File name:

drivermax.exe

Full analysis: https://app.any.run/tasks/67a67a6a-841b-4b05-abc3-5b4c77aad619
Verdict: Malicious activity
Analysis date: June 15, 2024, 19:00:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

08B1C00831EB994402598FBDE8231E97

SHA1:

D68B9FEE5DD2F544032C54C3B37E5AAC0909957A

SHA256:

4CA6B1F38A4486882F3416BCED3A1B9462BF55869A5A3CCE43FD57C4AA20A478

SSDEEP:

98304:igXnkfOwNL25WTrw3D8KehdAZG7DB0uKh2LqXJ5Y7ZVevMT2/K/O5F+AvHhwHAJ4:lin1Z983ez3b

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • drivermax.exe (PID: 6556)
      • drivermax.tmp (PID: 6604)
      • drivermax.exe (PID: 6448)
      • drivermax.exe (PID: 4776)
      • drivermax.exe (PID: 1008)

    • Connects to the CnC server

      • drivermax.tmp (PID: 6604)

    • Changes the autorun value in the registry

      • drivermax.tmp (PID: 6604)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • drivermax.tmp (PID: 6476)
      • drivermax.tmp (PID: 6604)
      • drivermax.exe (PID: 6848)
      • drivermax.exe (PID: 4776)
      • drivermax.exe (PID: 1008)
      • drivermax.exe (PID: 1512)

    • Process drops legitimate windows executable

      • drivermax.tmp (PID: 6604)
      • drivermax.exe (PID: 1008)

    • Executable content was dropped or overwritten

      • drivermax.tmp (PID: 6604)
      • drivermax.exe (PID: 6448)
      • drivermax.exe (PID: 6556)
      • drivermax.exe (PID: 4776)
      • drivermax.exe (PID: 1008)

    • Reads the date of Windows installation

      • drivermax.tmp (PID: 6476)
      • drivermax.exe (PID: 1008)

    • Reads the Windows owner or organization settings

      • drivermax.tmp (PID: 6604)

    • Checks for external IP

      • drivermax.tmp (PID: 6604)
      • drivermax.exe (PID: 6848)
      • drivermax.exe (PID: 4776)
      • drivermax.exe (PID: 1008)
      • drivermax.exe (PID: 1512)

    • Adds/modifies Windows certificates

      • drivermax.exe (PID: 6848)

    • Checks Windows Trust Settings

      • drivermax.exe (PID: 6848)
      • drivermax.exe (PID: 4776)
      • drivermax.exe (PID: 1008)
      • drivermax.exe (PID: 1512)

    • Uses TASKKILL.EXE to kill process

      • drivermax.tmp (PID: 6604)

    • Drops a system driver (possible attempt to evade defenses)

      • drivermax.exe (PID: 4776)
      • drivermax.exe (PID: 1008)

    • Creates/Modifies COM task schedule object

      • dxdiag.exe (PID: 6976)
      • dxdiag.exe (PID: 5924)

    • Searches for installed software

      • drivermax.exe (PID: 1008)

    • Starts CMD.EXE for commands execution

      • drivermax.exe (PID: 1008)

    • Checks for Java to be installed

      • java.exe (PID: 6996)
      • java.exe (PID: 6616)

    • Application launched itself

      • drivermax.exe (PID: 1008)

  • INFO

    • Checks supported languages

      • drivermax.exe (PID: 6448)
      • drivermax.exe (PID: 6556)
      • drivermax.tmp (PID: 6604)
      • drivermax.tmp (PID: 6476)
      • drivermax.exe (PID: 6848)
      • innostp.exe (PID: 372)
      • drivermax.exe (PID: 4776)
      • stop_dmx.exe (PID: 7072)
      • innostp.exe (PID: 6844)
      • innostp.exe (PID: 6952)
      • java.exe (PID: 6996)
      • drivermax.exe (PID: 1008)
      • drivermax.exe (PID: 1512)
      • identity_helper.exe (PID: 7008)
      • java.exe (PID: 6616)

