File name:

EasyDrv7(Win10.x64).exe

Full analysis: https://app.any.run/tasks/ac6b2d4b-517b-4ba3-85f7-02bca055ce74
Verdict: Malicious activity
Analysis date: November 09, 2024, 23:21:10
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit
qrcode
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

2126C259726066EFF33FE2C85802C8CD

SHA1:

326D9414EE2D276E52344FFFAB27C8A8A66B8F3B

SHA256:

33EA288672736D2AE88D940E1A1563B0A08EDB3D2E433ACDE80FB3167C2462F9

SSDEEP:

98304:NY5d+zuop0cOzIqIxfrlR+Q6yP3JKy2ju7JUWqznVolTI6j+Bat8+VbISirWdq3f:4y66JNSTK0MKcGRUeEtjL0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads mouse settings

      • EasyDrv7(Win10.x64).exe (PID: 920)

    • Reads the computer name

      • EasyDrv7(Win10.x64).exe (PID: 920)

    • Checks supported languages

      • EasyDrv7(Win10.x64).exe (PID: 920)

    • The process uses AutoIt

      • EasyDrv7(Win10.x64).exe (PID: 920)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:10:16 07:38:47+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 581632
InitializedDataSize: 2009600
UninitializedDataSize: -
EntryPoint: 0xfd8d4e
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 7.23.1009.3827
ProductVersionNumber: 7.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileVersion: 7.23.1009.3827
Comments: http://www.autoitscript.com/autoit3/
ProductVersion: 7
LegalCopyright: www.i-loadzone.com
OriginalFileName: EasyDrv7.exe
ProductName: Easy Driver 7
InternalName: EasyDrv7
FileDescription: Easy Driver 7
CompanyName: www.i-loadzone.com
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT easydrv7(win10.x64).exe easydrv7(win10.x64).exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
920"C:\Users\admin\AppData\Local\Temp\EasyDrv7(Win10.x64).exe" C:\Users\admin\AppData\Local\Temp\EasyDrv7(Win10.x64).exe
explorer.exe
User:
admin
Company:
www.i-loadzone.com
Integrity Level:
HIGH
Description:
Easy Driver 7
Version:
7.23.1009.3827
Modules
Images
c:\users\admin\appdata\local\temp\easydrv7(win10.x64).exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
6296"C:\Users\admin\AppData\Local\Temp\EasyDrv7(Win10.x64).exe" C:\Users\admin\AppData\Local\Temp\EasyDrv7(Win10.x64).exe—explorer.exe
User:
admin
Company:
www.i-loadzone.com
Integrity Level:
MEDIUM
Description:
Easy Driver 7
Exit code:
3221226540
Version:
7.23.1009.3827
Modules
Images
c:\users\admin\appdata\local\temp\easydrv7(win10.x64).exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
19
Read events
19
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
42
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6944
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5232
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6288
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6288
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6684
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6944
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6944
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6944
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4360
SearchApp.exe
104.126.37.123:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4360
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
5232
svchost.exe
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.23.110
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
www.bing.com
  • 104.126.37.123
  • 104.126.37.161
  • 104.126.37.185
  • 104.126.37.163
  • 104.126.37.179
  • 104.126.37.155
  • 104.126.37.171
  • 104.126.37.186
  • 104.126.37.160
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.23
  • 40.126.31.69
  • 20.190.159.2
  • 20.190.159.64
  • 20.190.159.73
  • 20.190.159.4
  • 40.126.31.71
  • 40.126.31.67
whitelisted
th.bing.com
  • 104.126.37.160
  • 104.126.37.146
  • 104.126.37.161
  • 104.126.37.123
  • 104.126.37.153
  • 104.126.37.139
  • 104.126.37.155
  • 104.126.37.163
  • 104.126.37.131
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
  • 4.245.163.56
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
EasyDrv7(Win10.x64).exe