URL:

https://download.cnet.com/Driver-Talent/3000-18512_4-76219521.html

Full analysis: https://app.any.run/tasks/3669d504-1e52-46ae-b028-9692dcd5824c
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: October 10, 2018, 23:05:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
adware
installcore
pup
loader
Indicators:
MD5:

F41001048D54D0C949FF1137F160E7DB

SHA1:

6E04D217F616B6E35205E72DF2FDB59A24AE1FCA

SHA256:

F538F25A4007B61DB6EFA504E34742B8CBCC15D10385F6DC3BFC79E1B47570D3

SSDEEP:

3:N8SElbKNxgAl1iKqdbUcXwJn:2SKmNxgAb3qvAJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes settings of System certificates

      • DriverTalent_setup[1].exe (PID: 2416)

    • Connects to CnC server

      • DriverTalent_setup[1].exe (PID: 2416)

    • Application was dropped or rewritten from another process

      • DriverTalent_setup[1].exe (PID: 2252)
      • DriverTalent_setup[1].exe (PID: 2416)
      • instup.exe (PID: 2520)
      • avast_free_antivirus_setup_online.exe (PID: 676)
      • DriverTalent.exe (PID: 2088)
      • instup.exe (PID: 3756)
      • sbr.exe (PID: 3712)

    • INSTALLCORE was detected

      • DriverTalent_setup[1].exe (PID: 2416)

    • Loads dropped or rewritten executable

      • svchost.exe (PID: 1336)
      • DriverTalent_setup[1].exe (PID: 2416)
      • DriverTalent.exe (PID: 2088)
      • rundll32.exe (PID: 1152)
      • instup.exe (PID: 2520)
      • instup.exe (PID: 3756)
      • AvEmUpdate.exe (PID: 3444)

    • Changes the autorun value in the registry

      • instup.exe (PID: 3756)

    • Loads the Task Scheduler COM API

      • AvEmUpdate.exe (PID: 1256)
      • AvEmUpdate.exe (PID: 3700)

    • Downloads executable files from the Internet

      • AvEmUpdate.exe (PID: 3700)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2124)
      • iexplore.exe (PID: 2296)
      • iexplore.exe (PID: 3724)
      • DriverTalent_setup[1].exe (PID: 2416)
      • cmd.exe (PID: 1180)
      • instup.exe (PID: 2520)
      • avast_free_antivirus_setup_online.exe (PID: 676)
      • AvEmUpdate.exe (PID: 3700)
      • AvEmUpdate.exe (PID: 3444)
      • instup.exe (PID: 3756)

    • Adds / modifies Windows certificates

      • DriverTalent_setup[1].exe (PID: 2416)

    • Reads the machine GUID from the registry

      • DriverTalent_setup[1].exe (PID: 2416)

    • Reads CPU info

      • DriverTalent_setup[1].exe (PID: 2416)

    • Reads productID from registry

      • DriverTalent_setup[1].exe (PID: 2416)

    • Reads internet explorer settings

      • DriverTalent_setup[1].exe (PID: 2416)
      • DriverTalent.exe (PID: 2088)

    • Reads the date of Windows installation

      • DriverTalent_setup[1].exe (PID: 2416)

    • Creates a software uninstall entry

      • DriverTalent_setup[1].exe (PID: 2416)
      • instup.exe (PID: 3756)

    • Starts CMD.EXE for commands execution

      • DriverTalent_setup[1].exe (PID: 2416)
      • cmd.exe (PID: 2796)

    • Application launched itself

      • cmd.exe (PID: 2796)
      • AvEmUpdate.exe (PID: 3700)

    • Creates files in the program directory

      • avast_free_antivirus_setup_online.exe (PID: 676)
      • instup.exe (PID: 2520)
      • DriverTalent.exe (PID: 2088)
      • DriverTalent_setup[1].exe (PID: 2416)
      • AvEmUpdate.exe (PID: 3700)
      • instup.exe (PID: 3756)

    • Creates or modifies windows services

      • DriverTalent_setup[1].exe (PID: 2416)
      • instup.exe (PID: 3756)

