126739979 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.126807928 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.126810074 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.126827002 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.126868963 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.126921892 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.126943111 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.126981974 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.127021074 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.127080917 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.127123117 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.127129078 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.127216101 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.127262115 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.127268076 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.127316952 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.127361059 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.127371073 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.127450943 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.127491951 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.127547979 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.127633095 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.127671957 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.127695084 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.127804041 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.127846003 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.128002882 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.128175974 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.128221035 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.128624916 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.128705978 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.128752947 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.128771067 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.128850937 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.128868103 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.128906012 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.128916025 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.128998041 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129014015 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129046917 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129125118 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129132986 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129160881 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129200935 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129216909 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129285097 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129332066 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129350901 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129374981 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129432917 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129436970 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129498005 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129514933 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129585028 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129641056 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129661083 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129695892 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129928112 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130004883 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130028963 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130084991 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130101919 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130131006 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130197048 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130233049 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130276918 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130316019 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130407095 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130455971 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130492926 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130521059 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130594969 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130597115 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130629063 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130641937 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130673885 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130733013 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130743027 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130865097 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130906105 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130911112 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130966902 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.131027937 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.131035089 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.131108046 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.131154060 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.131166935 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.131232023 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.131287098 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.131465912 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.131592035 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.131629944 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.131654024 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.131716967 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.131748915 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.131759882 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.131817102 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.131858110 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.131870031 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.131959915 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132002115 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132090092 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132122993 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132159948 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132200956 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132262945 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132301092 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132344007 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132378101 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132410049 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132412910 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132498026 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132536888 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132551908 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132582903 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132622004 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132677078 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132709026 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132746935 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132791042 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132822037 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132860899 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132900953 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132934093 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132965088 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.132972956 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.133053064 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.133095026 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.133167028 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.133198977 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.133236885 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.133611917 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.133645058 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.133683920 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.133712053 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.133805037 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.133843899 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.133853912 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.133886099 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.133930922 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.133999109 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.134083986 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.134124041 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.134160042 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.134223938 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.134255886 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.134263039 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.134347916 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.134387970 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.134471893 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.134505033 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.134536982 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.134543896 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.134598017 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.134629965 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.134637117 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.134730101 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.134768963 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.134897947 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.134995937 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.135026932 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.135035992 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.135201931 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.135237932 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.135246038 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.135298014 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.135335922 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.135350943 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.135410070 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.135445118 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.135448933 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.135505915 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.135544062 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.135581970 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.135665894 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.135704994 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.288466930 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.288532019 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.288570881 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.288595915 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.288609028 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.288650036 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.288655043 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.288688898 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.288724899 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.288734913 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.288764000 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.288803101 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.288809061 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.288840055 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.288877010 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.288887978 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.288990021 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.289026976 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.289036989 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.289190054 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.289237976 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.289263010 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.289433002 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.289469957 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.289483070 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.289532900 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.289570093 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.289583921 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.289623022 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.290788889 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.290997982 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.291045904 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.291935921 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.291996956 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.292042017 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.292126894 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.292253971 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.292301893 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.292315960 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.292480946 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.292520046 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.292526960 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.292660952 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.292697906 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.292697906 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.292880058 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.292922020 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.293102026 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.293139935 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.293179989 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.293220043 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.293323040 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.293365002 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.293370962 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.293401957 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.293476105 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.293514013 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.293557882 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.293557882 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.293595076 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.293728113 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.293762922 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.293767929 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.293800116 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.293808937 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.293956995 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.293996096 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.294002056 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.294061899 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.294102907 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.294374943 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.294456005 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.294501066 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.294548035 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.294718981 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.294760942 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.294847012 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.295001030 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.295085907 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.295378923 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.295481920 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.295531988 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.295682907 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.295758963 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.295802116 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.295810938 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.295856953 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.296025991 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.296061993 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.296099901 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.296106100 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.296180964 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.296225071 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.296273947 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.296395063 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.296432972 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.296436071 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.296469927 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.296504974 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.296509027 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.296540976 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.296652079 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.296657085 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.296689987 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.296725988 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.296730042 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.296794891 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.296833992 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.296838999 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.296931028 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.296971083 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.297059059 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.297163010 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.297204018 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.297216892 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.297261000 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.303263903 CEST4975180192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.304095030 CEST4975480192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.304207087 CEST4975380192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.304662943 CEST4975280192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.464652061 CEST8049751152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.465145111 CEST8049754152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.465444088 CEST8049753152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.465734959 CEST8049752152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.625111103 CEST4975580192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.787130117 CEST8049755152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.787631989 CEST4975580192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.788088083 CEST4975580192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.949265957 CEST8049755152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.951330900 CEST8049755152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.951349974 CEST8049755152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.951421022 CEST4975580192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.951773882 CEST4975580192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.967487097 CEST4975680192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.113132954 CEST8049755152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.128953934 CEST8049756152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.129062891 CEST4975680192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.129302979 CEST4975680192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.290663958 CEST8049756152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.291605949 CEST8049756152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.291642904 CEST8049756152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.291711092 CEST4975680192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.291970968 CEST4975680192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.453176022 CEST8049756152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.469876051 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.631135941 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.631237030 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.631412983 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.794229031 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795044899 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795087099 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795126915 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795166969 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795167923 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795236111 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795239925 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795370102 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795409918 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795432091 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795483112 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795540094 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795555115 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795594931 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795644999 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795664072 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795732975 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795780897 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795826912 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795898914 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795938015 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795948982 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.796029091 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.796068907 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.796078920 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.796106100 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.796142101 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.796153069 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.796179056 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.796227932 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.796284914 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.796355009 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.796406984 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.796425104 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.796462059 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.796509981 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.796530008 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.796569109 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.796617031 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.796638966 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.796675920 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.796720982 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.796775103 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.796864033 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.796911001 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.957775116 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.957807064 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.957885027 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.957911968 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.957977057 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.958026886 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.958065033 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.958161116 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.958251953 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.958303928 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.958307028 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.958347082 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.958393097 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.958461046 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.958511114 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.958589077 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.958655119 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.958698988 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.958813906 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.958861113 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.958901882 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.958928108 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.959002972 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.959043980 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.959063053 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.959115028 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.959153891 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.959156036 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.959173918 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.959218025 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.959613085 CEST4975880192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.960797071 CEST4975980192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:07.120999098 CEST8049758152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:07.121915102 CEST8049759152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:07.121987104 CEST4975980192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:07.122168064 CEST4975980192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:07.283242941 CEST8049759152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:07.284154892 CEST8049759152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:07.284198046 CEST8049759152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:07.284235001 CEST8049759152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:07.284248114 CEST4975980192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:07.284272909 CEST8049759152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:07.284311056 CEST8049759152.195.19.156192.168.2.4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:07.284316063 CEST4975980192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:07.284353971 CEST4975980192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:07.284682035 CEST4975980192.168.2.4152.195.19.156
                                                                                                                                                                                                                            Oct 13, 2023 00:30:07.446067095 CEST8049759152.195.19.156192.168.2.4
                                                                                                                                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                            Oct 13, 2023 00:30:03.250672102 CEST6479953192.168.2.41.1.1.1
                                                                                                                                                                                                                            Oct 13, 2023 00:30:03.414012909 CEST53647991.1.1.1192.168.2.4

                                                                                                                                                                                                                            DNS Queries

                                                                                                                                                                                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                            Oct 13, 2023 00:30:03.250672102 CEST192.168.2.41.1.1.10xb102Standard query (0)update.iobit.comA (IP address)IN (0x0001)false

                                                                                                                                                                                                                            DNS Answers

                                                                                                                                                                                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                            Oct 13, 2023 00:30:03.414012909 CEST1.1.1.1192.168.2.40xb102No error (0)update.iobit.comcs833182181.wpc.etacdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                            Oct 13, 2023 00:30:03.414012909 CEST1.1.1.1192.168.2.40xb102No error (0)cs833182181.wpc.etacdn.net152.195.19.156A (IP address)IN (0x0001)false

                                                                                                                                                                                                                            HTTP Request Dependency Graph

                                                                                                                                                                                                                            • update.iobit.com

                                                                                                                                                                                                                            HTTP Packets

                                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                            0192.168.2.449750152.195.19.15680C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.581084013 CEST0OUTGET /infofiles/db/rmd/install_cfg_n.zlb HTTP/1.0
                                                                                                                                                                                                                            Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
                                                                                                                                                                                                                            User-Agent: Mozilla/4.0
                                                                                                                                                                                                                            Host: update.iobit.com
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.743108034 CEST2INHTTP/1.0 200 OK
                                                                                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                                                                                            Age: 227239
                                                                                                                                                                                                                            Cache-Control: max-age=604800
                                                                                                                                                                                                                            Content-Type: application/octet-stream
                                                                                                                                                                                                                            Date: Thu, 12 Oct 2023 22:30:04 GMT
                                                                                                                                                                                                                            Etag: "869216985"
                                                                                                                                                                                                                            Expires: Thu, 19 Oct 2023 22:30:04 GMT
                                                                                                                                                                                                                            Last-Modified: Tue, 10 Oct 2023 07:21:49 GMT
                                                                                                                                                                                                                            Server: ECAcc (lac/55D2)
                                                                                                                                                                                                                            X-Cache: HIT
                                                                                                                                                                                                                            X-EC-BBR-Enable: 1
                                                                                                                                                                                                                            Content-Length: 245978
                                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                                            Data Raw: 78 9c ec bd 57 af 2b 51 92 9d c9 67 01 fa 0f 7a 27 d4 f4 4e 85 c2 80 de 7b cf 6e a1 40 ef bd e7 8f 97 26 d6 b7 f3 96 ba ba 25 0c 34 98 97 01 84 8b 73 ee 21 99 cc dc b9 4d c4 8a 15 2b 76 fe f7 ff f6 cf be ba 6f ea db fa 4e be ff ea fb 8f be ff e0 1b f8 96 be 9b ef 6e ef 9c ed bd bf fa c2 be a0 fd e8 77 c4 7e 47 7c 21 5f 9c ff 83 f6 4f c7 ff f9 f9 67 5f d3 be b7 e0 db ee 4c 43 df df ec 1c 7f de fb ab 9d f1 61 af 2f be bf d8 5f 77 7b 47 ff 2f f8 7f 6a af e7 7c 27 ed 7b ff bb 6f 2d ed ef 7f 7b ec 5f ec 3c 0b df 8a f7 9f de 19 dd ff 47 de bd f3 9d 85 1d 75 fc 7b 0b bb be 0d 67 3f d9 19 3f d6 96 bf da bd fc cf de ff 1b d7 5e da 77 ff 1c 91 b7 f7 9a ff d0 a6 9e 77 27 69 fb 76 d6 fe 5f fa 66 f6 ce d9 b7 ff 87 33 76 ed 6c 5f df c1 3e fd ab fd 54 7c 3f 7b ad ab 1c ad ad 35 bb 8b 85 5d ef 62 af 1b be 89 2f 60 bf ef f6 13 b2 e3 36 36 0a 21 bb 8f 94 ef 6a bf cb 76 86 a2 6f 6d af 32 76 fe ae af 63 57 3d d8 55 b7 76 8e 85 7d e7 e1 7b d9 d5 9e 76 86 95 9d 2b 69 3d 14 b6 ef fb ed f8 9f 1d d1 f4 c5 7c 05 5f df be 97 b0 33 0f ec b8 9c 6f 67 e7 69 fa 46 f6 f7 d9 da 77 b7 ab d4 ed bd 82 9d f1 e3 1b db eb 9d 9d 6b eb 2b d9 39 aa 36 d2 49 1b c9 97 2f 6a d7 09 d8 27 57 fb bd b1 33 af ac 35 0d 8e 3b d8 11 7e 3b db 8b be df d9 f5 52 f6 ff c7 5e e9 f8 30 c7 ef 38 3e 68 7f 7f ed 8c 4b da 3a b2 b3 5c ad 0d 49 5e eb 3a 63 7b 57 d7 59 fa 5a 76 b6 80 fd 7d b1 df 2f eb b3 8f 7d fa b5 ab b4 ec 2e 02 f6 bd 0d df ba d9 ab 84 bd f2 db 31 49 eb 17 7d 1e b0 7f 7a 37 6a ad 18 d8 fb ba 8b 00 3f 2d fb bb c9 eb ab 7d 33 62 df 8b d2 4b 23 fb ee 8a f3 fc f8 f6 c6 7e 3a 8c cc cf 3e f3 5b 5f b5 68 61 9c 5e f8 d0 ba 00 9f ac ec 9d 1f f7 32 b3 9e ca d9 b9 0f f6 8e df ce f5 b1 df 31 eb 9b 95 7d 5a b7 6b ed ec 67 45 cb d5 c6 b8 7d 7b 65 ff ae f6 ff 9f 4f 02 36 56 3b fb e4 60 af b5 d2 1e 76 ac e6 4a 8a 2b 4c ac 45 2f fb 66 d4 fe 6f d1 33 13 eb cf 85 5d 33 60 73 63 c1 7d dc 39 77 de ce f9 b5 77 4e 5c 2d 65 47 26 ec 2c 2f 9b 6d 57 fb 8e df de bf da bb 29 7b 37 67 23 54 62 de c5 ed 55 c8 fe 45 ed c8 81 b5 3b ca fd 7e 6c bc 96 cc 24 cd 44 f5 58 dd fa 6f 65 9f 2f b8 8f ab 7d fb 65 ff 52 f6 4e 80 f7 7b f6 f7 d8 ae 3e 63 c4 de 76 3f 09 fa fd 64 7f 57 b9 96 66 45 8d b9 dd a2 cf 13 8c ff c2 be a5 be 3d 30 52 09 bb 93 a9 1d 1f b7 63 34 ca 23 7b e7 64 6d d7 4a aa 59 2b fc 36 97 f5 d9 c8 1b 69 8d f1 c3 5e c9 36 69 9d a8 17 53 f6 ee c5 8e f4 33 73 34 0f 47 f6 57 80 9e ee 59 cb 0f f6 49 d9 5e d5 ed ac 63 bb fe c1 ae 1e b6 9e 88 70 c7 6a 75 88 19 34 b2 eb 6c ed 2f 8d 52 c7 8e 9f f3 6e dd ee 3f 62 c7 84 ed 1c 47 ef 9c 63 eb ad 2f 7d 5e 60 8e 35 6c 95 9e ac 4f c6 d6 da 96 7d a7 6a c7 d4 ec 88 1f e7 79 d8 7d 6b 1e d4 ec 08 59 86 99 dd f1 94 19 36 a7 7f 93 76 f4 93 3e d8 31 2f d5 c7 71 3b 7b d2 da d6 b7 6f 36 99 7b 51 bb 56 de da 1e b6 eb 0d ed 8a 33 46 7a 44 af 6c ec
                                                                                                                                                                                                                            Data Ascii: xW+Qgz'N{n@&%4s!M+voNnw~G|!_Og_LCa/_w{G/j|'{o-{_<Gu{g??^ww'iv_f3vl_>T|?{5]b/`66!jvom2vcW=Uv}{v+i=|_3ogiFwk+96I/j'W35;~;R^08>hK:\I^:c{WYZv}/}.1I}z7j?-}3bK#~:>[_ha^21}ZkgE}{eO6V;`vJ+LE/fo3]3`sc}9wwN\-eG&,/mW){7g#TbUE;~l$DXoe/}eRN{>cv?dWfE=0Rc4#{dmJY+6i^6iS3s4GWYI^cpju4l/Rn?bGc/}^`5lO}jy}kY6v>1/q;{o6{QV3FzDl
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.743149042 CEST3INData Raw: 55 cd 8e af 60 27 03 76 86 a6 dd f7 c0 ce 15 b7 9f a5 9d cf 6f bf b7 f6 3b 6e 57 6a 70 94 66 d7 98 fb 7a d9 18 7c b1 27 27 fb 64 48 7f 54 ed ac 6b fb ec 64 e7 4a 32 82 73 bb 56 c9 de d5 da 4f d0 cf 35 bb 42 94 d5 bc 62 2c a3 ac 1b f5 bb 7a 61 66
                                                                                                                                                                                                                            Data Ascii: U`'vo;nWjpfz|''dHTkdJ2sVO5Bb,zaf`5i/6EC[Zv&Yv.a7zZ9%]0C(FGe1Wq7dH_CW}[ln3AEVM]yjWLXO
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.743235111 CEST4INData Raw: c3 d2 ce 9d 03 0f 5f 89 cb e4 4b 12 60 c4 9b 9d 41 d1 52 cf be 39 b5 bb 9d da 37 57 76 e4 d8 3e 3d 59 8b a3 f6 5e cf ee 5b de e9 69 f3 56 b1 d5 c9 66 5a 8f 38 75 02 0a 91 9d f9 e1 61 e5 0f 9d 1f fd 32 fe 71 3b 9b 62 b2 09 57 12 8a d5 8c cd da 59
                                                                                                                                                                                                                            Data Ascii: _K`AR97Wv>=Y^[iVfZ8ua2q;bWY6^:w|tKi)gAinq/9\oVfYute4U^X_E7};T!2T5eOA,hc\9v83%
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.743328094 CEST6INData Raw: 06 6c 87 a2 b8 8f cd f2 b1 bd fe 80 29 27 ac ad 05 7c e2 d3 fa 6e 0d e7 d5 b2 3e 52 5c 7a 63 fc 4b 20 ea 39 ab 7f 00 bf b5 62 ed 2f b9 cf 8a 5d 6b 00 2a 7b db 7d 89 09 aa 12 eb 0b 1b d7 40 1a f2 95 0f 78 9a 83 fd 68 f6 f4 e0 02 e6 76 57 2f 3b 4f
                                                                                                                                                                                                                            Data Ascii: l)'|n>R\zcK 9b/]k*{}@xhvW/;OSU^9]X"%E"OZOpP:bv`GG\Ol%imAR%nUUa}^ck+\g+}S[La@fbY#XeeF%\v6/:`kvgk
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.743396044 CEST7INData Raw: f0 e9 0a 0b 5e 87 75 7a da df 69 6c a8 30 df 1e 3e 60 c1 6c 88 c3 8c 08 dd 85 60 92 8a d6 b2 0b 3d f7 85 ad d0 4c 5b d8 ef 0d d9 b6 2f 38 be 47 ae 76 44 bf 37 89 ba 27 5c 2b 8d bf 7a 80 67 ca e4 43 84 6b 22 c4 0e 57 fb 56 9c 2b f9 c9 96 16 ec e8
                                                                                                                                                                                                                            Data Ascii: ^uzil0>`l`=L[/8GvD7'\+zgCk"WV+CB'ctW;t[0>~I`NRO/'Q"uufx_]PEDY ?g.^>-,lx8y1;Fn[\-wv"q.(
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.743442059 CEST8INData Raw: b2 af 6d 6b 4b 0a cf 23 a6 66 45 64 d3 05 69 69 85 49 5f b8 65 0e f9 b1 05 ca 68 e8 3b 57 7c 76 89 fb ca d9 59 af e4 7e b4 02 27 76 bc 98 f4 3e 76 fc 0b a6 70 f9 af 02 8c 40 96 98 ed 84 fd 54 fc d0 22 bb 75 b1 4f 87 70 2b e2 ff 65 41 bb 36 07 be
                                                                                                                                                                                                                            Data Ascii: mkK#fEdiiI_eh;W|vY~'v>vp@T"uOp+eA61a-y!r)LDx$"L)DEE@KP%nr1=uToemEo:z;x>B4%=9O\;,-"b+(a6h`
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.743544102 CEST10INData Raw: 42 1a 6d 18 8f 1c 36 ea 82 ce 4b ea 85 10 76 a4 45 2d d2 19 cb bd 83 19 8d 12 35 5d c9 10 3e c0 f4 47 b4 c5 71 46 e4 0d 97 d3 63 b6 cd 58 7d 09 b2 7e 47 66 57 0d 8c 10 82 ed b8 a3 1a 6a a0 c5 39 a0 34 bc 61 ad 0a e0 b1 31 38 a9 43 b6 5f 71 de 9b
                                                                                                                                                                                                                            Data Ascii: Bm6KvE-5]>GqFcX}~GfWj94a18C_qXHv$Jc46Bh."TeX{O'~a{QFd)hdI+MxaC<NDIC^OHF.(UR7%r|p6B4s'
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.743630886 CEST11INData Raw: 81 c7 75 a6 0c d6 75 04 6e 8d 83 9c d7 78 9d 29 fe a1 06 63 55 a5 5f 9b a8 25 6a b0 99 25 7a ea c7 fa 3e 92 f1 7d 12 1b bb 39 fc c6 3b 6e 40 7e c2 fe 62 2c cf ac c7 13 3a c2 29 1e 27 8c c2 50 f1 c8 1a db 76 a5 8a 5d 3a be 06 38 a3 4b af 8f c9 23
                                                                                                                                                                                                                            Data Ascii: uunx)cU_%j%z>}9;n@~b,:)'Pv]:8K#_=_/Vyf#0K65ur9uoPjxvoM-xOau!Q{:F<]FwY>^XWE"w,ne"ZbFvF}ey.
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.743777990 CEST12INData Raw: 39 83 53 a5 10 bd 80 f4 0f ec c5 10 23 d2 6e 53 ed 15 25 ff 27 cb a1 35 39 c4 1e ee a9 62 6c b0 36 54 7d 56 44 f5 22 85 df 06 6e b2 c4 2a fe b3 9b 85 f2 ba 51 d4 61 2d 22 e5 38 59 da 0a b9 eb 20 79 9c 1b 7e e7 80 5d 77 aa e2 20 6c f7 9d fb 4d 79
                                                                                                                                                                                                                            Data Ascii: 9S#nS%'59bl6T}VD"n*Qa-"8Y y~]w lMy*fp;?T|wNz1B>d|R%rT(EVhjdNfQAQKE%Pp Z@8DZ0#F`KU^c>WNl}O*
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.743824959 CEST14INData Raw: 9c a1 fe d3 71 81 43 fc 4d 02 4c e7 66 f5 8b 5a 90 3d ba ce 82 c7 db df 61 cc e7 60 b7 2c 2c d4 17 a5 c8 9c 15 97 22 9f 9c 22 93 59 45 9b 55 02 47 8d 88 99 1f 64 57 26 d4 3c 8a 49 9d a1 68 4b f8 dc fe 25 5d 38 d6 0c 31 5a 96 98 a6 ef 31 dd 1b 18
                                                                                                                                                                                                                            Data Ascii: qCMLfZ=a`,,""YEUGdW&<IhK%]81Z1.S,~_,#0tk$!+a70y5G1r{Y`-N_)| d,9T79ZuX7!g{8>bNJuDv[A4
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.746845961 CEST15INData Raw: 3f 41 29 91 23 43 16 80 e9 2c 53 19 35 62 1e 1f 88 dd 6a ec 85 71 22 bb 10 a4 df cf d4 68 35 d1 c0 6f 51 29 1c 89 e2 73 68 43 56 3e b7 4b 5b 83 da ba 18 f5 12 aa 72 3b 61 7f 7b be 2d 99 90 1d 59 e5 bb cf ed 9f 99 42 13 fe 46 7f db a3 b2 42 7a 99
                                                                                                                                                                                                                            Data Ascii: ?A)#C,S5bjq"h5oQ)shCV>K[r;a{-YBFBz *>h@:xj=&RS@X\TGc;pWB/Q'Rx$ps8Qye-tIPa~ahdVhnGddj'vMrET4k{S


