URL:

https://dl.passixer.com/iphone-unlocker.exe

Full analysis: https://app.any.run/tasks/e48545f0-ebfa-46c5-886e-a5c43218587a
Verdict: Malicious activity
Analysis date: April 21, 2024, 08:37:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

6DFA49AC9A69DDE307503E37303DA02A

SHA1:

807B69536E2E6C7A6BDB00A5AACE2AB1313D07FD

SHA256:

790396EE8DD371E109B25476DECB65581D6154FFC9ACF8A756BD83422FACBA3C

SSDEEP:

3:N8RSWmK60IQLJd4A:2OK6xeJf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • iphone-unlocker.exe (PID: 2780)
      • Passixer iPhone Unlocker.exe (PID: 2920)
      • Passixer iPhone Unlocker.exe (PID: 4000)
      • iphone-unlocker.tmp (PID: 1632)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iphone-unlocker.exe (PID: 2780)
      • iphone-unlocker.tmp (PID: 1632)

    • Reads the Windows owner or organization settings

      • iphone-unlocker.tmp (PID: 1632)

    • Drops 7-zip archiver for unpacking

      • iphone-unlocker.tmp (PID: 1632)

    • Process drops legitimate windows executable

      • iphone-unlocker.tmp (PID: 1632)

    • Process drops SQLite DLL files

      • iphone-unlocker.tmp (PID: 1632)

    • Non-standard symbols in registry

      • iphone-unlocker.tmp (PID: 1632)

    • Reads the Internet Settings

      • iphone-unlocker.tmp (PID: 1632)
      • Passixer iPhone Unlocker.exe (PID: 3216)

    • Reads security settings of Internet Explorer

      • iphone-unlocker.tmp (PID: 1632)

    • The process drops C-runtime libraries

      • iphone-unlocker.tmp (PID: 1632)

    • Reads settings of System Certificates

      • Passixer iPhone Unlocker.exe (PID: 1432)
      • Passixer iPhone Unlocker.exe (PID: 2920)
      • Passixer iPhone Unlocker.exe (PID: 4000)

    • Searches for installed software

      • Passixer iPhone Unlocker.exe (PID: 4000)
      • Passixer iPhone Unlocker.exe (PID: 2920)

  • INFO

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 2652)

    • Application launched itself

      • iexplore.exe (PID: 1536)
      • msedge.exe (PID: 900)
      • msedge.exe (PID: 2440)

    • The process uses the downloaded file

      • iexplore.exe (PID: 1536)

    • Create files in a temporary directory

      • iphone-unlocker.exe (PID: 2780)
      • iphone-unlocker.tmp (PID: 1632)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 1536)

    • Checks supported languages

      • iphone-unlocker.exe (PID: 2780)
      • iphone-unlocker.tmp (PID: 1632)
      • Passixer iPhone Unlocker.exe (PID: 1308)
      • Passixer iPhone Unlocker.exe (PID: 2920)
      • splashScreen.exe (PID: 1020)
      • Passixer iPhone Unlocker.exe (PID: 3216)
      • Passixer iPhone Unlocker.exe (PID: 1432)
      • splashScreen.exe (PID: 2300)
      • Passixer iPhone Unlocker.exe (PID: 4000)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2652)

    • Dropped object may contain TOR URL's

      • iphone-unlocker.tmp (PID: 1632)

    • Reads the computer name

      • iphone-unlocker.tmp (PID: 1632)
      • Passixer iPhone Unlocker.exe (PID: 1308)
      • Passixer iPhone Unlocker.exe (PID: 2920)
      • Passixer iPhone Unlocker.exe (PID: 3216)
      • Passixer iPhone Unlocker.exe (PID: 1432)
      • Passixer iPhone Unlocker.exe (PID: 4000)

    • Creates files in the program directory

      • iphone-unlocker.tmp (PID: 1632)
      • Passixer iPhone Unlocker.exe (PID: 2920)
      • Passixer iPhone Unlocker.exe (PID: 4000)

    • Creates a software uninstall entry

      • iphone-unlocker.tmp (PID: 1632)

    • Creates files or folders in the user directory

      • iphone-unlocker.tmp (PID: 1632)
      • Passixer iPhone Unlocker.exe (PID: 2920)
      • Passixer iPhone Unlocker.exe (PID: 3216)
      • Passixer iPhone Unlocker.exe (PID: 4000)

    • Reads the machine GUID from the registry

      • Passixer iPhone Unlocker.exe (PID: 2920)
      • Passixer iPhone Unlocker.exe (PID: 1432)
      • Passixer iPhone Unlocker.exe (PID: 4000)

