File name:

NET-Atheros-Atheros-L2-Fast-Ethernet-10-100Base-T-Controller.exe

Full analysis: https://app.any.run/tasks/2045a106-6fab-4173-ba17-eb74c705da0e
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: September 26, 2024, 06:19:40
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C582132EF3C98335DCD3D44BDB503893

SHA1:

8C695E5EE46C86BE0A0345214C88767A1EDCD296

SHA256:

8E195B74F3AF8CB4BA82A48AF893B436CC93C814B2721CB16C97E3247FCD6D4E

SSDEEP:

49152:x5/yDsDyQF0DYgIefiGkvUKLUx77aNigJS1kLCLJ17s5s4vBF7rCRGqa9nj8DS/7:LN+B/QUP7s3z7rCRGmG/ccH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • tmp-drivermax13945590.tmp (PID: 6280)

    • Connects to the CnC server

      • tmp-drivermax13945590.tmp (PID: 6280)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • tmp-drivermax13945590.tmp (PID: 6280)
      • drivermax.exe (PID: 6356)

    • Executable content was dropped or overwritten

      • NET-Atheros-Atheros-L2-Fast-Ethernet-10-100Base-T-Controller.exe (PID: 6504)
      • tmp-drivermax13945590.tmp (PID: 6280)
      • tmp-drivermax13945590.exe (PID: 7004)
      • drivermax.exe (PID: 6232)
      • drivermax.exe (PID: 6356)

    • Reads security settings of Internet Explorer

      • tmp-drivermax13945590.tmp (PID: 6280)
      • drivermax.exe (PID: 6232)
      • drivermax.exe (PID: 6356)

    • Reads the Windows owner or organization settings

      • tmp-drivermax13945590.tmp (PID: 6280)

    • Uses TASKKILL.EXE to kill process

      • tmp-drivermax13945590.tmp (PID: 6280)

    • There is functionality for taking screenshot (YARA)

      • NET-Atheros-Atheros-L2-Fast-Ethernet-10-100Base-T-Controller.exe (PID: 6504)
      • innostp.exe (PID: 4824)

    • There is functionality for communication over UDP network (YARA)

      • NET-Atheros-Atheros-L2-Fast-Ethernet-10-100Base-T-Controller.exe (PID: 6504)

    • Checks Windows Trust Settings

      • drivermax.exe (PID: 6232)
      • drivermax.exe (PID: 6356)

    • Executes application which crashes

      • tmp-drivermax13945590.tmp (PID: 6280)

    • Drops a system driver (possible attempt to evade defenses)

      • drivermax.exe (PID: 6232)
      • drivermax.exe (PID: 6356)

    • Adds/modifies Windows certificates

      • drivermax.exe (PID: 6232)

    • Potential Corporate Privacy Violation

      • NET-Atheros-Atheros-L2-Fast-Ethernet-10-100Base-T-Controller.exe (PID: 6504)

    • Checks for external IP

      • tmp-drivermax13945590.tmp (PID: 6280)
      • svchost.exe (PID: 2256)
      • drivermax.exe (PID: 6232)
      • drivermax.exe (PID: 6356)

    • Creates/Modifies COM task schedule object

      • dxdiag.exe (PID: 4076)

    • Searches for installed software

      • drivermax.exe (PID: 6356)

    • Starts CMD.EXE for commands execution

      • drivermax.exe (PID: 6356)

  • INFO

    • Reads the computer name

      • NET-Atheros-Atheros-L2-Fast-Ethernet-10-100Base-T-Controller.exe (PID: 6504)
      • tmp-drivermax13945590.tmp (PID: 6280)
      • innostp.exe (PID: 4824)
      • drivermax.exe (PID: 6232)
      • drivermax.exe (PID: 6356)
      • innostp.exe (PID: 7068)
      • innostp.exe (PID: 6176)

    • Checks supported languages

      • NET-Atheros-Atheros-L2-Fast-Ethernet-10-100Base-T-Controller.exe (PID: 6504)
      • tmp-drivermax13945590.tmp (PID: 6280)
      • tmp-drivermax13945590.exe (PID: 7004)
      • stop_dmx.exe (PID: 1940)
      • drivermax.exe (PID: 6232)
      • innostp.exe (PID: 4824)
      • stop_dmx.exe (PID: 4472)
      • drivermax.exe (PID: 6356)
      • innostp.exe (PID: 7068)
      • innostp.exe (PID: 6176)

