File name:

driver-hub-install__28.exe

Full analysis: https://app.any.run/tasks/32e3ab38-b906-4855-a6ec-cc3a9807daa6
Verdict: Malicious activity
Analysis date: October 19, 2023, 13:38:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

01C0B780A0656D3A26A533EB0E0EAB2E

SHA1:

7792EF479D175CC9B1D0A1A002394EBD52BC3E8F

SHA256:

0A2304ED33B06FF486618CCBF8A06C321F12D72FD448B1FA20D8FF945D7589E7

SSDEEP:

49152:aA9puag5/UNsDK3tPjUTbRVcNbwe1sI3PwaSEg1a:akpuaEs+DQPjUDcNbweauVnn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • DriverHub.exe (PID: 2288)
      • OperaGXDownloader.exe (PID: 1956)
      • net_updater32.exe (PID: 1480)
      • drvinst.exe (PID: 188)
      • Installer.exe (PID: 2624)
      • drvinst.exe (PID: 3352)
      • Installer.exe (PID: 2792)
      • net_updater32.exe (PID: 1004)

    • Application was dropped or rewritten from another process

      • DriverHub.exe (PID: 2288)
      • test_wpf.exe (PID: 612)
      • net_updater32.exe (PID: 3328)
      • OperaGXDownloader.exe (PID: 1956)
      • net_updater32.exe (PID: 1480)
      • test_wpf.exe (PID: 3404)
      • idle_report.exe (PID: 3584)
      • brightdata.exe (PID: 3736)
      • Installer.exe (PID: 2624)
      • Installer.exe (PID: 2792)
      • Installer.exe (PID: 1808)
      • idle_report.exe (PID: 2688)
      • net_updater32.exe (PID: 1004)
      • test_wpf.exe (PID: 324)
      • brightdata.exe (PID: 3264)

    • Drops the executable file immediately after the start

      • DriverHub.exe (PID: 2288)
      • driver-hub-install__28.exe (PID: 1192)
      • net_updater32.exe (PID: 1480)
      • OperaGXDownloader.exe (PID: 1956)
      • Installer.exe (PID: 2624)
      • drvinst.exe (PID: 188)
      • drvinst.exe (PID: 3908)
      • drvinst.exe (PID: 2060)
      • Installer.exe (PID: 2792)
      • drvinst.exe (PID: 3352)
      • net_updater32.exe (PID: 1004)

    • Creates a writable file the system directory

      • net_updater32.exe (PID: 1480)
      • drvinst.exe (PID: 3908)
      • drvinst.exe (PID: 188)
      • drvinst.exe (PID: 2060)
      • drvinst.exe (PID: 3352)

  • SUSPICIOUS

    • Reads the Internet Settings

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • sipnotify.exe (PID: 2552)

    • Checks Windows Trust Settings

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • net_updater32.exe (PID: 1480)
      • Installer.exe (PID: 2624)
      • drvinst.exe (PID: 188)
      • drvinst.exe (PID: 3908)
      • Installer.exe (PID: 2792)
      • drvinst.exe (PID: 2060)
      • drvinst.exe (PID: 3352)
      • drvinst.exe (PID: 2468)
      • net_updater32.exe (PID: 1004)
      • Installer.exe (PID: 1808)

    • Reads security settings of Internet Explorer

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • Installer.exe (PID: 2624)
      • Installer.exe (PID: 2792)
      • Installer.exe (PID: 1808)

    • Reads settings of System Certificates

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • net_updater32.exe (PID: 3328)
      • Installer.exe (PID: 2624)
      • Installer.exe (PID: 2792)
      • Installer.exe (PID: 1808)
      • sipnotify.exe (PID: 2552)

    • Reads Microsoft Outlook installation path

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)

    • Application launched itself

      • driver-hub-install__28.exe (PID: 2464)

    • Reads Internet Explorer settings

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)

    • Adds/modifies Windows certificates

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)

    • Process drops legitimate windows executable

      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • Installer.exe (PID: 2792)
      • drvinst.exe (PID: 2060)
      • drvinst.exe (PID: 3352)

    • The process drops C-runtime libraries

      • DriverHub.exe (PID: 2288)

    • Detected use of alternative data streams (AltDS)

      • DriverHub.exe (PID: 2288)
      • net_updater32.exe (PID: 1480)
      • net_updater32.exe (PID: 1004)

    • Executes as Windows Service

      • net_updater32.exe (PID: 1480)

    • Drops a system driver (possible attempt to evade defenses)

