File name:

driver-hub-install__28.exe

Full analysis: https://app.any.run/tasks/32e3ab38-b906-4855-a6ec-cc3a9807daa6
Verdict: Malicious activity
Analysis date: October 19, 2023, 13:38:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

01C0B780A0656D3A26A533EB0E0EAB2E

SHA1:

7792EF479D175CC9B1D0A1A002394EBD52BC3E8F

SHA256:

0A2304ED33B06FF486618CCBF8A06C321F12D72FD448B1FA20D8FF945D7589E7

SSDEEP:

49152:aA9puag5/UNsDK3tPjUTbRVcNbwe1sI3PwaSEg1a:akpuaEs+DQPjUDcNbweauVnn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • DriverHub.exe (PID: 2288)
      • test_wpf.exe (PID: 612)
      • net_updater32.exe (PID: 3328)
      • OperaGXDownloader.exe (PID: 1956)
      • net_updater32.exe (PID: 1480)
      • test_wpf.exe (PID: 3404)
      • brightdata.exe (PID: 3736)
      • idle_report.exe (PID: 3584)
      • Installer.exe (PID: 2624)
      • Installer.exe (PID: 2792)
      • Installer.exe (PID: 1808)
      • idle_report.exe (PID: 2688)
      • test_wpf.exe (PID: 324)
      • brightdata.exe (PID: 3264)
      • net_updater32.exe (PID: 1004)

    • Loads dropped or rewritten executable

      • DriverHub.exe (PID: 2288)
      • OperaGXDownloader.exe (PID: 1956)
      • net_updater32.exe (PID: 1480)
      • Installer.exe (PID: 2624)
      • drvinst.exe (PID: 188)
      • drvinst.exe (PID: 3352)
      • Installer.exe (PID: 2792)
      • net_updater32.exe (PID: 1004)

    • Drops the executable file immediately after the start

      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • OperaGXDownloader.exe (PID: 1956)
      • net_updater32.exe (PID: 1480)
      • Installer.exe (PID: 2624)
      • drvinst.exe (PID: 3908)
      • Installer.exe (PID: 2792)
      • drvinst.exe (PID: 188)
      • drvinst.exe (PID: 2060)
      • drvinst.exe (PID: 3352)
      • net_updater32.exe (PID: 1004)

    • Creates a writable file the system directory

      • net_updater32.exe (PID: 1480)
      • drvinst.exe (PID: 3908)
      • drvinst.exe (PID: 188)
      • drvinst.exe (PID: 2060)
      • drvinst.exe (PID: 3352)

  • SUSPICIOUS

    • Checks Windows Trust Settings

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • net_updater32.exe (PID: 1480)
      • Installer.exe (PID: 2624)
      • drvinst.exe (PID: 188)
      • drvinst.exe (PID: 3908)
      • Installer.exe (PID: 2792)
      • drvinst.exe (PID: 2060)
      • drvinst.exe (PID: 3352)
      • drvinst.exe (PID: 2468)
      • Installer.exe (PID: 1808)
      • net_updater32.exe (PID: 1004)

    • Reads the Internet Settings

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • sipnotify.exe (PID: 2552)

    • Reads settings of System Certificates

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • net_updater32.exe (PID: 3328)
      • Installer.exe (PID: 2624)
      • Installer.exe (PID: 2792)
      • Installer.exe (PID: 1808)
      • sipnotify.exe (PID: 2552)

    • Reads security settings of Internet Explorer

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • Installer.exe (PID: 2624)
      • Installer.exe (PID: 2792)
      • Installer.exe (PID: 1808)

    • Reads Microsoft Outlook installation path

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)

    • Reads Internet Explorer settings

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)

    • Application launched itself

      • driver-hub-install__28.exe (PID: 2464)

    • Adds/modifies Windows certificates

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)

    • Process drops legitimate windows executable

      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • Installer.exe (PID: 2792)
      • drvinst.exe (PID: 2060)
      • drvinst.exe (PID: 3352)

    • The process drops C-runtime libraries

      • DriverHub.exe (PID: 2288)

    • Detected use of alternative data streams (AltDS)

      • DriverHub.exe (PID: 2288)
      • net_updater32.exe (PID: 1480)
      • net_updater32.exe (PID: 1004)

    • Executes as Windows Service

      • net_updater32.exe (PID: 1480)

    • Drops a system driver (possible attempt to evade defenses)

