File name:

drivermax.exe

Full analysis: https://app.any.run/tasks/67a67a6a-841b-4b05-abc3-5b4c77aad619
Verdict: Malicious activity
Analysis date: June 15, 2024, 19:00:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

08B1C00831EB994402598FBDE8231E97

SHA1:

D68B9FEE5DD2F544032C54C3B37E5AAC0909957A

SHA256:

4CA6B1F38A4486882F3416BCED3A1B9462BF55869A5A3CCE43FD57C4AA20A478

SSDEEP:

98304:igXnkfOwNL25WTrw3D8KehdAZG7DB0uKh2LqXJ5Y7ZVevMT2/K/O5F+AvHhwHAJ4:lin1Z983ez3b

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • drivermax.exe (PID: 6448)
      • drivermax.exe (PID: 6556)
      • drivermax.tmp (PID: 6604)
      • drivermax.exe (PID: 4776)
      • drivermax.exe (PID: 1008)

    • Connects to the CnC server

      • drivermax.tmp (PID: 6604)

    • Changes the autorun value in the registry

      • drivermax.tmp (PID: 6604)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • drivermax.exe (PID: 6448)
      • drivermax.exe (PID: 6556)
      • drivermax.tmp (PID: 6604)
      • drivermax.exe (PID: 4776)
      • drivermax.exe (PID: 1008)

    • Reads security settings of Internet Explorer

      • drivermax.tmp (PID: 6476)
      • drivermax.tmp (PID: 6604)
      • drivermax.exe (PID: 6848)
      • drivermax.exe (PID: 4776)
      • drivermax.exe (PID: 1008)
      • drivermax.exe (PID: 1512)

    • Reads the date of Windows installation

      • drivermax.tmp (PID: 6476)
      • drivermax.exe (PID: 1008)

    • Reads the Windows owner or organization settings

      • drivermax.tmp (PID: 6604)

    • Process drops legitimate windows executable

      • drivermax.tmp (PID: 6604)
      • drivermax.exe (PID: 1008)

    • Checks for external IP

      • drivermax.tmp (PID: 6604)
      • drivermax.exe (PID: 6848)
      • drivermax.exe (PID: 4776)
      • drivermax.exe (PID: 1008)
      • drivermax.exe (PID: 1512)

    • Uses TASKKILL.EXE to kill process

      • drivermax.tmp (PID: 6604)

    • Checks Windows Trust Settings

      • drivermax.exe (PID: 6848)
      • drivermax.exe (PID: 4776)
      • drivermax.exe (PID: 1008)
      • drivermax.exe (PID: 1512)

    • Adds/modifies Windows certificates

      • drivermax.exe (PID: 6848)

    • Drops a system driver (possible attempt to evade defenses)

      • drivermax.exe (PID: 4776)
      • drivermax.exe (PID: 1008)

    • Searches for installed software

      • drivermax.exe (PID: 1008)

    • Creates/Modifies COM task schedule object

      • dxdiag.exe (PID: 6976)
      • dxdiag.exe (PID: 5924)

    • Starts CMD.EXE for commands execution

      • drivermax.exe (PID: 1008)

    • Checks for Java to be installed

      • java.exe (PID: 6996)
      • java.exe (PID: 6616)

    • Application launched itself

      • drivermax.exe (PID: 1008)

  • INFO

    • Create files in a temporary directory

      • drivermax.exe (PID: 6448)
      • drivermax.exe (PID: 6556)
      • drivermax.tmp (PID: 6604)
      • java.exe (PID: 6996)
      • java.exe (PID: 6616)

    • Checks supported languages

      • drivermax.exe (PID: 6448)
      • drivermax.tmp (PID: 6476)
      • drivermax.exe (PID: 6556)
      • drivermax.tmp (PID: 6604)
      • stop_dmx.exe (PID: 7072)
      • drivermax.exe (PID: 6848)
      • drivermax.exe (PID: 4776)
      • drivermax.exe (PID: 1008)
      • innostp.exe (PID: 372)
      • innostp.exe (PID: 6952)
      • innostp.exe (PID: 6844)
      • java.exe (PID: 6996)
      • java.exe (PID: 6616)
      • identity_helper.exe (PID: 7008)
      • drivermax.exe (PID: 1512)