                                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                            1192.168.2.449751152.195.19.15680C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.964519978 CEST53OUTGET /infofiles/db/rmd/install_cfg_n.zlb HTTP/1.0
                                                                                                                                                                                                                            Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
                                                                                                                                                                                                                            User-Agent: Mozilla/4.0
                                                                                                                                                                                                                            Host: update.iobit.com
                                                                                                                                                                                                                            Range: bytes=0-61494
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.126524925 CEST55INHTTP/1.0 206 Partial Content
                                                                                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                                                                                            Age: 227240
                                                                                                                                                                                                                            Cache-Control: max-age=604800
                                                                                                                                                                                                                            Content-Range: bytes 0-61494/245978
                                                                                                                                                                                                                            Content-Type: application/octet-stream
                                                                                                                                                                                                                            Date: Thu, 12 Oct 2023 22:30:05 GMT
                                                                                                                                                                                                                            Etag: "869216985"
                                                                                                                                                                                                                            Expires: Thu, 19 Oct 2023 22:30:05 GMT
                                                                                                                                                                                                                            Last-Modified: Tue, 10 Oct 2023 07:21:49 GMT
                                                                                                                                                                                                                            Server: ECAcc (lac/55D2)
                                                                                                                                                                                                                            X-Cache: HIT
                                                                                                                                                                                                                            Content-Length: 61495
                                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                                            Data Raw: 78 9c ec bd 57 af 2b 51 92 9d c9 67 01 fa 0f 7a 27 d4 f4 4e 85 c2 80 de 7b cf 6e a1 40 ef bd e7 8f 97 26 d6 b7 f3 96 ba ba 25 0c 34 98 97 01 84 8b 73 ee 21 99 cc dc b9 4d c4 8a 15 2b 76 fe f7 ff f6 cf be ba 6f ea db fa 4e be ff ea fb 8f be ff e0 1b f8 96 be 9b ef 6e ef 9c ed bd bf fa c2 be a0 fd e8 77 c4 7e 47 7c 21 5f 9c ff 83 f6 4f c7 ff f9 f9 67 5f d3 be b7 e0 db ee 4c 43 df df ec 1c 7f de fb ab 9d f1 61 af 2f be bf d8 5f 77 7b 47 ff 2f f8 7f 6a af e7 7c 27 ed 7b ff bb 6f 2d ed ef 7f 7b ec 5f ec 3c 0b df 8a f7 9f de 19 dd ff 47 de bd f3 9d 85 1d 75 fc 7b 0b bb be 0d 67 3f d9 19 3f d6 96 bf da bd fc cf de ff 1b d7 5e da 77 ff 1c 91 b7 f7 9a ff d0 a6 9e 77 27 69 fb 76 d6 fe 5f fa 66 f6 ce d9 b7 ff 87 33 76 ed 6c 5f df c1 3e fd ab fd 54 7c 3f 7b ad ab 1c ad ad 35 bb 8b 85 5d ef 62 af 1b be 89 2f 60 bf ef f6 13 b2 e3 36 36 0a 21 bb 8f 94 ef 6a bf cb 76 86 a2 6f 6d af 32 76 fe ae af 63 57 3d d8 55 b7 76 8e 85 7d e7 e1 7b d9 d5 9e 76 86 95 9d 2b 69 3d 14 b6 ef fb ed f8 9f 1d d1 f4 c5 7c 05 5f df be 97 b0 33 0f ec b8 9c 6f 67 e7 69 fa 46 f6 f7 d9 da 77 b7 ab d4 ed bd 82 9d f1 e3 1b db eb 9d 9d 6b eb 2b d9 39 aa 36 d2 49 1b c9 97 2f 6a d7 09 d8 27 57 fb bd b1 33 af ac 35 0d 8e 3b d8 11 7e 3b db 8b be df d9 f5 52 f6 ff c7 5e e9 f8 30 c7 ef 38 3e 68 7f 7f ed 8c 4b da 3a b2 b3 5c ad 0d 49 5e eb 3a 63 7b 57 d7 59 fa 5a 76 b6 80 fd 7d b1 df 2f eb b3 8f 7d fa b5 ab b4 ec 2e 02 f6 bd 0d df ba d9 ab 84 bd f2 db 31 49 eb 17 7d 1e b0 7f 7a 37 6a ad 18 d8 fb ba 8b 00 3f 2d fb bb c9 eb ab 7d 33 62 df 8b d2 4b 23 fb ee 8a f3 fc f8 f6 c6 7e 3a 8c cc cf 3e f3 5b 5f b5 68 61 9c 5e f8 d0 ba 00 9f ac ec 9d 1f f7 32 b3 9e ca d9 b9 0f f6 8e df ce f5 b1 df 31 eb 9b 95 7d 5a b7 6b ed ec 67 45 cb d5 c6 b8 7d 7b 65 ff ae f6 ff 9f 4f 02 36 56 3b fb e4 60 af b5 d2 1e 76 ac e6 4a 8a 2b 4c ac 45 2f fb 66 d4 fe 6f d1 33 13 eb cf 85 5d 33 60 73 63 c1 7d dc 39 77 de ce f9 b5 77 4e 5c 2d 65 47 26 ec 2c 2f 9b 6d 57 fb 8e df de bf da bb 29 7b 37 67 23 54 62 de c5 ed 55 c8 fe 45 ed c8 81 b5 3b ca fd 7e 6c bc 96 cc 24 cd 44 f5 58 dd fa 6f 65 9f 2f b8 8f ab 7d fb 65 ff 52 f6 4e 80 f7 7b f6 f7 d8 ae 3e 63 c4 de 76 3f 09 fa fd 64 7f 57 b9 96 66 45 8d b9 dd a2 cf 13 8c ff c2 be a5 be 3d 30 52 09 bb 93 a9 1d 1f b7 63 34 ca 23 7b e7 64 6d d7 4a aa 59 2b fc 36 97 f5 d9 c8 1b 69 8d f1 c3 5e c9 36 69 9d a8 17 53 f6 ee c5 8e f4 33 73 34 0f 47 f6 57 80 9e ee 59 cb 0f f6 49 d9 5e d5 ed ac 63 bb fe c1 ae 1e b6 9e 88 70 c7 6a 75 88 19 34 b2 eb 6c ed 2f 8d 52 c7 8e 9f f3 6e dd ee 3f 62 c7 84 ed 1c 47 ef 9c 63 eb ad 2f 7d 5e 60 8e 35 6c 95 9e ac 4f c6 d6 da 96 7d a7 6a c7 d4 ec 88 1f e7 79 d8 7d 6b 1e d4 ec 08 59 86 99 dd f1 94 19 36 a7 7f 93 76 f4 93 3e d8 31 2f d5 c7
                                                                                                                                                                                                                            Data Ascii: xW+Qgz'N{n@&%4s!M+voNnw~G|!_Og_LCa/_w{G/j|'{o-{_<Gu{g??^ww'iv_f3vl_>T|?{5]b/`66!jvom2vcW=Uv}{v+i=|_3ogiFwk+96I/j'W35;~;R^08>hK:\I^:c{WYZv}/}.1I}z7j?-}3bK#~:>[_ha^21}ZkgE}{eO6V;`vJ+LE/fo3]3`sc}9wwN\-eG&,/mW){7g#TbUE;~l$DXoe/}eRN{>cv?dWfE=0Rc4#{dmJY+6i^6iS3s4GWYI^cpju4l/Rn?bGc/}^`5lO}jy}kY6v>1/
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.126636982 CEST57INData Raw: 71 3b 7b d2 da d6 b7 6f 36 99 7b 51 bb 56 de da 1e b6 eb 0d ed 8a 33 46 7a 44 af 6c ec 55 cd 8e af 60 27 03 76 86 a6 dd f7 c0 ce 15 b7 9f a5 9d cf 6f bf b7 f6 3b 6e 57 6a 70 94 66 d7 98 fb 7a d9 18 7c b1 27 27 fb 64 48 7f 54 ed ac 6b fb ec 64 e7
                                                                                                                                                                                                                            Data Ascii: q;{o6{QV3FzDlU`'vo;nWjpfz|''dHTkdJ2sVO5Bb,zaf`5i/6EC[Zv&Yv.a7zZ9%]0C(FGe1Wq7dH_CW}[ln3
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.126653910 CEST58INData Raw: 41 d4 b2 dc 29 2c f3 d2 da 90 b1 57 42 49 45 5e 55 ed d3 27 76 a7 6f 77 9f e3 0a 2b 6b c3 d2 ce 9d 03 0f 5f 89 cb e4 4b 12 60 c4 9b 9d 41 d1 52 cf be 39 b5 bb 9d da 37 57 76 e4 d8 3e 3d 59 8b a3 f6 5e cf ee 5b de e9 69 f3 56 b1 d5 c9 66 5a 8f 38
                                                                                                                                                                                                                            Data Ascii: A),WBIE^U'vow+k_K`AR97Wv>=Y^[iVfZ8ua2q;bWY6^:w|tKi)gAinq/9\oVfYute4U^X_E7};T!2T5
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.126733065 CEST59INData Raw: da ae 5b a5 e7 23 76 9e bc 5d ad 66 fd 7c 02 71 69 ae 74 98 97 37 7b fd b1 f7 63 e0 ba 06 6c 87 a2 b8 8f cd f2 b1 bd fe 80 29 27 ac ad 05 7c e2 d3 fa 6e 0d e7 d5 b2 3e 52 5c 7a 63 fc 4b 20 ea 39 ab 7f 00 bf b5 62 ed 2f b9 cf 8a 5d 6b 00 2a 7b db
                                                                                                                                                                                                                            Data Ascii: [#v]f|qit7{cl)'|n>R\zcK 9b/]k*{}@xhvW/;OSU^9]X"%E"OZOpP:bv`GG\Ol%imAR%nUUa}^ck+\g+}S[La@fbY#Xe
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.126810074 CEST61INData Raw: 44 a5 6d d8 66 79 f1 b2 b5 43 6b b2 05 a3 ba 87 4b 5d 33 4f e2 76 ad 01 59 25 31 99 09 f0 e9 0a 0b 5e 87 75 7a da df 69 6c a8 30 df 1e 3e 60 c1 6c 88 c3 8c 08 dd 85 60 92 8a d6 b2 0b 3d f7 85 ad d0 4c 5b d8 ef 0d d9 b6 2f 38 be 47 ae 76 44 bf 37
                                                                                                                                                                                                                            Data Ascii: DmfyCkK]3OvY%1^uzil0>`l`=L[/8GvD7'\+zgCk"WV+CB'ctW;t[0>~I`NRO/'Q"uufx_]PEDY ?g.^>-,lx8y1;Fn
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.126827002 CEST62INData Raw: 89 0a 98 a4 8e cf ed 91 a7 d0 5a 72 39 ef be b5 68 64 67 d8 33 b7 42 20 a0 91 37 52 17 b2 af 6d 6b 4b 0a cf 23 a6 66 45 64 d3 05 69 69 85 49 5f b8 65 0e f9 b1 05 ca 68 e8 3b 57 7c 76 89 fb ca d9 59 af e4 7e b4 02 27 76 bc 98 f4 3e 76 fc 0b a6 70
                                                                                                                                                                                                                            Data Ascii: Zr9hdg3B 7RmkK#fEdiiI_eh;W|vY~'v>vp@T"uOp+eA61a-y!r)LDx$"L)DEE@KP%nr1=uToemEo:z;x>B4%=9
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.126921892 CEST63INData Raw: 13 cd e9 09 31 5f 10 06 f1 84 76 60 89 4e f3 4d ff 1c d0 74 35 50 3f b7 40 27 05 14 00 42 1a 6d 18 8f 1c 36 ea 82 ce 4b ea 85 10 76 a4 45 2d d2 19 cb bd 83 19 8d 12 35 5d c9 10 3e c0 f4 47 b4 c5 71 46 e4 0d 97 d3 63 b6 cd 58 7d 09 b2 7e 47 66 57
                                                                                                                                                                                                                            Data Ascii: 1_v`NMt5P?@'Bm6KvE-5]>GqFcX}~GfWj94a18C_qXHv$Jc46Bh."TeX{O'~a{QFd)hdI+MxaC<NDIC^OHF.(
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.126943111 CEST65INData Raw: fe 45 b5 20 0d 4c 18 e6 30 8f 8f cf f1 fd ab 87 ab ba 54 0b e5 59 6f 55 7c df 8a 31 39 81 c7 75 a6 0c d6 75 04 6e 8d 83 9c d7 78 9d 29 fe a1 06 63 55 a5 5f 9b a8 25 6a b0 99 25 7a ea c7 fa 3e 92 f1 7d 12 1b bb 39 fc c6 3b 6e 40 7e c2 fe 62 2c cf
                                                                                                                                                                                                                            Data Ascii: E L0TYoU|19uunx)cU_%j%z>}9;n@~b,:)'Pv]:8K#_=_/Vyf#0K65ur9uoPjxvoM-xOau!Q{:F<]FwY>^XWE"w,
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.127021074 CEST66INData Raw: f6 39 43 c4 e6 27 b7 f0 26 4f 1c a6 fe c5 69 57 a5 b1 ae c3 7d 8d 58 ef 2d 46 ad 83 95 39 83 53 a5 10 bd 80 f4 0f ec c5 10 23 d2 6e 53 ed 15 25 ff 27 cb a1 35 39 c4 1e ee a9 62 6c b0 36 54 7d 56 44 f5 22 85 df 06 6e b2 c4 2a fe b3 9b 85 f2 ba 51
                                                                                                                                                                                                                            Data Ascii: 9C'&OiW}X-F9S#nS%'59bl6T}VD"n*Qa-"8Y y~]w lMy*fp;?T|wNz1B>d|R%rT(EVhjdNfQAQKE%Pp Z@8DZ0
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.127080917 CEST67INData Raw: c5 d8 ab ea ad 4f e6 3d 40 8e f0 4a 16 38 0a 56 28 10 19 5f b1 69 17 d8 53 d5 77 2b af 9c a1 fe d3 71 81 43 fc 4d 02 4c e7 66 f5 8b 5a 90 3d ba ce 82 c7 db df 61 cc e7 60 b7 2c 2c d4 17 a5 c8 9c 15 97 22 9f 9c 22 93 59 45 9b 55 02 47 8d 88 99 1f
                                                                                                                                                                                                                            Data Ascii: O=@J8V(_iSw+qCMLfZ=a`,,""YEUGdW&<IhK%]81Z1.S,~_,#0tk$!+a70y5G1r{Y`-N_)| d,9T79ZuX7!g{8>
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.127129078 CEST69INData Raw: 74 76 71 08 87 7f 87 db 4d c0 32 5f c0 14 69 3c ab cb ee e4 f1 04 27 2c ad d6 5d 81 b5 3f 41 29 91 23 43 16 80 e9 2c 53 19 35 62 1e 1f 88 dd 6a ec 85 71 22 bb 10 a4 df cf d4 68 35 d1 c0 6f 51 29 1c 89 e2 73 68 43 56 3e b7 4b 5b 83 da ba 18 f5 12
                                                                                                                                                                                                                            Data Ascii: tvqM2_i<',]?A)#C,S5bjq"h5oQ)shCV>K[r;a{-YBFBz *>h@:xj=&RS@X\TGc;pWB/Q'Rx$ps8Qye-tIPa~ahdVh