    • Low-level read access rights to disk partition

      • avast_free_antivirus_setup_online.exe (PID: 676)
      • instup.exe (PID: 2520)
      • DriverTalent.exe (PID: 2088)
      • instup.exe (PID: 3756)
      • AvEmUpdate.exe (PID: 3700)
      • AvEmUpdate.exe (PID: 3444)
      • AvEmUpdate.exe (PID: 3960)

    • Creates files in the user directory

      • DriverTalent.exe (PID: 2088)

    • Changes IE settings (feature browser emulation)

      • DriverTalent.exe (PID: 2088)

    • Reads Internet Cache Settings

      • DriverTalent.exe (PID: 2088)

    • Creates files in the Windows directory

      • DriverTalent.exe (PID: 2088)
      • instup.exe (PID: 3756)

    • Modifies the open verb of a shell class

      • DriverTalent.exe (PID: 2088)
      • instup.exe (PID: 3756)

    • Creates COM task schedule object

      • instup.exe (PID: 3756)

    • Creates files in the driver directory

      • instup.exe (PID: 3756)

  • INFO

    • Reads internet explorer settings

      • iexplore.exe (PID: 2296)
      • iexplore.exe (PID: 2124)

    • Changes internet zones settings

      • iexplore.exe (PID: 3724)

    • Application launched itself

      • iexplore.exe (PID: 3724)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2296)
      • iexplore.exe (PID: 2124)
      • iexplore.exe (PID: 3724)

    • Creates files in the user directory

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 1380)
      • iexplore.exe (PID: 2296)
      • iexplore.exe (PID: 2124)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3724)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 2296)
      • DriverTalent_setup[1].exe (PID: 2416)
      • iexplore.exe (PID: 2124)
      • instup.exe (PID: 3756)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3724)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3724)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
74
Monitored processes
29
Malicious processes
9
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs iexplore.exe drivertalent_setup[1].exe no specs #INSTALLCORE drivertalent_setup[1].exe cmd.exe no specs timeout.exe no specs svchost.exe cmd.exe cmd.exe no specs cmd.exe no specs avast_free_antivirus_setup_online.exe instup.exe drivertalent.exe rundll32.exe no specs verclsid.exe no specs instup.exe sbr.exe no specs taskmgr.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs avemupdate.exe no specs avemupdate.exe avemupdate.exe ac71f12f-ac4e-4fc3-924f-93590913f891.exe no specs avemupdate.exe

Process information

PID
CMD
Path
Indicators
Parent process
676"C:\Users\admin\AppData\Local\Temp\ns55057815\0AA10751_stp\avast_free_antivirus_setup_online.exe" /silent /psh:+bmUFrnixR+84MRqzZTBGr/mxByqo5RfseLAGrThwBq94MAbuuXAGLnh1kTqtpVZsZGmat+E1kj+s8MZsePCGL/hyR2+5sT+RwAAAIzQ8Cs=C:\Users\admin\AppData\Local\Temp\ns55057815\0AA10751_stp\avast_free_antivirus_setup_online.exe
DriverTalent_setup[1].exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Exit code:
0
Version:
17.1.3394.0
Modules
Images
c:\users\admin\appdata\local\temp\ns55057815\0aa10751_stp\avast_free_antivirus_setup_online.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1152C:\Windows\system32\rundll32.exe "C:\Program Files\OSTotoSoft\DriverTalent\pcidetect.dll",HDRundllDetectC:\Windows\system32\rundll32.exe—DriverTalent.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1180cmd /d /c copy /B /Y "C:\Users\admin\AppData\Local\Temp\D82885~1.DAT"+"C:\Users\admin\AppData\Local\Temp\D82885~2.DAT" "C:\Users\admin\AppData\Local\Temp\ns55057815\0AA10751_stp\avast_free_antivirus_setup_online.exe" C:\Windows\system32\cmd.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1256"C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe" /installer /regC:\Program Files\AVAST Software\Avast\AvEmUpdate.exe—instup.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Emergency Update
Exit code:
0
Version:
18.7.4041.0
Modules
Images
c:\program files\avast software\avast\avemupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\webio.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
1336C:\Windows\System32\svchost.exe -k LocalDriverServiceC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\program files\ostotosoft\drivertalent\ldrvsvc.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\shell32.dll
1380C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Exit code:
0
Version:
26,0,0,131
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_26_0_0_131_activex.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1796TIMEOUT 1 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
2088"C:\Program Files\OSTotoSoft\DriverTalent\DriverTalent.exe" C:\Program Files\OSTotoSoft\DriverTalent\DriverTalent.exe
DriverTalent_setup[1].exe
User:
admin
Company:
OSToto Co., Ltd.
Integrity Level:
HIGH
Description:
Driver Talent
Exit code:
0
Version:
7, 1, 4, 22
Modules
Images
c:\program files\ostotosoft\drivertalent\drivertalent.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2124"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3724 CREDAT:203009C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2196"C:\Program Files\AVAST Software\Avast\SetupInf.exe" /catalog:aswVmm.cat /uninstallC:\Program Files\AVAST Software\Avast\SetupInf.exe—instup.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Exit code:
0
Version:
18.7.4041.0
Modules
Images
c:\program files\avast software\avast\setupinf.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
8 477
Read events
2 432
Write events
6 038
Delete events
7

