URL:

https://www.passfab.com/products/remove-activation-lock.html

Full analysis: https://app.any.run/tasks/0920f450-9178-4315-8c3c-1f34ad612c50
Verdict: Malicious activity
Analysis date: October 10, 2021, 21:27:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
Indicators:
MD5:

5744DE64F49B7369D9FDF372FD97D7F8

SHA1:

F49F619F2BCB9D064248CF4EE6EAF13AFA5DFDE6

SHA256:

89509DFAB41345A220BFDA36ACE69EDC97D4366004BA2A63A0DD515AC8FD37AE

SSDEEP:

3:N8DSLoDErdIKVXaQGRWMf5sLqO8:2OLowKKQRW0qq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • activation-unlocker.exe (PID: 2884)
      • activation-unlocker.exe (PID: 2468)
      • NetFrameCheck.exe (PID: 2420)
      • Monitor.exe (PID: 2680)
      • NetFrameCheck.exe (PID: 2116)
      • NetFrameCheck.exe (PID: 2420)

    • Drops executable file immediately after starts

      • 4mekey_passfab3.0.4.exe (PID: 1036)
      • 4mekey_passfab3.0.4.tmp (PID: 2972)

    • Loads dropped or rewritten executable

      • PassFab Activation Unlocker.exe (PID: 3428)
      • Monitor.exe (PID: 2680)
      • PassFab Activation Unlocker.exe (PID: 3044)

    • Changes Windows auto-update feature

      • PassFab Activation Unlocker.exe (PID: 3428)

    • Disables Windows Defender

      • PassFab Activation Unlocker.exe (PID: 3428)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2304)
      • iexplore.exe (PID: 2520)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2304)
      • iexplore.exe (PID: 4072)
      • 4mekey_passfab3.0.4.exe (PID: 1036)
      • 4mekey_passfab3.0.4.tmp (PID: 2972)

    • Checks for external IP

      • activation-unlocker.exe (PID: 2884)

    • Checks supported languages

      • activation-unlocker.exe (PID: 2884)
      • 4mekey_passfab3.0.4.exe (PID: 1036)
      • 4mekey_passfab3.0.4.tmp (PID: 2972)
      • NetFrameCheck.exe (PID: 2420)
      • PassFab Activation Unlocker.exe (PID: 3428)
      • Monitor.exe (PID: 2680)
      • NetFrameCheck.exe (PID: 2420)
      • PassFab Activation Unlocker.exe (PID: 3044)

    • Creates a directory in Program Files

      • activation-unlocker.exe (PID: 2884)
      • 4mekey_passfab3.0.4.tmp (PID: 2972)
      • PassFab Activation Unlocker.exe (PID: 3428)

    • Reads Windows owner or organization settings

      • 4mekey_passfab3.0.4.tmp (PID: 2972)

    • Reads the computer name

      • activation-unlocker.exe (PID: 2884)
      • 4mekey_passfab3.0.4.tmp (PID: 2972)
      • NetFrameCheck.exe (PID: 2420)
      • PassFab Activation Unlocker.exe (PID: 3428)
      • Monitor.exe (PID: 2680)
      • NetFrameCheck.exe (PID: 2420)
      • PassFab Activation Unlocker.exe (PID: 3044)

    • Creates files in the user directory

      • activation-unlocker.exe (PID: 2884)
      • PassFab Activation Unlocker.exe (PID: 3428)

    • Reads the Windows organization settings

      • 4mekey_passfab3.0.4.tmp (PID: 2972)

    • Drops a file with too old compile date

      • 4mekey_passfab3.0.4.tmp (PID: 2972)

    • Drops a file with a compile date too recent

      • 4mekey_passfab3.0.4.tmp (PID: 2972)

    • Creates a software uninstall entry

      • activation-unlocker.exe (PID: 2884)
      • PassFab Activation Unlocker.exe (PID: 3428)

    • Creates files in the program directory

      • NetFrameCheck.exe (PID: 2420)
      • PassFab Activation Unlocker.exe (PID: 3428)