                                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                            2192.168.2.449752152.195.19.15680C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.964570999 CEST53OUTGET /infofiles/db/rmd/install_cfg_n.zlb HTTP/1.0
                                                                                                                                                                                                                            Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
                                                                                                                                                                                                                            User-Agent: Mozilla/4.0
                                                                                                                                                                                                                            Host: update.iobit.com
                                                                                                                                                                                                                            Range: bytes=61495-122989
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.133611917 CEST176INHTTP/1.0 206 Partial Content
                                                                                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                                                                                            Age: 227240
                                                                                                                                                                                                                            Cache-Control: max-age=604800
                                                                                                                                                                                                                            Content-Range: bytes 61495-122989/245978
                                                                                                                                                                                                                            Content-Type: application/octet-stream
                                                                                                                                                                                                                            Date: Thu, 12 Oct 2023 22:30:05 GMT
                                                                                                                                                                                                                            Etag: "869216985"
                                                                                                                                                                                                                            Expires: Thu, 19 Oct 2023 22:30:05 GMT
                                                                                                                                                                                                                            Last-Modified: Tue, 10 Oct 2023 07:21:49 GMT
                                                                                                                                                                                                                            Server: ECAcc (lac/55D2)
                                                                                                                                                                                                                            X-Cache: HIT
                                                                                                                                                                                                                            Content-Length: 61495
                                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                                            Data Raw: d1 4a 37 55 3a 0d ab a3 6b fc 04 3e 58 eb d9 6d f3 3d a4 a8 f3 a0 ab e3 c4 db 39 d1 e7 90 26 f8 47 97 f7 56 87 c3 4e 2f c9 29 24 91 c7 d5 56 ec 91 11 66 2f 62 eb 29 fe 35 90 7f 55 be 2e e2 97 be 73 69 f6 c1 33 7d a5 45 4f bb e2 7a f9 b1 37 66 56 5e 5d 4c 4c b3 e2 5a 76 f6 b7 ee 9a ad 18 f9 81 2b bf 12 1d 6f f1 40 9f 3c 50 7b e8 ed 97 bf 2a 75 37 75 4d 07 d9 ab b0 4f 31 4d 7d ee 99 67 18 69 a6 c6 4d e7 84 ac f0 7b 9f 1c f4 25 4e b2 bc ae 9f 53 b5 74 78 4f 7a 34 c5 98 c7 92 c7 ff 4f 55 87 c1 aa 5e 52 32 ce 64 f6 05 ff cc 3b 47 4e 0d 7a 9c d3 59 8f 55 be 5f d9 dc a1 0d de fc 87 9f ed 4c 9d 7e ae 1f 7b 96 e5 cf a2 3a f3 09 ce 5c e9 4d 9a 7a ab 63 71 24 71 9a 7f b8 9d b5 7d d0 d1 95 3a 57 cd 54 5c f7 0c 3e 78 f6 39 65 ce a4 47 79 77 92 4b b3 20 ff 68 bb 71 15 1f 7c c5 5f f8 ed b9 ff 0e b1 83 33 6e aa 35 fd a3 ee bd dd d1 62 de 44 cd d0 e7 5e a8 11 69 12 60 d1 13 39 54 d7 d4 e1 d8 43 2c 59 53 35 dd 53 41 86 42 9f 66 03 96 3d 99 73 5c 6d 83 42 7c a9 0f a5 80 11 da d1 f3 2b f8 87 c7 cc f7 da a3 ba a7 f5 98 d7 0d 9c 66 a0 16 78 79 93 42 3f e3 83 1f 58 59 e7 b9 3f 95 7e c1 f3 ac 52 9f 7e 69 1b 81 07 aa f8 f9 4b 08 b0 6a 02 fd 9e b3 b8 2b 9b f6 ed 94 d4 d7 b2 a1 94 1f 67 f1 b3 81 fb 9f c8 7d 45 dd 0f 79 57 12 6a 5f 1e 0b 3a 97 0b da fa 12 9e f9 7a 4e dc c9 58 57 c6 5c 2c 3b 87 b4 6b 66 bc dc 79 3a 0f 2a fe 3b 78 ed 01 36 09 ac 57 a7 66 ae e0 ad 03 de b9 32 9c 3e b7 f2 a2 3f 7f 0a 17 a4 59 86 09 05 ee d5 a1 27 2a fe b6 cc f9 a4 36 ff f5 cf 3b 07 6b 70 a5 7f dc 70 c1 79 87 23 35 d0 cb 36 97 a6 da 16 38 0a ee b0 42 b1 df c3 a5 f6 89 8f d9 73 98 f5 d4 65 7d 78 be 83 a7 8f 67 f3 ab 4b fb 80 03 79 4d 6b 7d 86 79 86 b9 74 7e d7 18 b3 5f d4 6b 70 2b c3 d4 45 b4 9a 15 bd 84 2a 27 7a 7e a6 74 c6 11 9f db 26 f3 b5 ad 55 3e e1 1f 3e e5 10 a8 a8 b5 4e 5d cd 2f 6e ec 8b d6 78 90 4b 27 78 37 a8 17 65 48 64 2e 46 1f e9 ba ff c2 7b 8d 39 dd c3 b1 d4 f3 be 23 cb 3f 60 bb cb 6a f4 57 48 e5 d0 de 39 b7 b6 42 9b 39 b6 2f 3e f1 19 87 38 e0 47 08 f5 58 75 15 5d 6c cf 62 c3 ab e7 5d a5 f0 dc 5a 19 c9 e5 35 11 49 ae 3c d1 1d 5c 11 6f f6 0c 5a db 53 f2 17 3a 39 92 9b fa d5 7e 3b 87 2e 5f 64 d6 4b f8 74 c7 2d 7e 07 95 5e 73 9f de d1 23 5e 31 0d 3f 9c f7 15 fe ca 36 84 3a 94 5b d3 04 d3 2e f6 b6 8e 81 ae 62 4b 46 76 c4 8a d7 b4 c2 13 1f eb 21 fc 91 9f 90 dc 4b 2e 9d ab 55 a6 54 f4 b2 3e bb 98 aa 75 4c d7 5c c2 65 69 c6 48 9b ff 75 9b 7d e6 b5 a9 15 fd ac 9b 32 b1 d5 0b dd a8 7b 6c 6c 03 e6 4d 27 08 45 9d d5 57 c3 35 32 35 33 4d 91 0f 07 cf 24 97 4e 7e 7d c7 23 44 5d 9b 26 e4 15 bd bd 43 99 32 9d 42 7b 86 a9 bd c2 41 8e 28 e3 79 58 e2 81 86 54 d1 23 fc 4d 41 ff c6 d7 7f e1 1a 3e b9 95 ba 59 85 3a c6 38 55 39 25 16 ea a1 91 7d 9a 74 fc c0
                                                                                                                                                                                                                            Data Ascii: J7U:k>Xm=9&GVN/)$Vf/b)5U.si3}EOz7fV^]LLZv+o@<P{*u7uMO1M}giM{%NStxOz4OU^R2d;GNzYU_L~{:\Mzcq$q}:WT\>x9eGywK hq|_3n5bD^i`9TC,YS5SABf=s\mB|+fxyB?XY?~R~iKj+g}EyWj_:zNXW\,;kfy:*;x6Wf2>?Y'*6;kppy#568Bse}xgKyMk}yt~_kp+E*'z~t&U>>N]/nxK'x7eHd.F{9#?`jWH9B9/>8GXu]lb]Z5I<\oZS:9~;._dKt-~^s#^1?6:[.bKFv!K.UT>uL\eiHu}2{llM'EW5253M$N~}#D]&C2B{A(yXT#MA>Y:8U9%}t
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.133645058 CEST177INData Raw: f5 03 95 d9 d6 ee 4a fa 42 5d 0e fe 83 ed 86 dc 83 03 9d 20 c1 d5 8d 30 87 13 15 42 1f 8f 1c cc c0 0f af cb 19 95 ea 15 47 3b e4 31 8f dd 34 50 9d 04 8a d8 e7 d2 f4 c4 33 1e d9 a3 5c 4b ef c0 25 47 e7 25 ce 7e 86 87 7e c1 eb ee 20 bf 7b f9 7f 25
                                                                                                                                                                                                                            Data Ascii: JB] 0BG;14P3\K%G%~~ {%w'9Uc_D.SaM'}EoXOLn]a{K(u}wt5-Mp'{_pv2~Qtt|fC=TJhV[^VIgXGz:l
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.133712053 CEST178INData Raw: df 2e 70 98 b4 31 79 b1 46 cf b3 ca 3c aa 9f 09 36 f6 1b fb 1b 8c c5 c4 cf 5f a8 05 da 7a 6c bf 32 37 f0 41 96 65 0a a2 7e 74 6a ff a9 05 3a 3c d8 e7 7a 0a 46 34 c2 6b aa e5 c8 2e bf e7 ad ae 64 2a d0 8f fd 30 e7 ae ec ab 31 67 a2 fe a7 fd 34 c4
                                                                                                                                                                                                                            Data Ascii: .p1yF<6_zl27Ae~tj:<zF4k.d*01g4D3:c~FL}wlcb@cl;3O{X~n_=KX+1J^>)Dku>wZt#**BK\=7|pG
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.133805037 CEST180INData Raw: bc d2 79 d9 8f 22 6e 70 e1 5b f8 28 50 76 89 7b af ed a7 b7 5c a7 7b 15 e3 31 75 34 4d c8 be d0 e7 70 ae f6 1b e8 e2 0f 95 69 4b af e8 fa d3 12 56 e7 36 5b e9 4f 14 e2 91 bd d1 d0 d3 b0 cf a5 b3 ce 27 aa 9d 22 44 30 b6 17 e2 dc 9f 81 88 d1 e0 af
                                                                                                                                                                                                                            Data Ascii: y"np[(Pv{\{1u4MpiKV6[O'"D0pA'Tn?TKOA+*qU{*N{g G}m"]g+=%ULul[~J%S[V8&jO9O<z=8c>#6OOLmtj}q=)6m5Chz8Gx
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.133853912 CEST181INData Raw: 3b 87 d9 f4 92 1b 99 a8 e4 53 4f b9 53 da 76 51 74 27 9c c8 34 15 19 a1 c0 d7 fe e5 cd 86 8e 73 88 15 ff 10 a3 0f 55 6e bf b8 d2 40 27 1d b3 1d 16 32 7a 8d 47 61 4b 23 1b e3 73 7e 4c 2b 78 b1 6a f7 58 d3 11 a4 fa a7 b7 ea 81 33 e6 1c 8f f1 aa c3
                                                                                                                                                                                                                            Data Ascii: ;SOSvQt'4sUn@'2zGaK#s~L+xjX3riAKgq1{?t'/UI~gu0E5U*&{sGcwkl\JxUEod;g:;T~9ciry`"WummQ-pKSr,E.P&hm%2-FrZ
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.133886099 CEST182INData Raw: 33 f9 d5 9f 50 f1 37 4f e1 9d 26 85 66 44 f3 8e 48 1a 48 f4 9e 52 54 a4 28 df e3 ea da b8 8b a9 ba 6a 22 06 16 ed f7 47 f1 77 44 47 da 63 ac 6e f5 7b 56 e4 bc 27 99 a4 47 89 1b ea 1a 6a d3 c9 6e a9 74 e1 19 fb 16 f1 4e b3 49 14 f1 4f 95 b2 f7 68
                                                                                                                                                                                                                            Data Ascii: 3P7O&fDHHRT(j"GwDGcn{V'GjntNIOh)S><Zx]fa=ev6y@~&{'%8H554r4[Af=R7Nb@;qr@n<Cwg,NhWj/[35L>5vkC8
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.133999109 CEST184INData Raw: dc bb 29 c9 f1 5f a2 45 78 87 7f a1 cc 34 db 61 a1 76 8d d8 12 ce ea 43 2a 43 c3 ef e6 d5 e8 e9 6c f6 81 eb 3c 57 db 4c 32 8c 1d 98 64 cd ff f4 23 e7 16 39 cc f3 78 f3 3e 8c 58 96 3b d3 44 8c a2 69 14 51 cd b7 64 e3 53 7e a1 09 8f 42 55 16 48 1d
                                                                                                                                                                                                                            Data Ascii: )_Ex4avC*Cl<WL2d#9x>X;DiQdS~BUHeFxAT0^uqzVF-J[kzVWXP]%TXFN|VmY\`*}b/D:9uu&UQ<pkrB-m%pJ
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.134083986 CEST185INData Raw: 7c 92 53 f3 9e 03 af 7d 70 6a 86 fb e5 4a 6c 7a 53 87 dc ca b3 91 a1 e2 74 e0 35 27 6b 11 0b f7 c6 63 7b a5 16 4e a7 e2 bd f3 21 77 70 d5 05 38 a7 a9 c6 be f0 bc 92 4b 2d 18 a9 27 ef fa c4 2c 97 02 ec 1d 79 3f 66 dd bd 61 9c 17 34 d9 2f 7f 3b a6
                                                                                                                                                                                                                            Data Ascii: |S}pjJlzSt5'kc{N!wp8K-',y?fa4/;m,D_{SotPv9#d{:]s[1;pPJonUh$QE6uNUqp"#|EJ~IXg"[Srg(Z8Ko &CYrg2w^
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.134160042 CEST186INData Raw: 8b 4e 93 22 37 f5 0d 5d 3e b9 ef a3 a2 99 e3 ef d2 89 f7 8f 18 e1 b2 ff b6 32 b7 cb 06 4e ff b4 56 5f f0 de 65 1c d4 87 3a 35 dc 37 03 6a 49 1d e7 51 d4 09 db d3 3d d2 d3 05 ba 81 60 ee c4 9e 34 09 e8 c0 ee 19 5b 65 2f 3e 27 9c bb a7 b9 74 e2 c8
                                                                                                                                                                                                                            Data Ascii: N"7]>2NV_e:57jIQ=`4[e/>'tw6?GZw$\}S3~4Nt=?fN-qk[wW/3>I{<<C;W~uF(\J`s*^<IYDB'RT#<jTMU=Y94Q
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.134223938 CEST188INData Raw: 20 94 86 a7 f1 cd bf d6 87 63 9f 21 e1 bd 9c f3 a1 3b a1 a0 ff 60 6d 3f 1e ca fc 9f 2a ce 37 2e d4 e4 3a ae 89 bb 2d f1 2d 3a 7b 6f 3c d1 bd 08 f5 01 55 ef 71 1c 2d 28 ec dc f3 69 43 38 7d 1d 5b e7 58 b9 e8 a3 38 b3 bb d3 0c d2 29 5e 3b 9d f3 7b
                                                                                                                                                                                                                            Data Ascii: c!;`m?*7.:--:{o<Uq-(iC8}[X8)^;{K{KO>2{VoeIRc~aczt>K<w3[!wk"igE=m,v:9Z~3K##lfjY;}U}J4Or4?[
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.134255886 CEST189INData Raw: bc fd 93 fa c7 d2 74 91 bd ee f3 01 47 f4 39 b6 f7 c8 da 09 17 cb 86 73 ac c3 33 9d f0 7f 91 0b f8 2b 97 4e 73 fa e6 3f 8e 4f 3a a2 36 4e e5 c0 92 ea 72 42 45 fa 95 5d 63 ef 2c f9 a7 a6 98 fc 2e 2d b7 9b d5 51 9f f0 40 05 5f 94 7c 49 73 ff be 66
                                                                                                                                                                                                                            Data Ascii: tG9s3+Ns?O:6NrBE]c,.-Q@_|Isfip]2J.ks_r|cTG T6#7XQ78#WL6Uc fTty|H,]clhPwky5jfzN0-7j_E.W&O]9


