File name:

driver-hub-install__28.exe

Full analysis: https://app.any.run/tasks/32e3ab38-b906-4855-a6ec-cc3a9807daa6
Verdict: Malicious activity
Analysis date: October 19, 2023, 13:38:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

01C0B780A0656D3A26A533EB0E0EAB2E

SHA1:

7792EF479D175CC9B1D0A1A002394EBD52BC3E8F

SHA256:

0A2304ED33B06FF486618CCBF8A06C321F12D72FD448B1FA20D8FF945D7589E7

SSDEEP:

49152:aA9puag5/UNsDK3tPjUTbRVcNbwe1sI3PwaSEg1a:akpuaEs+DQPjUDcNbweauVnn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • DriverHub.exe (PID: 2288)
      • test_wpf.exe (PID: 612)
      • net_updater32.exe (PID: 3328)
      • OperaGXDownloader.exe (PID: 1956)
      • net_updater32.exe (PID: 1480)
      • test_wpf.exe (PID: 3404)
      • idle_report.exe (PID: 3584)
      • brightdata.exe (PID: 3736)
      • Installer.exe (PID: 2624)
      • Installer.exe (PID: 2792)
      • Installer.exe (PID: 1808)
      • test_wpf.exe (PID: 324)
      • idle_report.exe (PID: 2688)
      • brightdata.exe (PID: 3264)
      • net_updater32.exe (PID: 1004)

    • Loads dropped or rewritten executable

      • DriverHub.exe (PID: 2288)
      • OperaGXDownloader.exe (PID: 1956)
      • net_updater32.exe (PID: 1480)
      • drvinst.exe (PID: 188)
      • Installer.exe (PID: 2624)
      • drvinst.exe (PID: 3352)
      • Installer.exe (PID: 2792)
      • net_updater32.exe (PID: 1004)

    • Drops the executable file immediately after the start

      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • OperaGXDownloader.exe (PID: 1956)
      • net_updater32.exe (PID: 1480)
      • Installer.exe (PID: 2624)
      • drvinst.exe (PID: 3908)
      • drvinst.exe (PID: 188)
      • Installer.exe (PID: 2792)
      • drvinst.exe (PID: 3352)
      • drvinst.exe (PID: 2060)
      • net_updater32.exe (PID: 1004)

    • Creates a writable file the system directory

      • net_updater32.exe (PID: 1480)
      • drvinst.exe (PID: 3908)
      • drvinst.exe (PID: 188)
      • drvinst.exe (PID: 2060)
      • drvinst.exe (PID: 3352)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • net_updater32.exe (PID: 3328)
      • Installer.exe (PID: 2624)
      • Installer.exe (PID: 2792)
      • Installer.exe (PID: 1808)
      • sipnotify.exe (PID: 2552)

    • Reads the Internet Settings

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • sipnotify.exe (PID: 2552)

    • Reads security settings of Internet Explorer

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • Installer.exe (PID: 2624)
      • Installer.exe (PID: 2792)
      • Installer.exe (PID: 1808)

    • Checks Windows Trust Settings

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • net_updater32.exe (PID: 1480)
      • Installer.exe (PID: 2624)
      • drvinst.exe (PID: 3908)
      • drvinst.exe (PID: 188)
      • Installer.exe (PID: 2792)
      • drvinst.exe (PID: 2060)
      • drvinst.exe (PID: 3352)
      • Installer.exe (PID: 1808)
      • net_updater32.exe (PID: 1004)
      • drvinst.exe (PID: 2468)

    • Reads Internet Explorer settings

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)

    • Application launched itself

      • driver-hub-install__28.exe (PID: 2464)

    • Reads Microsoft Outlook installation path

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)

    • Adds/modifies Windows certificates

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)

    • Process drops legitimate windows executable

      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • Installer.exe (PID: 2792)
      • drvinst.exe (PID: 2060)
      • drvinst.exe (PID: 3352)

    • Detected use of alternative data streams (AltDS)

      • DriverHub.exe (PID: 2288)
      • net_updater32.exe (PID: 1480)
      • net_updater32.exe (PID: 1004)

    • The process drops C-runtime libraries

      • DriverHub.exe (PID: 2288)

    • Executes as Windows Service

      • net_updater32.exe (PID: 1480)

    • Drops a system driver (possible attempt to evade defenses)

      • DriverHub.exe (PID: 2288)
      • Installer.exe (PID: 2624)
      • drvinst.exe (PID: 3908)
      • drvinst.exe (PID: 188)
      • Installer.exe (PID: 2792)
      • drvinst.exe (PID: 3352)
      • drvinst.exe (PID: 2060)