      • DriverHub.exe (PID: 2288)
      • Installer.exe (PID: 2624)
      • drvinst.exe (PID: 3908)
      • drvinst.exe (PID: 188)
      • Installer.exe (PID: 2792)
      • drvinst.exe (PID: 2060)
      • drvinst.exe (PID: 3352)

    • Creates files in the driver directory

      • drvinst.exe (PID: 3908)
      • drvinst.exe (PID: 188)
      • drvinst.exe (PID: 2060)
      • drvinst.exe (PID: 3352)

    • Creates or modifies Windows services

      • drvinst.exe (PID: 188)

    • The process executes via Task Scheduler

      • sipnotify.exe (PID: 2552)

  • INFO

    • Reads the machine GUID from the registry

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • test_wpf.exe (PID: 612)
      • net_updater32.exe (PID: 3328)
      • net_updater32.exe (PID: 1480)
      • test_wpf.exe (PID: 3404)
      • idle_report.exe (PID: 3584)
      • brightdata.exe (PID: 3736)
      • Installer.exe (PID: 2624)
      • drvinst.exe (PID: 3908)
      • drvinst.exe (PID: 188)
      • Installer.exe (PID: 2792)
      • drvinst.exe (PID: 2060)
      • drvinst.exe (PID: 3352)
      • wmpnscfg.exe (PID: 2972)
      • wmpnscfg.exe (PID: 632)
      • Installer.exe (PID: 1808)
      • drvinst.exe (PID: 2468)
      • idle_report.exe (PID: 2688)
      • test_wpf.exe (PID: 324)
      • brightdata.exe (PID: 3264)
      • net_updater32.exe (PID: 1004)
      • wmpnscfg.exe (PID: 3068)
      • wmpnscfg.exe (PID: 3480)

    • Checks supported languages

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • net_updater32.exe (PID: 3328)
      • test_wpf.exe (PID: 612)
      • OperaGXDownloader.exe (PID: 1956)
      • net_updater32.exe (PID: 1480)
      • test_wpf.exe (PID: 3404)
      • idle_report.exe (PID: 3584)
      • brightdata.exe (PID: 3736)
      • Installer.exe (PID: 2624)
      • drvinst.exe (PID: 3908)
      • drvinst.exe (PID: 188)
      • Installer.exe (PID: 2792)
      • drvinst.exe (PID: 2060)
      • drvinst.exe (PID: 3352)
      • wmpnscfg.exe (PID: 2972)
      • Installer.exe (PID: 1808)
      • drvinst.exe (PID: 2468)
      • idle_report.exe (PID: 2688)
      • wmpnscfg.exe (PID: 632)
      • test_wpf.exe (PID: 324)
      • net_updater32.exe (PID: 1004)
      • brightdata.exe (PID: 3264)
      • IMEKLMG.EXE (PID: 3644)
      • IMEKLMG.EXE (PID: 3764)
      • wmpnscfg.exe (PID: 3068)
      • wmpnscfg.exe (PID: 3480)

    • Checks proxy server information

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)

    • Reads the computer name

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • net_updater32.exe (PID: 3328)
      • test_wpf.exe (PID: 612)
      • DriverHub.exe (PID: 2288)
      • net_updater32.exe (PID: 1480)
      • test_wpf.exe (PID: 3404)
      • brightdata.exe (PID: 3736)
      • idle_report.exe (PID: 3584)
      • Installer.exe (PID: 2624)
      • drvinst.exe (PID: 3908)
      • drvinst.exe (PID: 188)
      • Installer.exe (PID: 2792)
      • drvinst.exe (PID: 2060)
      • drvinst.exe (PID: 3352)
      • wmpnscfg.exe (PID: 2972)
      • drvinst.exe (PID: 2468)
      • idle_report.exe (PID: 2688)
      • wmpnscfg.exe (PID: 632)
      • Installer.exe (PID: 1808)
      • net_updater32.exe (PID: 1004)
      • test_wpf.exe (PID: 324)
      • brightdata.exe (PID: 3264)
      • IMEKLMG.EXE (PID: 3644)
      • IMEKLMG.EXE (PID: 3764)
      • wmpnscfg.exe (PID: 3068)
      • wmpnscfg.exe (PID: 3480)

    • Creates files or folders in the user directory

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)

    • Create files in a temporary directory

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • OperaGXDownloader.exe (PID: 1956)
      • Installer.exe (PID: 2624)
      • Installer.exe (PID: 2792)

    • Process checks are UAC notifies on

      • driver-hub-install__28.exe (PID: 1192)
      • IMEKLMG.EXE (PID: 3644)
      • IMEKLMG.EXE (PID: 3764)