    • Reads the computer name

      • drivermax.tmp (PID: 6476)
      • drivermax.tmp (PID: 6604)
      • drivermax.exe (PID: 6848)
      • drivermax.exe (PID: 4776)
      • innostp.exe (PID: 372)
      • drivermax.exe (PID: 1008)
      • innostp.exe (PID: 6844)
      • innostp.exe (PID: 6952)
      • identity_helper.exe (PID: 7008)
      • drivermax.exe (PID: 1512)

    • Create files in a temporary directory

      • drivermax.tmp (PID: 6604)
      • drivermax.exe (PID: 6448)
      • drivermax.exe (PID: 6556)
      • java.exe (PID: 6996)
      • java.exe (PID: 6616)

    • Process checks computer location settings

      • drivermax.tmp (PID: 6476)

    • Creates files or folders in the user directory

      • drivermax.tmp (PID: 6604)
      • drivermax.exe (PID: 6848)
      • drivermax.exe (PID: 4776)
      • drivermax.exe (PID: 1008)
      • dxdiag.exe (PID: 5924)

    • Checks proxy server information

      • drivermax.tmp (PID: 6604)
      • drivermax.exe (PID: 6848)
      • dxdiag.exe (PID: 5924)

    • Reads the machine GUID from the registry

      • drivermax.tmp (PID: 6604)
      • drivermax.exe (PID: 6848)
      • innostp.exe (PID: 372)
      • drivermax.exe (PID: 4776)
      • drivermax.exe (PID: 1008)
      • innostp.exe (PID: 6844)
      • innostp.exe (PID: 6952)
      • drivermax.exe (PID: 1512)

    • Reads the software policy settings

      • drivermax.tmp (PID: 6604)
      • drivermax.exe (PID: 6848)
      • drivermax.exe (PID: 1008)
      • drivermax.exe (PID: 4776)
      • dxdiag.exe (PID: 6976)
      • dxdiag.exe (PID: 5924)
      • drivermax.exe (PID: 1512)

    • Creates a software uninstall entry

      • drivermax.tmp (PID: 6604)

    • Creates files in the program directory

      • drivermax.exe (PID: 6848)
      • drivermax.tmp (PID: 6604)
      • drivermax.exe (PID: 1008)
      • dxdiag.exe (PID: 6976)
      • cmd.exe (PID: 5712)
      • java.exe (PID: 6996)
      • cmd.exe (PID: 6640)
      • dxdiag.exe (PID: 5924)

    • Reads Microsoft Office registry keys

      • drivermax.tmp (PID: 6604)
      • msedge.exe (PID: 7004)
      • msedge.exe (PID: 6112)
      • msedge.exe (PID: 1176)

    • Application launched itself

      • msedge.exe (PID: 7004)
      • msedge.exe (PID: 6112)
      • msedge.exe (PID: 1176)

    • Manual execution by a user

      • msedge.exe (PID: 6112)

    • Reads security settings of Internet Explorer

      • dxdiag.exe (PID: 6976)
      • dxdiag.exe (PID: 5924)

    • Reads CPU info

      • drivermax.exe (PID: 1008)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (74.3)
.exe | Win32 Executable Delphi generic (9.6)
.scr | Windows screen saver (8.8)
.exe | Win32 Executable (generic) (3)
.exe | Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 40448
InitializedDataSize: 382976
UninitializedDataSize: -
EntryPoint: 0xa5f8
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Innovative Solutions
FileDescription: DriverMax Setup
FileVersion:
LegalCopyright:
ProductName: DriverMax
ProductVersion: 16.14.0.9
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
212
Monitored processes
90
Malicious processes
10
Suspicious processes
4