    • Creates files in the driver directory

      • drvinst.exe (PID: 3908)
      • drvinst.exe (PID: 188)
      • drvinst.exe (PID: 2060)
      • drvinst.exe (PID: 3352)

    • Creates or modifies Windows services

      • drvinst.exe (PID: 188)

    • The process executes via Task Scheduler

      • sipnotify.exe (PID: 2552)

  • INFO

    • Checks supported languages

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • net_updater32.exe (PID: 3328)
      • test_wpf.exe (PID: 612)
      • OperaGXDownloader.exe (PID: 1956)
      • net_updater32.exe (PID: 1480)
      • test_wpf.exe (PID: 3404)
      • idle_report.exe (PID: 3584)
      • brightdata.exe (PID: 3736)
      • Installer.exe (PID: 2624)
      • drvinst.exe (PID: 188)
      • drvinst.exe (PID: 3908)
      • Installer.exe (PID: 2792)
      • drvinst.exe (PID: 2060)
      • wmpnscfg.exe (PID: 2972)
      • drvinst.exe (PID: 3352)
      • Installer.exe (PID: 1808)
      • drvinst.exe (PID: 2468)
      • wmpnscfg.exe (PID: 632)
      • test_wpf.exe (PID: 324)
      • idle_report.exe (PID: 2688)
      • brightdata.exe (PID: 3264)
      • IMEKLMG.EXE (PID: 3644)
      • net_updater32.exe (PID: 1004)
      • wmpnscfg.exe (PID: 3068)
      • wmpnscfg.exe (PID: 3480)
      • IMEKLMG.EXE (PID: 3764)

    • Reads the computer name

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • test_wpf.exe (PID: 612)
      • net_updater32.exe (PID: 1480)
      • net_updater32.exe (PID: 3328)
      • test_wpf.exe (PID: 3404)
      • idle_report.exe (PID: 3584)
      • brightdata.exe (PID: 3736)
      • Installer.exe (PID: 2624)
      • drvinst.exe (PID: 188)
      • drvinst.exe (PID: 3908)
      • Installer.exe (PID: 2792)
      • drvinst.exe (PID: 2060)
      • drvinst.exe (PID: 3352)
      • wmpnscfg.exe (PID: 2972)
      • wmpnscfg.exe (PID: 632)
      • Installer.exe (PID: 1808)
      • test_wpf.exe (PID: 324)
      • drvinst.exe (PID: 2468)
      • idle_report.exe (PID: 2688)
      • brightdata.exe (PID: 3264)
      • IMEKLMG.EXE (PID: 3644)
      • net_updater32.exe (PID: 1004)
      • wmpnscfg.exe (PID: 3480)
      • wmpnscfg.exe (PID: 3068)
      • IMEKLMG.EXE (PID: 3764)

    • Reads the machine GUID from the registry

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • test_wpf.exe (PID: 612)
      • net_updater32.exe (PID: 1480)
      • net_updater32.exe (PID: 3328)
      • test_wpf.exe (PID: 3404)
      • idle_report.exe (PID: 3584)
      • brightdata.exe (PID: 3736)
      • Installer.exe (PID: 2624)
      • drvinst.exe (PID: 3908)
      • drvinst.exe (PID: 188)
      • Installer.exe (PID: 2792)
      • drvinst.exe (PID: 2060)
      • wmpnscfg.exe (PID: 2972)
      • drvinst.exe (PID: 3352)
      • Installer.exe (PID: 1808)
      • wmpnscfg.exe (PID: 632)
      • drvinst.exe (PID: 2468)
      • idle_report.exe (PID: 2688)
      • net_updater32.exe (PID: 1004)
      • brightdata.exe (PID: 3264)
      • test_wpf.exe (PID: 324)
      • wmpnscfg.exe (PID: 3068)
      • wmpnscfg.exe (PID: 3480)

    • Checks proxy server information

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)

    • Creates files or folders in the user directory

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)

    • Create files in a temporary directory

      • driver-hub-install__28.exe (PID: 2464)
      • driver-hub-install__28.exe (PID: 1192)
      • OperaGXDownloader.exe (PID: 1956)
      • Installer.exe (PID: 2624)
      • Installer.exe (PID: 2792)

    • Creates files in the program directory

      • driver-hub-install__28.exe (PID: 1192)
      • DriverHub.exe (PID: 2288)
      • net_updater32.exe (PID: 3328)
      • net_updater32.exe (PID: 1480)
      • brightdata.exe (PID: 3736)
      • net_updater32.exe (PID: 1004)

