File name:

imyfone-lockwiper-android_setup-com_tw.exe

Full analysis: https://app.any.run/tasks/1fbf5a29-c6c0-48d2-b3f6-5020ab56a194
Verdict: Malicious activity
Analysis date: July 29, 2024, 14:08:15
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
qrcode
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

BAB45D0F16D78724162136776E1ABCA1

SHA1:

8F79AF20CF1B07EA1158D5844B4A7D69636EB584

SHA256:

6E826D6F2B32DACA6B5AF4A8C7A29882B20844333CD69F9ED9271008481F8196

SSDEEP:

98304:rg5E057nmBV0wb/Zd0Xwi1ZZ6UWVWe0XEeqO3vbq+HqnwrFUtPx8VuZCcbP2Hyx/:9FBc1hA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • imyfone-lockwiper-android_setup-com_tw.exe (PID: 7028)
      • imyfone-download.exe (PID: 1180)
      • imyfone-download.tmp (PID: 2112)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • imyfone-lockwiper-android_setup-com_tw.exe (PID: 7028)

    • Executable content was dropped or overwritten

      • imyfone-download.exe (PID: 1180)
      • imyfone-download.tmp (PID: 2112)

    • Reads the Windows owner or organization settings

      • imyfone-download.tmp (PID: 2112)

    • Starts CMD.EXE for commands execution

      • imyfone-download.tmp (PID: 2112)

    • Process drops legitimate windows executable

      • imyfone-download.tmp (PID: 2112)

    • Process drops legitimate windows executable (CertUtil.exe)

      • imyfone-download.tmp (PID: 2112)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2668)
      • cmd.exe (PID: 2480)
      • cmd.exe (PID: 2192)

    • Drops a system driver (possible attempt to evade defenses)

      • imyfone-download.tmp (PID: 2112)

    • Drops 7-zip archiver for unpacking

      • imyfone-download.tmp (PID: 2112)

    • The process drops C-runtime libraries

      • imyfone-download.tmp (PID: 2112)

  • INFO

    • Creates files in the program directory

      • imyfone-lockwiper-android_setup-com_tw.exe (PID: 7028)
      • imyfone-download.tmp (PID: 2112)

    • Checks supported languages

      • imyfone-lockwiper-android_setup-com_tw.exe (PID: 7028)
      • imyfone-download.exe (PID: 1180)
      • imyfone-download.tmp (PID: 2112)

    • Reads the computer name

      • imyfone-lockwiper-android_setup-com_tw.exe (PID: 7028)
      • imyfone-download.tmp (PID: 2112)

    • Reads Environment values

      • imyfone-lockwiper-android_setup-com_tw.exe (PID: 7028)

    • Reads product name

      • imyfone-lockwiper-android_setup-com_tw.exe (PID: 7028)

    • Checks proxy server information

      • imyfone-lockwiper-android_setup-com_tw.exe (PID: 7028)
      • slui.exe (PID: 6788)

    • Reads the software policy settings

      • imyfone-lockwiper-android_setup-com_tw.exe (PID: 7028)
      • slui.exe (PID: 6788)

    • Reads the machine GUID from the registry

      • imyfone-lockwiper-android_setup-com_tw.exe (PID: 7028)

