File name:

Intel-Driver-and-Support-Assistant-Installer.exe

Full analysis: https://app.any.run/tasks/fc38fcc4-c887-4fb0-963f-b954464bb6d4
Verdict: Malicious activity
Analysis date: April 12, 2025, 12:55:37
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

A3F9A844858AE41C3F9C139671437C98

SHA1:

0D874E9AC40A7CBCAAA5308D885E178B659504AC

SHA256:

C8257BD8A8A7E63D927492858E29A50DECF0938AD724E584CC840A40025591AA

SSDEEP:

98304:TiwhXSWAgQEf6cGBm4rmLbFsopn7PYONoyjSUL9A7uxuJnKdACUSQ37YWxsC6tqC:P0aDaToUCR0S

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Intel-Driver-and-Support-Assistant-Installer.exe (PID: 7348)

    • Process drops legitimate windows executable

      • Intel-Driver-and-Support-Assistant-Installer.exe (PID: 7348)

    • Searches for installed software

      • Intel-Driver-and-Support-Assistant-Installer.exe (PID: 7348)

  • INFO

    • Checks supported languages

      • Intel-Driver-and-Support-Assistant-Installer.exe (PID: 7348)
      • wixprqba.exe (PID: 7380)
      • netcoresearch.exe (PID: 7428)
      • netcoresearch.exe (PID: 7492)
      • netcoresearch.exe (PID: 7556)

    • Create files in a temporary directory

      • Intel-Driver-and-Support-Assistant-Installer.exe (PID: 7348)

    • The sample compiled with english language support

      • Intel-Driver-and-Support-Assistant-Installer.exe (PID: 7348)

    • Reads the computer name

      • Intel-Driver-and-Support-Assistant-Installer.exe (PID: 7348)
      • wixprqba.exe (PID: 7380)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:04:05 19:45:02+00:00
ImageFileCharacteristics: Executable, 32-bit, Removable run from swap, Net run from swap
PEType: PE32
LinkerVersion: 14.38
CodeSize: 483328
InitializedDataSize: 317440
UninitializedDataSize: -
EntryPoint: 0x517f0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 25.2.15.9
ProductVersionNumber: 25.2.15.9
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: ASCII
CompanyName: Intel
FileDescription: Intel® Driver & Support Assistant
FileVersion: 25.2.15.9
InternalName: burn
OriginalFileName: Intel-Driver-and-Support-Assistant-Installer.exe
ProductName: Intel® Driver & Support Assistant
ProductVersion: 25.2.15.9
LegalCopyright: Copyright © Intel Corporation. All rights reserved.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
10
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start intel-driver-and-support-assistant-installer.exe wixprqba.exe no specs netcoresearch.exe no specs conhost.exe no specs netcoresearch.exe no specs conhost.exe no specs netcoresearch.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
7348"C:\Users\admin\AppData\Local\Temp\Intel-Driver-and-Support-Assistant-Installer.exe" C:\Users\admin\AppData\Local\Temp\Intel-Driver-and-Support-Assistant-Installer.exe
explorer.exe
User:
admin
Company:
Intel
Integrity Level:
MEDIUM
Description:
Intel® Driver & Support Assistant
Version:
25.2.15.9
Modules
Images
c:\users\admin\appdata\local\temp\intel-driver-and-support-assistant-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7380"C:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\wixprqba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{3CC23506-0B07-4DCA-A7CD-0E5475959C46} {589DB6CB-8B20-42D0-AE66-422026522B54}C:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\wixprqba.exe—Intel-Driver-and-Support-Assistant-Installer.exe
User:
admin
Company:
WiX Toolset
Integrity Level:
MEDIUM
Description:
WiX Prerequisite Bootstrapper Application
Version:
5.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\{3568bd4f-0dfa-4b33-889e-9799eaca34ac}\.ba\wixprqba.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7428"C:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\Wix4NetfxBootstrapperExtension_X86\x86\netcoresearch.exe" runtime 8 Microsoft.AspNetCore.AppC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\Wix4NetfxBootstrapperExtension_X86\x86\netcoresearch.exe—Intel-Driver-and-Support-Assistant-Installer.exe
User:
admin
Company:
WiX Toolset
Integrity Level:
MEDIUM
Description:
netcoresearch
Exit code:
0
Version:
5.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\{3568bd4f-0dfa-4b33-889e-9799eaca34ac}\.ba\wix4netfxbootstrapperextension_x86\x86\netcoresearch.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\users\admin\appdata\local\temp\{3568bd4f-0dfa-4b33-889e-9799eaca34ac}\.ba\wix4netfxbootstrapperextension_x86\x86\hostfxr.dll
7436\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netcoresearch.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7492"C:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\Wix4NetfxBootstrapperExtension_X86\x86\netcoresearch.exe" runtime 8 Microsoft.WindowsDesktop.AppC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\Wix4NetfxBootstrapperExtension_X86\x86\netcoresearch.exe—Intel-Driver-and-Support-Assistant-Installer.exe
User:
admin
Company:
WiX Toolset
Integrity Level:
MEDIUM
Description:
netcoresearch
Exit code:
0
Version:
5.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\{3568bd4f-0dfa-4b33-889e-9799eaca34ac}\.ba\wix4netfxbootstrapperextension_x86\x86\netcoresearch.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\users\admin\appdata\local\temp\{3568bd4f-0dfa-4b33-889e-9799eaca34ac}\.ba\wix4netfxbootstrapperextension_x86\x86\hostfxr.dll
7500\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netcoresearch.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7556"C:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\Wix4NetfxBootstrapperExtension_X86\x64\netcoresearch.exe" runtime 8 Microsoft.NETCore.AppC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\Wix4NetfxBootstrapperExtension_X86\x64\netcoresearch.exe—Intel-Driver-and-Support-Assistant-Installer.exe
User:
admin
Company:
WiX Toolset
Integrity Level:
MEDIUM
Description:
netcoresearch
Exit code:
0
Version:
5.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\{3568bd4f-0dfa-4b33-889e-9799eaca34ac}\.ba\wix4netfxbootstrapperextension_x86\x64\netcoresearch.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\temp\{3568bd4f-0dfa-4b33-889e-9799eaca34ac}\.ba\wix4netfxbootstrapperextension_x86\x64\hostfxr.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
7564\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netcoresearch.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7616C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7648"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
516
Read events
516
Write events
0
Delete events
0