                                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                            3192.168.2.449754152.195.19.15680C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.964673042 CEST53OUTGET /infofiles/db/rmd/install_cfg_n.zlb HTTP/1.0
                                                                                                                                                                                                                            Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
                                                                                                                                                                                                                            User-Agent: Mozilla/4.0
                                                                                                                                                                                                                            Host: update.iobit.com
                                                                                                                                                                                                                            Range: bytes=184485-245978
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129125118 CEST95INHTTP/1.0 206 Partial Content
                                                                                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                                                                                            Age: 227240
                                                                                                                                                                                                                            Cache-Control: max-age=604800
                                                                                                                                                                                                                            Content-Range: bytes 184485-245977/245978
                                                                                                                                                                                                                            Content-Type: application/octet-stream
                                                                                                                                                                                                                            Date: Thu, 12 Oct 2023 22:30:05 GMT
                                                                                                                                                                                                                            Etag: "869216985"
                                                                                                                                                                                                                            Expires: Thu, 19 Oct 2023 22:30:05 GMT
                                                                                                                                                                                                                            Last-Modified: Tue, 10 Oct 2023 07:21:49 GMT
                                                                                                                                                                                                                            Server: ECAcc (lac/55D2)
                                                                                                                                                                                                                            X-Cache: HIT
                                                                                                                                                                                                                            Content-Length: 61493
                                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                                            Data Raw: 0b f5 dc 08 0e 4e b3 ab ab 78 99 40 e8 03 0a 47 83 56 58 a3 6e 0e f9 2d e6 d0 ee 44 8d db d1 07 55 a4 f5 95 ed cf 34 91 fa 8c 7e 5e c5 e0 86 52 b9 85 67 03 a7 74 75 7f bc 5b bb f1 34 03 ff a7 f3 6d db b8 eb 8d 6e fc 98 60 70 4d 1d 3c d0 95 31 a1 fe 96 e5 b1 d4 39 d5 b6 c7 0f 3c 95 8e de 95 4b 9d 05 3d f1 ab af d3 f7 81 53 6b c3 b9 1e f5 69 e8 81 0b 39 a0 6d e2 4c f0 1a 69 2e d5 2f 3d 6d c3 a1 fb 80 43 7a c0 78 bd 5a d9 97 76 f0 14 57 38 a5 c2 fc 60 12 f7 f1 0e 3b b4 f3 39 9f 69 49 7d 1a 15 4e 95 4b 33 39 60 7e c4 a6 67 bd 80 c1 36 fc 62 4c d7 14 9e e0 d0 a7 14 c8 15 6c df a5 91 3c 88 d8 ef 26 22 6c d5 a9 73 9f bb a7 3a 7b 82 3c ca 94 e6 bf f6 5d 41 5c ac 5a 9f 6d f8 2c 72 ee 23 5f cd 8e 1c d5 96 23 9e 39 69 ef a9 f9 cf dc 8f bb b8 c2 40 2f f7 b0 49 68 3f 5d c8 7f a9 ae 6c aa 05 8f c4 8b 0b f5 5e 07 6a 78 55 9d 1d da d3 0d f9 ed dd 3e 8a 09 87 6f 10 5a 5b 0e b8 d0 57 b4 36 07 ab cb 8d f0 a1 f7 2c 50 77 64 97 7d dd 4d 5f b9 76 b3 80 f2 22 de bc e4 5d 2c 5b b3 1c 4a b8 83 d0 7b ea fc ec 07 59 9a 54 1a ae ae 11 c6 29 90 c8 1d 3c 7c 9f a5 59 79 35 2c 57 dc db 07 16 be c2 c1 f6 c2 87 51 e1 6d 9b e9 87 59 a8 fb c2 ab b8 a7 2f 72 4b 49 7a b6 66 6f e8 ba 13 7b 72 02 61 d7 44 fd 17 77 55 16 37 62 c2 43 cc 17 bc c3 ee a5 f3 cb 1b 76 e2 4c cd 1a fd ad b1 d6 53 67 f0 67 96 26 4b 2e 30 ba 57 d8 9a 06 c5 6a 23 b6 4c 69 b8 29 d2 ed ab 60 d3 0c e6 2b 77 f6 c5 df bc f5 b7 31 67 a4 9b f7 c8 44 bd 30 81 0e bb f0 4c 20 f7 c8 84 1b 6e dd f0 f4 74 55 6f 25 9c 53 0d 6e 38 11 fd 5f 28 1c 97 7a 0b b7 7a 7d a7 38 b3 6e 96 e6 aa ef 72 a5 ac f8 dc 5e e8 de 53 98 fc 9c 2f bb 27 c2 16 e4 e7 63 aa 64 3a 45 27 7c 91 77 fc 7f 65 a8 bc c3 67 d6 e5 c1 78 92 db 2a b2 de bb 0e c4 0d 47 d1 10 b2 b9 f7 a9 4b ef 67 68 3a c7 17 7d ac a7 cb 26 3c eb 71 b2 53 78 68 46 30 7d b0 10 c7 56 73 fc a9 a2 97 e4 90 da b4 4b 89 7a e0 a8 38 50 4b 74 73 6c 16 5d e2 0b 5a 75 55 d4 aa b9 e7 22 b5 bf 07 7b 05 53 31 b6 37 7e 74 dd c6 54 98 57 8c da 91 6e e7 34 ff f5 1d 06 3a 97 f7 af 20 e6 7b cf e6 9d a3 77 2d 5e 3d 71 d1 74 38 50 0b b9 0b f2 56 dd 71 49 07 af 5b bf af 10 76 42 df 13 fa 73 ac 8e aa 09 46 2f 34 b8 d4 a3 1c e7 70 9d d3 a2 4f 29 91 4d 7b ea 53 47 77 3c c9 63 2b ee 52 8c ac 51 9d 46 10 63 f8 91 ee a9 34 0d dc 63 64 f7 5f 13 22 82 79 fa c6 98 8c 31 c2 f7 10 74 55 37 67 28 24 6f bc 35 c1 43 de 79 cb 0b 7d 5c e9 54 83 c4 c7 7e f0 57 4e dd 7f f8 dc 63 b6 42 1b cf 76 a3 4e 3d e1 3c 2e 62 53 2e dc 69 c3 5a 0e c5 ad 6c a2 4a 54 91 e9 64 b7 4f e8 34 fc 32 a7 54 f1 3d f3 6b 1a 34 9e 0a d5 f1 17 1b 1d f3 70 ca 39 2b b3 b4 ba f6 c4 e5 81 df 11 ca c7 39 4c 35 a7 90 cf e9 2c 5d 1a e6 af 7b 6c 71 9b 34 a1 fc 91 9e ac 53 6a 77 0f 37 f3 a9 96 ff 91 57 2a dc
                                                                                                                                                                                                                            Data Ascii: Nx@GVXn-DU4~^Rgtu[4mn`pM<19<K=Ski9mLi./=mCzxZvW8`;9iI}NK39`~g6bLl<&"ls:{<]A\Zm,r#_#9i@/Ih?]l^jxU>oZ[W6,Pwd}M_v"],[J{YT)<|Yy5,WQmY/rKIzfo{raDwU7bCvLSgg&K.0Wj#Li)`+w1gD0L ntUo%Sn8_(zz}8nr^S/'cd:E'|wegx*GKgh:}&<qSxhF0}VsKz8PKtsl]ZuU"{S17~tTWn4: {w-^=qt8PVqI[vBsF/4pO)M{SGw<c+RQFc4cd_"y1tU7g($o5Cy}\T~WNcBvN=<.bS.iZlJTdO42T=k4p9+9L5,]{lq4Sjw7W*
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129160881 CEST97INData Raw: 95 35 1e 81 13 b9 31 d8 a1 d4 b5 1c 2a 41 c7 bb 78 e1 7f 5d 59 21 c1 0e 84 87 6b a6 77 a8 8a 25 3c e1 dd 8f bf 9b 61 a2 83 0d 9f 53 8f ca 6a db 39 fc 3b 80 36 6f 3d cb 33 5e 91 dd dc 7b 33 ca d2 59 68 4d fa 7e 20 95 4f ec e0 45 96 4e d0 fa a6 96
                                                                                                                                                                                                                            Data Ascii: 51*Ax]Y!kw%<aSj9;6o=3^{3YhM~ OENUe;E[.M=Qev~:Kn-dY'=AktoqEH=V-}P%z<ENveg)?mUsN"546`X
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129216909 CEST98INData Raw: df 5e 7b 32 bf f9 7b 6f 88 92 bb 76 c4 ad f8 55 84 35 76 3d f9 89 6e d2 16 04 5f f2 7b b7 76 61 53 26 78 a2 9f 5c 41 02 d1 57 7b 2d fe b4 f2 df d3 e6 42 8c 08 5c 87 71 bf 28 5a 03 d8 79 e3 e7 23 b2 37 45 94 3b 77 de 84 23 a7 18 b1 2b 6f aa 2c c7
                                                                                                                                                                                                                            Data Ascii: ^{2{ovU5v=n_{vaS&x\AW{-B\q(Zy#7E;w#+o,}683Knu'k}iVO8p)8/*qAMk>S=ym+v3MIms\:uuJa/<-62fMe8n^'X^%1W(jx_([8[UU
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129285097 CEST99INData Raw: 3c e1 08 0c 96 e2 13 7f 7f 2e 2f be d3 24 56 b9 5e 78 af 22 de d3 db f0 89 d1 5d d9 25 bf 90 65 83 a7 e4 1e 83 76 89 fd ad ab 0d b6 30 ce 10 2a 4c 9d 3b 1b de d4 23 f8 21 75 cd 5e 58 c7 1b 35 69 53 87 56 03 be db cf aa 50 75 cc 5d ec 53 a6 d6 7c
                                                                                                                                                                                                                            Data Ascii: <./$V^x"]%ev0*L;#!u^X5iSVPu]S|/\;fP2}v3i<~ODcMRnrrKv+R#}HyOzw-I94.|hO:ge.%Dv3]t{[C{<]|D;`^uA]hz
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129332066 CEST101INData Raw: 56 38 57 31 fd c2 a4 cf b9 07 24 18 b6 74 a2 71 e4 c4 33 0c 45 4c 76 ba e2 d7 48 93 d0 ae a8 df 2d 9d 11 f1 66 ab 3c b8 27 b0 72 4d bf cf 1e d7 c2 a9 af ad c5 c6 82 88 52 c4 ed 34 f4 33 57 f1 8b df b9 cb b8 47 89 19 70 88 ee 63 4f 1f d4 7d 7b b4
                                                                                                                                                                                                                            Data Ascii: V8W1$tq3ELvH-f<'rMR43WGpcO}{,_`nk#qw.~-jj`r!7tDe\R_Q/Has?(z{[Ot]#RWdKk&>0TD{|x'|k:%Mwols6q
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129374981 CEST102INData Raw: 83 b9 f8 52 ab 7d a9 11 8e 30 71 63 78 23 e6 c9 d7 f5 3d bc 70 f3 7f d2 59 e7 59 3a 17 ba af 63 60 ea 37 54 78 f0 c7 aa f7 b9 9a 34 56 d2 15 34 57 b4 03 07 b9 1f a4 a1 c3 ea 33 4b e7 50 cc f8 5c 5f 78 e4 8a 79 e7 53 4c 3e 3a c9 d5 9e b5 fd b6 a3
                                                                                                                                                                                                                            Data Ascii: R}0qcx#=pYY:c`7Tx4V4W3KP\_xySL>:+2HEnAe7WbGZW!B?<^554N!>%"?B(0S]]l5.7Z*Ao-t64Syixyunlw{8l
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129514933 CEST106INData Raw: d6 a6 01 8d a8 37 33 99 72 20 36 ec f0 1c bc a8 98 7f 29 0a 5f 66 be 6d 74 2f ec 40 f5 05 2c 4a d7 f5 c5 cf 74 78 ac 9e ad d3 01 a5 f3 eb cf f7 bf 72 32 04 af 1a 39 f3 9a 77 fd 0e f3 59 a7 7e 0c f1 59 b1 3e 4a 7e c3 14 db ff cd 13 3f 13 e9 de 20
                                                                                                                                                                                                                            Data Ascii: 73r 6)_fmt/@,Jtxr29wY~Y>J~? skz=O*8vGtZb.Z'j#zwtB;q{+rFY.SP=F~2n>5n'a(0+}k)'\0CU/wrw
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129585028 CEST107INData Raw: a3 e7 d4 f9 3e a5 e6 8d 5f f7 99 3a 15 ec 68 3a 53 eb 0c aa be e1 1a be a2 af 4e 60 bf 74 42 fc 93 88 fa a9 e3 76 9c bb 73 5f 28 b2 e9 14 cf 99 2a e5 4b fc 5a da b7 8f f2 48 9a 33 58 e2 d9 0b fc 71 9d a5 b3 3c ef f4 4d bf cb 28 f7 d8 b7 a9 15 d9
                                                                                                                                                                                                                            Data Ascii: >_:h:SN`tBvs_(*KZH3Xq<M(fctejO[|a]5a"%gG0E:?NfXo%!Np-30pUjF}E}scOSTwq/VsO|k>W7GEv
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129641056 CEST109INData Raw: 3d 51 f9 5c f1 84 86 6f b6 82 31 99 65 0f fc b7 3b dc 21 f7 f8 df 7a 96 ce 9d be a5 e5 85 66 da d4 6f d7 55 7f 3e e2 12 9e f4 82 bd f0 06 5d d2 7b 17 b9 7f ee 49 de ad 70 5b 1e c9 27 2b ec e8 25 cf e5 be 08 94 3a 8e df b0 ca 2d 77 3e e7 42 8e 37
                                                                                                                                                                                                                            Data Ascii: =Q\o1e;!zfoU>]{Ip['+%:-w>B7vG(-{Pdss%wn8cUMOvtC]q\?JZWN>a0L9_{j:qV6*cVI1>JZ%n"2dD=6<e
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129928112 CEST110INData Raw: 5f a3 34 d7 f4 7f 3d 71 86 ef 7b de 37 39 af 32 17 79 87 7c 24 63 11 75 e6 93 ee e0 88 01 cf cd 37 26 a2 99 3f ef 5b de bc 4f bd ea 89 79 99 5b 97 13 73 f1 8e 28 3c bb 5c c5 ab 2c 9d fa f9 83 01 5f eb 43 df a3 26 bc 62 7a d2 1c d2 d4 b9 f8 05 51
                                                                                                                                                                                                                            Data Ascii: _4=q{792y|$cu7&?[Oy[s(<\,_C&bzQ,tV:E9KBCO(l{^4:;3 x;u{+*G3LR@bSV'}%uV@L8jJ\GQwz?=1oL~- y9qVk9U
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130197048 CEST115INData Raw: d6 71 6a 4d e8 30 f8 d8 82 3a 2e 2a 85 f0 db 3d 50 9a 16 d6 f6 91 6a 74 47 8d 9b e6 49 d6 f3 e8 77 89 89 3c c8 d9 d3 81 ae 97 8a ec 7c 6b c7 fe 88 32 81 f6 df b9 ad 7e bd d7 47 d1 69 4c 79 3a e1 c6 db 40 58 6d 7c c5 57 96 4e 50 7c 95 fb 8b 3a c6
                                                                                                                                                                                                                            Data Ascii: qjM0:.*=PjtGIw<|k2~GiLy:@Xm|WNP|:~AFmq+bvx'pR__ghO8O{:74j5='G{&nT+kDk=:Ol>wfv07,1)aXntA]sb