    • Reads Environment values

      • PassFab Activation Unlocker.exe (PID: 3428)
      • PassFab Activation Unlocker.exe (PID: 3044)

    • Searches for installed software

      • PassFab Activation Unlocker.exe (PID: 3428)

    • Drops a file that was compiled in debug mode

      • 4mekey_passfab3.0.4.tmp (PID: 2972)

    • Changes IE settings (feature browser emulation)

      • PassFab Activation Unlocker.exe (PID: 3428)

    • Starts Internet Explorer

      • PassFab Activation Unlocker.exe (PID: 3428)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 4072)
      • iexplore.exe (PID: 2316)

    • Reads the computer name

      • iexplore.exe (PID: 4072)
      • iexplore.exe (PID: 2304)
      • iexplore.exe (PID: 2316)
      • iexplore.exe (PID: 2520)
      • WISPTIS.EXE (PID: 2964)

    • Checks supported languages

      • iexplore.exe (PID: 4072)
      • iexplore.exe (PID: 2304)
      • iexplore.exe (PID: 2316)
      • iexplore.exe (PID: 2520)
      • WISPTIS.EXE (PID: 2964)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 4072)
      • iexplore.exe (PID: 2304)
      • activation-unlocker.exe (PID: 2884)
      • iexplore.exe (PID: 2520)
      • PassFab Activation Unlocker.exe (PID: 3428)

    • Creates files in the user directory

      • iexplore.exe (PID: 2304)
      • iexplore.exe (PID: 2520)

    • Application launched itself

      • iexplore.exe (PID: 4072)
      • iexplore.exe (PID: 2316)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2304)
      • iexplore.exe (PID: 2520)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2304)
      • iexplore.exe (PID: 4072)
      • activation-unlocker.exe (PID: 2884)
      • iexplore.exe (PID: 2520)
      • PassFab Activation Unlocker.exe (PID: 3428)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 4072)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 4072)
      • iexplore.exe (PID: 2520)

    • Changes settings of System certificates

      • iexplore.exe (PID: 4072)
      • iexplore.exe (PID: 2520)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 4072)
      • iexplore.exe (PID: 2316)

    • Application was dropped or rewritten from another process

      • 4mekey_passfab3.0.4.tmp (PID: 2972)

    • Creates a software uninstall entry

      • 4mekey_passfab3.0.4.tmp (PID: 2972)

    • Dropped object may contain Bitcoin addresses

      • 4mekey_passfab3.0.4.tmp (PID: 2972)

    • Creates files in the program directory

      • 4mekey_passfab3.0.4.tmp (PID: 2972)

    • Manual execution by user

      • NetFrameCheck.exe (PID: 2116)
      • NetFrameCheck.exe (PID: 2420)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
67
Monitored processes
16
Malicious processes
6
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start iexplore.exe iexplore.exe activation-unlocker.exe no specs activation-unlocker.exe 4mekey_passfab3.0.4.exe 4mekey_passfab3.0.4.tmp netframecheck.exe no specs passfab activation unlocker.exe monitor.exe iexplore.exe no specs iexplore.exe wisptis.exe no specs wisptis.exe no specs netframecheck.exe no specs netframecheck.exe passfab activation unlocker.exe