    • Process checks are UAC notifies on

      • driver-hub-install__28.exe (PID: 1192)
      • IMEKLMG.EXE (PID: 3644)
      • IMEKLMG.EXE (PID: 3764)

    • Reads Environment values

      • DriverHub.exe (PID: 2288)
      • net_updater32.exe (PID: 1480)
      • brightdata.exe (PID: 3736)
      • net_updater32.exe (PID: 1004)
      • brightdata.exe (PID: 3264)

    • Process checks computer location settings

      • DriverHub.exe (PID: 2288)
      • net_updater32.exe (PID: 1480)
      • net_updater32.exe (PID: 1004)

    • Application launched itself

      • msedge.exe (PID: 2064)
      • msedge.exe (PID: 3816)

    • Manual execution by a user

      • msedge.exe (PID: 3816)
      • wmpnscfg.exe (PID: 2972)
      • wmpnscfg.exe (PID: 632)
      • IMEKLMG.EXE (PID: 3764)
      • IMEKLMG.EXE (PID: 3644)
      • wmpnscfg.exe (PID: 3068)
      • wmpnscfg.exe (PID: 3480)
      • taskmgr.exe (PID: 2796)

    • Reads security settings of Internet Explorer

      • sipnotify.exe (PID: 2552)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (76)
.exe | Win32 Executable (generic) (12.6)
.exe | Generic Win/DOS Executable (5.6)
.exe | DOS Executable Generic (5.6)

EXIF

EXE

ProductVersion: 3.3.2
FileVersion: 3.3.2
ProductName: DriverHub
OriginalFileName: DriverHubInstaller.exe
LegalCopyright: © ROSTPAY LTD. All rights reserved.
InternalName: DriverHubInstaller
FileDescription: Install DriverHub
CompanyName: ROSTPAY LTD.
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 3.3.2.0
FileVersionNumber: 3.3.2.0
Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0xb6dd50
UninitializedDataSize: 10358784
InitializedDataSize: 446464
CodeSize: 1626112
LinkerVersion: 14.29
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2023:10:05 13:23:56+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
50
Malicious processes
21
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start driver-hub-install__28.exe driver-hub-install__28.exe driverhub.exe test_wpf.exe no specs wisptis.exe no specs wisptis.exe no specs net_updater32.exe operagxdownloader.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe net_updater32.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs test_wpf.exe no specs msedge.exe no specs idle_report.exe no specs msedge.exe no specs brightdata.exe no specs installer.exe no specs msedge.exe no specs msedge.exe no specs drvinst.exe no specs drvinst.exe no specs rundll32.exe no specs installer.exe no specs drvinst.exe no specs drvinst.exe wmpnscfg.exe no specs wmpnscfg.exe no specs installer.exe no specs drvinst.exe no specs idle_report.exe no specs net_updater32.exe no specs test_wpf.exe no specs sipnotify.exe no specs brightdata.exe no specs imeklmg.exe no specs imeklmg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs taskmgr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188DrvInst.exe "2" "211" "PCI\VEN_8086&DEV_100E&SUBSYS_11001AF4&REV_03\3&13C0B0C5&0&18" "C:\Windows\INF\oem2.inf" "e1g6032.inf:Intel.NTx86.6.0.1:E100E:8.3.15.0:pci\ven_8086&dev_100e" "6efe00be3" "0000039C" "000005E0" "000005D8"C:\Windows\System32\drvinst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\advapi32.dll
324C:\ProgramData\BrightData\0958021a4a573e283a9a7d03525578a2225ac6fd\test_wpf.exeC:\ProgramData\BrightData\0958021a4a573e283a9a7d03525578a2225ac6fd\test_wpf.exe—net_updater32.exe
User:
SYSTEM
Company:
BrightData Ltd.
Integrity Level:
SYSTEM
Description:
test_wpf
Exit code:
0
Version:
1.407.240
Modules
Images
c:\programdata\brightdata\0958021a4a573e283a9a7d03525578a2225ac6fd\test_wpf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
612C:\ProgramData\BrightData\0958021a4a573e283a9a7d03525578a2225ac6fd\test_wpf.exeC:\ProgramData\BrightData\0958021a4a573e283a9a7d03525578a2225ac6fd\test_wpf.exe—DriverHub.exe
User:
admin
Company:
BrightData Ltd.
Integrity Level:
HIGH
Description:
test_wpf
Exit code:
0
Version:
1.407.240
Modules
Images
c:\programdata\brightdata\0958021a4a573e283a9a7d03525578a2225ac6fd\test_wpf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
632"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
856"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;C:\Windows\System32\wisptis.exe—DriverHub.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Pen and Touch Input Component
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wisptis.exe
c:\windows\system32\ntdll.dll
860"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xf0,0x5b5ef598,0x5b5ef5a8,0x5b5ef5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1004"C:/Program Files/DriverHub/net_updater32.exe" --updater win_drvhub.netC:\Program Files\DriverHub\net_updater32.exe—services.exe
User:
SYSTEM
Company:
BrightData Ltd.
Integrity Level:
SYSTEM
Description:
BrightData service allows free use of certain features in an app you installed
Exit code:
0
Version:
1.407.240
Modules
Images
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\sensapi.dll
1192"C:\Users\admin\Desktop\driver-hub-install__28.exe" /screen=proc /pos=240,46 /lang=enC:\Users\admin\Desktop\driver-hub-install__28.exe
driver-hub-install__28.exe
User:
admin
Company:
ROSTPAY LTD.
Integrity Level:
HIGH
Description:
Install DriverHub
Exit code:
0
Version:
3.3.2
Modules
Images
c:\users\admin\desktop\driver-hub-install__28.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
1280"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=1308,i,188092726319333807,9769413556429561116,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1304"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2616 --field-trial-handle=1312,i,4371997885843688681,14395995601762411663,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\msedge.exe
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
81 511
Read events
80 786
Write events
622
Delete events
103