      • DriverHub.exe (PID: 2288)
      • Installer.exe (PID: 2624)
      • drvinst.exe (PID: 3908)
      • drvinst.exe (PID: 188)
      • Installer.exe (PID: 2792)
      • drvinst.exe (PID: 2060)
      • drvinst.exe (PID: 3352)

    • Creates files in the driver directory

      • drvinst.exe (PID: 3908)
      • drvinst.exe (PID: 188)
      • drvinst.exe (PID: 2060)
      • drvinst.exe (PID: 3352)

    • Creates or modifies Windows services

      • drvinst.exe (PID: 188)

    • The process executes via Task Scheduler

      • sipnotify.exe (PID: 2552)

  • INFO

    • Reads the computer name

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • test_wpf.exe (PID: 612)
      • DriverHub.exe (PID: 2288)
      • net_updater32.exe (PID: 3328)
      • net_updater32.exe (PID: 1480)
      • test_wpf.exe (PID: 3404)
      • idle_report.exe (PID: 3584)
      • brightdata.exe (PID: 3736)
      • Installer.exe (PID: 2624)
      • drvinst.exe (PID: 3908)
      • drvinst.exe (PID: 188)
      • drvinst.exe (PID: 2060)
      • Installer.exe (PID: 2792)
      • drvinst.exe (PID: 3352)
      • wmpnscfg.exe (PID: 2972)
      • wmpnscfg.exe (PID: 632)
      • Installer.exe (PID: 1808)
      • idle_report.exe (PID: 2688)
      • drvinst.exe (PID: 2468)
      • test_wpf.exe (PID: 324)
      • net_updater32.exe (PID: 1004)
      • brightdata.exe (PID: 3264)
      • IMEKLMG.EXE (PID: 3764)
      • IMEKLMG.EXE (PID: 3644)
      • wmpnscfg.exe (PID: 3068)
      • wmpnscfg.exe (PID: 3480)

    • Checks proxy server information

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)

    • Checks supported languages

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • test_wpf.exe (PID: 612)
      • net_updater32.exe (PID: 3328)
      • OperaGXDownloader.exe (PID: 1956)
      • net_updater32.exe (PID: 1480)
      • test_wpf.exe (PID: 3404)
      • idle_report.exe (PID: 3584)
      • Installer.exe (PID: 2624)
      • brightdata.exe (PID: 3736)
      • drvinst.exe (PID: 3908)
      • drvinst.exe (PID: 188)
      • Installer.exe (PID: 2792)
      • drvinst.exe (PID: 2060)
      • drvinst.exe (PID: 3352)
      • wmpnscfg.exe (PID: 2972)
      • wmpnscfg.exe (PID: 632)
      • Installer.exe (PID: 1808)
      • drvinst.exe (PID: 2468)
      • idle_report.exe (PID: 2688)
      • test_wpf.exe (PID: 324)
      • net_updater32.exe (PID: 1004)
      • brightdata.exe (PID: 3264)
      • IMEKLMG.EXE (PID: 3764)
      • wmpnscfg.exe (PID: 3068)
      • wmpnscfg.exe (PID: 3480)
      • IMEKLMG.EXE (PID: 3644)

    • Reads the machine GUID from the registry

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • test_wpf.exe (PID: 612)
      • net_updater32.exe (PID: 3328)
      • net_updater32.exe (PID: 1480)
      • test_wpf.exe (PID: 3404)
      • idle_report.exe (PID: 3584)
      • brightdata.exe (PID: 3736)
      • Installer.exe (PID: 2624)
      • drvinst.exe (PID: 3908)
      • drvinst.exe (PID: 188)
      • Installer.exe (PID: 2792)
      • drvinst.exe (PID: 2060)
      • drvinst.exe (PID: 3352)
      • wmpnscfg.exe (PID: 2972)
      • Installer.exe (PID: 1808)
      • idle_report.exe (PID: 2688)
      • drvinst.exe (PID: 2468)
      • net_updater32.exe (PID: 1004)
      • wmpnscfg.exe (PID: 632)
      • test_wpf.exe (PID: 324)
      • brightdata.exe (PID: 3264)
      • wmpnscfg.exe (PID: 3068)
      • wmpnscfg.exe (PID: 3480)

    • Create files in a temporary directory

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • OperaGXDownloader.exe (PID: 1956)
      • Installer.exe (PID: 2624)
      • Installer.exe (PID: 2792)

    • Creates files or folders in the user directory

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)