    • Reads the computer name

      • drivermax.tmp (PID: 6476)
      • drivermax.tmp (PID: 6604)
      • drivermax.exe (PID: 6848)
      • innostp.exe (PID: 372)
      • drivermax.exe (PID: 4776)
      • drivermax.exe (PID: 1008)
      • innostp.exe (PID: 6952)
      • innostp.exe (PID: 6844)
      • identity_helper.exe (PID: 7008)
      • drivermax.exe (PID: 1512)

    • Process checks computer location settings

      • drivermax.tmp (PID: 6476)

    • Creates files or folders in the user directory

      • drivermax.tmp (PID: 6604)
      • drivermax.exe (PID: 6848)
      • drivermax.exe (PID: 4776)
      • drivermax.exe (PID: 1008)
      • dxdiag.exe (PID: 5924)

    • Reads the software policy settings

      • drivermax.tmp (PID: 6604)
      • drivermax.exe (PID: 6848)
      • drivermax.exe (PID: 4776)
      • drivermax.exe (PID: 1008)
      • dxdiag.exe (PID: 6976)
      • dxdiag.exe (PID: 5924)
      • drivermax.exe (PID: 1512)

    • Reads the machine GUID from the registry

      • drivermax.tmp (PID: 6604)
      • drivermax.exe (PID: 6848)
      • innostp.exe (PID: 372)
      • drivermax.exe (PID: 4776)
      • drivermax.exe (PID: 1008)
      • innostp.exe (PID: 6844)
      • innostp.exe (PID: 6952)
      • drivermax.exe (PID: 1512)

    • Creates files in the program directory

      • drivermax.tmp (PID: 6604)
      • drivermax.exe (PID: 6848)
      • drivermax.exe (PID: 1008)
      • dxdiag.exe (PID: 6976)
      • cmd.exe (PID: 5712)
      • java.exe (PID: 6996)
      • dxdiag.exe (PID: 5924)
      • cmd.exe (PID: 6640)

    • Creates a software uninstall entry

      • drivermax.tmp (PID: 6604)

    • Checks proxy server information

      • drivermax.tmp (PID: 6604)
      • drivermax.exe (PID: 6848)
      • dxdiag.exe (PID: 5924)

    • Reads Microsoft Office registry keys

      • drivermax.tmp (PID: 6604)
      • msedge.exe (PID: 7004)
      • msedge.exe (PID: 6112)
      • msedge.exe (PID: 1176)

    • Application launched itself

      • msedge.exe (PID: 7004)
      • msedge.exe (PID: 6112)
      • msedge.exe (PID: 1176)

    • Manual execution by a user

      • msedge.exe (PID: 6112)

    • Reads security settings of Internet Explorer

      • dxdiag.exe (PID: 6976)
      • dxdiag.exe (PID: 5924)

    • Reads CPU info

      • drivermax.exe (PID: 1008)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (74.3)
.exe | Win32 Executable Delphi generic (9.6)
.scr | Windows screen saver (8.8)
.exe | Win32 Executable (generic) (3)
.exe | Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 40448
InitializedDataSize: 382976
UninitializedDataSize: -
EntryPoint: 0xa5f8
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Innovative Solutions
FileDescription: DriverMax Setup
FileVersion:
LegalCopyright:
ProductName: DriverMax
ProductVersion: 16.14.0.9
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
212
Monitored processes
90
Malicious processes
10
Suspicious processes
4