    • Manual execution by a user

      • msedge.exe (PID: 2440)
      • Passixer iPhone Unlocker.exe (PID: 4000)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
77
Monitored processes
36
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iphone-unlocker.exe no specs iphone-unlocker.exe iphone-unlocker.tmp passixer iphone unlocker.exe no specs passixer iphone unlocker.exe splashscreen.exe no specs passixer iphone unlocker.exe no specs passixer iphone unlocker.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs passixer iphone unlocker.exe splashscreen.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
296"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3572 --field-trial-handle=1252,i,1022873677698948338,3895204982277680236,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
392"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1460 --field-trial-handle=1252,i,1022873677698948338,3895204982277680236,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
568"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3624 --field-trial-handle=1252,i,1022873677698948338,3895204982277680236,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
696"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3488 --field-trial-handle=1252,i,1022873677698948338,3895204982277680236,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
900"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument https://passixer.eassiy.com/install/iphone-unlocker-win.htmlC:\Program Files\Microsoft\Edge\Application\msedge.exe—Passixer iPhone Unlocker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1020"C:\Program Files\Passixer\Passixer iPhone Unlocker\splashScreen.exe" -l ZW4= -fsize MTA= -m1 PGZvbnQgY29sb3IgPSAjMjgyNDU1PkxvYWRpbmcgbGFuZ3VhZ2UuLi48L2ZvbnQ+ -c PGZvbnQgY29sb3I9IzI4MjQ1NT5Db3B5cmlnaHQgPHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkFyaWFsOyI+JmNvcHk7PC9zcGFuPiAyMDI0IFBhc3NpeGVyLiBBbGwgcmlnaHRzIHJlc2VydmVkLjwvZm9udD4= -v PGI+PGZvbnQgY29sb3IgPSAjMjgyNDU1PlZlcnNpb246IDYuMC4xMTwvZm9udD4= -m2 PGZvbnQgY29sb3IgPSAjMjgyNDU1PkZyYW1ld29yayBpbml0aWFsaXppbmcuLi48L2ZvbnQ+ -m3 PGZvbnQgY29sb3IgPSAjMjgyNDU1PkxvYWRpbmcgc2tpbi4uLjwvZm9udD4= -m4 PGZvbnQgY29sb3IgPSAjMjgyNDU1PlByZXBhcmluZyBtYWluIHdpbmRvdy4uLjwvZm9udD4= -f VGFob21h -fdpi MQ==C:\Program Files\Passixer\Passixer iPhone Unlocker\splashScreen.exe—Passixer iPhone Unlocker.exe
User:
admin
Integrity Level:
HIGH
Exit code:
62097
Modules
Images
c:\program files\passixer\passixer iphone unlocker\splashscreen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\passixer\passixer iphone unlocker\qt5widgets.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1308"C:\Program Files\Passixer\Passixer iPhone Unlocker\Passixer iPhone Unlocker.exe" --registerC:\Program Files\Passixer\Passixer iPhone Unlocker\Passixer iPhone Unlocker.exe—iphone-unlocker.tmp
User:
admin
Company:
Passixer
Integrity Level:
HIGH
Description:
Passixer iPhone Unlocker
Exit code:
0
Version:
6.0.11.4442
Modules
Images
c:\program files\passixer\passixer iphone unlocker\passixer iphone unlocker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1404"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4232 --field-trial-handle=1252,i,1022873677698948338,3895204982277680236,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1432"C:\Program Files\Passixer\Passixer iPhone Unlocker\Passixer iPhone Unlocker.exe" --access_after_install_counting_urlC:\Program Files\Passixer\Passixer iPhone Unlocker\Passixer iPhone Unlocker.exe
iphone-unlocker.tmp
User:
admin
Company:
Passixer
Integrity Level:
HIGH
Description:
Passixer iPhone Unlocker
Exit code:
0
Version:
6.0.11.4442
Modules
Images
c:\program files\passixer\passixer iphone unlocker\passixer iphone unlocker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1536"C:\Program Files\Internet Explorer\iexplore.exe" "https://dl.passixer.com/iphone-unlocker.exe"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
35 378
Read events
35 102
Write events
211
Delete events
65

Modification events

(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
874424080
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31101895
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31101895
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
Executable files
329
Suspicious files
874
Text files
228
Unknown types
70