    • Process checks are UAC notifies on

      • driver-hub-install__28.exe (PID: 1192)
      • IMEKLMG.EXE (PID: 3644)
      • IMEKLMG.EXE (PID: 3764)

    • Creates files in the program directory

      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • net_updater32.exe (PID: 3328)
      • net_updater32.exe (PID: 1480)
      • brightdata.exe (PID: 3736)
      • net_updater32.exe (PID: 1004)

    • Reads Environment values

      • DriverHub.exe (PID: 2288)
      • net_updater32.exe (PID: 1480)
      • brightdata.exe (PID: 3736)
      • net_updater32.exe (PID: 1004)
      • brightdata.exe (PID: 3264)

    • Process checks computer location settings

      • DriverHub.exe (PID: 2288)
      • net_updater32.exe (PID: 1480)
      • net_updater32.exe (PID: 1004)

    • Application launched itself

      • msedge.exe (PID: 3816)
      • msedge.exe (PID: 2064)

    • Manual execution by a user

      • msedge.exe (PID: 3816)
      • wmpnscfg.exe (PID: 2972)
      • wmpnscfg.exe (PID: 632)
      • IMEKLMG.EXE (PID: 3644)
      • wmpnscfg.exe (PID: 3068)
      • wmpnscfg.exe (PID: 3480)
      • IMEKLMG.EXE (PID: 3764)
      • taskmgr.exe (PID: 2796)

    • Reads security settings of Internet Explorer

      • sipnotify.exe (PID: 2552)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (76)
.exe | Win32 Executable (generic) (12.6)
.exe | Generic Win/DOS Executable (5.6)
.exe | DOS Executable Generic (5.6)

EXIF

EXE

ProductVersion: 3.3.2
FileVersion: 3.3.2
ProductName: DriverHub
OriginalFileName: DriverHubInstaller.exe
LegalCopyright: © ROSTPAY LTD. All rights reserved.
InternalName: DriverHubInstaller
FileDescription: Install DriverHub
CompanyName: ROSTPAY LTD.
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 3.3.2.0
FileVersionNumber: 3.3.2.0
Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0xb6dd50
UninitializedDataSize: 10358784
InitializedDataSize: 446464
CodeSize: 1626112
LinkerVersion: 14.29
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2023:10:05 13:23:56+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
50
Malicious processes
21
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start driver-hub-install__28.exe driver-hub-install__28.exe driverhub.exe test_wpf.exe no specs wisptis.exe no specs wisptis.exe no specs net_updater32.exe operagxdownloader.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe net_updater32.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs test_wpf.exe no specs msedge.exe no specs idle_report.exe no specs msedge.exe no specs brightdata.exe no specs installer.exe no specs msedge.exe no specs msedge.exe no specs drvinst.exe no specs drvinst.exe no specs rundll32.exe no specs installer.exe no specs drvinst.exe no specs drvinst.exe wmpnscfg.exe no specs wmpnscfg.exe no specs installer.exe no specs drvinst.exe no specs idle_report.exe no specs net_updater32.exe no specs test_wpf.exe no specs sipnotify.exe no specs brightdata.exe no specs imeklmg.exe no specs imeklmg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs taskmgr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188DrvInst.exe "2" "211" "PCI\VEN_8086&DEV_100E&SUBSYS_11001AF4&REV_03\3&13C0B0C5&0&18" "C:\Windows\INF\oem2.inf" "e1g6032.inf:Intel.NTx86.6.0.1:E100E:8.3.15.0:pci\ven_8086&dev_100e" "6efe00be3" "0000039C" "000005E0" "000005D8"C:\Windows\System32\drvinst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\advapi32.dll
324C:\ProgramData\BrightData\0958021a4a573e283a9a7d03525578a2225ac6fd\test_wpf.exeC:\ProgramData\BrightData\0958021a4a573e283a9a7d03525578a2225ac6fd\test_wpf.exe—net_updater32.exe
User:
SYSTEM
Company:
BrightData Ltd.
Integrity Level:
SYSTEM
Description:
test_wpf
Exit code:
0
Version:
1.407.240
Modules
Images
c:\programdata\brightdata\0958021a4a573e283a9a7d03525578a2225ac6fd\test_wpf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
612C:\ProgramData\BrightData\0958021a4a573e283a9a7d03525578a2225ac6fd\test_wpf.exeC:\ProgramData\BrightData\0958021a4a573e283a9a7d03525578a2225ac6fd\test_wpf.exe—DriverHub.exe
User:
admin
Company:
BrightData Ltd.
Integrity Level:
HIGH
Description:
test_wpf
Exit code:
0
Version:
1.407.240
Modules
Images
c:\programdata\brightdata\0958021a4a573e283a9a7d03525578a2225ac6fd\test_wpf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
632"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
856"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;C:\Windows\System32\wisptis.exe—DriverHub.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Pen and Touch Input Component
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wisptis.exe
c:\windows\system32\ntdll.dll
860"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xf0,0x5b5ef598,0x5b5ef5a8,0x5b5ef5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1004"C:/Program Files/DriverHub/net_updater32.exe" --updater win_drvhub.netC:\Program Files\DriverHub\net_updater32.exe—services.exe
User:
SYSTEM
Company:
BrightData Ltd.
Integrity Level:
SYSTEM
Description:
BrightData service allows free use of certain features in an app you installed
Exit code:
0
Version:
1.407.240
Modules
Images
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\sensapi.dll
1192"C:\Users\admin\Desktop\driver-hub-install__28.exe" /screen=proc /pos=240,46 /lang=enC:\Users\admin\Desktop\driver-hub-install__28.exe
driver-hub-install__28.exe
User:
admin
Company:
ROSTPAY LTD.
Integrity Level:
HIGH
Description:
Install DriverHub
Exit code:
0
Version:
3.3.2
Modules
Images
c:\users\admin\desktop\driver-hub-install__28.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
1280"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=1308,i,188092726319333807,9769413556429561116,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1304"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2616 --field-trial-handle=1312,i,4371997885843688681,14395995601762411663,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\msedge.exe
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
81 511
Read events
80 786
Write events
622
Delete events
103