Behavior graph

Click at the process to see the details
start drivermax.exe drivermax.tmp no specs drivermax.exe drivermax.tmp taskkill.exe no specs conhost.exe no specs stop_dmx.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs drivermax.exe innostp.exe no specs drivermax.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs drivermax.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs innostp.exe no specs innostp.exe no specs dxdiag.exe no specs msedge.exe no specs dxdiag.exe msedge.exe no specs cmd.exe no specs conhost.exe no specs java.exe no specs icacls.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs java.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs drivermax.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
364\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
372"C:\Program Files (x86)\Innovative Solutions\DriverMax\innostp.exe" "-install"C:\Program Files (x86)\Innovative Solutions\DriverMax\innostp.exe—drivermax.tmp
User:
admin
Company:
Innovative Solutions
Integrity Level:
HIGH
Description:
Application Starter
Version:
1.0.0.9
Modules
Images
c:\program files (x86)\innovative solutions\drivermax\innostp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
708\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1008"Taskkill.exe" /IM stop_dmx.exe /FC:\Windows\SysWOW64\taskkill.exe—drivermax.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1008"C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe"C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe
drivermax.tmp
User:
admin
Company:
Innovative Solutions
Integrity Level:
HIGH
Description:
DriverMax
Version:
16.14.0.9
Modules
Images
c:\program files (x86)\innovative solutions\drivermax\drivermax.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1100"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4864 --field-trial-handle=2184,i,12565576099139923676,15803963531025781648,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1176"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-windowC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1228"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2628 --field-trial-handle=2184,i,12565576099139923676,15803963531025781648,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1512"C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe" -UPLOADC:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe
drivermax.exe
User:
admin
Company:
Innovative Solutions
Integrity Level:
HIGH
Description:
DriverMax
Exit code:
0
Version:
16.14.0.9
Modules
Images
c:\program files (x86)\innovative solutions\drivermax\drivermax.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1684"Taskkill.exe" /IM drivermax.exe /FC:\Windows\SysWOW64\taskkill.exe—drivermax.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
83 060
Read events
82 290
Write events
709
Delete events
61

Modification events

(PID) Process:(6604) drivermax.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Innovative Solutions\DriverMax
Operation:writeName:Affiliate
Value:
Inno
(PID) Process:(6604) drivermax.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6604) drivermax.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6604) drivermax.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6604) drivermax.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6604) drivermax.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6604) drivermax.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6604) drivermax.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6604) drivermax.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Innovative Solutions\DriverMax
Operation:writeName:fc
Value:
SE
(PID) Process:(6604) drivermax.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Innovative Solutions\DriverMax
Operation:writeName:lc
Value:
SE
Executable files
143
Suspicious files
350
Text files
153
Unknown types
2

Dropped files

PID
Process
Filename
Type
6448drivermax.exeC:\Users\admin\AppData\Local\Temp\is-GT4GG.tmp\drivermax.tmpexecutable
MD5:AB126F7F9FF2E7902FF2BBDC1A6D3158
SHA256:89D0CFA56BACC7981227BF45E2983DD6BFF5BAA359EBF756EF2B171B5668E515
6604drivermax.tmpC:\Users\admin\AppData\Local\Temp\is-0J7CM.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
6604drivermax.tmpC:\Program Files (x86)\Innovative Solutions\DriverMax\unins000.exeexecutable
MD5:DDA56268C2B003EA0ECF68982E950F9E
SHA256:61E4D3ED79FD304D8D8E9588A4E4ACDD9193FE44955A3E1CF3BF60A2B8351138
6604drivermax.tmpC:\Program Files (x86)\Innovative Solutions\DriverMax\is-N1C4M.tmpexecutable
MD5:DDA56268C2B003EA0ECF68982E950F9E
SHA256:61E4D3ED79FD304D8D8E9588A4E4ACDD9193FE44955A3E1CF3BF60A2B8351138
6556drivermax.exeC:\Users\admin\AppData\Local\Temp\is-75EM9.tmp\drivermax.tmpexecutable
MD5:AB126F7F9FF2E7902FF2BBDC1A6D3158
SHA256:89D0CFA56BACC7981227BF45E2983DD6BFF5BAA359EBF756EF2B171B5668E515
6604drivermax.tmpC:\Users\admin\AppData\Local\Temp\is-0J7CM.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
6604drivermax.tmpC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\json[1].jsonbinary
MD5:2907EAE6C1FB7F229A72142FABC5DF25
SHA256:C0515603C6D128C671781DE5FABF55D131126C164E2188A38F0D32F37B1A65C4
6604drivermax.tmpC:\Users\admin\AppData\Local\Temp\is-0J7CM.tmp\analytics_v2.dllexecutable
MD5:9997F8936AC3187262ED21E681A6F254
SHA256:E53317E0ECD2B26D4901D4E29914B4BB3F3097AAF5485D5B0A2D58E1340B45EC
6604drivermax.tmpC:\Users\admin\AppData\Local\Temp\is-0J7CM.tmp\folder-images-icon.bmpimage
MD5:D393253B0477CCE0D1E2F6E96E1339E9
SHA256:171092952FE01BACAFEEA6B4C7CF90AF0CA98EB251834F9B9E3E702DC878FA61
6604drivermax.tmpC:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exeexecutable
MD5:FEA887BCC3A342B2FACB566B7F7E5FCE
SHA256:087A5E4CBE8278E364703EA78F7EE57BC85D6C24A361529940634957FE18D1C5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
91
TCP/UDP connections
93
DNS requests
61
Threats
15