    • Reads the machine GUID from the registry

      • NET-Atheros-Atheros-L2-Fast-Ethernet-10-100Base-T-Controller.exe (PID: 6504)
      • tmp-drivermax13945590.tmp (PID: 6280)
      • innostp.exe (PID: 4824)
      • drivermax.exe (PID: 6232)
      • drivermax.exe (PID: 6356)
      • innostp.exe (PID: 7068)
      • innostp.exe (PID: 6176)

    • Create files in a temporary directory

      • tmp-drivermax13945590.exe (PID: 7004)
      • NET-Atheros-Atheros-L2-Fast-Ethernet-10-100Base-T-Controller.exe (PID: 6504)
      • tmp-drivermax13945590.tmp (PID: 6280)

    • Checks proxy server information

      • tmp-drivermax13945590.tmp (PID: 6280)
      • drivermax.exe (PID: 6232)

    • Creates files or folders in the user directory

      • tmp-drivermax13945590.tmp (PID: 6280)
      • drivermax.exe (PID: 6232)
      • drivermax.exe (PID: 6356)

    • Reads the software policy settings

      • tmp-drivermax13945590.tmp (PID: 6280)
      • drivermax.exe (PID: 6232)
      • drivermax.exe (PID: 6356)

    • Creates files in the program directory

      • tmp-drivermax13945590.tmp (PID: 6280)
      • drivermax.exe (PID: 6232)
      • drivermax.exe (PID: 6356)

    • Creates a software uninstall entry

      • tmp-drivermax13945590.tmp (PID: 6280)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (81.5)
.exe | Win32 Executable Delphi generic (10.5)
.exe | Win32 Executable (generic) (3.3)
.exe | Win16/32 Executable Delphi generic (1.5)
.exe | Generic Win/DOS Executable (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 1299456
InitializedDataSize: 1800704
UninitializedDataSize: -
EntryPoint: 0x13e380
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.1.0.2
ProductVersionNumber: 2.1.0.2
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Innovative Solutions
FileDescription: Driver Installer
FileVersion: 2.1.0.2
InternalName: Driver Installer
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: Driver Installer
ProductName: Driver Installer
ProductVersion: 2.1.0.2
Comments: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
170
Monitored processes
47
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT net-atheros-atheros-l2-fast-ethernet-10-100base-t-controller.exe tmp-drivermax13945590.exe tmp-drivermax13945590.tmp svchost.exe taskkill.exe no specs conhost.exe no specs stop_dmx.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs THREAT innostp.exe no specs drivermax.exe werfault.exe no specs stop_dmx.exe no specs drivermax.exe innostp.exe no specs innostp.exe no specs dxdiag.exe no specs cmd.exe no specs conhost.exe no specs java.exe no specs icacls.exe no specs conhost.exe no specs net-atheros-atheros-l2-fast-ethernet-10-100base-t-controller.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1080"Taskkill.exe" /IM innostp.exe /FC:\Windows\SysWOW64\taskkill.exe—tmp-drivermax13945590.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1164"C:\Users\admin\AppData\Local\Temp\NET-Atheros-Atheros-L2-Fast-Ethernet-10-100Base-T-Controller.exe" C:\Users\admin\AppData\Local\Temp\NET-Atheros-Atheros-L2-Fast-Ethernet-10-100Base-T-Controller.exe—explorer.exe
User:
admin
Company:
Innovative Solutions
Integrity Level:
MEDIUM
Description:
Driver Installer
Exit code:
3221226540
Version:
2.1.0.2
Modules
Images
c:\users\admin\appdata\local\temp\net-atheros-atheros-l2-fast-ethernet-10-100base-t-controller.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1244"Taskkill.exe" /IM innostp.exe /FC:\Windows\SysWOW64\taskkill.exe—tmp-drivermax13945590.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1492"Taskkill.exe" /IM stop_dmx.exe /FC:\Windows\SysWOW64\taskkill.exe—tmp-drivermax13945590.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1492\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1940"C:\Program Files (x86)\Innovative Solutions\DriverMax\stop_dmx.exe" /STOPC:\Program Files (x86)\Innovative Solutions\DriverMax\stop_dmx.exe—tmp-drivermax13945590.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files (x86)\innovative solutions\drivermax\stop_dmx.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1952\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2040"Taskkill.exe" /IM stop_dmx.exe /FC:\Windows\SysWOW64\taskkill.exe—tmp-drivermax13945590.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2144\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2248\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
37 593
Read events
37 511
Write events
73
Delete events
9

