URL:

https://dl.passixer.com/iphone-unlocker.exe

Full analysis: https://app.any.run/tasks/e48545f0-ebfa-46c5-886e-a5c43218587a
Verdict: Malicious activity
Analysis date: April 21, 2024, 08:37:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

6DFA49AC9A69DDE307503E37303DA02A

SHA1:

807B69536E2E6C7A6BDB00A5AACE2AB1313D07FD

SHA256:

790396EE8DD371E109B25476DECB65581D6154FFC9ACF8A756BD83422FACBA3C

SSDEEP:

3:N8RSWmK60IQLJd4A:2OK6xeJf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • iphone-unlocker.exe (PID: 2780)
      • iphone-unlocker.tmp (PID: 1632)
      • Passixer iPhone Unlocker.exe (PID: 2920)
      • Passixer iPhone Unlocker.exe (PID: 4000)

  • SUSPICIOUS

    • Drops 7-zip archiver for unpacking

      • iphone-unlocker.tmp (PID: 1632)

    • Process drops SQLite DLL files

      • iphone-unlocker.tmp (PID: 1632)

    • Executable content was dropped or overwritten

      • iphone-unlocker.exe (PID: 2780)
      • iphone-unlocker.tmp (PID: 1632)

    • Reads the Windows owner or organization settings

      • iphone-unlocker.tmp (PID: 1632)

    • The process drops C-runtime libraries

      • iphone-unlocker.tmp (PID: 1632)

    • Non-standard symbols in registry

      • iphone-unlocker.tmp (PID: 1632)

    • Reads the Internet Settings

      • iphone-unlocker.tmp (PID: 1632)
      • Passixer iPhone Unlocker.exe (PID: 3216)

    • Reads security settings of Internet Explorer

      • iphone-unlocker.tmp (PID: 1632)

    • Reads settings of System Certificates

      • Passixer iPhone Unlocker.exe (PID: 1432)
      • Passixer iPhone Unlocker.exe (PID: 2920)
      • Passixer iPhone Unlocker.exe (PID: 4000)

    • Searches for installed software

      • Passixer iPhone Unlocker.exe (PID: 2920)
      • Passixer iPhone Unlocker.exe (PID: 4000)

    • Process drops legitimate windows executable

      • iphone-unlocker.tmp (PID: 1632)

  • INFO

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 2652)

    • Application launched itself

      • iexplore.exe (PID: 1536)
      • msedge.exe (PID: 900)
      • msedge.exe (PID: 2440)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 1536)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2652)

    • Checks supported languages

      • iphone-unlocker.exe (PID: 2780)
      • iphone-unlocker.tmp (PID: 1632)
      • Passixer iPhone Unlocker.exe (PID: 1308)
      • splashScreen.exe (PID: 1020)
      • Passixer iPhone Unlocker.exe (PID: 2920)
      • Passixer iPhone Unlocker.exe (PID: 1432)
      • Passixer iPhone Unlocker.exe (PID: 3216)
      • Passixer iPhone Unlocker.exe (PID: 4000)
      • splashScreen.exe (PID: 2300)

    • The process uses the downloaded file

      • iexplore.exe (PID: 1536)

    • Create files in a temporary directory

      • iphone-unlocker.exe (PID: 2780)
      • iphone-unlocker.tmp (PID: 1632)

    • Reads the computer name

      • iphone-unlocker.tmp (PID: 1632)
      • Passixer iPhone Unlocker.exe (PID: 1308)
      • Passixer iPhone Unlocker.exe (PID: 2920)
      • Passixer iPhone Unlocker.exe (PID: 1432)
      • Passixer iPhone Unlocker.exe (PID: 3216)
      • Passixer iPhone Unlocker.exe (PID: 4000)

    • Creates files or folders in the user directory

      • iphone-unlocker.tmp (PID: 1632)
      • Passixer iPhone Unlocker.exe (PID: 2920)
      • Passixer iPhone Unlocker.exe (PID: 3216)
      • Passixer iPhone Unlocker.exe (PID: 4000)

    • Creates a software uninstall entry

      • iphone-unlocker.tmp (PID: 1632)

    • Reads the machine GUID from the registry

      • Passixer iPhone Unlocker.exe (PID: 2920)
      • Passixer iPhone Unlocker.exe (PID: 1432)
      • Passixer iPhone Unlocker.exe (PID: 4000)

    • Creates files in the program directory

      • Passixer iPhone Unlocker.exe (PID: 2920)
      • Passixer iPhone Unlocker.exe (PID: 4000)
      • iphone-unlocker.tmp (PID: 1632)

    • Manual execution by a user

      • msedge.exe (PID: 2440)
      • Passixer iPhone Unlocker.exe (PID: 4000)