Modification events

(PID) Process:(3724) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3724) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3724) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3724) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(3724) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3724) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3724) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{08692DC1-CCE1-11E8-BFAB-5254004AAD11}
Value:
0
(PID) Process:(3724) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(3724) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
3
(PID) Process:(3724) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E2070A0003000A001700050034001C03
Executable files
161
Suspicious files
90
Text files
704
Unknown types
47

Dropped files

PID
Process
Filename
Type
3724iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
3724iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2296iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab1618.tmp —
MD5:—
SHA256:—
2296iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar1619.tmp —
MD5:—
SHA256:—
2296iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab162A.tmp —
MD5:—
SHA256:—
2296iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar163B.tmp —
MD5:—
SHA256:—
2296iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@cnet[2].txt —
MD5:—
SHA256:—
2296iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab16A9.tmp —
MD5:—
SHA256:—
2296iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar16AA.tmp —
MD5:—
SHA256:—
2296iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\country[1].jstext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
129
TCP/UDP connections
325
DNS requests
181
Threats
21

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2416
DriverTalent_setup[1].exe
POST
200
52.31.214.5:80
http://rp.bestupdatemeta.com/
IE
—
—
malicious
2416
DriverTalent_setup[1].exe
GET
200
95.211.184.67:80
http://img.bestupdatemeta.com/img/Tavasat/15Feb17/v2_fs/EN.jpg
NL
image
23.4 Kb
malicious
2296
iexplore.exe
GET
200
2.16.186.81:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
unknown
compressed
54.2 Kb
whitelisted
2416
DriverTalent_setup[1].exe
POST
200
52.31.214.5:80
http://rp.bestupdatemeta.com/
IE
—
—
malicious
2416
DriverTalent_setup[1].exe
POST
200
52.31.214.5:80
http://rp.bestupdatemeta.com/
IE
—
—
malicious
2416
DriverTalent_setup[1].exe
GET
200
95.211.184.67:80
http://img.bestupdatemeta.com/img/Rowabobeso/b2_fus_clean.png
NL
image
33.6 Kb
malicious
2416
DriverTalent_setup[1].exe
POST
200
52.31.214.5:80
http://rp.bestupdatemeta.com/
IE
—
—
malicious
2416
DriverTalent_setup[1].exe
POST
200
52.211.15.5:80
http://os.bestupdatemeta.com/FusionOSToto_New/
IE
binary
296 Kb
malicious
2416
DriverTalent_setup[1].exe
GET
200
95.211.184.67:80
http://img.bestupdatemeta.com/img/Rowabobeso/icon2.png
NL
image
422 b
malicious
2416
DriverTalent_setup[1].exe
GET
200
95.211.184.67:80
http://img.bestupdatemeta.com/img/Rowabobeso/icon1.png
NL
image
481 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3724
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2296
iexplore.exe
2.19.47.102:443
download.cnet.com
Akamai International B.V.
—
whitelisted
2296
iexplore.exe
151.101.1.198:443
mtrx.go.sonobi.com
Fastly
US
unknown
2296
iexplore.exe
2.19.34.83:443
cdn.optimizely.com
Akamai International B.V.
—
whitelisted
2296
iexplore.exe
2.18.234.21:443
js-sec.indexww.com
Akamai International B.V.
—
whitelisted
2296
iexplore.exe
2.16.186.81:80
www.download.windowsupdate.com
Akamai International B.V.
—
whitelisted
2296
iexplore.exe
151.101.2.2:443
cdn.taboola.com
Fastly
US
shared
2296
iexplore.exe
104.111.214.103:443
sb.scorecardresearch.com
Akamai International B.V.
NL
whitelisted
2296
iexplore.exe
87.248.114.11:443
s.yimg.com
Yahoo! UK Services Limited
GB
shared
2296
iexplore.exe
151.101.1.181:443
widget.perfectmarket.com
Fastly
US
suspicious