                                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                            4192.168.2.449753152.195.19.15680C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                            Oct 13, 2023 00:30:04.964751959 CEST54OUTGET /infofiles/db/rmd/install_cfg_n.zlb HTTP/1.0
                                                                                                                                                                                                                            Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
                                                                                                                                                                                                                            User-Agent: Mozilla/4.0
                                                                                                                                                                                                                            Host: update.iobit.com
                                                                                                                                                                                                                            Range: bytes=122990-184484
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129436970 CEST103INHTTP/1.0 206 Partial Content
                                                                                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                                                                                            Age: 227240
                                                                                                                                                                                                                            Cache-Control: max-age=604800
                                                                                                                                                                                                                            Content-Range: bytes 122990-184484/245978
                                                                                                                                                                                                                            Content-Type: application/octet-stream
                                                                                                                                                                                                                            Date: Thu, 12 Oct 2023 22:30:05 GMT
                                                                                                                                                                                                                            Etag: "869216985"
                                                                                                                                                                                                                            Expires: Thu, 19 Oct 2023 22:30:05 GMT
                                                                                                                                                                                                                            Last-Modified: Tue, 10 Oct 2023 07:21:49 GMT
                                                                                                                                                                                                                            Server: ECAcc (lac/55D2)
                                                                                                                                                                                                                            X-Cache: HIT
                                                                                                                                                                                                                            Content-Length: 61495
                                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                                            Data Raw: 3f 7c 33 7b fc a9 b3 dc f7 79 a3 77 fc 3a 4b 27 0e 84 d3 f9 44 d5 b5 c8 d2 89 d2 af 5c 4b 7d 2e 9f 1a 26 6f 9b 77 81 cc f1 b2 b3 2c 9d c9 36 93 a7 8e 20 b9 a5 fd 38 d4 27 de cd d2 b9 10 9f 94 d2 01 4e 34 bc 53 57 39 6a 7b 56 8b 1d 40 cc 87 7a f4 62 8e c6 af 9f 2d ca 19 35 f1 e9 12 22 b8 c6 9a d7 4c c3 e9 cb 4c df f4 f1 47 7b ed 16 1f 72 91 63 c6 ad a8 14 73 91 22 d2 cf b1 63 69 4d ad 54 c7 03 ba eb 96 0b bc 95 3b 39 62 b2 7b f8 17 63 8e 67 ea 79 99 70 09 b7 f5 84 c5 c9 76 0f 5c 0a 2b f9 3b cd 3a 78 c7 cc af f1 98 35 7c 6e 51 9c 6c f2 fe bd ea fb af e1 ec 87 ea e6 ad e7 11 6a f4 15 b6 ad 61 25 36 b8 fd c7 f9 d4 92 21 e4 5d 10 03 97 38 ca 77 ca 63 5f 16 9e 61 50 eb bc c7 31 3f ea dc d4 90 26 bf cc 37 bf 52 85 06 78 22 0e 04 5e bb f6 94 26 f6 ed 84 8f 34 4d f9 2c a9 74 0e e8 31 75 8e d9 88 49 ad dc 81 f6 a3 76 3a c8 95 86 b1 2c 7a 47 d1 fc c3 49 c6 0c 84 78 cb 23 79 f1 59 ec 1f 79 b3 25 ae a6 7d 57 ff ec dd 95 38 49 ea 7e e6 91 b6 94 9c 97 35 68 bb ce 0f b3 84 08 1e a8 10 c9 ed 3a c4 f3 34 30 d1 ef 9e ef 1f f6 b9 88 0f 89 0e 9b d3 2c cd eb fd 53 d7 c5 be 88 b3 83 fb dc 9e 6b 9e bf 42 96 a6 63 dd c9 2e 7f b8 b2 d8 09 e7 59 9a e8 17 6c cd 39 af dd 3e cd 26 39 98 6f 28 1d 07 e2 fe 23 7d fc 09 8e ee 40 88 1b b9 e4 50 44 6b f2 7f 9c f1 cd 7c 51 f6 ae e9 f6 0d 77 75 82 01 fe d0 85 17 fe 95 11 1c 7b ca a9 54 a3 5c 44 07 c5 12 df 1f 1e b4 21 67 64 81 ee 77 4f db 8e 4e 91 50 2a 8f 55 16 37 62 e5 95 da a5 8e 73 3d f6 94 be 39 97 aa 2a d3 be a8 11 ca de 4a 9f 40 9a 96 75 6b 27 46 4f ff 11 74 d1 c6 c7 ff d0 66 3f 71 b1 4d ec 62 1d ab 1e 1d 55 e9 74 de 3d ce a0 11 0c 3d 54 ed b6 71 22 a1 75 bd d0 a0 6f 44 e7 50 59 76 b4 88 5b be ed 1f 18 af ce 2d 31 e5 0a 58 5b d7 9f 56 c2 be bd 50 17 8d 4a aa dd 2e d4 7c c0 7b b8 6f dd b6 69 25 71 8d 13 d5 57 29 4b b3 4f 6e 54 ce 4f 94 8b 95 3a 3e 62 72 44 84 79 ce bb 94 f9 4e 43 ef 7f e1 6e a9 d9 0f 81 8e e2 1c b6 a1 27 3c 97 cb d2 f4 e9 1b ce c0 89 2a 34 62 d9 05 e4 f7 41 29 5d 71 69 b4 a0 dd e8 3a 5b 5b 65 15 7d 8b e7 3e 77 1f ea bd d6 89 b6 15 0f ab 3c 48 6f f2 f3 29 7f d4 47 96 3a 59 ee 79 05 aa b2 63 51 b5 bd d6 05 9a 78 da 29 97 6e ac bc ef 5c a9 7a 32 3d e0 4c 97 c8 4a 75 fb ea a9 f7 74 12 94 ac d9 22 37 7c ec 87 7d 11 32 f2 57 27 4b 27 2e 8c b8 fd 1f 31 5a 2d 59 fa 46 bc ed 73 4f a4 7e e5 72 1e b5 c2 b1 f8 90 77 23 ec 73 d0 37 a9 53 7b 76 d2 35 c6 f7 8e 3f a8 8c 13 db e5 6e 9b 25 76 6b a2 2b 22 f9 0e ee a1 87 33 15 df 8f 1d b8 af 8a 1f 43 52 e1 fb 2b a9 9d ee 70 e4 05 c8 31 ee 26 e5 f3 b2 88 1a 67 ef a6 69 96 7d 59 e7 1e 9f fd 80 57 6a 43 77 2f 56 fc 67 ce 2c 4c 60 a3 95 7a e6 91 ab b4 8f 2b 99 99 0b d3 57 73 17 ed e3 89 2e af 22 1d 2c ba 1a 22 c3 84 3a 59 81 cf 07 a2
                                                                                                                                                                                                                            Data Ascii: ?|3{yw:K'D\K}.&ow,6 8'N4SW9j{V@zb-5"LLG{rcs"ciMT;9b{cgypv\+;:x5|nQlja%6!]8wc_aP1?&7Rx"^&4M,t1uIv:,zGIx#yYy%}W8I~5h:40,SkBc.Yl9>&9o(#}@PDk|Qwu{T\D!gdwONP*U7bs=9*J@uk'FOtf?qMbUt==Tq"uoDPYv[-1X[VPJ.|{oi%qW)KOnTO:>brDyNCn'<*4bA)]qi:[[e}>w<Ho)G:YycQx)n\z2=LJut"7|}2W'K'.1Z-YFsO~rw#s7S{v5?n%vk+"3CR+p1&gi}YWjCw/Vg,L`z+Ws.",":Y
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.129498005 CEST105INData Raw: cb 2d 46 ac ca 9d f8 0c 47 5f c9 f7 c1 d4 8e 64 cb 54 9f 7f 43 a2 e1 e3 bc 93 0d de e8 6a e9 14 d0 73 7c f5 27 a7 dd 17 e7 43 4c 49 7f ce d2 69 25 6b 0e a8 a5 eb 4d 9e fb 60 85 63 42 ee 8d fa e3 41 35 9e e6 3d 4f 3d d5 d7 2c 4d 03 8c 6a fa d9 cf
                                                                                                                                                                                                                            Data Ascii: -FG_dTCjs|'CLIi%kM`cBA5=O=,MjGN]j4wj,9F7KOD|NW:qnoO.SMs3qLLNrIx~H's:pGmPxX.SY\Y:d
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130028963 CEST111INData Raw: 90 a4 e9 cb 03 78 ec 87 06 17 5a ff 18 a7 fc 20 7b ae 45 b4 34 93 74 5f 05 11 67 45 1d 51 90 4a 22 5d ea 98 38 a5 b6 7f 72 a9 5e c1 c5 cf d6 fd 3b 5f d2 0c c6 89 4c f5 fb 7f 32 f6 6f 4d c9 6d 5b 9f e0 3b ae 2b 62 7f 87 bc 37 22 41 8e 12 6f e4 85
                                                                                                                                                                                                                            Data Ascii: xZ {E4t_gEQJ"]8r^;_L2oMm[;+b7"AogQrx@ENl>[Ub3}T'H6<o~9{GJ/OD5v?w7EV2BCCn8/77ErY?QKtoCp#(N
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130084991 CEST113INData Raw: 33 71 43 69 59 cb 27 3d 62 16 5d fa 48 47 36 a2 48 ff 98 4b 75 3e d8 ff 91 9b fe c6 a8 6f a8 7f c7 12 fb c7 92 b6 89 87 bf 4b 91 df cb c7 7c a8 5c 7b fe e6 48 8d 58 4a b7 c4 89 d3 ca 3b 38 7e 75 d6 1e 63 f7 7b 56 55 87 47 31 80 1e 52 57 e6 dc 49
                                                                                                                                                                                                                            Data Ascii: 3qCiY'=b]HG6HKu>oK|\{HXJ;8~uc{VUG1RWI;!l+?I~tLt@7Z^&')9g"TU@k@g-]'ogURGp-)~{1'GI7_zqLp^\E^eDjI
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130101919 CEST114INData Raw: 37 7c a9 0f 4c 29 52 d6 55 0c f1 1c 97 ec 5a 67 3f 98 dd 0c 93 58 cb b2 ef 51 10 3b 74 80 6b 3a e8 d8 5e 5d 50 78 ea ce c1 63 6a d4 33 36 51 c4 18 ee 9d 21 15 dd 30 63 3a 62 ba 99 fe 3e 3f cd ab fa b4 6a ba d2 ca 7e 4e 43 1f c6 ad 7f 5b 94 63 4b
                                                                                                                                                                                                                            Data Ascii: 7|L)RUZg?XQ;tk:^]Pxcj36Q!0c:b>?j~NC[cKSv97V{]s_e /XwYy^5\N';gFN.uO>,o%LwJG[X=92Dv{|o0"+DktWTweV"wB
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130597115 CEST123INData Raw: 99 36 3d e1 0e 03 da d9 e5 47 74 9a 67 55 76 44 ff be e7 12 8f 74 a4 4c a5 b6 d2 9d d3 e7 b4 e8 6f b5 7b 65 3a c5 23 77 e0 8f fa 10 7a c2 08 87 dc c0 85 bb 5c 63 df cb d2 2d 23 ef 76 dc d2 8e 09 0c 36 e2 76 95 68 d0 e7 d0 6b cf de 8c ac c8 04 0a
                                                                                                                                                                                                                            Data Ascii: 6=GtgUvDtLo{e:#wz\c-#v6vhk-$yv6T55 ]Dg{jY%un#r%qHE~=jnKO`W?A_jO|I1R,Mt/8{ClTGzTs>ZHo=fF
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130629063 CEST125INData Raw: 2d 0e 1a 48 a0 67 f5 a7 ee fd d8 9d b1 6b e2 13 1d 79 a3 a7 f2 03 9d 2c dd 4b fe 95 a5 5b f8 ca 7a 1a 66 79 f2 e2 18 56 fd 90 fe 1c 49 e0 6e 3d c9 22 7d b4 2b f9 f0 e6 0d 14 a5 48 3a 74 e8 19 9e fc 86 bd 7e c3 b9 73 d9 9d 74 ef 51 3f c7 fa 07 f2
                                                                                                                                                                                                                            Data Ascii: -Hgky,K[zfyVIn="}+H:t~stQ?`'K%)]?2OsIO,uYS/sa|Ay(8vzfcYAu\yo^-6>u_2%uE64rW;
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130673885 CEST126INData Raw: d8 ad d1 19 78 e6 8c f8 75 7a ac fc c6 6f f0 d3 c2 a9 7d c4 9b 0d 3f a9 cc 99 8e 4f 71 07 d7 ae f8 6c cd 2c dd 79 be e5 99 57 4c 30 b8 b1 32 36 f2 3b 93 5c b3 4a 5d 5d 1f f6 eb 0f d5 71 22 51 12 6c ee c2 39 fc 8a 43 ec 63 84 73 d3 6c 62 c2 c2 85
                                                                                                                                                                                                                            Data Ascii: xuzo}?Oql,yWL026;\J]]q"Ql9Ccslb6v{Q:9+`3-K}AdQFs4g)=.xSCRChMv'MeCsP6ghKC>GljhqvK1Fn@yFi
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130743027 CEST127INData Raw: b2 72 ba a7 0e 8d 3b b8 79 43 d7 28 60 b0 45 55 3c aa 5d f0 b8 70 8f bf 74 30 55 ec 86 3d a9 85 73 49 a3 8a 75 d8 a1 96 1f a8 39 4d cf ea d3 0c 82 3e 0d f5 80 5a 90 fc c3 a5 bc 60 9a b2 f6 c0 bd ab 63 f3 6f 79 d7 d5 73 9e 01 7f 50 7f f7 61 c9 a6
                                                                                                                                                                                                                            Data Ascii: r;yC(`EU<]pt0U=sIu9M>Z`coysPa"K"I5GXLb?5%<&}pAGO*M_B-ZAQz>-L+!kyt<xMgMzZj ]1M9!_G.345;jzn(Wl2lv$s
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130865097 CEST129INData Raw: 21 ff 32 0e f5 ea 84 09 c4 73 e2 eb 63 f2 4f dc 34 fc cd f9 3a 81 f8 5f f4 dc ef a4 fe ee ac a5 78 17 33 ae d4 a1 93 7c 48 d9 6e 70 b5 2e 20 e9 3e 06 b5 b5 cf e2 56 c3 f7 1c b5 a4 5a 7c 4b 83 2f ca ea ee 53 60 4e e0 a8 2a 76 30 ca bb 17 ef f2 64
                                                                                                                                                                                                                            Data Ascii: !2scO4:_x3|Hnp. >VZ|K/S`N*v0d=T^w;~$X]?f\)G7WQ5KwuKYDFflTu/tN{-l/CYB7LEI~WI_iAet<64c;bB:8=>%
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.130911112 CEST130INData Raw: 4f 7e df 38 eb 2f bd ef f7 2c 4d 3a 1c f0 ca 23 25 90 66 bc 47 b7 ee c6 a9 5f c2 30 7e 9c ca fb f6 d2 92 ab f1 c7 89 18 39 97 1e 78 af 53 e7 48 95 d7 bb 86 e3 96 39 de bd a3 14 0f 64 6c 5f 20 89 a8 a0 6f 54 83 63 7f fe ef 79 53 73 c6 96 70 ae 22
                                                                                                                                                                                                                            Data Ascii: O~8/,M:#%fG_0~9xSH9dl_ oTcySsp"N:?G)}@3|w?f[\o>y<08GS'9>iUlx=T.:>:{ORYNe_dOf_T+YeveQ:%y*


                                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                            5192.168.2.449755152.195.19.15680C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.788088083 CEST313OUTGET /infofiles/ac/appver-ac.upt HTTP/1.0
                                                                                                                                                                                                                            Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
                                                                                                                                                                                                                            User-Agent: Mozilla/4.0
                                                                                                                                                                                                                            Host: update.iobit.com
                                                                                                                                                                                                                            Oct 13, 2023 00:30:05.951330900 CEST314INHTTP/1.0 200 OK
                                                                                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                                                                                            Age: 328823
                                                                                                                                                                                                                            Cache-Control: max-age=604800
                                                                                                                                                                                                                            Content-Type: application/octet-stream
                                                                                                                                                                                                                            Date: Thu, 12 Oct 2023 22:30:05 GMT
                                                                                                                                                                                                                            Etag: "3018307681"
                                                                                                                                                                                                                            Expires: Thu, 19 Oct 2023 22:30:05 GMT
                                                                                                                                                                                                                            Last-Modified: Mon, 09 Oct 2023 03:08:48 GMT
                                                                                                                                                                                                                            Server: ECAcc (lac/55C0)
                                                                                                                                                                                                                            X-Cache: HIT
                                                                                                                                                                                                                            Content-Length: 851
                                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                                            Data Raw: 5b 61 70 70 76 65 72 73 69 6f 6e 5d 0d 0a 61 73 63 3d 31 36 2e 36 2e 30 2e 32 35 39 0d 0a 64 62 3d 31 30 2e 36 2e 30 2e 31 34 31 0d 0a 69 75 3d 31 33 2e 30 2e 30 2e 31 33 0d 0a 69 6d 66 3d 31 30 2e 34 2e 30 2e 31 31 30 34 0d 0a 61 73 63 75 3d 31 36 2e 32 2e 30 2e 31 38 0d 0a 73 64 3d 39 2e 30 2e 30 2e 33 30 37 0d 0a 69 6f 74 3d 34 2e 33 2e 31 2e 31 35 36 31 0d 0a 69 73 75 3d 36 2e 31 2e 30 2e 31 30 0d 0a 73 6d 38 3d 36 2e 30 2e 30 2e 32 0d 0a 73 6d 67 62 3d 35 2e 32 2e 34 2e 36 34 33 0d 0a 69 74 6f 70 3d 35 2e 30 2e 30 2e 34 37 38 35 0d 0a 69 73 72 3d 34 2e 31 2e 30 2e 38 38 39 0d 0a 69 76 62 3d 33 2e 31 2e 30 2e 32 35 35 0d 0a 69 70 62 3d 33 2e 32 2e 30 2e 32 37 35 0d 0a 69 64 72 3d 33 2e 36 2e 30 2e 31 31 32 0d 0a 64 70 6d 3d 31 2e 34 2e 30 2e 31 34 0d 0a 70 64 66 3d 33 2e 35 2e 30 2e 31 38 0d 0a 69 65 64 3d 32 2e 31 2e 30 2e 33 38 0d 0a 0d 0a 5b 50 72 6f 64 75 63 74 5f 50 5d 0d 0a 43 6f 6d 70 61 72 61 64 69 67 68 74 3d 31 0d 0a 41 63 74 69 6f 6e 43 65 6e 74 65 72 5f 43 6f 6d 70 61 72 61 64 69 67 68 74 3d 32 0d 0a 41 53 43 5f 76 65 72 73 69 6f 6e 3d 31 36 2e 36 2e 30 2e 32 35 39 0d 0a 41 53 43 55 5f 76 65 72 73 69 6f 6e 3d 31 36 2e 33 2e 30 2e 33 30 0d 0a 44 42 5f 76 65 72 73 69 6f 6e 3d 31 31 2e 30 2e 30 2e 32 31 0d 0a 46 50 5f 76 65 72 73 69 6f 6e 3d 33 2e 30 2e 32 2e 32 31 33 35 0d 0a 49 4d 46 5f 76 65 72 73 69 6f 6e 3d 31 30 2e 34 2e 30 2e 31 31 30 34 0d 0a 49 55 5f 76 65 72 73 69 6f 6e 3d 31 33 2e 31 2e 30 2e 33 0d 0a 49 4f 54 5f 76 65 72 73 69 6f 6e 3d 34 2e 33 2e 31 2e 31 35 36 31 0d 0a 49 53 55 5f 76 65 72 73 69 6f 6e 3d 36 2e 31 2e 30 2e 31 30 0d 0a 69 74 6f 70 5f 76 65 72 73 69 6f 6e 3d 35 2e 30 2e 30 2e 34 37 38 35 0d 0a 76 70 6e 5f 76 65 72 73 69 6f 6e 3d 34 2e 35 2e 31 2e 34 31 39 30 0d 0a 49 56 43 5f 76 65 72 73 69 6f 6e 3d 31 2e 30 2e 31 2e 32 36 30 36 0d 0a 53 44 5f 76 65 72 73 69 6f 6e 3d 39 2e 31 2e 30 2e 33 31 39 0d 0a 53 47 42 5f 76 65 72 73 69 6f 6e 3d 33 2e 31 2e 31 2e 31 35 31 0d 0a 53 4d 38 5f 76 65 72 73 69 6f 6e 3d 36 2e 30 2e 30 2e 32 0d 0a 53 4d 47 42 5f 76 65 72 73 69 6f 6e 3d 35 2e 32 2e 34 2e 36 34 33 0d 0a 49 53 52 5f 76 65 72 73 69 6f 6e 3d 34 2e 32 2e 30 2e 31 30 38 36 0d 0a 49 56 42 5f 76 65 72 73 69 6f 6e 3d 33 2e 30 2e 30 2e 32 34 36 0d 0a 49 50 42 5f 76 65 72 73 69 6f 6e 3d 33 2e 32 2e 30 2e 32 37 35 0d 0a 49 44 52 5f 76 65 72 73 69 6f 6e 3d 34 2e 30 2e 30 2e 34 37 35 0d 0a 44 50 4d 5f 76 65 72 73 69 6f 6e 3d 31 2e 34 2e 30 2e 31 34 0d 0a 50 44 46 5f 76 65 72 73 69 6f 6e 3d 33 2e 35 2e 30 2e 31 38 0d 0a 49 45 44 5f 76 65 72 73 69 6f 6e 3d 32 2e 31 2e 30 2e 33 34 0d 0a
                                                                                                                                                                                                                            Data Ascii: [appversion]asc=16.6.0.259db=10.6.0.141iu=13.0.0.13imf=10.4.0.1104ascu=16.2.0.18sd=9.0.0.307iot=4.3.1.1561isu=6.1.0.10sm8=6.0.0.2smgb=5.2.4.643itop=5.0.0.4785isr=4.1.0.889ivb=3.1.0.255ipb=3.2.0.275idr=3.6.0.112dpm=1.4.0.14pdf=3.5.0.18ied=2.1.0.38[Product_P]Comparadight=1ActionCenter_Comparadight=2ASC_version=16.6.0.259ASCU_version=16.3.0.30DB_version=11.0.0.21FP_version=3.0.2.2135IMF_version=10.4.0.1104IU_version=13.1.0.3IOT_version=4.3.1.1561ISU_version=6.1.0.10itop_version=5.0.0.4785vpn_version=4.5.1.4190IVC_version=1.0.1.2606SD_version=9.1.0.319SGB_version=3.1.1.151SM8_version=6.0.0.2SMGB_version=5.2.4.643ISR_version=4.2.0.1086IVB_version=3.0.0.246IPB_version=3.2.0.275IDR_version=4.0.0.475DPM_version=1.4.0.14PDF_version=3.5.0.18IED_version=2.1.0.34


