URL:

https://dl.passixer.com/iphone-unlocker.exe

Full analysis: https://app.any.run/tasks/e48545f0-ebfa-46c5-886e-a5c43218587a
Verdict: Malicious activity
Analysis date: April 21, 2024, 08:37:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

6DFA49AC9A69DDE307503E37303DA02A

SHA1:

807B69536E2E6C7A6BDB00A5AACE2AB1313D07FD

SHA256:

790396EE8DD371E109B25476DECB65581D6154FFC9ACF8A756BD83422FACBA3C

SSDEEP:

3:N8RSWmK60IQLJd4A:2OK6xeJf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • iphone-unlocker.exe (PID: 2780)
      • Passixer iPhone Unlocker.exe (PID: 2920)
      • Passixer iPhone Unlocker.exe (PID: 4000)
      • iphone-unlocker.tmp (PID: 1632)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iphone-unlocker.exe (PID: 2780)
      • iphone-unlocker.tmp (PID: 1632)

    • Reads the Windows owner or organization settings

      • iphone-unlocker.tmp (PID: 1632)

    • Drops 7-zip archiver for unpacking

      • iphone-unlocker.tmp (PID: 1632)

    • Process drops SQLite DLL files

      • iphone-unlocker.tmp (PID: 1632)

    • Process drops legitimate windows executable

      • iphone-unlocker.tmp (PID: 1632)

    • The process drops C-runtime libraries

      • iphone-unlocker.tmp (PID: 1632)

    • Reads security settings of Internet Explorer

      • iphone-unlocker.tmp (PID: 1632)

    • Reads the Internet Settings

      • iphone-unlocker.tmp (PID: 1632)
      • Passixer iPhone Unlocker.exe (PID: 3216)

    • Non-standard symbols in registry

      • iphone-unlocker.tmp (PID: 1632)

    • Reads settings of System Certificates

      • Passixer iPhone Unlocker.exe (PID: 1432)
      • Passixer iPhone Unlocker.exe (PID: 2920)
      • Passixer iPhone Unlocker.exe (PID: 4000)

    • Searches for installed software

      • Passixer iPhone Unlocker.exe (PID: 4000)
      • Passixer iPhone Unlocker.exe (PID: 2920)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 1536)
      • msedge.exe (PID: 2440)
      • msedge.exe (PID: 900)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 2652)

    • Checks supported languages

      • iphone-unlocker.exe (PID: 2780)
      • iphone-unlocker.tmp (PID: 1632)
      • Passixer iPhone Unlocker.exe (PID: 1308)
      • Passixer iPhone Unlocker.exe (PID: 2920)
      • splashScreen.exe (PID: 1020)
      • Passixer iPhone Unlocker.exe (PID: 3216)
      • Passixer iPhone Unlocker.exe (PID: 1432)
      • Passixer iPhone Unlocker.exe (PID: 4000)
      • splashScreen.exe (PID: 2300)

    • Create files in a temporary directory

      • iphone-unlocker.exe (PID: 2780)
      • iphone-unlocker.tmp (PID: 1632)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 1536)

    • The process uses the downloaded file

      • iexplore.exe (PID: 1536)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2652)

    • Dropped object may contain TOR URL's

      • iphone-unlocker.tmp (PID: 1632)

    • Reads the computer name

      • iphone-unlocker.tmp (PID: 1632)
      • Passixer iPhone Unlocker.exe (PID: 2920)
      • Passixer iPhone Unlocker.exe (PID: 1308)
      • Passixer iPhone Unlocker.exe (PID: 3216)
      • Passixer iPhone Unlocker.exe (PID: 1432)
      • Passixer iPhone Unlocker.exe (PID: 4000)

    • Creates files in the program directory

      • iphone-unlocker.tmp (PID: 1632)
      • Passixer iPhone Unlocker.exe (PID: 2920)
      • Passixer iPhone Unlocker.exe (PID: 4000)

    • Creates files or folders in the user directory

      • iphone-unlocker.tmp (PID: 1632)
      • Passixer iPhone Unlocker.exe (PID: 2920)
      • Passixer iPhone Unlocker.exe (PID: 3216)
      • Passixer iPhone Unlocker.exe (PID: 4000)

    • Creates a software uninstall entry

      • iphone-unlocker.tmp (PID: 1632)

    • Reads the machine GUID from the registry

      • Passixer iPhone Unlocker.exe (PID: 2920)
      • Passixer iPhone Unlocker.exe (PID: 1432)
      • Passixer iPhone Unlocker.exe (PID: 4000)