    • Dropped object may contain TOR URL's

      • iphone-unlocker.tmp (PID: 1632)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
77
Monitored processes
36
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iphone-unlocker.exe no specs iphone-unlocker.exe iphone-unlocker.tmp passixer iphone unlocker.exe no specs passixer iphone unlocker.exe splashscreen.exe no specs passixer iphone unlocker.exe no specs passixer iphone unlocker.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs passixer iphone unlocker.exe splashscreen.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
296"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3572 --field-trial-handle=1252,i,1022873677698948338,3895204982277680236,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
392"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1460 --field-trial-handle=1252,i,1022873677698948338,3895204982277680236,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
568"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3624 --field-trial-handle=1252,i,1022873677698948338,3895204982277680236,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
696"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3488 --field-trial-handle=1252,i,1022873677698948338,3895204982277680236,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
900"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument https://passixer.eassiy.com/install/iphone-unlocker-win.htmlC:\Program Files\Microsoft\Edge\Application\msedge.exe—Passixer iPhone Unlocker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1020"C:\Program Files\Passixer\Passixer iPhone Unlocker\splashScreen.exe" -l ZW4= -fsize MTA= -m1 PGZvbnQgY29sb3IgPSAjMjgyNDU1PkxvYWRpbmcgbGFuZ3VhZ2UuLi48L2ZvbnQ+ -c PGZvbnQgY29sb3I9IzI4MjQ1NT5Db3B5cmlnaHQgPHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkFyaWFsOyI+JmNvcHk7PC9zcGFuPiAyMDI0IFBhc3NpeGVyLiBBbGwgcmlnaHRzIHJlc2VydmVkLjwvZm9udD4= -v PGI+PGZvbnQgY29sb3IgPSAjMjgyNDU1PlZlcnNpb246IDYuMC4xMTwvZm9udD4= -m2 PGZvbnQgY29sb3IgPSAjMjgyNDU1PkZyYW1ld29yayBpbml0aWFsaXppbmcuLi48L2ZvbnQ+ -m3 PGZvbnQgY29sb3IgPSAjMjgyNDU1PkxvYWRpbmcgc2tpbi4uLjwvZm9udD4= -m4 PGZvbnQgY29sb3IgPSAjMjgyNDU1PlByZXBhcmluZyBtYWluIHdpbmRvdy4uLjwvZm9udD4= -f VGFob21h -fdpi MQ==C:\Program Files\Passixer\Passixer iPhone Unlocker\splashScreen.exe—Passixer iPhone Unlocker.exe
User:
admin
Integrity Level:
HIGH
Exit code:
62097
Modules
Images
c:\program files\passixer\passixer iphone unlocker\splashscreen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\passixer\passixer iphone unlocker\qt5widgets.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1308"C:\Program Files\Passixer\Passixer iPhone Unlocker\Passixer iPhone Unlocker.exe" --registerC:\Program Files\Passixer\Passixer iPhone Unlocker\Passixer iPhone Unlocker.exe—iphone-unlocker.tmp
User:
admin
Company:
Passixer
Integrity Level:
HIGH
Description:
Passixer iPhone Unlocker
Exit code:
0
Version:
6.0.11.4442
Modules
Images
c:\program files\passixer\passixer iphone unlocker\passixer iphone unlocker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1404"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4232 --field-trial-handle=1252,i,1022873677698948338,3895204982277680236,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1432"C:\Program Files\Passixer\Passixer iPhone Unlocker\Passixer iPhone Unlocker.exe" --access_after_install_counting_urlC:\Program Files\Passixer\Passixer iPhone Unlocker\Passixer iPhone Unlocker.exe
iphone-unlocker.tmp
User:
admin
Company:
Passixer
Integrity Level:
HIGH
Description:
Passixer iPhone Unlocker
Exit code:
0
Version:
6.0.11.4442
Modules
Images
c:\program files\passixer\passixer iphone unlocker\passixer iphone unlocker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1536"C:\Program Files\Internet Explorer\iexplore.exe" "https://dl.passixer.com/iphone-unlocker.exe"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
35 378
Read events
35 102
Write events
211
Delete events
65

Modification events

(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
874424080
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31101895
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31101895
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
Executable files
329
Suspicious files
874
Text files
228
Unknown types
70