Modification events

(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000056010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2464) driver-hub-install__28.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\417C44EB
Operation:writeName:LanguageList
Value:
en-GB
(PID) Process:(1192) driver-hub-install__28.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
111
Suspicious files
405
Text files
642
Unknown types
0

Dropped files

PID
Process
Filename
Type
2464driver-hub-install__28.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
2464driver-hub-install__28.exeC:\Users\admin\AppData\Local\Temp\TarE8E8.tmpbinary
MD5:9441737383D21192400ECA82FDA910EC
SHA256:BC3A6E84E41FAEB57E7C21AA3B60C2A64777107009727C5B7C0ED8FE658909E5
2464driver-hub-install__28.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
2464driver-hub-install__28.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FA8B72E153ECD2AB5A49B87A4DF1FAB2binary
MD5:8259677FAA846B0A8F479F86A9D50E48
SHA256:F1F0FDC45510F7B9B384529950B35E910424738A700AC751162A3B05AB6E634C
2464driver-hub-install__28.exeC:\Users\admin\AppData\Local\Temp\CabE8E7.tmpcompressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
1192driver-hub-install__28.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A7DC4336A059FB0AA5F093D96409A96Abinary
MD5:ABAAEA655756B399CED13D0F6579520B
SHA256:0FEE070580EA042CC73D6D18119E65CB762CAD94143C1CFD1DCC71372994678C
2464driver-hub-install__28.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\payload[1].jsonbinary
MD5:62204A5AA290F39B08F5B5FC4C0C2466
SHA256:2A6914C4E79C389B52EA5F3198FB5DC834E20874A313BCA5E355C67CE122314E
2464driver-hub-install__28.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FA8B72E153ECD2AB5A49B87A4DF1FAB2binary
MD5:A6ABF249E09365B573E6BBBF63DB0C57
SHA256:2DCE5E88F2520FAF386769D27EB6AE468BE7E4DC5B371B62F5061D508874E43C
1192driver-hub-install__28.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\payload[1].jsonbinary
MD5:62204A5AA290F39B08F5B5FC4C0C2466
SHA256:2A6914C4E79C389B52EA5F3198FB5DC834E20874A313BCA5E355C67CE122314E
2464driver-hub-install__28.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:74C723822AFD9E44C8E1863B7B9A18D0
SHA256:4D549D08947D4DF1A67E3694578B6DD6F26B11249AEAC5C8D3698BE2B57252CC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
112
DNS requests
55
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
HEAD
200
104.103.87.173:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133422001203040000
unknown
—
—
unknown
2464
driver-hub-install__28.exe
GET
200
104.122.38.61:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
2464
driver-hub-install__28.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?aa2e95dbe42fbdc2
unknown
compressed
61.6 Kb
unknown
2464
driver-hub-install__28.exe
GET
200
95.101.54.114:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgNDLu2rk%2BYtiWrcHseTEt2Acw%3D%3D
unknown
binary
503 b
unknown
2464
driver-hub-install__28.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d9d446fd2e6edf24
unknown
compressed
4.66 Kb
unknown
1480
net_updater32.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
binary
727 b
unknown
1192
driver-hub-install__28.exe
GET
200
95.101.54.114:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgOck9dCzp6NMVs6s4AKRbW9uQ%3D%3D
unknown
binary
503 b
unknown
1192
driver-hub-install__28.exe
GET
200
23.212.210.158:80
http://x2.c.lencr.org/
unknown
binary
300 b
unknown
1192
driver-hub-install__28.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAfy81yHqHeveu%2FpR5k1Jb0%3D
unknown
binary
471 b
unknown
2288
DriverHub.exe
POST
200
216.58.212.142:80
http://www.google-analytics.com/collect
unknown
image
35 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2464
driver-hub-install__28.exe
188.130.153.33:443
api.az-partners.net
Rostpay Ltd
RU
unknown
2464
driver-hub-install__28.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
2464
driver-hub-install__28.exe
104.122.38.61:80
x1.c.lencr.org
AKAMAI-AS
DE
unknown
2464
driver-hub-install__28.exe
95.101.54.114:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown
1192
driver-hub-install__28.exe
188.130.153.33:443
api.az-partners.net
Rostpay Ltd
RU
unknown
1192
driver-hub-install__28.exe
188.130.153.32:443
api.az-partners.net
Rostpay Ltd
RU
unknown
1192
driver-hub-install__28.exe
95.101.54.114:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown
1192
driver-hub-install__28.exe
172.67.152.108:443
www.biphic.com
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
api.az-partners.net
  • 188.130.153.33
  • 188.130.153.32
unknown
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
x1.c.lencr.org
  • 104.122.38.61
whitelisted
r3.o.lencr.org
  • 95.101.54.114
  • 95.101.54.195
shared
www.drvhub.net
  • 188.130.153.32
  • 188.130.153.33
unknown
www.az-partners.net
  • 188.130.153.32
  • 188.130.153.33
malicious
www.biphic.com
  • 172.67.152.108
  • 104.21.12.132
unknown
x2.c.lencr.org
  • 23.212.210.158
whitelisted
net.geo.opera.com
  • 185.26.182.111
  • 185.26.182.112
whitelisted
perr.lum-sdk.io
  • 192.81.214.145
  • 206.189.231.23
  • 159.223.133.120
  • 161.35.48.195
unknown