    • Manual execution by a user

      • msedge.exe (PID: 2440)
      • Passixer iPhone Unlocker.exe (PID: 4000)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
77
Monitored processes
36
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iphone-unlocker.exe no specs iphone-unlocker.exe iphone-unlocker.tmp passixer iphone unlocker.exe no specs passixer iphone unlocker.exe splashscreen.exe no specs passixer iphone unlocker.exe no specs passixer iphone unlocker.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs passixer iphone unlocker.exe splashscreen.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
296"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3572 --field-trial-handle=1252,i,1022873677698948338,3895204982277680236,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
392"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1460 --field-trial-handle=1252,i,1022873677698948338,3895204982277680236,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
568"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3624 --field-trial-handle=1252,i,1022873677698948338,3895204982277680236,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
696"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3488 --field-trial-handle=1252,i,1022873677698948338,3895204982277680236,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
900"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument https://passixer.eassiy.com/install/iphone-unlocker-win.htmlC:\Program Files\Microsoft\Edge\Application\msedge.exe—Passixer iPhone Unlocker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1020"C:\Program Files\Passixer\Passixer iPhone Unlocker\splashScreen.exe" -l ZW4= -fsize MTA= -m1 PGZvbnQgY29sb3IgPSAjMjgyNDU1PkxvYWRpbmcgbGFuZ3VhZ2UuLi48L2ZvbnQ+ -c PGZvbnQgY29sb3I9IzI4MjQ1NT5Db3B5cmlnaHQgPHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkFyaWFsOyI+JmNvcHk7PC9zcGFuPiAyMDI0IFBhc3NpeGVyLiBBbGwgcmlnaHRzIHJlc2VydmVkLjwvZm9udD4= -v PGI+PGZvbnQgY29sb3IgPSAjMjgyNDU1PlZlcnNpb246IDYuMC4xMTwvZm9udD4= -m2 PGZvbnQgY29sb3IgPSAjMjgyNDU1PkZyYW1ld29yayBpbml0aWFsaXppbmcuLi48L2ZvbnQ+ -m3 PGZvbnQgY29sb3IgPSAjMjgyNDU1PkxvYWRpbmcgc2tpbi4uLjwvZm9udD4= -m4 PGZvbnQgY29sb3IgPSAjMjgyNDU1PlByZXBhcmluZyBtYWluIHdpbmRvdy4uLjwvZm9udD4= -f VGFob21h -fdpi MQ==C:\Program Files\Passixer\Passixer iPhone Unlocker\splashScreen.exe—Passixer iPhone Unlocker.exe
User:
admin
Integrity Level:
HIGH
Exit code:
62097
Modules
Images
c:\program files\passixer\passixer iphone unlocker\splashscreen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\passixer\passixer iphone unlocker\qt5widgets.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1308"C:\Program Files\Passixer\Passixer iPhone Unlocker\Passixer iPhone Unlocker.exe" --registerC:\Program Files\Passixer\Passixer iPhone Unlocker\Passixer iPhone Unlocker.exe—iphone-unlocker.tmp
User:
admin
Company:
Passixer
Integrity Level:
HIGH
Description:
Passixer iPhone Unlocker
Exit code:
0
Version:
6.0.11.4442
Modules
Images
c:\program files\passixer\passixer iphone unlocker\passixer iphone unlocker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1404"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4232 --field-trial-handle=1252,i,1022873677698948338,3895204982277680236,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1432"C:\Program Files\Passixer\Passixer iPhone Unlocker\Passixer iPhone Unlocker.exe" --access_after_install_counting_urlC:\Program Files\Passixer\Passixer iPhone Unlocker\Passixer iPhone Unlocker.exe
iphone-unlocker.tmp
User:
admin
Company:
Passixer
Integrity Level:
HIGH
Description:
Passixer iPhone Unlocker
Exit code:
0
Version:
6.0.11.4442
Modules
Images
c:\program files\passixer\passixer iphone unlocker\passixer iphone unlocker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1536"C:\Program Files\Internet Explorer\iexplore.exe" "https://dl.passixer.com/iphone-unlocker.exe"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
35 378
Read events
35 102
Write events
211
Delete events
65

Modification events

(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
874424080
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31101895
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31101895
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
Executable files
329
Suspicious files
874
Text files
228
Unknown types
70