Modification events

(PID) Process:(6504) NET-Atheros-Atheros-L2-Fast-Ethernet-10-100Base-T-Controller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Innovative Solutions\Analytics
Operation:writeName:cid
Value:
9878DF11-04CA-4DAE-87A0-5FB4695CA081
(PID) Process:(6280) tmp-drivermax13945590.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Innovative Solutions\DriverMax
Operation:writeName:Affiliate
Value:
Inno
(PID) Process:(6280) tmp-drivermax13945590.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6280) tmp-drivermax13945590.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6280) tmp-drivermax13945590.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6280) tmp-drivermax13945590.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Innovative Solutions\DriverMax
Operation:writeName:fc
Value:
DE
(PID) Process:(6280) tmp-drivermax13945590.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Innovative Solutions\DriverMax
Operation:writeName:lc
Value:
DE
(PID) Process:(6280) tmp-drivermax13945590.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:DriverMax
Value:
(PID) Process:(6280) tmp-drivermax13945590.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Innovative Solutions\DriverMax
Operation:delete valueName:chkAgentEnabledCheck
Value:
(PID) Process:(6280) tmp-drivermax13945590.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Innovative Solutions\DriverMax
Operation:writeName:chkAgentEnabledCheck
Value:
1
Executable files
94
Suspicious files
154
Text files
44
Unknown types
5