Dropped files

PID
Process
Filename
Type
2652iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\iphone-unlocker.exe.3nk8cn8.partial —
MD5:—
SHA256:—
1536iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\iphone-unlocker.exe —
MD5:—
SHA256:—
2652iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:884CC7830AAA7E309F286C5CFB3A9ADB
SHA256:9BE624337B3D40B586B6714DF4BDC96C80C5C60AE5454C4CDC42ACC3C4745FF3
2652iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\38E84922A1197FDD4D181A73135959F1binary
MD5:D8A8AB8E0352AA515BAD2AB6DAAD801C
SHA256:98155B171E673974D4FD9EB7D1495F7DD86728BB0BBDF72A1A859365B6F8DB5D
1536iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:7C378D16E7D09911F81C8D85FCB5AFFB
SHA256:A7E6F943BB94F9471194D1C6C7F2E7ADE425CD46B0F871B534B99EDA21DF465D
2652iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_BE25D0FE540174A4A87E2295C663329Dbinary
MD5:9377F91F63935F28DB9E6B2422501F3A
SHA256:256E7FA0DE66D72EE0E26984B5BF0B0620E9DD6F570661CDBB584FC9264E87C2
2652iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_BE25D0FE540174A4A87E2295C663329Dder
MD5:35CAFD020C99A92DA52733F7C33519C5
SHA256:BDD84EC7FBEFFCE8B5F47A3C612ABA983DF85787E2165D99BCD1B6F02ECEDCA3
2652iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\38E84922A1197FDD4D181A73135959F1der
MD5:945C699F82C81B4E8F718B63D1C5192F
SHA256:602830CAFD8D7362A5001D0EB1B907E3D8FC034A80EC0D54F5FEB7C12F44970B
2652iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\iphone-unlocker[1].exeexecutable
MD5:71AC51BBC97EA5073FDE4082A3D1196E
SHA256:04C721BFB463C33B741275FCCD583AADCBEDEF6792C6B883EED5B670C5C533D4
1536iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\urlblockindex[1].bin —
MD5:FA518E3DFAE8CA3A0E495460FD60C791
SHA256:775853600060162C4B4E5F883F9FD5A278E61C471B3EE1826396B6D129499AA7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
54
DNS requests
46
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2652
iexplore.exe
GET
304
217.20.57.26:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?94405334593711fa
US
—
—
unknown
2652
iexplore.exe
GET
304
217.20.57.23:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?501143bdbf2f2bd6
US
—
—
unknown
2652
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEQCyDO1VLjGgvzQ6dSh0O%2Bmr
US
binary
1.42 Kb
unknown
1536
iexplore.exe
GET
304
217.20.57.19:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?44c4333d94fff777
US
—
—
unknown
1536
iexplore.exe
GET
304
217.20.57.25:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5c39dfd216fd59c9
US
—
—
unknown
1536
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
unknown
1080
svchost.exe
GET
200
217.20.57.19:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?393982f109b60f02
US
—
68.3 Kb
unknown
1536
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
US
binary
471 b
unknown
1536
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
US
binary
471 b
unknown
1536
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
US
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
2652
iexplore.exe
154.85.69.57:443
dl.passixer.com
Galaxy Broadband
PK
unknown
2652
iexplore.exe
217.20.57.26:80
ctldl.windowsupdate.com
—
US
unknown
2652
iexplore.exe
217.20.57.23:80
ctldl.windowsupdate.com
—
US
unknown
2652
iexplore.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
unknown
2652
iexplore.exe
36.248.38.100:80
ocsp.trust-provider.cn
CHINA UNICOM China169 Backbone
CN
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1536
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
1536
iexplore.exe
217.20.57.21:80
ctldl.windowsupdate.com
—
US
unknown
1536
iexplore.exe
217.20.57.19:80
ctldl.windowsupdate.com
—
US
unknown

DNS requests

Domain
IP
Reputation
dl.passixer.com
  • 154.85.69.57
  • 154.85.69.56
  • 154.85.69.53
  • 154.85.69.54
unknown
ctldl.windowsupdate.com
  • 217.20.57.23
  • 217.20.57.26
  • 217.20.57.34
  • 217.20.57.35
  • 217.20.57.21
  • 217.20.57.22
  • 217.20.57.19
  • 217.20.57.25
  • 217.20.57.18
  • 217.20.57.24
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.trust-provider.cn
  • 36.248.38.100
  • 183.201.243.154
  • 112.50.95.96
  • 117.27.246.96
  • 150.139.142.18
malicious
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
reg.mobietool.com
  • 18.136.176.218
unknown
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
go.microsoft.com
  • 184.25.196.202
whitelisted

Threats

No threats detected
Process
Message
Passixer iPhone Unlocker.exe
MAIN_Font use font "Tahoma"
Passixer iPhone Unlocker.exe
MAIN version "6.0.11"
Passixer iPhone Unlocker.exe
MAIN_Font use font "Tahoma"
Passixer iPhone Unlocker.exe
MAIN version "6.0.11"
Passixer iPhone Unlocker.exe
ASL checking for logging parameters in environment variable "Passixer iPhone Unlocker.exe.log"
Passixer iPhone Unlocker.exe
ASL checking for logging parameters in environment variable "asl.log"
Passixer iPhone Unlocker.exe
ASL logging to file "C:\Users\admin\AppData\Roaming\Apple Computer\Logs\asl.094012_21Apr24.log"
Passixer iPhone Unlocker.exe
[(unknown facility) Passixer iPhone Unlocker.exe] _MobileDeviceLibraryInitRoutine (thread 3180): MobileDevice.framework version: 1533.100.57.100.2
Passixer iPhone Unlocker.exe
[(unknown facility) Passixer iPhone Unlocker.exe] _SubscribeForMuxNotifications (thread 3180): USBMuxListenerCreate: File exists
Passixer iPhone Unlocker.exe
[(unknown facility) Passixer iPhone Unlocker.exe] AMDeviceNotificationSubscribeWithOptions (thread 3180): Failed to subscribe for mux notifications: 0xe8000063 (kAMDMuxCreateListenerError)
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://dl.passixer.com/iphone-unlocker.exe