    • Creates files in the program directory

      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • net_updater32.exe (PID: 3328)
      • net_updater32.exe (PID: 1480)
      • brightdata.exe (PID: 3736)
      • net_updater32.exe (PID: 1004)

    • Reads Environment values

      • DriverHub.exe (PID: 2288)
      • net_updater32.exe (PID: 1480)
      • brightdata.exe (PID: 3736)
      • net_updater32.exe (PID: 1004)
      • brightdata.exe (PID: 3264)

    • Process checks computer location settings

      • DriverHub.exe (PID: 2288)
      • net_updater32.exe (PID: 1480)
      • net_updater32.exe (PID: 1004)

    • Application launched itself

      • msedge.exe (PID: 3816)
      • msedge.exe (PID: 2064)

    • Manual execution by a user

      • msedge.exe (PID: 3816)
      • wmpnscfg.exe (PID: 2972)
      • wmpnscfg.exe (PID: 632)
      • IMEKLMG.EXE (PID: 3644)
      • IMEKLMG.EXE (PID: 3764)
      • wmpnscfg.exe (PID: 3480)
      • wmpnscfg.exe (PID: 3068)
      • taskmgr.exe (PID: 2796)

    • Reads security settings of Internet Explorer

      • sipnotify.exe (PID: 2552)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (76)
.exe | Win32 Executable (generic) (12.6)
.exe | Generic Win/DOS Executable (5.6)
.exe | DOS Executable Generic (5.6)

EXIF

EXE

ProductVersion: 3.3.2
FileVersion: 3.3.2
ProductName: DriverHub
OriginalFileName: DriverHubInstaller.exe
LegalCopyright: © ROSTPAY LTD. All rights reserved.
InternalName: DriverHubInstaller
FileDescription: Install DriverHub
CompanyName: ROSTPAY LTD.
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 3.3.2.0
FileVersionNumber: 3.3.2.0
Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0xb6dd50
UninitializedDataSize: 10358784
InitializedDataSize: 446464
CodeSize: 1626112
LinkerVersion: 14.29
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2023:10:05 13:23:56+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
50
Malicious processes
21
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start driver-hub-install__28.exe driver-hub-install__28.exe driverhub.exe test_wpf.exe no specs wisptis.exe no specs wisptis.exe no specs net_updater32.exe operagxdownloader.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe net_updater32.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs test_wpf.exe no specs msedge.exe no specs idle_report.exe no specs msedge.exe no specs brightdata.exe no specs installer.exe no specs msedge.exe no specs msedge.exe no specs drvinst.exe no specs drvinst.exe no specs rundll32.exe no specs installer.exe no specs drvinst.exe no specs drvinst.exe wmpnscfg.exe no specs wmpnscfg.exe no specs installer.exe no specs drvinst.exe no specs idle_report.exe no specs net_updater32.exe no specs test_wpf.exe no specs sipnotify.exe no specs brightdata.exe no specs imeklmg.exe no specs imeklmg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs taskmgr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188DrvInst.exe "2" "211" "PCI\VEN_8086&DEV_100E&SUBSYS_11001AF4&REV_03\3&13C0B0C5&0&18" "C:\Windows\INF\oem2.inf" "e1g6032.inf:Intel.NTx86.6.0.1:E100E:8.3.15.0:pci\ven_8086&dev_100e" "6efe00be3" "0000039C" "000005E0" "000005D8"C:\Windows\System32\drvinst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\advapi32.dll
324C:\ProgramData\BrightData\0958021a4a573e283a9a7d03525578a2225ac6fd\test_wpf.exeC:\ProgramData\BrightData\0958021a4a573e283a9a7d03525578a2225ac6fd\test_wpf.exe—net_updater32.exe
User:
SYSTEM
Company:
BrightData Ltd.
Integrity Level:
SYSTEM
Description:
test_wpf
Exit code:
0
Version:
1.407.240
Modules
Images
c:\programdata\brightdata\0958021a4a573e283a9a7d03525578a2225ac6fd\test_wpf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
612C:\ProgramData\BrightData\0958021a4a573e283a9a7d03525578a2225ac6fd\test_wpf.exeC:\ProgramData\BrightData\0958021a4a573e283a9a7d03525578a2225ac6fd\test_wpf.exe—DriverHub.exe
User:
admin
Company:
BrightData Ltd.
Integrity Level:
HIGH
Description:
test_wpf
Exit code:
0
Version:
1.407.240
Modules
Images
c:\programdata\brightdata\0958021a4a573e283a9a7d03525578a2225ac6fd\test_wpf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
632"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
856"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;C:\Windows\System32\wisptis.exe—DriverHub.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Pen and Touch Input Component
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wisptis.exe
c:\windows\system32\ntdll.dll
860"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xf0,0x5b5ef598,0x5b5ef5a8,0x5b5ef5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1004"C:/Program Files/DriverHub/net_updater32.exe" --updater win_drvhub.netC:\Program Files\DriverHub\net_updater32.exe—services.exe
User:
SYSTEM
Company:
BrightData Ltd.
Integrity Level:
SYSTEM
Description:
BrightData service allows free use of certain features in an app you installed
Exit code:
0
Version:
1.407.240
Modules
Images
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\sensapi.dll
1192"C:\Users\admin\Desktop\driver-hub-install__28.exe" /screen=proc /pos=240,46 /lang=enC:\Users\admin\Desktop\driver-hub-install__28.exe
driver-hub-install__28.exe
User:
admin
Company:
ROSTPAY LTD.
Integrity Level:
HIGH
Description:
Install DriverHub
Exit code:
0
Version:
3.3.2
Modules
Images
c:\users\admin\desktop\driver-hub-install__28.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
1280"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=1308,i,188092726319333807,9769413556429561116,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1304"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2616 --field-trial-handle=1312,i,4371997885843688681,14395995601762411663,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\msedge.exe
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
81 511
Read events
80 786
Write events
622
Delete events
103