Modification events

No data
Executable files
27
Suspicious files
3
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
7348Intel-Driver-and-Support-Assistant-Installer.exeC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\ja\BootstrapperUI_V2.resources.dllexecutable
MD5:D154ED8D7B34025E7AAC9419B688527C
SHA256:79DE386DBED7AFA9EE5EA044FFDE3BBB93AD0BB39431F70EEDE93B8D8EECF74F
7348Intel-Driver-and-Support-Assistant-Installer.exeC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\fr\BootstrapperUI_V2.resources.dllexecutable
MD5:096F2BA54EC195AB5AA59309CF6359C9
SHA256:CCCE58987FE8E295B364915752A251BEC86CB24C1D877C13812A38419F4E27F9
7348Intel-Driver-and-Support-Assistant-Installer.exeC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\de\BootstrapperUI_V2.resources.dllexecutable
MD5:CA132A84DFEA164CEBD4130DBB38E725
SHA256:FBE8295B9C51AC14D666A6AF44AA1DF12F06CDD533A82A6BBE57897AC9889155
7348Intel-Driver-and-Support-Assistant-Installer.exeC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\System.ComponentModel.Composition.dllexecutable
MD5:951A53D0AFEA0806A1C5D93FBD6F2CD6
SHA256:FB61683179CAEDAD6F462C574BC4E1BD4C360F8AF1BD2CC64CC1AC267CDEB172
7348Intel-Driver-and-Support-Assistant-Installer.exeC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\mbanative.dllexecutable
MD5:0D1702D52E86DD07C489E30B9ADBF153
SHA256:443506029D771D1598BDABF0B4F9E4D363C562AFD8FDDFE68462A0FFFE6A8138
7348Intel-Driver-and-Support-Assistant-Installer.exeC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\BootstrapperUI_V2.pdbbinary
MD5:19505A97D904B55067919D69C59114B7
SHA256:47AF9EB9D2FADA509728D196EA4B185AFCA2A0235DA41FA68444E730F3F6DE59
7348Intel-Driver-and-Support-Assistant-Installer.exeC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\BootstrapperUI_V2.dllexecutable
MD5:B2056EC21C3FBC5EC117C9518BDE2339
SHA256:3F94E8B67E4E13BDCE153D188A78228BCCCD94E16D294BC7591FD34387E56F0D
7348Intel-Driver-and-Support-Assistant-Installer.exeC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\th\BootstrapperUI_V2.resources.dllexecutable
MD5:05E2FBCFC932AC9DC79616A0B99A3B9D
SHA256:C2C48C4B2185CC58040095D8B0342307CB9F725BDD44173EA5111AB62D5FC0AE
7348Intel-Driver-and-Support-Assistant-Installer.exeC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\System.CodeDom.dllexecutable
MD5:027E139F08873948F55A896A178DD426
SHA256:98ED5E5DFFBFC8D540AFA10AEF8A57AB24165FAD13387E9288F2E26F51094081
7348Intel-Driver-and-Support-Assistant-Installer.exeC:\Users\admin\AppData\Local\Temp\{3568BD4F-0DFA-4B33-889E-9799EACA34AC}\.ba\pt-BR\BootstrapperUI_V2.resources.dllexecutable
MD5:550990871CFF5D1809BAD3E95846770C
SHA256:B6F8555F5398B11775A50395D2BA26DF87B6DCA9599FC257227351325CEB5329
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
17
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.13:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8184
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8184
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.13:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
8184
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
8184
SIHClient.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.216.77.13
  • 23.216.77.31
  • 23.216.77.43
  • 23.216.77.12
  • 23.216.77.5
  • 23.216.77.41
  • 23.216.77.32
  • 23.216.77.27
  • 23.216.77.35
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.130
  • 40.126.31.129
  • 40.126.31.73
  • 20.190.159.64
  • 20.190.159.0
  • 20.190.159.128
  • 20.190.159.131
  • 40.126.31.130
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Intel-Driver-and-Support-Assistant-Installer.exe