Modification events

(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000056010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\417C44EB
Operation:writeName:LanguageList
Value:
en-GB
(PID) Process:(1192) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
111
Suspicious files
405
Text files
642
Unknown types
0

Dropped files

PID
Process
Filename
Type
2464driver-hub-install__28.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FA8B72E153ECD2AB5A49B87A4DF1FAB2binary
MD5:8259677FAA846B0A8F479F86A9D50E48
SHA256:F1F0FDC45510F7B9B384529950B35E910424738A700AC751162A3B05AB6E634C
2464driver-hub-install__28.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:60FE01DF86BE2E5331B0CDBE86165686
SHA256:C08CCBC876CD5A7CDFA9670F9637DA57F6A1282198A9BC71FC7D7247A6E5B7A8
2464driver-hub-install__28.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\payload[1].jsonbinary
MD5:62204A5AA290F39B08F5B5FC4C0C2466
SHA256:2A6914C4E79C389B52EA5F3198FB5DC834E20874A313BCA5E355C67CE122314E
2464driver-hub-install__28.exeC:\Users\admin\AppData\Local\Temp\CabE8E7.tmpcompressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
2464driver-hub-install__28.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
2464driver-hub-install__28.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:74C723822AFD9E44C8E1863B7B9A18D0
SHA256:4D549D08947D4DF1A67E3694578B6DD6F26B11249AEAC5C8D3698BE2B57252CC
2464driver-hub-install__28.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:546DA43A01706E029907EE4AE8AF4ACA
SHA256:DF31E73B216A85A3FA70CE76AA5D3F829B7EC9244719ADA0F29B00A0B19B464E
2464driver-hub-install__28.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
2464driver-hub-install__28.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FA8B72E153ECD2AB5A49B87A4DF1FAB2binary
MD5:A6ABF249E09365B573E6BBBF63DB0C57
SHA256:2DCE5E88F2520FAF386769D27EB6AE468BE7E4DC5B371B62F5061D508874E43C
1192driver-hub-install__28.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A7DC4336A059FB0AA5F093D96409A96Abinary
MD5:1BC0806CD2F000AEABA0F8E5B57C1EE0
SHA256:D7084797DD7BCBB3FEE40B217E06037DE0C3D30896808D9A0E69ECCE0A661F53
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
112
DNS requests
55
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
HEAD
200
104.103.87.173:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133422001203040000
unknown
—
—
—
2464
driver-hub-install__28.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d9d446fd2e6edf24
unknown
compressed
4.66 Kb
—
1192
driver-hub-install__28.exe
GET
200
95.101.54.114:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgOck9dCzp6NMVs6s4AKRbW9uQ%3D%3D
unknown
binary
503 b
—
2464
driver-hub-install__28.exe
GET
200
95.101.54.114:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgNDLu2rk%2BYtiWrcHseTEt2Acw%3D%3D
unknown
binary
503 b
—
1192
driver-hub-install__28.exe
GET
200
23.212.210.158:80
http://x2.c.lencr.org/
unknown
binary
300 b
—
1192
driver-hub-install__28.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAfy81yHqHeveu%2FpR5k1Jb0%3D
unknown
binary
471 b
—
2288
DriverHub.exe
POST
200
216.58.212.142:80
http://www.google-analytics.com/collect
unknown
image
35 b
—
2288
DriverHub.exe
POST
200
216.58.212.142:80
http://www.google-analytics.com/collect
unknown
image
35 b
—
2288
DriverHub.exe
POST
200
216.58.212.142:80
http://www.google-analytics.com/collect
unknown
image
35 b
—
2288
DriverHub.exe
POST
200
216.58.212.142:80
http://www.google-analytics.com/collect
unknown
image
35 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
2464
driver-hub-install__28.exe
188.130.153.33:443
api.az-partners.net
Rostpay Ltd
RU
unknown
2464
driver-hub-install__28.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
unknown
2464
driver-hub-install__28.exe
104.122.38.61:80
x1.c.lencr.org
AKAMAI-AS
DE
unknown
2464
driver-hub-install__28.exe
95.101.54.114:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown
1192
driver-hub-install__28.exe
188.130.153.33:443
api.az-partners.net
Rostpay Ltd
RU
unknown
1192
driver-hub-install__28.exe
188.130.153.32:443
api.az-partners.net
Rostpay Ltd
RU
unknown
1192
driver-hub-install__28.exe
95.101.54.114:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown
1192
driver-hub-install__28.exe
172.67.152.108:443
www.biphic.com
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
api.az-partners.net
  • 188.130.153.33
  • 188.130.153.32
unknown
ctldl.windowsupdate.com
  • 209.197.3.8
unknown
x1.c.lencr.org
  • 104.122.38.61
unknown
r3.o.lencr.org
  • 95.101.54.114
  • 95.101.54.195
unknown
www.drvhub.net
  • 188.130.153.32
  • 188.130.153.33
unknown
www.az-partners.net
  • 188.130.153.32
  • 188.130.153.33
unknown
www.biphic.com
  • 172.67.152.108
  • 104.21.12.132
unknown
x2.c.lencr.org
  • 23.212.210.158
unknown
net.geo.opera.com
  • 185.26.182.111
  • 185.26.182.112
unknown
perr.lum-sdk.io
  • 192.81.214.145
  • 206.189.231.23
  • 159.223.133.120
  • 161.35.48.195
unknown