Dropped files

PID
Process
Filename
Type
2652iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\iphone-unlocker.exe.3nk8cn8.partial —
MD5:—
SHA256:—
1536iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\iphone-unlocker.exe —
MD5:—
SHA256:—
2652iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\38E84922A1197FDD4D181A73135959F1binary
MD5:D8A8AB8E0352AA515BAD2AB6DAAD801C
SHA256:98155B171E673974D4FD9EB7D1495F7DD86728BB0BBDF72A1A859365B6F8DB5D
1536iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\iphone-unlocker.exe.3nk8cn8.partial:Zone.Identifier —
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
1536iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:39C3EBFD33ED04359C5C1C9014846BD5
SHA256:092DA489760A7D1FA666E92CB2EDFE4B340C38E4EF3308404389D7C70495655C
2652iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_BE25D0FE540174A4A87E2295C663329Dder
MD5:35CAFD020C99A92DA52733F7C33519C5
SHA256:BDD84EC7FBEFFCE8B5F47A3C612ABA983DF85787E2165D99BCD1B6F02ECEDCA3
2652iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:884CC7830AAA7E309F286C5CFB3A9ADB
SHA256:9BE624337B3D40B586B6714DF4BDC96C80C5C60AE5454C4CDC42ACC3C4745FF3
2652iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\iphone-unlocker[1].exeexecutable
MD5:71AC51BBC97EA5073FDE4082A3D1196E
SHA256:04C721BFB463C33B741275FCCD583AADCBEDEF6792C6B883EED5B670C5C533D4
1536iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFE890437DA2CE566B.TMPgmc
MD5:663FDC623FAB221ADBB44E6EF6156708
SHA256:4030CDF51E85156B4461E8561DCA205C90343E0DC24741EFAEEFA79410381D26
2652iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\38E84922A1197FDD4D181A73135959F1der
MD5:945C699F82C81B4E8F718B63D1C5192F
SHA256:602830CAFD8D7362A5001D0EB1B907E3D8FC034A80EC0D54F5FEB7C12F44970B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
54
DNS requests
46
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2652
iexplore.exe
GET
304
217.20.57.26:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?94405334593711fa
unknown
—
—
unknown
1536
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
2652
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEQCyDO1VLjGgvzQ6dSh0O%2Bmr
unknown
—
—
unknown
1536
iexplore.exe
GET
304
217.20.57.21:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?dce1dee6221329dc
unknown
—
—
unknown
2652
iexplore.exe
GET
200
36.248.38.100:80
http://ocsp.trust-provider.cn/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQDhvjmfMdSVsHZ9u52p9jqu3rd8gQUXzp8ERB%2BDGdxYdyLo7UAA2f1VxwCEQDvDwTiBWt3GU5uhtwfwh6J
unknown
—
—
unknown
1536
iexplore.exe
GET
304
217.20.57.19:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?44c4333d94fff777
unknown
—
—
unknown
1536
iexplore.exe
GET
304
217.20.57.25:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5c39dfd216fd59c9
unknown
—
—
unknown
1536
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
unknown
—
—
unknown
1080
svchost.exe
GET
200
217.20.57.19:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?393982f109b60f02
unknown
—
—
unknown
1536
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
2652
iexplore.exe
154.85.69.57:443
dl.passixer.com
Galaxy Broadband
PK
unknown
2652
iexplore.exe
217.20.57.26:80
ctldl.windowsupdate.com
—
US
unknown
2652
iexplore.exe
217.20.57.23:80
ctldl.windowsupdate.com
—
US
unknown
2652
iexplore.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
unknown
2652
iexplore.exe
36.248.38.100:80
ocsp.trust-provider.cn
CHINA UNICOM China169 Backbone
CN
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1536
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
1536
iexplore.exe
217.20.57.21:80
ctldl.windowsupdate.com
—
US
unknown
1536
iexplore.exe
217.20.57.19:80
ctldl.windowsupdate.com
—
US
unknown

DNS requests

Domain
IP
Reputation
dl.passixer.com
  • 154.85.69.57
  • 154.85.69.56
  • 154.85.69.53
  • 154.85.69.54
unknown
ctldl.windowsupdate.com
  • 217.20.57.23
  • 217.20.57.26
  • 217.20.57.34
  • 217.20.57.35
  • 217.20.57.21
  • 217.20.57.22
  • 217.20.57.19
  • 217.20.57.25
  • 217.20.57.18
  • 217.20.57.24
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.trust-provider.cn
  • 36.248.38.100
  • 183.201.243.154
  • 112.50.95.96
  • 117.27.246.96
  • 150.139.142.18
malicious
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
reg.mobietool.com
  • 18.136.176.218
unknown
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
go.microsoft.com
  • 184.25.196.202
whitelisted

Threats

No threats detected
Process
Message
Passixer iPhone Unlocker.exe
MAIN_Font use font "Tahoma"
Passixer iPhone Unlocker.exe
MAIN version "6.0.11"
Passixer iPhone Unlocker.exe
MAIN_Font use font "Tahoma"
Passixer iPhone Unlocker.exe
MAIN version "6.0.11"
Passixer iPhone Unlocker.exe
ASL checking for logging parameters in environment variable "Passixer iPhone Unlocker.exe.log"
Passixer iPhone Unlocker.exe
ASL checking for logging parameters in environment variable "asl.log"
Passixer iPhone Unlocker.exe
ASL logging to file "C:\Users\admin\AppData\Roaming\Apple Computer\Logs\asl.094012_21Apr24.log"
Passixer iPhone Unlocker.exe
[(unknown facility) Passixer iPhone Unlocker.exe] _MobileDeviceLibraryInitRoutine (thread 3180): MobileDevice.framework version: 1533.100.57.100.2
Passixer iPhone Unlocker.exe
[(unknown facility) Passixer iPhone Unlocker.exe] _SubscribeForMuxNotifications (thread 3180): USBMuxListenerCreate: File exists
Passixer iPhone Unlocker.exe
[(unknown facility) Passixer iPhone Unlocker.exe] AMDeviceNotificationSubscribeWithOptions (thread 3180): Failed to subscribe for mux notifications: 0xe8000063 (kAMDMuxCreateListenerError)
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://dl.passixer.com/iphone-unlocker.exe