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
download.cnet.com
  • 2.19.47.102
whitelisted
a4.fdlstatic.com
  • 2.18.233.149
whitelisted
cdn.optimizely.com
  • 2.19.34.83
whitelisted
c.evidon.com
  • 104.111.244.243
whitelisted
a3.fdlstatic.com
  • 2.18.233.149
whitelisted
mtrx.go.sonobi.com
  • 151.101.1.198
  • 151.101.65.198
  • 151.101.129.198
  • 151.101.193.198
unknown
www.download.windowsupdate.com
  • 2.16.186.81
  • 2.16.186.56
whitelisted
l.betrad.com
  • 35.168.154.40
  • 54.88.108.213
  • 18.214.158.180
  • 52.0.77.209
  • 107.23.89.178
  • 52.72.136.100
  • 52.72.158.71
  • 52.54.5.87
whitelisted
js-sec.indexww.com
  • 2.18.234.21
whitelisted

Threats

PID
Process
Class
Message
2416
DriverTalent_setup[1].exe
Misc activity
ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M2
2416
DriverTalent_setup[1].exe
Misc activity
ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M1
2416
DriverTalent_setup[1].exe
Misc activity
ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M3
2416
DriverTalent_setup[1].exe
Misc activity
ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M4
3700
AvEmUpdate.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
16 ETPRO signatures available at the full report
Process
Message
DriverTalent_setup[1].exe
hwang global_licence_url: http://www.drivethelife.com/EULA.html
DriverTalent_setup[1].exe
hwang Create Directory C:\Users\admin\AppData\Local\Temp\HotEEB5.tmp!
DriverTalent_setup[1].exe
hwang UnCompress EXT to C:\Users\admin\AppData\Local\Temp\HotEEB5.tmp .
DriverTalent_setup[1].exe
hwang UnCompress successful.
DriverTalent_setup[1].exe
hwang Create Directory C:\Program Files\OSTotoSoft\DriverTalent!
DriverTalent_setup[1].exe
hwang UnCompress DATA to C:\Program Files\OSTotoSoft\DriverTalent .
DriverTalent_setup[1].exe
hwang UnCompress successful.
DriverTalent_setup[1].exe
hwang Copy C:\Users\admin\AppData\Local\Temp\HotEEB5.tmp\DTInstUI.dll to C:\Program Files\OSTotoSoft\DriverTalent !
DriverTalent_setup[1].exe
hwang Copy C:\Users\admin\AppData\Local\Temp\HotEEB5.tmp\AdModule.dll to C:\Program Files\OSTotoSoft\DriverTalent !
DriverTalent_setup[1].exe
hwang Copy C:\Users\admin\AppData\Local\Temp\HotEEB5.tmp\substat.dll to C:\Program Files\OSTotoSoft\DriverTalent !
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://download.cnet.com/Driver-Talent/3000-18512_4-76219521.html