                                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                            6192.168.2.449756152.195.19.15680C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.129302979 CEST315OUTGET /infofiles/itop/itopav.upt HTTP/1.0
                                                                                                                                                                                                                            Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
                                                                                                                                                                                                                            User-Agent: Mozilla/4.0
                                                                                                                                                                                                                            Host: update.iobit.com
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.291605949 CEST315INHTTP/1.0 200 OK
                                                                                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                                                                                            Age: 4460665
                                                                                                                                                                                                                            Cache-Control: max-age=604800
                                                                                                                                                                                                                            Content-Type: application/octet-stream
                                                                                                                                                                                                                            Date: Thu, 12 Oct 2023 22:30:06 GMT
                                                                                                                                                                                                                            Etag: "935634287"
                                                                                                                                                                                                                            Expires: Thu, 19 Oct 2023 22:30:06 GMT
                                                                                                                                                                                                                            Last-Modified: Wed, 23 Feb 2022 03:42:59 GMT
                                                                                                                                                                                                                            Server: ECAcc (lac/55D7)
                                                                                                                                                                                                                            X-Cache: HIT
                                                                                                                                                                                                                            Content-Length: 336
                                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                                            Data Raw: ff fe 5b 00 50 00 5f 00 4d 00 63 00 41 00 66 00 65 00 65 00 5d 00 0d 00 0a 00 44 00 69 00 73 00 70 00 6c 00 61 00 79 00 4e 00 61 00 6d 00 65 00 3d 00 28 00 28 00 27 00 4d 00 63 00 41 00 66 00 65 00 65 00 27 00 20 00 26 00 20 00 28 00 27 00 41 00 6e 00 74 00 69 00 56 00 69 00 72 00 75 00 73 00 27 00 20 00 7c 00 20 00 27 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 27 00 20 00 7c 00 20 00 27 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 69 00 6f 00 6e 00 27 00 20 00 7c 00 20 00 27 00 4c 00 69 00 76 00 65 00 53 00 61 00 66 00 65 00 27 00 20 00 7c 00 20 00 27 00 46 00 69 00 72 00 65 00 77 00 61 00 6c 00 6c 00 27 00 20 00 7c 00 20 00 27 00 56 00 50 00 4e 00 27 00 29 00 29 00 20 00 7c 00 20 00 28 00 27 00 c8 8f 4b 51 f2 83 27 00 29 00 20 00 7c 00 20 00 28 00 27 00 42 00 54 00 20 00 4e 00 65 00 74 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 27 00 20 00 7c 00 20 00 27 00 46 00 69 00 72 00 65 00 77 00 61 00 6c 00 6c 00 27 00 20 00 7c 00 20 00 27 00 56 00 50 00 4e 00 27 00 29 00 29 00 0d 00 0a 00
                                                                                                                                                                                                                            Data Ascii: [P_McAfee]DisplayName=(('McAfee' & ('AntiVirus' | 'Security' | 'Protection' | 'LiveSafe' | 'Firewall' | 'VPN')) | ('KQ') | ('BT NetProtect' | 'Firewall' | 'VPN'))


                                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                            7192.168.2.449758152.195.19.15680C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.631412983 CEST317OUTGET /dl/img/inst/img_screenshot_ied.png HTTP/1.0
                                                                                                                                                                                                                            Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
                                                                                                                                                                                                                            User-Agent: Mozilla/4.0
                                                                                                                                                                                                                            Host: update.iobit.com
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795044899 CEST318INHTTP/1.0 200 OK
                                                                                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                                                                                            Age: 4461586
                                                                                                                                                                                                                            Cache-Control: max-age=604800
                                                                                                                                                                                                                            Content-Type: image/png
                                                                                                                                                                                                                            Date: Thu, 12 Oct 2023 22:30:06 GMT
                                                                                                                                                                                                                            Etag: "4180324065"
                                                                                                                                                                                                                            Expires: Thu, 19 Oct 2023 22:30:06 GMT
                                                                                                                                                                                                                            Last-Modified: Thu, 03 Aug 2023 01:28:51 GMT
                                                                                                                                                                                                                            Server: ECAcc (lac/55CE)
                                                                                                                                                                                                                            X-Cache: HIT
                                                                                                                                                                                                                            Content-Length: 63485
                                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                                            Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 90 00 00 01 90 08 06 00 00 00 80 bf 36 cc 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 20 00 49 44 41 54 78 5e ec 7d 07 a0 56 c5 d1 f6 dc 42 87 0b 28 28 5d 44 05 15 7b 8b 35 d8 4b f4 4b f2 c5 5e 12 8d 88 5d b1 d7 d8 4b ec d8 1b 16 ec 31 76 40 44 40 14 1b 2a 36 44 50 b1 80 62 ef 82 d2 6e fb 67 76 b6 cc ee 39 e7 bd 97 37 ff 97 a8 99 a3 97 f7 94 ad cf ce ce b3 33 bb 67 4f 05 e8 a1 08 28 02 8a 80 22 a0 08 94 81 40 45 19 71 34 8a 22 a0 08 28 02 8a 80 22 00 4a 20 2a 04 8a 80 22 a0 08 28 02 65 21 a0 04 52 16 6c 1a 49 11 50 04 14 01 45 40 09 44 65 40 11 50 04 14 01 45 a0 2c 04 94 40 ca 82 4d 23 29 02 8a 80 22 a0 08 28 81 a8 0c 28 02 8a 80 22 a0 08 94 85 80 12 48 59 b0 69 24 45 40 11 50 04 14 01 25 10 95 01 45 40 11 50 04 14 81 b2 10 50 02 29 0b 36 8d a4 08 28 02 8a 80 22 a0 04 a2 32 a0 08 28 02 8a 80 22 50 16 02 4a 20 65 c1 a6 91 14 01 45 40 11 50 04 94 40 54 06 14 01 45 40 11 50 04 ca 42 40 09 a4 2c d8 34 92 22 a0 08 28 02 8a 80 12 88 ca 80 22 a0 08 28 02 8a 40 59 08 28 81 94 05 9b 46 52 04 14 01 45 40 11 50 02 51 19 50 04 14 01 45 40 11 28 0b 01 25 90 b2 60 d3 48 8a 80 22 a0 08 28 02 4a 20 2a 03 8a 80 22 a0 08 28 02 65 21 a0 04 52 16 6c 1a 49 11 50 04 14 01 45 40 09 44 65 40 11 50 04 14 01 45 a0 2c 04 94 40 ca 82 4d 23 29 02 8a 80 22 a0 08 28 81 a8 0c 28 02 8a 80 22 a0 08 94 85 80 12 48 59 b0 69 24 45 40 11 50 04 14 01 25 10 95 01 45 40 11 50 04 14 81 b2 10 50 02 29 0b 36 8d a4 08 28 02 8a 80 22 a0 04 a2 32 a0 08 28 02 8a 80 22 50 16 02 4a 20 65 c1 a6 91 14 01 45 40 11 50 04 94 40 54 06 14 01 45 40 11 50 04 ca 42 40 09 a4 2c d8 34 92 22 a0 08 28 02 8a 80 12 88 ca 80 22 a0 08 28 02 8a 40 59 08 28 81 94 05 9b 46 52 04 14 01 45 40 11 50 02 51 19 50 04 14 01 45 40 11 28 0b 01 25 90 b2 60 d3 48 8a 80 22 a0 08 28 02 4a 20 2a 03 8a 80 22 a0 08 28 02 65 21 a0 04 52 16 6c 1a 49 11 50 04 14 01 45 40 09 44 65 40 11 50 04 14 01 45 a0 2c 04 94 40 ca 82 4d 23 29 02 8a 80 22 a0 08 28 81 a8 0c 28 02 8a 80 22 a0 08 94 85 80 12 48 59 b0 69 24 45 40 11 50 04 14 01 25 10 95 01 45 40 11 50 04 14 81 b2 10 50 02 29 0b 36 8d a4 08 28 02 8a 80 22 a0 04 a2 32 a0 08 28 02 8a 80 22 50 16 02 4a 20 65 c1 a6 91 14 01 45 40 11 50 04 94 40 54 06 14 01 45 40 11 50 04 ca 42 40 09 a4 2c d8 34 92 22 a0 08 28 02 8a 80 12 88 ca 80 22 a0 08 28 02 8a 40 59 08 28 81 94 05 9b 46 52 04 14 01 45 40 11 50 02 51 19 50 04 14 01 45 40 11 28 0b 01 25 90 b2 60 d3 48 8a 80 22 a0 08 28 02 4a 20 2a 03 8a 80 22 a0 08 28 02 65 21 a0 04 52 16 6c 1a 49 11 50 04 14 01 45 40 09 44 65 40 11 50 04 14 01 45 a0 2c 04 94 40 ca 82 4d 23 29 02 8a 80 22 a0 08 28 81 a8 0c 28 02 8a 80 22 a0 08 94 85 80 12 48 59 b0 69 24 45 40 11 50 04 14 01 25 10 95 01 45 40 11 50 04 14 81 b2 10 50 02 29 0b 36 8d a4 08 28 02 8a 80 22 a0 04 a2 32 a0 08 28 02 8a 80 22 50 16 02 4a 20 65 c1 a6 91 14 01 45 40 11 50 04 94 40 54 06
                                                                                                                                                                                                                            Data Ascii: PNGIHDR6sBIT|d IDATx^}VB((]D{5KK^]K1v@D@*6DPbngv973gO("@Eq4"("J *"(e!RlIPE@De@PE,@M#)"(("HYi$E@P%E@PP)6("2("PJ eE@P@TE@PB@,4"("(@Y(FRE@PQPE@(%`H"(J *"(e!RlIPE@De@PE,@M#)"(("HYi$E@P%E@PP)6("2("PJ eE@P@TE@PB@,4"("(@Y(FRE@PQPE@(%`H"(J *"(e!RlIPE@De@PE,@M#)"(("HYi$E@P%E@PP)6("2("PJ eE@P@TE@PB@,4"("(@Y(FRE@PQPE@(%`H"(J *"(e!RlIPE@De@PE,@M#)"(("HYi$E@P%E@PP)6("2("PJ eE@P@T
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795087099 CEST319INData Raw: 14 01 45 40 11 50 04 ca 42 40 09 a4 2c d8 34 92 22 a0 08 28 02 8a 80 12 88 ca 80 22 a0 08 28 02 8a 40 59 08 28 81 94 05 9b 46 52 04 14 01 45 40 11 50 02 51 19 50 04 14 01 45 40 11 28 0b 01 25 90 b2 60 d3 48 8a 80 22 a0 08 28 02 4a 20 2a 03 8a 80
                                                                                                                                                                                                                            Data Ascii: E@PB@,4"("(@Y(FRE@PQPE@(%`H"(J *"(e!RlIPE@De@PE,@M#)"(("HYi$E@P%E@PP)6("2("PJ eE@P@TE@PB@,4"("
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795126915 CEST321INData Raw: 76 7c 7c dc b8 4a 9d 38 ff f9 09 aa 96 48 11 f8 4f 23 50 5d 5d dd 30 e4 80 03 16 d6 d6 d5 1d 38 7c f8 f0 bb fe d3 e5 f9 39 e4 af 04 82 ad b0 f9 e6 9b 57 0f da 6c b3 47 5e 78 f1 c5 1d c6 4f 98 00 4a 20 3f 07 d1 d4 32 28 02 3f 2f 04 70 69 6f c3 81
                                                                                                                                                                                                                            Data Ascii: v||J8HO#P]]08|9WlG^xOJ ?2(?/pioC,Xk8~^Fq?3[TW|Wp{O=?;beuIO?]J RiU/QHA&9`Kjtzy(4A Gw"V
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795166969 CEST322INData Raw: d3 b9 49 69 0a a4 f3 04 da 75 24 af 24 84 50 b3 0e 61 a5 51 d4 19 c2 33 1a 75 d2 e8 91 47 8c d4 c2 c6 bd 63 6b 51 4d 6a 5d 28 5e d7 c4 92 28 cc e8 96 14 1d 45 b2 64 93 8e 1c dd b5 53 64 b2 13 f2 e8 94 94 4e c8 4b c6 67 02 23 a5 87 c1 5c fa 4e cb
                                                                                                                                                                                                                            Data Ascii: Iiu$$PaQ3uGckQMj](^(EdSdNKg#\N,Y<z5h-ICUN1,V_CBW[c$+|cCQalYI4v2dCm\P6;bADd{JML`
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795239925 CEST323INData Raw: b0 5b cb fd b2 c5 b9 18 07 09 4c 2a dc c6 2c 35 89 95 c5 d5 e5 f4 0d 81 04 cb 32 1a 78 51 dd 88 40 d0 2a 30 f2 82 6e 2a f7 3c 33 11 cf 10 7b d2 4c eb ca d7 59 55 27 f3 33 ab b6 1c c1 db f4 5e 7f fd 61 25 90 a4 5f a5 97 4a 20 88 48 29 0b e4 6f 07
                                                                                                                                                                                                                            Data Ascii: [L*,52xQ@*0n*<3{LYU'3^a%_J H)oE/O,Br1YO%DQ&}w:M*sZdZG8y<~#?YVz{Shp'Fa3aFfh&y-3c\&`x{fgZRjXj*\j={e
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795370102 CEST325INData Raw: c2 76 30 a3 6c 10 cd 97 a6 4f b6 6a 25 d6 b4 e9 28 3a ab 87 4b 68 b4 dc 9e 19 df f4 1e 5e d9 cb 9d 0e 4e 34 ad 54 26 b1 66 2e a5 aa 72 9e e5 55 4a d4 3e 56 31 e2 aa 20 5e 26 07 ab fd 3c 49 26 9a b3 18 b1 a0 74 b2 a5 ce 19 29 27 1a 87 42 ac d6 77
                                                                                                                                                                                                                            Data Ascii: v0lOj%(:Kh^N4T&f.rUJ>V1 ^&<I&t)'Bwu;ng#X@D,XWyK"%/~Tz%&9~OkxBH=?+koyzR'|-#{-;.8nCx.CUXjUAMQO=vcE@B_7\$$Q^
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795409918 CEST326INData Raw: 39 8f 65 4b 1e 45 4d 6b 94 7b 24 03 7c 15 dd 2b 48 2b 4f 8e 8a 90 a4 f7 76 06 f4 44 02 31 3b fd f2 d6 8f 94 8b 5b 57 c7 5b dd c4 c7 c3 2f de 9b b1 40 94 40 62 8c 94 40 10 8f 92 04 72 d8 19 8c 58 e2 6b 75 a3 22 39 82 a1 09 b9 67 de 7c d9 8a 66 4e
                                                                                                                                                                                                                            Data Ascii: 9eKEMk{$|+H+OvD1;[W[/@@b@rXku"9g|fNrLG`y(DSE"@(~C?[#,i>=t?9p_};cFAL#&[mm5'|{Y8SwmX}e\x?sf}7]vCGc
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795483112 CEST327INData Raw: 34 b7 bb 2b 91 cd 6d 33 71 33 df 4e 49 b0 c5 b6 1a d8 8b 09 c4 59 1b b4 a4 97 b6 a6 37 73 9b 76 ff 2d 96 2f de ab ec fe 17 d4 85 95 2f a1 e1 6e b3 f5 4f 53 09 fd 92 9f 97 22 90 ab 87 9e 8e c2 6f 86 2b a1 df d3 ea 8d 48 80 83 4b ea e9 37 5e b2 04
                                                                                                                                                                                                                            Data Ascii: 4+m3q3NIY7sv-//nOS"o+HK7^CN]'yP\$domwyA>6;h,;d'/-;ag}h2q${>,T"+fAVz\}\b&%z+e
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795555115 CEST329INData Raw: 99 17 09 d3 55 58 b7 1d 77 b2 f9 68 8e fd 2a 86 d7 06 ac 18 e9 c3 3a f1 c7 92 26 bc f6 b2 f7 a5 4a 92 91 5a 36 af 53 49 1d 50 52 0d d8 87 cd 51 5a 51 03 15 25 5a 5a e7 64 46 a3 9c 66 a2 8a 13 65 90 67 91 48 22 91 ca 86 ce 53 65 19 13 52 a8 45 aa
                                                                                                                                                                                                                            Data Ascii: UXwh*:&JZ6SIPRQZQ%ZZdFfegH"SeRE"R1G%b6ic7_TYT2.KcM[@r@OUu^J@ C2"(m"e.~QPHIQ}Xhxg.vua!A:E~G
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795594931 CEST330INData Raw: e1 c7 1e 7b ec 88 52 b2 f8 df f2 4c 09 04 5b 9a 08 a4 13 12 c8 04 24 90 31 09 81 8c 39 9d df 8a f6 8a c1 8f 76 4c d7 0b ee 2c 1a c6 e0 46 6d 8f bd 42 ab b0 ac b2 c9 51 b2 69 27 c8 76 1e a1 94 64 4f 11 5d 3c 4f e1 35 5b d9 24 69 fa b2 26 09 e4 11
                                                                                                                                                                                                                            Data Ascii: {RL[$19vL,FmBQi'vdO]<O5[$i&E$?H+MzJ?NX-d\}gHcX62^\p8+qNf-#A9Z4tSH93EB'&r@"FVe_a%?xE
                                                                                                                                                                                                                            Oct 13, 2023 00:30:06.795664072 CEST332INData Raw: df fb 91 be bd 7b 26 65 b7 32 39 f2 c8 23 cd 5e 58 4a 20 0c 5c 93 83 96 52 1d f5 d7 f2 8c 08 a4 73 a7 4e a3 26 4c 98 b0 dd a3 09 81 bc 36 ec 74 1e 9d e1 ff 34 5a 24 02 31 6f 05 e0 35 7d 06 b3 82 de 50 27 df 69 43 bd 79 9f e0 de c9 d6 dd 61 95 a7
                                                                                                                                                                                                                            Data Ascii: {&e29#^XJ \RsN&L6t4Z$1o5}P'iCya4GU]w$L$EQ.Y"//;xFIy+}f[f!klV2Y$tbHEFNJ4K%S"#K/mQ<I+/G+9j