Modification events

(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000056010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\417C44EB
Operation:writeName:LanguageList
Value:
en-GB
(PID) Process:(1192) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
111
Suspicious files
405
Text files
642
Unknown types
0

Dropped files

PID
Process
Filename
Type
2464driver-hub-install__28.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
2464driver-hub-install__28.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
1192driver-hub-install__28.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\CFIFG9H7.txttext
MD5:AC1B40D30B2844A110037C1AF1FC9463
SHA256:F7C3148FEE156F2C72F0C7BCAB7FD0831A26AFC1E473CB99DA1E4BD5C7F34955
1192driver-hub-install__28.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\SBVLGZ0U.txttext
MD5:4E6FE3C55E0D5C2E74D2008E439F880A
SHA256:81F61B59CD684A04E3289F3C693F3C9AE4F4C51A649C3E1242A51E2C78C107D7
1192driver-hub-install__28.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\14KJN92K.txttext
MD5:D1DCD10833DAA4655EE61A8D3FEB1717
SHA256:E0CDD5DDD38BDBEBE38EB2CA017DB9F7C45025F09A05BA384F65E6335CFD4E49
1192driver-hub-install__28.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\23U5ONTW.txttext
MD5:B7AD3D18EB45650644614597AF9690CD
SHA256:9ADC0447EE5E9B6F8E2054719D23A14F02D4898B671F59BC14FB4FA420DB07CB
2464driver-hub-install__28.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:74C723822AFD9E44C8E1863B7B9A18D0
SHA256:4D549D08947D4DF1A67E3694578B6DD6F26B11249AEAC5C8D3698BE2B57252CC
2464driver-hub-install__28.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FA8B72E153ECD2AB5A49B87A4DF1FAB2binary
MD5:A6ABF249E09365B573E6BBBF63DB0C57
SHA256:2DCE5E88F2520FAF386769D27EB6AE468BE7E4DC5B371B62F5061D508874E43C
2464driver-hub-install__28.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:546DA43A01706E029907EE4AE8AF4ACA
SHA256:DF31E73B216A85A3FA70CE76AA5D3F829B7EC9244719ADA0F29B00A0B19B464E
2464driver-hub-install__28.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:60FE01DF86BE2E5331B0CDBE86165686
SHA256:C08CCBC876CD5A7CDFA9670F9637DA57F6A1282198A9BC71FC7D7247A6E5B7A8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
112
DNS requests
55
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
HEAD
200
104.103.87.173:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133422001203040000
unknown
—
—
unknown
2464
driver-hub-install__28.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d9d446fd2e6edf24
unknown
compressed
4.66 Kb
unknown
2464
driver-hub-install__28.exe
GET
200
104.122.38.61:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
1192
driver-hub-install__28.exe
GET
200
23.212.210.158:80
http://x2.c.lencr.org/
unknown
binary
300 b
unknown
2464
driver-hub-install__28.exe
GET
200
95.101.54.114:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgNDLu2rk%2BYtiWrcHseTEt2Acw%3D%3D
unknown
binary
503 b
unknown
1192
driver-hub-install__28.exe
GET
200
95.101.54.114:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgOck9dCzp6NMVs6s4AKRbW9uQ%3D%3D
unknown
binary
503 b
unknown
2464
driver-hub-install__28.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?aa2e95dbe42fbdc2
unknown
compressed
61.6 Kb
unknown
2288
DriverHub.exe
POST
200
216.58.212.142:80
http://www.google-analytics.com/collect
unknown
image
35 b
unknown
1192
driver-hub-install__28.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAfy81yHqHeveu%2FpR5k1Jb0%3D
unknown
binary
471 b
unknown
2288
DriverHub.exe
POST
200
216.58.212.142:80
http://www.google-analytics.com/collect
unknown
image
35 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2464
driver-hub-install__28.exe
188.130.153.33:443
api.az-partners.net
Rostpay Ltd
RU
unknown
2464
driver-hub-install__28.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
2464
driver-hub-install__28.exe
104.122.38.61:80
x1.c.lencr.org
AKAMAI-AS
DE
unknown
2464
driver-hub-install__28.exe
95.101.54.114:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown
1192
driver-hub-install__28.exe
188.130.153.33:443
api.az-partners.net
Rostpay Ltd
RU
unknown
1192
driver-hub-install__28.exe
188.130.153.32:443
api.az-partners.net
Rostpay Ltd
RU
unknown
1192
driver-hub-install__28.exe
95.101.54.114:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown
1192
driver-hub-install__28.exe
172.67.152.108:443
www.biphic.com
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
api.az-partners.net
  • 188.130.153.33
  • 188.130.153.32
unknown
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
x1.c.lencr.org
  • 104.122.38.61
whitelisted
r3.o.lencr.org
  • 95.101.54.114
  • 95.101.54.195
shared
www.drvhub.net
  • 188.130.153.32
  • 188.130.153.33
unknown
www.az-partners.net
  • 188.130.153.32
  • 188.130.153.33
malicious
www.biphic.com
  • 172.67.152.108
  • 104.21.12.132
unknown
x2.c.lencr.org
  • 23.212.210.158
whitelisted
net.geo.opera.com
  • 185.26.182.111
  • 185.26.182.112
whitelisted
perr.lum-sdk.io
  • 192.81.214.145
  • 206.189.231.23
  • 159.223.133.120
  • 161.35.48.195
unknown