Threats

PID
Process
Class
Message
1088
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
1480
net_updater32.exe
Potential Corporate Privacy Violation
ET POLICY Dropbox.com Offsite File Backup in Use
1480
net_updater32.exe
Misc activity
ET INFO DropBox User Content Download Access over SSL M2
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
—
—
Misc activity
ET INFO DropBox User Content Download Access over SSL M2
Process
Message
DriverHub.exe
qrc:/UpdateProgressDialog.qml:11:5: QML Connections: Implicitly defined onFoo properties in Connections are deprecated. Use this syntax instead: function onFoo(<arguments>) { ... }
DriverHub.exe
qrc:/main.qml:655:13: QML Connections: Implicitly defined onFoo properties in Connections are deprecated. Use this syntax instead: function onFoo(<arguments>) { ... }
DriverHub.exe
qrc:/main.qml:453:31: QML ItemDelegate: Binding loop detected for property "height"
DriverHub.exe
file:///C:/Program Files/DriverHub/QtQuick/Dialogs/DefaultFileDialog.qml:102:33: QML Settings: Failed to initialize QSettings instance. Status code is: 1
DriverHub.exe
file:///C:/Program Files/DriverHub/QtQuick/Dialogs/DefaultFileDialog.qml:102:33: QML Settings: The following application identifiers have not been set: QVector("organizationName", "organizationDomain")
DriverHub.exe
qrc:/SettingsPage.qml:47:9: QML MyCheckBox: Binding loop detected for property "width"
DriverHub.exe
qrc:/SettingsPage.qml:47:9: QML MyCheckBox: Binding loop detected for property "width"
DriverHub.exe
qrc:/SettingsPage.qml:47:9: QML MyCheckBox: Binding loop detected for property "width"
DriverHub.exe
qrc:/SettingsPage.qml:29:9: QML MyCheckBox: Binding loop detected for property "width"
DriverHub.exe
qrc:/SettingsPage.qml:29:9: QML MyCheckBox: Binding loop detected for property "width"
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
driver-hub-install__28.exe