                                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                            8192.168.2.449759152.195.19.15680C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                            Oct 13, 2023 00:30:07.122168064 CEST388OUTGET /dl/img/inst/logo_ied.png HTTP/1.0
                                                                                                                                                                                                                            Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
                                                                                                                                                                                                                            User-Agent: Mozilla/4.0
                                                                                                                                                                                                                            Host: update.iobit.com
                                                                                                                                                                                                                            Oct 13, 2023 00:30:07.284154892 CEST390INHTTP/1.0 200 OK
                                                                                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                                                                                            Age: 4461587
                                                                                                                                                                                                                            Cache-Control: max-age=604800
                                                                                                                                                                                                                            Content-Type: image/png
                                                                                                                                                                                                                            Date: Thu, 12 Oct 2023 22:30:07 GMT
                                                                                                                                                                                                                            Etag: "452507291"
                                                                                                                                                                                                                            Expires: Thu, 19 Oct 2023 22:30:07 GMT
                                                                                                                                                                                                                            Last-Modified: Tue, 30 Aug 2022 02:54:20 GMT
                                                                                                                                                                                                                            Server: ECAcc (lac/5596)
                                                                                                                                                                                                                            X-Cache: HIT
                                                                                                                                                                                                                            Content-Length: 5033
                                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                                            Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 06 01 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 36 2e 30 2d 63 30 30 32 20 37 39 2e 31 36 34 34 38 38 2c 20 32 30 32 30 2f 30 37 2f 31 30 2d 32 32 3a 30 36 3a 35 33 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 22 20 78 6d 6c 6e 73 3a 78 6d 70 4d 4d 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 6d 6d 2f 22 20 78 6d 6c 6e 73 3a 73 74 52 65 66 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 73 54 79 70 65 2f 52 65 73 6f 75 72 63 65 52 65 66 23 22 20 78 6d 6c 6e 73 3a 73 74 45 76 74 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 73 54 79 70 65 2f 52 65 73 6f 75 72 63 65 45 76 65 6e 74 23 22 20 78 6d 6c 6e 73 3a 78 6d 70 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 22 20 78 6d 6c 6e 73 3a 64 63 3d 22 68 74 74 70 3a 2f 2f 70 75 72 6c 2e 6f 72 67 2f 64 63 2f 65 6c 65 6d 65 6e 74 73 2f 31 2e 31 2f 22 20 78 6d 6c 6e 73 3a 70 68 6f 74 6f 73 68 6f 70 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 70 68 6f 74 6f 73 68 6f 70 2f 31 2e 30 2f 22 20 78 6d 70 4d 4d 3a 4f 72 69 67 69 6e 61 6c 44 6f 63 75 6d 65 6e 74 49 44 3d 22 78 6d 70 2e 64 69 64 3a 32 42 30 30 37 43 31 35 42 41 45 37 45 32 31 31 38 36 34 46 46 32 38 38 35 34 43 42 43 33 36 34 22 20 78 6d 70 4d 4d 3a 44 6f 63 75 6d 65 6e 74 49 44 3d 22 78 6d 70 2e 64 69 64 3a 43 44 32 35 46 45 45 38 30 37 30 46 31 31 45 44 42 31 31 37 43 38 32 34 31 35 45 44 32 33 37 41 22 20 78 6d 70 4d 4d 3a 49 6e 73 74 61 6e 63 65 49 44 3d 22 78 6d 70 2e 69 69 64 3a 31 38 37 36 38 31 65 38 2d 65 32 39 65 2d 34 32 34 61 2d 62 39 33 32 2d 39 34 65 39 62 61 65 61 65 63 39 62 22 20 78 6d 70 3a 43 72 65 61 74 6f 72 54 6f 6f 6c 3d 22 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 20 28 57 69 6e 64 6f 77 73 29 22 20 78 6d 70 3a 43 72 65 61 74 65 44 61 74 65 3d 22 32 30 32 32 2d 30 38 2d 33 30 54 31 30 3a 30 35 3a 30 34 2b 30 38 3a 30 30 22 20 78 6d 70 3a 4d 6f 64 69 66 79 44 61 74
                                                                                                                                                                                                                            Data Ascii: PNGIHDR22?pHYsiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmpMM:OriginalDocumentID="xmp.did:2B007C15BAE7E211864FF28854CBC364" xmpMM:DocumentID="xmp.did:CD25FEE8070F11EDB117C82415ED237A" xmpMM:InstanceID="xmp.iid:187681e8-e29e-424a-b932-94e9baeaec9b" xmp:CreatorTool="Adobe Photoshop CC 2017 (Windows)" xmp:CreateDate="2022-08-30T10:05:04+08:00" xmp:ModifyDat
                                                                                                                                                                                                                            Oct 13, 2023 00:30:07.284198046 CEST391INData Raw: 65 3d 22 32 30 32 32 2d 30 38 2d 33 30 54 31 30 3a 30 36 3a 31 38 2b 30 38 3a 30 30 22 20 78 6d 70 3a 4d 65 74 61 64 61 74 61 44 61 74 65 3d 22 32 30 32 32 2d 30 38 2d 33 30 54 31 30 3a 30 36 3a 31 38 2b 30 38 3a 30 30 22 20 64 63 3a 66 6f 72 6d
                                                                                                                                                                                                                            Data Ascii: e="2022-08-30T10:06:18+08:00" xmp:MetadataDate="2022-08-30T10:06:18+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:86dd2433-17ec-4642-bfeb-a80e3dc6803
                                                                                                                                                                                                                            Oct 13, 2023 00:30:07.284235001 CEST392INData Raw: 08 fc f8 fd d9 ea 80 28 82 8c 07 6b af 5b c6 dc 15 37 f0 e0 1f de c9 f8 d0 41 0a 73 16 a3 a1 df 7a d3 9d 9b ad 5f 11 c1 af 4d 71 ee f4 30 77 dc f3 20 2b d7 5c c3 d1 83 11 53 13 01 46 a4 2e b4 88 34 00 8a ef 51 65 28 eb b1 f6 86 6b b9 fb cf ee e5
                                                                                                                                                                                                                            Data Ascii: (k[7Asz_Mq0w +\SF.4Qe(kE|+ajGD2W,/ycj1k?lWPI5J%b8szRu.&`b<"}_&'CNw5J7>J3/xtYvyjYFW]GaLB|yS1J
                                                                                                                                                                                                                            Oct 13, 2023 00:30:07.284272909 CEST394INData Raw: d0 47 9d b6 ad d7 da 02 51 85 5c 3e cb d1 23 87 a9 54 e6 f2 f0 e7 be c0 8d 37 6f 40 bd 02 ae 4d 0f ad 4e 09 9d b2 60 c1 e5 2c 9f 9f 67 5b 3f 3c f9 32 bc fa d5 df 67 cf cb cf 10 01 77 fc c1 1f f1 5b bf f6 7e 32 85 0e fc 20 ac 6f 44 da 6d 02 58 63
                                                                                                                                                                                                                            Data Ascii: GQ\>#T7o@MN`,g[?<2gw[~2 oDmXc$v_%K4L& ~<ojjh{*cY}/8<t/>Pcz'C_A`imZ&=_}~5{;rAX#
                                                                                                                                                                                                                            Oct 13, 2023 00:30:07.284311056 CEST394INData Raw: 58 c3 13 13 93 84 61 eb 8d 68 45 e5 72 19 11 69 a7 89 94 7e e2 a9 ea 53 aa da 1e 08 c9 01 4c ae 40 36 df a6 cf 6c 22 55 88 9a e2 72 1c 44 20 97 cb 91 cf e7 a7 bf 78 81 1f 19 5c 00 40 4a af 48 b1 58 ec 75 ce ed 12 91 16 7e f2 ff 86 6e f0 9c 73 27
                                                                                                                                                                                                                            Data Ascii: XahEri~SL@6l"UrD x\@JHXu~ns':q~t~cNS"C|;"m;f ~"</]tmQKAmx?,"%gtQqD<)"?N~(IENDB`


                                                                                                                                                                                                                            Statistics

                                                                                                                                                                                                                            CPU Usage

                                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                                            Memory Usage

                                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                                            High Level Behavior Distribution

                                                                                                                                                                                                                            • • File
                                                                                                                                                                                                                            • • Registry
                                                                                                                                                                                                                            • • Network

                                                                                                                                                                                                                            Click to dive into process behavior distribution

                                                                                                                                                                                                                            Behavior

                                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                                            System Behavior

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:0
                                                                                                                                                                                                                            Start time:00:29:47
                                                                                                                                                                                                                            Start date:13/10/2023
                                                                                                                                                                                                                            Path:C:\Users\user\Desktop\driver booster setup.exe
                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                            Commandline:C:\Users\user\Desktop\driver booster setup.exe
                                                                                                                                                                                                                            Imagebase:0x400000
                                                                                                                                                                                                                            File size:25'763'240 bytes
                                                                                                                                                                                                                            MD5 hash:D242A796EBC0219DC52B49B8F1D1AF7A
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:Borland Delphi
                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                            Has exited:true
                                                                                                                                                                                                                            Show Windows behavior

                                                                                                                                                                                                                            File Activities

                                                                                                                                                                                                                            Show Windows behavior

                                                                                                                                                                                                                            Section Activities

                                                                                                                                                                                                                            Show Windows behavior

                                                                                                                                                                                                                            Registry Activities

                                                                                                                                                                                                                            There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                                                                                                                                                            Show Windows behavior

                                                                                                                                                                                                                            Process Activities

                                                                                                                                                                                                                            Show Windows behavior

                                                                                                                                                                                                                            Thread Activities

                                                                                                                                                                                                                            Show Windows behavior

                                                                                                                                                                                                                            Memory Activities

                                                                                                                                                                                                                            There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                                                                                                                                                            Show Windows behavior

                                                                                                                                                                                                                            Windows UI Activities

                                                                                                                                                                                                                            There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:1
                                                                                                                                                                                                                            Start time:00:29:48
                                                                                                                                                                                                                            Start date:13/10/2023
                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmp
                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                            Commandline:"C:\Users\user\AppData\Local\Temp\is-FLQS7.tmp\driver booster setup.tmp" /SL5="$2046E,25039561,139264,C:\Users\user\Desktop\driver booster setup.exe"
                                                                                                                                                                                                                            Imagebase:0x400000
                                                                                                                                                                                                                            File size:1'214'488 bytes
                                                                                                                                                                                                                            MD5 hash:68B52A0B8E3D45BF3B520A0E7F16DAD1
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:Borland Delphi
                                                                                                                                                                                                                            Yara matches:
                                                                                                                                                                                                                            • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000001.00000003.1751330587.00000000075B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                            Has exited:true
                                                                                                                                                                                                                            Show Windows behavior

                                                                                                                                                                                                                            File Activities

                                                                                                                                                                                                                            Show Windows behavior

                                                                                                                                                                                                                            Section Activities

                                                                                                                                                                                                                            Show Windows behavior

                                                                                                                                                                                                                            Registry Activities

                                                                                                                                                                                                                            There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                                                                                                                                                            There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                                                                                                                                                            Show Windows behavior

                                                                                                                                                                                                                            Process Activities

                                                                                                                                                                                                                            Show Windows behavior

                                                                                                                                                                                                                            Thread Activities

                                                                                                                                                                                                                            Show Windows behavior

                                                                                                                                                                                                                            Memory Activities

                                                                                                                                                                                                                            Show Windows behavior

                                                                                                                                                                                                                            System Activities

                                                                                                                                                                                                                            There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                                                                                                                                                            Show Windows behavior

                                                                                                                                                                                                                            Windows UI Activities

                                                                                                                                                                                                                            Process Token Activities

                                                                                                                                                                                                                            There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                                                                                                                                                            There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:2
                                                                                                                                                                                                                            Start time:00:29:57
                                                                                                                                                                                                                            Start date:13/10/2023
                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe
                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                            Commandline:"C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe" "C:\Users\user\Desktop\driver booster setup.exe" /title="Driver Booster 9" /dbver=9.4.0.233 /eula="C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\EULA.rtf" /showlearnmore /pmtproduct /nochromepmt
                                                                                                                                                                                                                            Imagebase:0x400000
                                                                                                                                                                                                                            File size:6'075'480 bytes
                                                                                                                                                                                                                            MD5 hash:6233816372E39E2E2D22787A649D0187
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:Borland Delphi
                                                                                                                                                                                                                            Yara matches:
                                                                                                                                                                                                                            • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000002.00000000.1747731405.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Author: Joe Security
                                                                                                                                                                                                                            • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\is-MK7O5.tmp-dbinst\setup.exe, Author: Joe Security
                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                            Has exited:false
                                                                                                                                                                                                                            Show Windows behavior

                                                                                                                                                                                                                            File Activities

                                                                                                                                                                                                                            Show Windows behavior

                                                                                                                                                                                                                            Section Activities

                                                                                                                                                                                                                            Show Windows behavior

                                                                                                                                                                                                                            Registry Activities

                                                                                                                                                                                                                            There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                                                                                                                                                            Show Windows behavior

                                                                                                                                                                                                                            Mutex Activities

                                                                                                                                                                                                                            Show Windows behavior

                                                                                                                                                                                                                            Process Activities

                                                                                                                                                                                                                            Show Windows behavior

                                                                                                                                                                                                                            Thread Activities

                                                                                                                                                                                                                            Show Windows behavior

                                                                                                                                                                                                                            Memory Activities

                                                                                                                                                                                                                            Show Windows behavior

                                                                                                                                                                                                                            System Activities

                                                                                                                                                                                                                            Show Windows behavior

                                                                                                                                                                                                                            Timing Activities

                                                                                                                                                                                                                            Show Windows behavior

                                                                                                                                                                                                                            Windows UI Activities

                                                                                                                                                                                                                            Network Activities

                                                                                                                                                                                                                            There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                                                                                                                                                                                                                            Disassembly

                                                                                                                                                                                                                            Execution Graph

                                                                                                                                                                                                                            Execution Coverage

                                                                                                                                                                                                                            Dynamic/Packed Code Coverage

                                                                                                                                                                                                                            Signature Coverage

                                                                                                                                                                                                                            Execution Coverage:5.8%
                                                                                                                                                                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                            Signature Coverage:0%
                                                                                                                                                                                                                            Total number of Nodes:71
                                                                                                                                                                                                                            Total number of Limit Nodes:1
                                                                                                                                                                                                                            Show Legend
                                                                                                                                                                                                                            Hide Nodes/Edges
                                                                                                                                                                                                                            execution_graph 4304 50ee90 4305 50eeaa KiUserCallbackDispatcher 4304->4305 4306 4fac6c 4307 4facb0 4306->4307 4308 4fac7c SetTimer 4307->4308 4309 4faca3 4308->4309 4310 546490 4311 5464b4 ReadProcessMemory 4310->4311 4312 54659a 4311->4312 4313 5464c2 4311->4313 4313->4312 4314 546583 WriteProcessMemory 4313->4314 4314->4312 4371 4fade8 4373 4fadf5 4371->4373 4372 4fae00 4373->4372 4374 4fb164 SetTimer 4373->4374 4374->4372 4351 4fb145 4354 4fb196 4351->4354 4352 4fb4b9 4353 4fac6c SetTimer 4352->4353 4360 4fb4a9 4352->4360 4353->4360 4354->4352 4355 4fb3a6 4354->4355 4356 4fb49e 4355->4356 4357 4fb4ab 4355->4357 4359 4fac6c SetTimer 4356->4359 4358 4fac6c SetTimer 4357->4358 4358->4360 4359->4360 4375 4fae85 4376 4fae88 4375->4376 4377 4fae13 4375->4377 4378 4fb164 SetTimer 4377->4378 4379 4fae1a 4378->4379 4330 4facde 4332 4fad11 4330->4332 4331 4fad30 4332->4331 4333 4fadc7 4332->4333 4334 4fadaa 4332->4334 4347 4fac6c 4333->4347 4337 4fb164 4334->4337 4341 4fb196 4337->4341 4338 4fb4b9 4339 4fac6c SetTimer 4338->4339 4340 4fb4a9 4338->4340 4339->4340 4340->4331 4341->4338 4342 4fb3a6 4341->4342 4343 4fb49e 4342->4343 4344 4fb4ab 4342->4344 4346 4fac6c SetTimer 4343->4346 4345 4fac6c SetTimer 4344->4345 4345->4340 4346->4340 4348 4facb0 4347->4348 4349 4fac7c SetTimer 4348->4349 4350 4faca3 4349->4350 4350->4331 4367 50e904 4368 50e914 4367->4368 4369 50ee90 KiUserCallbackDispatcher 4368->4369 4370 50e928 4369->4370 4317 514d84 4318 514d99 4317->4318 4320 514dde 4317->4320 4319 514e44 CallWindowProcW 4318->4319 4318->4320 4319->4320 4361 50e948 4362 50e958 4361->4362 4365 50ee90 4362->4365 4364 50e96a 4366 50eeaa KiUserCallbackDispatcher 4365->4366 4366->4364 4321 4fb9f3 4322 4fba02 SetWindowLongW SetWindowTextW 4321->4322 4323 4fba54 4322->4323 4324 50e66c KiUserCallbackDispatcher 4325 50e692 4324->4325 4326 51046c 4327 510482 4326->4327 4328 510738 KiUserCallbackDispatcher 4327->4328 4329 51068c 4327->4329 4328->4329

