File name:

Intel-Driver-and-Support-Assistant-Installer.exe

Full analysis: https://app.any.run/tasks/fc38fcc4-c887-4fb0-963f-b954464bb6d4
Verdict: Malicious activity
Analysis date: April 12, 2025, 12:55:37
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

A3F9A844858AE41C3F9C139671437C98

SHA1:

0D874E9AC40A7CBCAAA5308D885E178B659504AC

SHA256:

C8257BD8A8A7E63D927492858E29A50DECF0938AD724E584CC840A40025591AA

SSDEEP:

98304:TiwhXSWAgQEf6cGBm4rmLbFsopn7PYONoyjSUL9A7uxuJnKdACUSQ37YWxsC6tqC:P0aDaToUCR0S

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Intel-Driver-and-Support-Assistant-Installer.exe (PID: 7348)

    • Process drops legitimate windows executable

      • Intel-Driver-and-Support-Assistant-Installer.exe (PID: 7348)

    • Searches for installed software

      • Intel-Driver-and-Support-Assistant-Installer.exe (PID: 7348)

  • INFO

    • The sample compiled with english language support

      • Intel-Driver-and-Support-Assistant-Installer.exe (PID: 7348)

    • Create files in a temporary directory

      • Intel-Driver-and-Support-Assistant-Installer.exe (PID: 7348)

    • Checks supported languages

      • netcoresearch.exe (PID: 7492)
      • Intel-Driver-and-Support-Assistant-Installer.exe (PID: 7348)
      • netcoresearch.exe (PID: 7556)
      • netcoresearch.exe (PID: 7428)
      • wixprqba.exe (PID: 7380)

    • Reads the computer name

      • Intel-Driver-and-Support-Assistant-Installer.exe (PID: 7348)
      • wixprqba.exe (PID: 7380)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:04:05 19:45:02+00:00
ImageFileCharacteristics: Executable, 32-bit, Removable run from swap, Net run from swap
PEType: PE32
LinkerVersion: 14.38
CodeSize: 483328
InitializedDataSize: 317440
UninitializedDataSize: -
EntryPoint: 0x517f0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 25.2.15.9
ProductVersionNumber: 25.2.15.9
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: ASCII
CompanyName: Intel
FileDescription: Intel® Driver & Support Assistant
FileVersion: 25.2.15.9
InternalName: burn
OriginalFileName: Intel-Driver-and-Support-Assistant-Installer.exe
ProductName: Intel® Driver & Support Assistant
ProductVersion: 25.2.15.9
LegalCopyright: Copyright © Intel Corporation. All rights reserved.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
10
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start intel-driver-and-support-assistant-installer.exe wixprqba.exe no specs netcoresearch.exe no specs conhost.exe no specs netcoresearch.exe no specs conhost.exe no specs netcoresearch.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
7348"C:\Users\admin\AppData\Local\Temp\Intel-Driver-and-Support-Assistant-Installer.exe" C:\Users\admin\AppData\Local\Temp\Intel-Driver-and-Support-Assistant-Installer.exe
explorer.exe
User:
admin
Company:
Intel
Integrity Level:
MEDIUM
Description:
Intel® Driver & Support Assistant
Version:
25.2.15.9
Modules
Images
c:\users\admin\appdata\local\temp\intel-driver-and-support-assistant-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7380"C:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\wixprqba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{3CC23506-0B07-4DCA-A7CD-0E5475959C46} {589DB6CB-8B20-42D0-AE66-422026522B54}C:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\wixprqba.exe—Intel-Driver-and-Support-Assistant-Installer.exe
User:
admin
Company:
WiX Toolset
Integrity Level:
MEDIUM
Description:
WiX Prerequisite Bootstrapper Application
Version:
5.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\{3568bd4f-0dfa-4b33-889e-9799eaca34ac}\.ba\wixprqba.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7428"C:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\Wix4NetfxBootstrapperExtension_X86\x86\netcoresearch.exe" runtime 8 Microsoft.AspNetCore.AppC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\Wix4NetfxBootstrapperExtension_X86\x86\netcoresearch.exe—Intel-Driver-and-Support-Assistant-Installer.exe
User:
admin
Company:
WiX Toolset
Integrity Level:
MEDIUM
Description:
netcoresearch
Exit code:
0
Version:
5.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\{3568bd4f-0dfa-4b33-889e-9799eaca34ac}\.ba\wix4netfxbootstrapperextension_x86\x86\netcoresearch.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\users\admin\appdata\local\temp\{3568bd4f-0dfa-4b33-889e-9799eaca34ac}\.ba\wix4netfxbootstrapperextension_x86\x86\hostfxr.dll
7436\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netcoresearch.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7492"C:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\Wix4NetfxBootstrapperExtension_X86\x86\netcoresearch.exe" runtime 8 Microsoft.WindowsDesktop.AppC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\Wix4NetfxBootstrapperExtension_X86\x86\netcoresearch.exe—Intel-Driver-and-Support-Assistant-Installer.exe
User:
admin
Company:
WiX Toolset
Integrity Level:
MEDIUM
Description:
netcoresearch
Exit code:
0
Version:
5.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\{3568bd4f-0dfa-4b33-889e-9799eaca34ac}\.ba\wix4netfxbootstrapperextension_x86\x86\netcoresearch.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\users\admin\appdata\local\temp\{3568bd4f-0dfa-4b33-889e-9799eaca34ac}\.ba\wix4netfxbootstrapperextension_x86\x86\hostfxr.dll
7500\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netcoresearch.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7556"C:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\Wix4NetfxBootstrapperExtension_X86\x64\netcoresearch.exe" runtime 8 Microsoft.NETCore.AppC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\Wix4NetfxBootstrapperExtension_X86\x64\netcoresearch.exe—Intel-Driver-and-Support-Assistant-Installer.exe
User:
admin
Company:
WiX Toolset
Integrity Level:
MEDIUM
Description:
netcoresearch
Exit code:
0
Version:
5.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\{3568bd4f-0dfa-4b33-889e-9799eaca34ac}\.ba\wix4netfxbootstrapperextension_x86\x64\netcoresearch.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\temp\{3568bd4f-0dfa-4b33-889e-9799eaca34ac}\.ba\wix4netfxbootstrapperextension_x86\x64\hostfxr.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
7564\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netcoresearch.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7616C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7648"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
516
Read events
516
Write events
0
Delete events
0