    • Create files in a temporary directory

      • imyfone-download.exe (PID: 1180)
      • imyfone-download.tmp (PID: 2112)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (3.6)
.exe | Generic Win/DOS Executable (1.6)
.exe | DOS Executable Generic (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:12:18 10:33:07+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 2118144
InitializedDataSize: 2534400
UninitializedDataSize: -
EntryPoint: 0x1bb644
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 4.3.0.1
ProductVersionNumber: 4.3.0.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: imyfone-lockwiper-android_setup-com_tw.exe
FileVersion: 4.3.0.1
LegalCopyright: Copyright (C) 2024 iMyFone. All rights reserved.
ProductName: iMyFone LockWiper (Android)
ProductVersion: 4.3.0.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
14
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start imyfone-lockwiper-android_setup-com_tw.exe slui.exe imyfone-download.exe imyfone-download.tmp cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs imyfone-lockwiper-android_setup-com_tw.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1180 /verysilent /imyfone_down /wait_run /path="C:\Program Files (x86)\" /progress="C:\Program Files (x86)\imyfone_down\imyfone-lockwiper-android_setup-com_tw\temp.progress"C:\Program Files (x86)\imyfone_down\imyfone-lockwiper-android_setup-com_tw\imyfone-download.exe
imyfone-lockwiper-android_setup-com_tw.exe
User:
admin
Company:
Shenzhen iMyFone Technology Co., Ltd.
Integrity Level:
HIGH
Description:
iMyFone LockWiper (Android)
Version:
5.4.8.1
Modules
Images
c:\program files (x86)\imyfone_down\imyfone-lockwiper-android_setup-com_tw\imyfone-download.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
2112"C:\Users\admin\AppData\Local\Temp\is-K9PIF.tmp\imyfone-download.tmp" /SL5="$B03FC,195668533,214016,C:\Program Files (x86)\imyfone_down\imyfone-lockwiper-android_setup-com_tw\imyfone-download.exe" /verysilent /imyfone_down /wait_run /path="C:\Program Files (x86)\" /progress="C:\Program Files (x86)\imyfone_down\imyfone-lockwiper-android_setup-com_tw\temp.progress"C:\Users\admin\AppData\Local\Temp\is-K9PIF.tmp\imyfone-download.tmp
imyfone-download.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-k9pif.tmp\imyfone-download.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
2116taskkill /f /t /im Feedback.exeC:\Windows\SysWOW64\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2124"C:\Users\admin\AppData\Local\Temp\imyfone-lockwiper-android_setup-com_tw.exe" C:\Users\admin\AppData\Local\Temp\imyfone-lockwiper-android_setup-com_tw.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
imyfone-lockwiper-android_setup-com_tw.exe
Exit code:
3221226540
Version:
4.3.0.1
Modules
Images
c:\users\admin\appdata\local\temp\imyfone-lockwiper-android_setup-com_tw.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2192"cmd.exe" /c taskkill /f /t /im appAutoUpdate.exeC:\Windows\SysWOW64\cmd.exe—imyfone-download.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2480"cmd.exe" /c taskkill /f /t /im Feedback.exeC:\Windows\SysWOW64\cmd.exe—imyfone-download.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2668"cmd.exe" /c taskkill /f /t /im adb.exeC:\Windows\SysWOW64\cmd.exe—imyfone-download.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4548taskkill /f /t /im adb.exeC:\Windows\SysWOW64\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4820\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6372\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
3 106
Read events
3 100
Write events
6
Delete events
0

Modification events

(PID) Process:(7028) imyfone-lockwiper-android_setup-com_tw.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\iMyfone\iMyfoneDown
Operation:writeName:GUID
Value:
683A12CE-F6D9-4a43-BF2A-F26DB1547F92
(PID) Process:(2112) imyfone-download.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
40080000B142E511C1E1DA01
(PID) Process:(2112) imyfone-download.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
51421DF0C70FC49EF4306F9607C8436B91B7BC3C22B157D54F8CADF57AAC99C3
(PID) Process:(2112) imyfone-download.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(2112) imyfone-download.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Program Files (x86)\iMyFone\iMyfone LockWiper (Android)\7z.dll
(PID) Process:(2112) imyfone-download.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
820C3CD9BCDB48040FFDE3F9E8864A17F429127156F96C2861DA2677631AED76
Executable files
394
Suspicious files
179
Text files
1 545
Unknown types
123