Dropped files

PID
Process
Filename
Type
6280tmp-drivermax13945590.tmpC:\Program Files (x86)\Innovative Solutions\DriverMax\unins000.exeexecutable
MD5:DDA56268C2B003EA0ECF68982E950F9E
SHA256:61E4D3ED79FD304D8D8E9588A4E4ACDD9193FE44955A3E1CF3BF60A2B8351138
6280tmp-drivermax13945590.tmpC:\Users\admin\AppData\Local\Temp\is-JFAF8.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
6504NET-Atheros-Atheros-L2-Fast-Ethernet-10-100Base-T-Controller.exeC:\Users\admin\AppData\Local\Temp\tmp-drivermax13945590.exeexecutable
MD5:B666EA6DA4E501E90A2AD8183DC60BD5
SHA256:A2AE414849DDAE1056007CEDAF204905F45437080438BCE81A8BB091490F46A7
6280tmp-drivermax13945590.tmpC:\Users\admin\AppData\Local\Temp\is-JFAF8.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
6280tmp-drivermax13945590.tmpC:\Users\admin\AppData\Local\Temp\is-JFAF8.tmp\folder-images-icon.bmpimage
MD5:D393253B0477CCE0D1E2F6E96E1339E9
SHA256:171092952FE01BACAFEEA6B4C7CF90AF0CA98EB251834F9B9E3E702DC878FA61
6280tmp-drivermax13945590.tmpC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\json[1].jsonbinary
MD5:D1A5029DF0761FB16204E5BA90D018D8
SHA256:41259873978FF2081F6A4BC067C40E9AD974F897A493085A4311DF5EE3A7447F
6280tmp-drivermax13945590.tmpC:\Users\admin\AppData\Local\Temp\is-JFAF8.tmp\analytics_v2.dllexecutable
MD5:F39F747376FE925CFC727F99ACAFE682
SHA256:C41DE2A1F0F9BFF8FB51D84E6E09FFBE48BCA58CEC4421E36B7F7EE383911E35
6280tmp-drivermax13945590.tmpC:\Program Files (x86)\Innovative Solutions\DriverMax\Readme\is-R08RS.tmptext
MD5:EE7204BC2FE947E020945431E7BB0696
SHA256:560FABF6D58F78AE92E34D9D2BEDA7EFF07DC4260DB948E60382641FDFA3A43F
6280tmp-drivermax13945590.tmpC:\Program Files (x86)\Innovative Solutions\DriverMax\Readme\license.rtftext
MD5:EE7204BC2FE947E020945431E7BB0696
SHA256:560FABF6D58F78AE92E34D9D2BEDA7EFF07DC4260DB948E60382641FDFA3A43F
6504NET-Atheros-Atheros-L2-Fast-Ethernet-10-100Base-T-Controller.exeC:\Users\admin\AppData\Local\Temp\tmp-drivermax13945590.exe.partexecutable
MD5:B666EA6DA4E501E90A2AD8183DC60BD5
SHA256:A2AE414849DDAE1056007CEDAF204905F45437080438BCE81A8BB091490F46A7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
40
DNS requests
22
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6504
NET-Atheros-Atheros-L2-Fast-Ethernet-10-100Base-T-Controller.exe
POST
200
168.119.201.56:80
http://user.drivermax.com/driver-download/hdwl.php
unknown
—
—
unknown
6504
NET-Atheros-Atheros-L2-Fast-Ethernet-10-100Base-T-Controller.exe
GET
206
168.119.201.56:80
http://small.drivermax.com/soft/dmx/drivermax.exe
unknown
—
—
whitelisted
6232
drivermax.exe
GET
200
34.117.59.81:80
http://ipinfo.io/json
unknown
—
—
whitelisted
6280
tmp-drivermax13945590.tmp
GET
200
34.117.59.81:80
http://ipinfo.io/json
unknown
—
—
whitelisted
6232
drivermax.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/gsgccr45evcodesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQaCbVYh07WONuW4e63Ydlu4AlbDAQUJZ3Q%2FFkJhmPF7POxEztXHAOSNhECDA5ml5aITsG9Y8TP4w%3D%3D
unknown
—
—
whitelisted
6232
drivermax.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6NM1IAQUHwC%2FRoAK%2FHg5t6W0Q9lWULvOljsCEHe9DgW3WQu2HUdhUx4%2Fde0%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6504
NET-Atheros-Atheros-L2-Fast-Ethernet-10-100Base-T-Controller.exe
POST
200
142.250.185.110:80
http://www.google-analytics.com/collect
unknown
—
—
unknown
6504
NET-Atheros-Atheros-L2-Fast-Ethernet-10-100Base-T-Controller.exe
POST
200
142.250.185.110:80
http://www.google-analytics.com/collect
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1692
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6504
NET-Atheros-Atheros-L2-Fast-Ethernet-10-100Base-T-Controller.exe
168.119.201.56:80
user.drivermax.com
Hetzner Online GmbH
UA
whitelisted
2988
svchost.exe
40.126.31.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2988
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
6504
NET-Atheros-Atheros-L2-Fast-Ethernet-10-100Base-T-Controller.exe
142.250.185.110:80
www.google-analytics.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
google.com
  • 142.250.181.238
whitelisted
user.drivermax.com
  • 168.119.201.56
whitelisted
small.drivermax.com
  • 168.119.201.56
whitelisted
login.live.com
  • 40.126.31.73
  • 40.126.31.67
  • 20.190.159.75
  • 20.190.159.68
  • 20.190.159.71
  • 20.190.159.23
  • 20.190.159.73
  • 20.190.159.0
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.google-analytics.com
  • 142.250.185.110
whitelisted
ipinfo.io
  • 34.117.59.81
shared
ocsp.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted

Threats

PID
Process
Class
Message
6504
NET-Atheros-Atheros-L2-Fast-Ethernet-10-100Base-T-Controller.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2256
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ipinfo .io)
6280
tmp-drivermax13945590.tmp
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ipinfo.io
6280
tmp-drivermax13945590.tmp
Misc activity
ET ADWARE_PUP Drivermax Utility Checkin Activity
6280
tmp-drivermax13945590.tmp
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
2256
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ipinfo .io)
6232
drivermax.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ipinfo.io
6356
drivermax.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ipinfo.io
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NET-Atheros-Atheros-L2-Fast-Ethernet-10-100Base-T-Controller.exe