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
—
—
Potential Corporate Privacy Violation
ET POLICY Dropbox.com Offsite File Backup in Use
—
—
Misc activity
ET INFO DropBox User Content Download Access over SSL M2
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
—
—
Misc activity
ET INFO DropBox User Content Download Access over SSL M2
Process
Message
DriverHub.exe
qrc:/UpdateProgressDialog.qml:11:5: QML Connections: Implicitly defined onFoo properties in Connections are deprecated. Use this syntax instead: function onFoo(<arguments>) { ... }
DriverHub.exe
qrc:/main.qml:655:13: QML Connections: Implicitly defined onFoo properties in Connections are deprecated. Use this syntax instead: function onFoo(<arguments>) { ... }
DriverHub.exe
qrc:/main.qml:453:31: QML ItemDelegate: Binding loop detected for property "height"
DriverHub.exe
file:///C:/Program Files/DriverHub/QtQuick/Dialogs/DefaultFileDialog.qml:102:33: QML Settings: Failed to initialize QSettings instance. Status code is: 1
DriverHub.exe
file:///C:/Program Files/DriverHub/QtQuick/Dialogs/DefaultFileDialog.qml:102:33: QML Settings: The following application identifiers have not been set: QVector("organizationName", "organizationDomain")
DriverHub.exe
qrc:/SettingsPage.qml:47:9: QML MyCheckBox: Binding loop detected for property "width"
DriverHub.exe
qrc:/SettingsPage.qml:47:9: QML MyCheckBox: Binding loop detected for property "width"
DriverHub.exe
qrc:/SettingsPage.qml:47:9: QML MyCheckBox: Binding loop detected for property "width"
DriverHub.exe
qrc:/SettingsPage.qml:29:9: QML MyCheckBox: Binding loop detected for property "width"
DriverHub.exe
qrc:/SettingsPage.qml:29:9: QML MyCheckBox: Binding loop detected for property "width"
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
driver-hub-install__28.exe