Threats

PID
Process
Class
Message
1088
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
1480
net_updater32.exe
Potential Corporate Privacy Violation
ET POLICY Dropbox.com Offsite File Backup in Use
1480
net_updater32.exe
Misc activity
ET INFO DropBox User Content Download Access over SSL M2
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
—
—
Misc activity
ET INFO DropBox User Content Download Access over SSL M2
Process
Message
DriverHub.exe
qrc:/UpdateProgressDialog.qml:11:5: QML Connections: Implicitly defined onFoo properties in Connections are deprecated. Use this syntax instead: function onFoo(<arguments>) { ... }
DriverHub.exe
qrc:/main.qml:655:13: QML Connections: Implicitly defined onFoo properties in Connections are deprecated. Use this syntax instead: function onFoo(<arguments>) { ... }
DriverHub.exe
qrc:/main.qml:453:31: QML ItemDelegate: Binding loop detected for property "height"
DriverHub.exe
file:///C:/Program Files/DriverHub/QtQuick/Dialogs/DefaultFileDialog.qml:102:33: QML Settings: Failed to initialize QSettings instance. Status code is: 1
DriverHub.exe
file:///C:/Program Files/DriverHub/QtQuick/Dialogs/DefaultFileDialog.qml:102:33: QML Settings: The following application identifiers have not been set: QVector("organizationName", "organizationDomain")
DriverHub.exe
qrc:/SettingsPage.qml:47:9: QML MyCheckBox: Binding loop detected for property "width"
DriverHub.exe
qrc:/SettingsPage.qml:47:9: QML MyCheckBox: Binding loop detected for property "width"
DriverHub.exe
qrc:/SettingsPage.qml:47:9: QML MyCheckBox: Binding loop detected for property "width"
DriverHub.exe
qrc:/SettingsPage.qml:29:9: QML MyCheckBox: Binding loop detected for property "width"
DriverHub.exe
qrc:/SettingsPage.qml:29:9: QML MyCheckBox: Binding loop detected for property "width"
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
driver-hub-install__28.exe