Dropped files

PID
Process
Filename
Type
7028imyfone-lockwiper-android_setup-com_tw.exeC:\Program Files (x86)\imyfone_down\imyfone-lockwiper-android_setup-com_tw\language\ChineseTW\pr_1.pngimage
MD5:9A0548388E035A60D788CAA093F6C143
SHA256:DF478B04784DCE0BE5D4DB6450DF2EA96D1ECB9970C29CA948FB4AF0C83972AB
7028imyfone-lockwiper-android_setup-com_tw.exeC:\Program Files (x86)\imyfone_down\imyfone-lockwiper-android_setup-com_tw\language\ChineseTW\pr_3.pngimage
MD5:689A18CA7E495749CB1BB785AC84BCFB
SHA256:2970BD4C9CDF3AFE81AEE692068C68329A4D0837E8261B3581DD29D3DE75E3F8
7028imyfone-lockwiper-android_setup-com_tw.exeC:\Program Files (x86)\imyfone_down\imyfone-lockwiper-android_setup-com_tw\language\Dutch\UrlInfo.initext
MD5:DA07B8686390EDB756D88AD774A622B6
SHA256:5C9C4F7CC36131A29FD9F8DCD27485B340CE6F7B270278704133D71EB5329C8D
7028imyfone-lockwiper-android_setup-com_tw.exeC:\Program Files (x86)\imyfone_down\imyfone-lockwiper-android_setup-com_tw\language\Dutch\pr_3.pngimage
MD5:45BAE5D0A90A80F08935B9631768E61C
SHA256:BB13C2E4BCD9E5BBB56A4CF88EF0661F12EC379E5FDB10B5010F71EA9C6075E8
7028imyfone-lockwiper-android_setup-com_tw.exeC:\Program Files (x86)\imyfone_down\imyfone-lockwiper-android_setup-com_tw\language\ChineseTW\text.initext
MD5:CA3A0F1453F6210B9D87E1B4C2FEBD86
SHA256:51C9132DA03D5ACBD8CC641680ADF41E8E9E962766873B52E08A3238E683614B
7028imyfone-lockwiper-android_setup-com_tw.exeC:\Program Files (x86)\imyfone_down\imyfone-lockwiper-android_setup-com_tw\language\Chinese\text.initext
MD5:FFAA64827526F852271561EDB07F4231
SHA256:C423B0871C13A26DCE9D179090C9ACC4EE48B24F17E8C3D1380D7BF4C63B0C6E
7028imyfone-lockwiper-android_setup-com_tw.exeC:\Program Files (x86)\imyfone_down\imyfone-lockwiper-android_setup-com_tw\language\Chinese\pr_2.pngimage
MD5:FA971B8C6649D6810356F0010AA3428A
SHA256:77EB60EB2D69CC57EC8F89163C6FBB3A06F0C7264414FC859C83A14A7194E203
7028imyfone-lockwiper-android_setup-com_tw.exeC:\Program Files (x86)\imyfone_down\imyfone-lockwiper-android_setup-com_tw\language\ChineseTW\pr_2.pngimage
MD5:DC89FB9BEA54D06DEF5BD846CDA0BB34
SHA256:8CFF16A1E81FD2224A17F87581ACC9516FAB2EEC44C7952CE4885C8B8099188D
7028imyfone-lockwiper-android_setup-com_tw.exeC:\Program Files (x86)\imyfone_down\imyfone-lockwiper-android_setup-com_tw\language\Chinese\UrlInfo.initext
MD5:D73850B48A31AAF94FFFDD2547E2789C
SHA256:444543DC030D831D03BA2B538F93AA0A375DC1A2F53ADF20C9CA02767E406230
7028imyfone-lockwiper-android_setup-com_tw.exeC:\Program Files (x86)\imyfone_down\imyfone-lockwiper-android_setup-com_tw\language\Dutch\pr_2.pngimage
MD5:D9BD60E7AEAA07F34C489E1F1F99E0B5
SHA256:0CB2A92EB62F3CCDEA940DB52233043DAE214BF518B0A5B5F51035DD20EAAE0A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
65
DNS requests
29
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
4424
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
3676
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4132
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
5560
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
131.253.33.254:443
a-ring-fallback.msedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
—
—
92.123.104.51:443
www.bing.com
Akamai International B.V.
DE
unknown
5800
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6012
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6076
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1752
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1328
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
a-ring-fallback.msedge.net
  • 131.253.33.254
unknown
www.bing.com
  • 92.123.104.51
  • 92.123.104.47
  • 92.123.104.45
  • 92.123.104.42
  • 92.123.104.43
  • 92.123.104.52
  • 92.123.104.56
  • 92.123.104.46
  • 92.123.104.44
  • 92.123.104.15
  • 92.123.104.16
  • 92.123.104.21
  • 92.123.104.17
  • 92.123.104.11
  • 92.123.104.19
  • 92.123.104.12
  • 92.123.104.18
  • 92.123.104.20
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.78
whitelisted
download.imyfone.com
  • 65.9.66.119
  • 65.9.66.97
  • 65.9.66.61
  • 65.9.66.89
whitelisted
apipdm.imyfone.club
  • 52.39.55.200
unknown
www.google-analytics.com
  • 172.217.16.142
whitelisted
fp-afd-nocache-ccp.azureedge.net
  • 13.107.246.60
whitelisted
login.live.com
  • 40.126.32.76
  • 20.190.160.17
  • 40.126.32.136
  • 40.126.32.72
  • 20.190.160.14
  • 40.126.32.138
  • 40.126.32.68
  • 40.126.32.140
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
imyfone-lockwiper-android_setup-com_tw.exe