Modification events

No data
Executable files
27
Suspicious files
3
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
7348Intel-Driver-and-Support-Assistant-Installer.exeC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\BootstrapperUI_V2.exeexecutable
MD5:2577A461587CA759C49683FEC1097749
SHA256:4C961009AE13A5C9A2BC5C010201EA8A3CC10D4DB07530592F356751E561FAE0
7348Intel-Driver-and-Support-Assistant-Installer.exeC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\de\BootstrapperUI_V2.resources.dllexecutable
MD5:CA132A84DFEA164CEBD4130DBB38E725
SHA256:FBE8295B9C51AC14D666A6AF44AA1DF12F06CDD533A82A6BBE57897AC9889155
7348Intel-Driver-and-Support-Assistant-Installer.exeC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\ja\BootstrapperUI_V2.resources.dllexecutable
MD5:D154ED8D7B34025E7AAC9419B688527C
SHA256:79DE386DBED7AFA9EE5EA044FFDE3BBB93AD0BB39431F70EEDE93B8D8EECF74F
7348Intel-Driver-and-Support-Assistant-Installer.exeC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\vi\BootstrapperUI_V2.resources.dllexecutable
MD5:615C1CFBCB7AE078EE05A3018E573A95
SHA256:3A03C23FC93103879581E242D43CD6818A56FC8C8AD77A31C4B26C79606B5335
7348Intel-Driver-and-Support-Assistant-Installer.exeC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\System.CodeDom.dllexecutable
MD5:027E139F08873948F55A896A178DD426
SHA256:98ED5E5DFFBFC8D540AFA10AEF8A57AB24165FAD13387E9288F2E26F51094081
7348Intel-Driver-and-Support-Assistant-Installer.exeC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\pt-BR\BootstrapperUI_V2.resources.dllexecutable
MD5:550990871CFF5D1809BAD3E95846770C
SHA256:B6F8555F5398B11775A50395D2BA26DF87B6DCA9599FC257227351325CEB5329
7348Intel-Driver-and-Support-Assistant-Installer.exeC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\zh-CN\BootstrapperUI_V2.resources.dllexecutable
MD5:454A38B50E6BDEB78D47937AB6AC6E7E
SHA256:BDB90FBDB31E98EDC53B48C7F7B9BE00EAA3E2075347C7D0AFA0E75ED0607BA6
7348Intel-Driver-and-Support-Assistant-Installer.exeC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\BootstrapperUI_V2.dllexecutable
MD5:B2056EC21C3FBC5EC117C9518BDE2339
SHA256:3F94E8B67E4E13BDCE153D188A78228BCCCD94E16D294BC7591FD34387E56F0D
7348Intel-Driver-and-Support-Assistant-Installer.exeC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\BootstrapperUI_V2.pdbbinary
MD5:19505A97D904B55067919D69C59114B7
SHA256:47AF9EB9D2FADA509728D196EA4B185AFCA2A0235DA41FA68444E730F3F6DE59
7348Intel-Driver-and-Support-Assistant-Installer.exeC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\CommunityToolkit.Mvvm.dllexecutable
MD5:277B42047F081D70DE67AD09A31D8B35
SHA256:540F0F3FD0CBF1DAC653F3A4EE432EBD9365F812B74BD9986FDEAFF973F6D5CB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
17
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8184
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8184
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.13:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.13:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
8184
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
8184
SIHClient.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.216.77.13
  • 23.216.77.31
  • 23.216.77.43
  • 23.216.77.12
  • 23.216.77.5
  • 23.216.77.41
  • 23.216.77.32
  • 23.216.77.27
  • 23.216.77.35
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.130
  • 40.126.31.129
  • 40.126.31.73
  • 20.190.159.64
  • 20.190.159.0
  • 20.190.159.128
  • 20.190.159.131
  • 40.126.31.130
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Intel-Driver-and-Support-Assistant-Installer.exe