Behavior graph

Click at the process to see the details
start drivermax.exe drivermax.tmp no specs drivermax.exe drivermax.tmp taskkill.exe no specs conhost.exe no specs stop_dmx.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs drivermax.exe innostp.exe no specs drivermax.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs drivermax.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs innostp.exe no specs innostp.exe no specs dxdiag.exe no specs msedge.exe no specs dxdiag.exe msedge.exe no specs cmd.exe no specs conhost.exe no specs java.exe no specs icacls.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs java.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs drivermax.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
364\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
372"C:\Program Files (x86)\Innovative Solutions\DriverMax\innostp.exe" "-install"C:\Program Files (x86)\Innovative Solutions\DriverMax\innostp.exe—drivermax.tmp
User:
admin
Company:
Innovative Solutions
Integrity Level:
HIGH
Description:
Application Starter
Version:
1.0.0.9
Modules
Images
c:\program files (x86)\innovative solutions\drivermax\innostp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
708\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1008"Taskkill.exe" /IM stop_dmx.exe /FC:\Windows\SysWOW64\taskkill.exe—drivermax.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1008"C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe"C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe
drivermax.tmp
User:
admin
Company:
Innovative Solutions
Integrity Level:
HIGH
Description:
DriverMax
Version:
16.14.0.9
Modules
Images
c:\program files (x86)\innovative solutions\drivermax\drivermax.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1100"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4864 --field-trial-handle=2184,i,12565576099139923676,15803963531025781648,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1176"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-windowC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1228"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2628 --field-trial-handle=2184,i,12565576099139923676,15803963531025781648,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1512"C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe" -UPLOADC:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe
drivermax.exe
User:
admin
Company:
Innovative Solutions
Integrity Level:
HIGH
Description:
DriverMax
Exit code:
0
Version:
16.14.0.9
Modules
Images
c:\program files (x86)\innovative solutions\drivermax\drivermax.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1684"Taskkill.exe" /IM drivermax.exe /FC:\Windows\SysWOW64\taskkill.exe—drivermax.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
83 060
Read events
82 290
Write events
709
Delete events
61

Modification events

(PID) Process:(6604) drivermax.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Innovative Solutions\DriverMax
Operation:writeName:Affiliate
Value:
Inno
(PID) Process:(6604) drivermax.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6604) drivermax.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6604) drivermax.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6604) drivermax.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6604) drivermax.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6604) drivermax.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6604) drivermax.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6604) drivermax.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Innovative Solutions\DriverMax
Operation:writeName:fc
Value:
SE
(PID) Process:(6604) drivermax.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Innovative Solutions\DriverMax
Operation:writeName:lc
Value:
SE
Executable files
143
Suspicious files
350
Text files
153
Unknown types
2

Dropped files

PID
Process
Filename
Type
6448drivermax.exeC:\Users\admin\AppData\Local\Temp\is-GT4GG.tmp\drivermax.tmpexecutable
MD5:AB126F7F9FF2E7902FF2BBDC1A6D3158
SHA256:89D0CFA56BACC7981227BF45E2983DD6BFF5BAA359EBF756EF2B171B5668E515
6604drivermax.tmpC:\Program Files (x86)\Innovative Solutions\DriverMax\Readme\license.rtftext
MD5:7FABABD2AAE7365FAB3366D0EA8B5C09
SHA256:B835321246B4EBE6B3640F50A320C6FB8F0B26331664B72007D2CEBA64369773
6604drivermax.tmpC:\Program Files (x86)\Innovative Solutions\DriverMax\is-VAAUI.tmpexecutable
MD5:86BC406040B1CAA3D1A2B87455AD207D
SHA256:D3561466339F7A7731E7D8FD7A42B21EC48B7AA5C291CB445B5B3D7D0CBE9468
6604drivermax.tmpC:\Program Files (x86)\Innovative Solutions\DriverMax\stop_dmx.exeexecutable
MD5:86BC406040B1CAA3D1A2B87455AD207D
SHA256:D3561466339F7A7731E7D8FD7A42B21EC48B7AA5C291CB445B5B3D7D0CBE9468
6604drivermax.tmpC:\Users\admin\AppData\Local\Temp\is-0J7CM.tmp\folder-images-icon.bmpimage
MD5:D393253B0477CCE0D1E2F6E96E1339E9
SHA256:171092952FE01BACAFEEA6B4C7CF90AF0CA98EB251834F9B9E3E702DC878FA61
6604drivermax.tmpC:\Program Files (x86)\Innovative Solutions\DriverMax\unins000.exeexecutable
MD5:DDA56268C2B003EA0ECF68982E950F9E
SHA256:61E4D3ED79FD304D8D8E9588A4E4ACDD9193FE44955A3E1CF3BF60A2B8351138
6604drivermax.tmpC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\json[1].jsonbinary
MD5:2907EAE6C1FB7F229A72142FABC5DF25
SHA256:C0515603C6D128C671781DE5FABF55D131126C164E2188A38F0D32F37B1A65C4
6604drivermax.tmpC:\Program Files (x86)\Innovative Solutions\DriverMax\is-FRSH0.tmpexecutable
MD5:FEA887BCC3A342B2FACB566B7F7E5FCE
SHA256:087A5E4CBE8278E364703EA78F7EE57BC85D6C24A361529940634957FE18D1C5
6604drivermax.tmpC:\Users\admin\AppData\Local\Temp\is-0J7CM.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
6604drivermax.tmpC:\Program Files (x86)\Innovative Solutions\DriverMax\is-IKNME.tmpexecutable
MD5:8EA82C588C7B9C293F2E63D3050EA20E
SHA256:4BA919D1D0F2DFF3D8B1B1973B8B8BF1D6985EA382BD8C7A99FFE9C3C7E4FB46
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
91
TCP/UDP connections
93
DNS requests
61
Threats
15