Dropped files

PID
Process
Filename
Type
2652iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\iphone-unlocker.exe.3nk8cn8.partial —
MD5:—
SHA256:—
1536iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\iphone-unlocker.exe —
MD5:—
SHA256:—
1536iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:7C378D16E7D09911F81C8D85FCB5AFFB
SHA256:A7E6F943BB94F9471194D1C6C7F2E7ADE425CD46B0F871B534B99EDA21DF465D
1536iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\urlblockindex[1].bin —
MD5:FA518E3DFAE8CA3A0E495460FD60C791
SHA256:775853600060162C4B4E5F883F9FD5A278E61C471B3EE1826396B6D129499AA7
1536iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver65F5.tmp —
MD5:CBD0581678FA40F0EDCBC7C59E0CAD10
SHA256:159BD4343F344A08F6AF3B716B6FA679859C1BD1D7030D26FF5EF0255B86E1D9
2652iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\38E84922A1197FDD4D181A73135959F1der
MD5:945C699F82C81B4E8F718B63D1C5192F
SHA256:602830CAFD8D7362A5001D0EB1B907E3D8FC034A80EC0D54F5FEB7C12F44970B
2780iphone-unlocker.exeC:\Users\admin\AppData\Local\Temp\is-KRL84.tmp\iphone-unlocker.tmpexecutable
MD5:5C1D958C27671A181298B9E42CEF4773
SHA256:959CB96A2D552D22FF5991B6F454725BAFC6D5DDC73D18E6E3C0B8659E5DA5B2
2652iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\iphone-unlocker[1].exeexecutable
MD5:71AC51BBC97EA5073FDE4082A3D1196E
SHA256:04C721BFB463C33B741275FCCD583AADCBEDEF6792C6B883EED5B670C5C533D4
1536iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xml —
MD5:CBD0581678FA40F0EDCBC7C59E0CAD10
SHA256:159BD4343F344A08F6AF3B716B6FA679859C1BD1D7030D26FF5EF0255B86E1D9
1536iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFE890437DA2CE566B.TMPgmc
MD5:663FDC623FAB221ADBB44E6EF6156708
SHA256:4030CDF51E85156B4461E8561DCA205C90343E0DC24741EFAEEFA79410381D26
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
54
DNS requests
46
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2652
iexplore.exe
GET
304
217.20.57.26:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?94405334593711fa
unknown
—
—
unknown
2652
iexplore.exe
GET
304
217.20.57.23:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?501143bdbf2f2bd6
unknown
—
—
unknown
2652
iexplore.exe
GET
200
36.248.38.100:80
http://ocsp.trust-provider.cn/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQDhvjmfMdSVsHZ9u52p9jqu3rd8gQUXzp8ERB%2BDGdxYdyLo7UAA2f1VxwCEQDvDwTiBWt3GU5uhtwfwh6J
unknown
—
—
unknown
1536
iexplore.exe
GET
304
217.20.57.21:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?dce1dee6221329dc
unknown
—
—
unknown
2652
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEQCyDO1VLjGgvzQ6dSh0O%2Bmr
unknown
—
—
unknown
1536
iexplore.exe
GET
304
217.20.57.19:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?44c4333d94fff777
unknown
—
—
unknown
1536
iexplore.exe
GET
304
217.20.57.25:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5c39dfd216fd59c9
unknown
—
—
unknown
1536
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
1080
svchost.exe
GET
200
217.20.57.19:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?393982f109b60f02
unknown
—
—
unknown
1536
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
2652
iexplore.exe
154.85.69.57:443
dl.passixer.com
Galaxy Broadband
PK
unknown
2652
iexplore.exe
217.20.57.26:80
ctldl.windowsupdate.com
—
US
unknown
2652
iexplore.exe
217.20.57.23:80
ctldl.windowsupdate.com
—
US
unknown
2652
iexplore.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
unknown
2652
iexplore.exe
36.248.38.100:80
ocsp.trust-provider.cn
CHINA UNICOM China169 Backbone
CN
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1536
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
1536
iexplore.exe
217.20.57.21:80
ctldl.windowsupdate.com
—
US
unknown
1536
iexplore.exe
217.20.57.19:80
ctldl.windowsupdate.com
—
US
unknown

DNS requests

Domain
IP
Reputation
dl.passixer.com
  • 154.85.69.57
  • 154.85.69.56
  • 154.85.69.53
  • 154.85.69.54
unknown
ctldl.windowsupdate.com
  • 217.20.57.23
  • 217.20.57.26
  • 217.20.57.34
  • 217.20.57.35
  • 217.20.57.21
  • 217.20.57.22
  • 217.20.57.19
  • 217.20.57.25
  • 217.20.57.18
  • 217.20.57.24
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.trust-provider.cn
  • 36.248.38.100
  • 183.201.243.154
  • 112.50.95.96
  • 117.27.246.96
  • 150.139.142.18
malicious
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
reg.mobietool.com
  • 18.136.176.218
unknown
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
go.microsoft.com
  • 184.25.196.202
whitelisted

Threats

No threats detected
Process
Message
Passixer iPhone Unlocker.exe
MAIN_Font use font "Tahoma"
Passixer iPhone Unlocker.exe
MAIN version "6.0.11"
Passixer iPhone Unlocker.exe
MAIN_Font use font "Tahoma"
Passixer iPhone Unlocker.exe
MAIN version "6.0.11"
Passixer iPhone Unlocker.exe
ASL checking for logging parameters in environment variable "Passixer iPhone Unlocker.exe.log"
Passixer iPhone Unlocker.exe
ASL checking for logging parameters in environment variable "asl.log"
Passixer iPhone Unlocker.exe
ASL logging to file "C:\Users\admin\AppData\Roaming\Apple Computer\Logs\asl.094012_21Apr24.log"
Passixer iPhone Unlocker.exe
[(unknown facility) Passixer iPhone Unlocker.exe] _MobileDeviceLibraryInitRoutine (thread 3180): MobileDevice.framework version: 1533.100.57.100.2
Passixer iPhone Unlocker.exe
[(unknown facility) Passixer iPhone Unlocker.exe] _SubscribeForMuxNotifications (thread 3180): USBMuxListenerCreate: File exists
Passixer iPhone Unlocker.exe
[(unknown facility) Passixer iPhone Unlocker.exe] AMDeviceNotificationSubscribeWithOptions (thread 3180): Failed to subscribe for mux notifications: 0xe8000063 (kAMDMuxCreateListenerError)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://dl.passixer.com/iphone-unlocker.exe