                                                                                                                                                                                                                            Executed Functions

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 0 546490-5464bc ReadProcessMemory 2 5464c2-5464d1 0->2 3 54659a-5465a4 0->3 4 5464d6-5464da 2->4 5 5464e0-5464e2 4->5 6 54658b-546594 4->6 7 5464e4-5464e6 5->7 8 5464eb-5464f0 5->8 6->3 6->4 7->6 9 5464f2-5464fa 8->9 10 54652a-546532 8->10 9->6 11 546500-546528 9->11 12 546534-54653c 10->12 13 54653e-546546 10->13 11->6 12->13 14 546552-546561 12->14 13->6 15 546548-546550 13->15 14->3 16 546563-546589 WriteProcessMemory 14->16 15->6 15->14 16->3
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ReadProcessMemory.KERNEL32(00000000), ref: 005464B5
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.3515997149.0000000000546000.00000020.00000001.01000000.00000009.sdmp, Offset: 00546000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_546000_setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MemoryProcessRead
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1726664587-0
                                                                                                                                                                                                                            • Opcode ID: dc787fcc93027a9af59d33d205c4aabc3d67c905600f5966b0ea9c856f40e9fc
                                                                                                                                                                                                                            • Instruction ID: 434669a93856d8334246a224a6d525899a038644613dd82d8d7ef49f4c297ab9
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: dc787fcc93027a9af59d33d205c4aabc3d67c905600f5966b0ea9c856f40e9fc
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0431263060C3C12ED712963C8C447E77FD4AB97358F4849AAF0D9C71A6C234D8969323
                                                                                                                                                                                                                            Uniqueness

                                                                                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 18 4fb9f3-4fba1e SetWindowLongW SetWindowTextW 20 4fba54-4fba58 18->20
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004FBA0B
                                                                                                                                                                                                                            • SetWindowTextW.USER32(?,00000000), ref: 004FBA19
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.3515997149.00000000004FA000.00000020.00000001.01000000.00000009.sdmp, Offset: 004FA000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_4fa000_setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Window$LongText
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2549665715-0
                                                                                                                                                                                                                            • Opcode ID: 86d122d676fd4638b87c1a7bf87397fdd1aa88fc278c2c7e753a1e67e763a9b9
                                                                                                                                                                                                                            • Instruction ID: 8e84489833ad6f36163cd17635af7536d43513e9743c5e312264bffd6b87cfb3
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 86d122d676fd4638b87c1a7bf87397fdd1aa88fc278c2c7e753a1e67e763a9b9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B9D05E72208B0066D500B1B69C81FA6135CEB88325F244A3BF25AE61C3CB3DA10642B8
                                                                                                                                                                                                                            Uniqueness

                                                                                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 21 51046c-510480 22 510482-510492 21->22 23 5104ba-5104c1 21->23 22->23 31 510494-51049e 22->31 24 5104c3-5104c8 23->24 25 5104fc-510503 23->25 24->25 26 5104ca-5104da 24->26 27 510721-510726 25->27 28 510509-51050e 25->28 32 510738-51073e KiUserCallbackDispatcher 26->32 42 5104e0-5104f1 26->42 27->32 33 510728-510733 call 50eb90 27->33 28->27 30 510514-510518 28->30 37 51051a-51051f 30->37 38 51052e-510538 30->38 31->23 39 5104a0-5104b4 31->39 35 510741-510747 32->35 33->32 43 510521-510524 37->43 44 51052b 37->44 40 5106b0-5106b9 38->40 41 51053e 38->41 39->23 39->35 40->32 46 5106bb-5106c4 40->46 41->40 47 510565-510575 41->47 48 510686-51068a 41->48 49 5106a6-5106ab 41->49 50 51057a-51057e 41->50 42->35 60 5104f7 42->60 43->44 51 510526-510529 43->51 44->38 46->32 52 5106c6-5106d1 46->52 47->32 55 51069c-5106a1 48->55 56 51068c-510697 48->56 49->32 50->32 53 510584-510599 50->53 51->38 51->44 52->32 57 5106d3-51071f 52->57 53->32 59 51059f-5105ab 53->59 55->32 56->35 57->35 59->32 64 5105b1-5105c9 59->64 60->32 68 510648-51064c 64->68 69 5105cb-5105da 64->69 70 510666-51066f 68->70 71 51064e-510661 68->71 75 5105f6-5105fa 69->75 76 5105dc-5105f4 69->76 70->32 73 510675-510681 70->73 71->32 73->32 78 510617-510627 75->78 79 5105fc-510615 75->79 76->68 78->68 85 510629-510645 78->85 79->68 85->68
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • KiUserCallbackDispatcher.NTDLL ref: 0051073E
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.3515997149.000000000050E000.00000020.00000001.01000000.00000009.sdmp, Offset: 0050E000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_50e000_setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CallbackDispatcherUser
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2492992576-0
                                                                                                                                                                                                                            • Opcode ID: 743138791096003fd842acf3cc8163ed49ceaed751c1224381a5db0b76aa9608
                                                                                                                                                                                                                            • Instruction ID: a91eb906b6f616146da6b72407e8613ad3ffea7d7a1b2bf233bfedc1b12cbd18
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 743138791096003fd842acf3cc8163ed49ceaed751c1224381a5db0b76aa9608
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0581BD346002458BEB50EB69C488AEEBBE2BF45704F549469E405EB3E1C7B8EDC5CF91
                                                                                                                                                                                                                            Uniqueness

                                                                                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 89 514d84-514d93 90 514d99-514d9e 89->90 91 514e7c-514e7e 89->91 92 514da0-514da4 90->92 93 514dc4-514dd0 90->93 94 514e85-514e89 91->94 92->93 95 514da6-514dbe 92->95 96 514dd2-514dda 93->96 97 514dde-514df6 93->97 95->93 95->94 98 514df8-514e35 96->98 99 514ddc-514e3d 96->99 105 514e63-514e68 97->105 98->105 103 514e44-514e60 CallWindowProcW 99->103 104 514e3f-514e42 99->104 103->105 104->105 105->94 107 514e6a-514e7a 105->107 107->94
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.3515997149.0000000000514000.00000020.00000001.01000000.00000009.sdmp, Offset: 00514000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_514000_setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 87d4e01c02533b2d264cb2d7f25cbe3630675755677e11fad0a8a450549787a2
                                                                                                                                                                                                                            • Instruction ID: d3d52f8351c58cf73fcb0744f77a9ec7e741f0f6686230a3d1270015806792c6
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 87d4e01c02533b2d264cb2d7f25cbe3630675755677e11fad0a8a450549787a2
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 303171716006009BDB50EF6DC8C4A8ABBEDBF88710B149569F409DF25ACB34EC81CF65
                                                                                                                                                                                                                            Uniqueness

                                                                                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 114 50ee90-50eed7 KiUserCallbackDispatcher
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • KiUserCallbackDispatcher.NTDLL(?,?), ref: 0050EECB
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.3515997149.000000000050E000.00000020.00000001.01000000.00000009.sdmp, Offset: 0050E000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_50e000_setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CallbackDispatcherUser
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2492992576-0
                                                                                                                                                                                                                            • Opcode ID: c4643b4b68760a8d6199615b02a577f63622df5181be579b687e7404b3f1c16c
                                                                                                                                                                                                                            • Instruction ID: ae7e1c5642afe656c6ce1464cd9707bf1fd320cf40c09bb8fbf1a9685e4a0d09
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c4643b4b68760a8d6199615b02a577f63622df5181be579b687e7404b3f1c16c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7EF0D4362042019FC704DF5CC8C498ABBE5FF89255F4446A8FA89CB356DA32E858CB92
                                                                                                                                                                                                                            Uniqueness

                                                                                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 116 4fac6c-4faca1 call 4facb0 SetTimer 119 4facaa-4facad 116->119 120 4faca3-4faca5 call 4fae94 116->120 120->119
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetTimer.USER32(00000000,00000000,?,0074533C,?,?,?,004FB4CB), ref: 004FAC87
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.3515997149.00000000004FA000.00000020.00000001.01000000.00000009.sdmp, Offset: 004FA000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_4fa000_setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Timer
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2870079774-0
                                                                                                                                                                                                                            • Opcode ID: 6733c68bf2d094eb04ce7465ca5b77615dd52af3a2f7213b9224cf97aa714474
                                                                                                                                                                                                                            • Instruction ID: a6c123e44f1f968bc4dd524026079da1fb85079809f650fe0e797094fb9a1bac
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6733c68bf2d094eb04ce7465ca5b77615dd52af3a2f7213b9224cf97aa714474
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F0E0865130464827D214A76A5C41B779698EF85365F05801AF20CC7352CB5D1C2593EA
                                                                                                                                                                                                                            Uniqueness

                                                                                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 122 50e69e-50e6c4 KiUserCallbackDispatcher 123 50e6c6-50e6c9 122->123 124 50e6cf-50e6d1 122->124 123->124
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • KiUserCallbackDispatcher.NTDLL(?,?), ref: 0050E6B3
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.3515997149.000000000050E000.00000020.00000001.01000000.00000009.sdmp, Offset: 0050E000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_50e000_setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CallbackDispatcherUser
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2492992576-0
                                                                                                                                                                                                                            • Opcode ID: 7f8bb051a61c2fbf9b952caf02cf83d447f75eb62475ddd544fa1c7dacf31b0e
                                                                                                                                                                                                                            • Instruction ID: 13bc3e829dec6161a47167e3eaac2342f763a76b54f41ba11f37ae72be263809
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7f8bb051a61c2fbf9b952caf02cf83d447f75eb62475ddd544fa1c7dacf31b0e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CBE09A712001409FEB44CE58D4C5BA17BE5BF49215F5480A9EE49CB25AEA619C44CB50
                                                                                                                                                                                                                            Uniqueness

                                                                                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 125 50e66c-50e690 KiUserCallbackDispatcher 126 50e692-50e695 125->126 127 50e69b-50e69d 125->127 126->127
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • KiUserCallbackDispatcher.NTDLL(?), ref: 0050E67F
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.3515997149.000000000050E000.00000020.00000001.01000000.00000009.sdmp, Offset: 0050E000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_50e000_setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CallbackDispatcherUser
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2492992576-0
                                                                                                                                                                                                                            • Opcode ID: c7cf7074a665caa880df6352a8bf1e0f51914274fe53a4cf435d6a591524547b
                                                                                                                                                                                                                            • Instruction ID: d8511cd7d2d2e2eaf89c347d6cb5115341499210d9bf07f7969d55fd253fe952
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c7cf7074a665caa880df6352a8bf1e0f51914274fe53a4cf435d6a591524547b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 50E0B6712002408FEB48CE58D5C9B927BE8BF49214F5880E9EE49CF25BEB71AC45CB50
                                                                                                                                                                                                                            Uniqueness

                                                                                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 128 4f6cc4-4f6ccc 129 4f6cce 128->129 130 4f6cd6-4f6dd1 128->130 129->130 147 4f6dd8-4f6e18 130->147 148 4f6e1a-4f6e26 147->148 149 4f6e29-4f6e2f 147->149 148->149
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.3515997149.00000000004F6000.00000020.00000001.01000000.00000009.sdmp, Offset: 004F6000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_4f6000_setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 164f0d8f5319c51f8ca7d9ff2c8f5d1d7eed80782dd6f78efc356781f030a8ff
                                                                                                                                                                                                                            • Instruction ID: 7fef5b2d09c11bf875dec451465cb1400ffdb06e2140f657358e76890321bfe9
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 164f0d8f5319c51f8ca7d9ff2c8f5d1d7eed80782dd6f78efc356781f030a8ff
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F8411BB06042019FCB40EF6AD8C1B597BE0EF55318F0595BEEA08DF362DB7A9804CB58
                                                                                                                                                                                                                            Uniqueness

                                                                                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 178 4eff00-4eff12 179 4eff1c-4eff6b call 4ef42c 178->179 180 4eff14 178->180 184 4eff6d-4eff72 179->184 185 4eff79-4effc3 179->185 180->179 184->185 187 4effcb-4effef 185->187
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.3515997149.00000000004EF000.00000020.00000001.01000000.00000009.sdmp, Offset: 004EF000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_4ef000_setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: fd4f4520ae53f3ef818ae32170067626eb72f66c9373dcaee838be7be5ec245a
                                                                                                                                                                                                                            • Instruction ID: b4fb6032cc422a051b8097630d9454f4c377fb4278361decbb34e1efbd62000e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: fd4f4520ae53f3ef818ae32170067626eb72f66c9373dcaee838be7be5ec245a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 20318134A00348DFD711CF69D881FAABBB5FB4A300F1441B6E900A7392C778AE04DBA5
                                                                                                                                                                                                                            Uniqueness

                                                                                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 245 4efe7a-4efe97 248 4efe99-4efe9b 245->248 249 4efea3-4efebe 245->249 248->249 250 4efecb-4efecd 249->250 251 4efec0-4efec3 249->251 252 4efed5-4efee6 250->252 251->250 254 4efee8-4efeea 252->254 255 4efef2 252->255 254->255
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.3515997149.00000000004EF000.00000020.00000001.01000000.00000009.sdmp, Offset: 004EF000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_4ef000_setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 913187beae4ad84240ad52b9fd7dda8765e763a0340f401a49a6da9232c20178
                                                                                                                                                                                                                            • Instruction ID: 77a6629dbfd67a7d23660aec7826b686fe597749713bdfc3fda1bf0e7db7b3ad
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 913187beae4ad84240ad52b9fd7dda8765e763a0340f401a49a6da9232c20178
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2001B530B14288AFE711DB6DC846ADEBBF5FB89300F6544F1E400936A2DB756E44D600
                                                                                                                                                                                                                            Uniqueness

                                                                                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.3515997149.00000000004EF000.00000020.00000001.01000000.00000009.sdmp, Offset: 004EF000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_4ef000_setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: f732927a3a9e0ad2f12f61988e0f1a401e48cad3e52f422676c677d4367b1e9c
                                                                                                                                                                                                                            • Instruction ID: 74cb4c7539135bd88bfff7724dc5377e80f8fb2bee122ef7ea8290a10cc9ab4e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f732927a3a9e0ad2f12f61988e0f1a401e48cad3e52f422676c677d4367b1e9c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1E01B130A14288AFEB11DB6DC886ADEBBF6BB89300F6544F1E400936A2CB756E44D600
                                                                                                                                                                                                                            Uniqueness

                                                                                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.3515997149.00000000004C8000.00000020.00000001.01000000.00000009.sdmp, Offset: 004C8000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_4c8000_setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: ca4de4ecb5168486bc6f0c79097e7c38dca8a5737f41728e9fa7def15348a919
                                                                                                                                                                                                                            • Instruction ID: e8cc4e944ff735a1b8b0282dceb48b2216f6af0dfcf4c83c49e9c7aa2822aa70
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ca4de4ecb5168486bc6f0c79097e7c38dca8a5737f41728e9fa7def15348a919
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7EE02B91702A5047C260A7794941B47BE845F417A8F08013EE94487786EB2E980003AD
                                                                                                                                                                                                                            Uniqueness

                                                                                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.3515997149.00000000004EF000.00000020.00000001.01000000.00000009.sdmp, Offset: 004EF000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_4ef000_setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: eb46dfe346b8cda1a3fee37f10ff2edb56cca33e41b4f468ae15149d75d70ddf
                                                                                                                                                                                                                            • Instruction ID: 6ad4ab430c644b810df471bcfe670cd8aae678675839393bb0d1c561cfb91933
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: eb46dfe346b8cda1a3fee37f10ff2edb56cca33e41b4f468ae15149d75d70ddf
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 09D0125070028517FB007EBE5C8578A46985F54309F40A979F4058B343DA7DCD884314
                                                                                                                                                                                                                            Uniqueness

                                                                                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                                                                                            Non-executed Functions

                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.3515997149.00000000004F6000.00000020.00000001.01000000.00000009.sdmp, Offset: 004F6000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_4f6000_setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 11a8eaa462b9fbea2fef2151f0cf2eaa805d5712b756c2ac37e8817a4ed98629
                                                                                                                                                                                                                            • Instruction ID: 015fc18211eaf4349a9e84803fa1c92f2bd84be6a441fc55b6d249db1e96b122
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 11a8eaa462b9fbea2fef2151f0cf2eaa805d5712b756c2ac37e8817a4ed98629
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 414112B43042088FCB08EF69D48195A37E5AFCE304716857EF919DB366EB38DC459A98
                                                                                                                                                                                                                            Uniqueness

                                                                                                                                                                                                                            Uniqueness Score: -1.00%