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5228
svchost.exe
GET
200
2.19.122.206:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
5228
svchost.exe
GET
200
23.32.220.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
6604
drivermax.tmp
GET
200
34.117.186.192:80
http://ipinfo.io/json
unknown
—
—
unknown
5140
MoUsoCoreWorker.exe
GET
200
2.19.122.206:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
6848
drivermax.exe
GET
200
34.117.186.192:80
http://ipinfo.io/json
unknown
—
—
unknown
6848
drivermax.exe
GET
200
151.101.2.133:80
http://ocsp.globalsign.com/gsgccr45evcodesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQaCbVYh07WONuW4e63Ydlu4AlbDAQUJZ3Q%2FFkJhmPF7POxEztXHAOSNhECDA5ml5aITsG9Y8TP4w%3D%3D
unknown
—
—
unknown
6848
drivermax.exe
GET
200
151.101.2.133:80
http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6NM1IAQUHwC%2FRoAK%2FHg5t6W0Q9lWULvOljsCEHe9DgW3WQu2HUdhUx4%2Fde0%3D
unknown
—
—
unknown
5140
MoUsoCoreWorker.exe
GET
200
23.32.220.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
4776
drivermax.exe
GET
200
34.117.186.192:80
http://ipinfo.io/json
unknown
—
—
unknown
1008
drivermax.exe
GET
200
34.117.186.192:80
http://ipinfo.io/json
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4364
svchost.exe
239.255.255.250:1900
—
—
—
unknown
5228
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
unknown
4232
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5140
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5228
svchost.exe
2.19.122.206:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
5140
MoUsoCoreWorker.exe
2.19.122.206:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
5228
svchost.exe
23.32.220.96:80
www.microsoft.com
AKAMAI-AS
IT
unknown
5140
MoUsoCoreWorker.exe
23.32.220.96:80
www.microsoft.com
AKAMAI-AS
IT
unknown
6604
drivermax.tmp
34.117.186.192:80
ipinfo.io
GOOGLE-CLOUD-PLATFORM
US
unknown

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.19.122.206
  • 2.19.122.202
whitelisted
www.microsoft.com
  • 23.32.220.96
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
ipinfo.io
  • 34.117.186.192
shared
www.google-analytics.com
  • 216.239.34.178
  • 216.239.38.178
  • 216.239.32.178
  • 216.239.36.178
whitelisted
ocsp.globalsign.com
  • 151.101.2.133
  • 151.101.66.133
  • 151.101.130.133
  • 151.101.194.133
whitelisted
www.bing.com
  • 2.19.120.21
  • 2.19.120.29
whitelisted
r.bing.com
  • 2.19.120.29
  • 2.19.120.21
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
www.drivermax.com
  • 168.119.201.56
unknown

Threats

PID
Process
Class
Message
6604
drivermax.tmp
Misc activity
ET ADWARE_PUP Drivermax Utility Checkin Activity
6604
drivermax.tmp
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ipinfo.io
6604
drivermax.tmp
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
—
—
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ipinfo.io
—
—
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
—
—
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
6848
drivermax.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ipinfo.io
—
—
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
4776
drivermax.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ipinfo.io
1008
drivermax.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ipinfo.io
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
drivermax.exe