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5228
svchost.exe
GET
200
2.19.122.206:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
5140
MoUsoCoreWorker.exe
GET
200
2.19.122.206:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
5228
svchost.exe
GET
200
23.32.220.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
5140
MoUsoCoreWorker.exe
GET
200
23.32.220.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
6604
drivermax.tmp
GET
200
34.117.186.192:80
http://ipinfo.io/json
unknown
—
—
unknown
4776
drivermax.exe
GET
200
34.117.186.192:80
http://ipinfo.io/json
unknown
—
—
unknown
1008
drivermax.exe
GET
200
34.117.186.192:80
http://ipinfo.io/json
unknown
—
—
unknown
—
—
GET
401
13.107.6.158:443
https://business.bing.com/api/v1/user/token/microsoftgraph?&clienttype=edge-omnibox
unknown
—
—
—
1008
drivermax.exe
GET
200
168.119.201.56:80
http://www.drivermax.com/promo8//Inno/_v5.xml
unknown
—
—
unknown
1008
drivermax.exe
POST
200
168.119.201.56:80
http://user.drivermax.com/sc-detect/sc-params.php
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4364
svchost.exe
239.255.255.250:1900
—
—
—
unknown
5228
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
unknown
4232
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5140
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5228
svchost.exe
2.19.122.206:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
5140
MoUsoCoreWorker.exe
2.19.122.206:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
5228
svchost.exe
23.32.220.96:80
www.microsoft.com
AKAMAI-AS
IT
unknown
5140
MoUsoCoreWorker.exe
23.32.220.96:80
www.microsoft.com
AKAMAI-AS
IT
unknown
6604
drivermax.tmp
34.117.186.192:80
ipinfo.io
GOOGLE-CLOUD-PLATFORM
US
unknown

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.19.122.206
  • 2.19.122.202
whitelisted
www.microsoft.com
  • 23.32.220.96
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
ipinfo.io
  • 34.117.186.192
shared
www.google-analytics.com
  • 216.239.34.178
  • 216.239.38.178
  • 216.239.32.178
  • 216.239.36.178
whitelisted
ocsp.globalsign.com
  • 151.101.2.133
  • 151.101.66.133
  • 151.101.130.133
  • 151.101.194.133
whitelisted
www.bing.com
  • 2.19.120.21
  • 2.19.120.29
whitelisted
r.bing.com
  • 2.19.120.29
  • 2.19.120.21
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
www.drivermax.com
  • 168.119.201.56
unknown

Threats

PID
Process
Class
Message
6604
drivermax.tmp
Misc activity
ET ADWARE_PUP Drivermax Utility Checkin Activity
6604
drivermax.tmp
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ipinfo.io
6604
drivermax.tmp
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
—
—
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ipinfo.io
—
—
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
—
—
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
6848
drivermax.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ipinfo.io
—
—
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
4776
drivermax.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ipinfo.io
1008
drivermax.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ipinfo.io
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
drivermax.exe