Process information

PID
CMD
Path
Indicators
Parent process
1036 /VERYSILENT /SP- /NORESTART /DIR="C:\Program Files\PassFab\PassFab Activation Unlocker\" /LANG=en /LOG="C:\Users\admin\AppData\Local\Temp\PassFab Activation Unlocker_Setup_20211010222858.log"C:\Users\admin\AppData\Local\Temp\4mekey_passfab\4mekey_passfab3.0.4.exe
activation-unlocker.exe
User:
admin
Company:
Tenorshare, Inc.
Integrity Level:
HIGH
Description:
PassFab Activation Unlocker Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\4mekey_passfab\4mekey_passfab3.0.4.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1208"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;C:\Windows\SYSTEM32\WISPTIS.EXE—PassFab Activation Unlocker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Pen and Touch Input Component
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wisptis.exe
c:\windows\system32\ntdll.dll
2116"C:\Program Files\PassFab\PassFab Activation Unlocker\NetFrameCheck.exe" C:\Program Files\PassFab\PassFab Activation Unlocker\NetFrameCheck.exe—Explorer.EXE
User:
admin
Company:
PassFab
Integrity Level:
MEDIUM
Description:
PassFab Activation Unlocker
Exit code:
3221226540
Version:
2.0.0.1
Modules
Images
c:\program files\passfab\passfab activation unlocker\netframecheck.exe
c:\windows\system32\ntdll.dll
2304"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:4072 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2316"C:\Program Files\Internet Explorer\iexplore.exe" http://cbs.passfab.com/go?pid=2424&a=i&v=3.0.4C:\Program Files\Internet Explorer\iexplore.exe—PassFab Activation Unlocker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2420"C:\Program Files\PassFab\PassFab Activation Unlocker\NetFrameCheck.exe"C:\Program Files\PassFab\PassFab Activation Unlocker\NetFrameCheck.exe—activation-unlocker.exe
User:
admin
Company:
PassFab
Integrity Level:
HIGH
Description:
PassFab Activation Unlocker
Exit code:
0
Version:
2.0.0.1
Modules
Images
c:\program files\passfab\passfab activation unlocker\netframecheck.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msimg32.dll
2420"C:\Program Files\PassFab\PassFab Activation Unlocker\NetFrameCheck.exe" C:\Program Files\PassFab\PassFab Activation Unlocker\NetFrameCheck.exe
Explorer.EXE
User:
admin
Company:
PassFab
Integrity Level:
HIGH
Description:
PassFab Activation Unlocker
Exit code:
0
Version:
2.0.0.1
Modules
Images
c:\program files\passfab\passfab activation unlocker\netframecheck.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msimg32.dll
2468"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\activation-unlocker.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\activation-unlocker.exe—iexplore.exe
User:
admin
Company:
PassFab Co., Ltd.
Integrity Level:
MEDIUM
Description:
PassFab Activation Unlocker
Exit code:
3221226540
Version:
2.5.1.4
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\activation-unlocker.exe
c:\windows\system32\ntdll.dll
2520"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2316 CREDAT:275457 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2680"C:\Program Files\PassFab\PassFab Activation Unlocker\Monitor\Monitor.exe" 3428(#-+)UA-167618528-2(#-+)PassFab Activation Unlocker(#-+)3.0.4.3(#-+)&cd1=3.0.4.3&cd2=0&cd3=PF&cd4=EN(#-+)1C:\Program Files\PassFab\PassFab Activation Unlocker\Monitor\Monitor.exe
PassFab Activation Unlocker.exe
User:
admin
Company:
TS
Integrity Level:
HIGH
Description:
Monitor_20210728
Exit code:
0
Version:
1.0.0.10
Modules
Images
c:\program files\passfab\passfab activation unlocker\monitor\monitor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\program files\passfab\passfab activation unlocker\monitor\softwarelog.dll
Total events
38 517
Read events
38 048
Write events
427
Delete events
42

Modification events

(PID) Process:(4072) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(4072) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(4072) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30916125
(PID) Process:(4072) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(4072) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30916125
(PID) Process:(4072) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4072) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4072) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4072) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(4072) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
370
Suspicious files
43
Text files
123
Unknown types
33

Dropped files

PID
Process
Filename
Type
2304iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab4F10.tmpcompressed
MD5:—
SHA256:—
2304iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
2304iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab4F0E.tmpcompressed
MD5:—
SHA256:—
2304iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar4F0F.tmpcat
MD5:—
SHA256:—
2304iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar4F11.tmpcat
MD5:—
SHA256:—
2304iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:—
SHA256:—
2304iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:—
SHA256:—
4072iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442binary
MD5:—
SHA256:—
4072iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442der
MD5:—
SHA256:—
2304iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AD85261C04F6BA97CCBABAE2EDF85AB4der
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
67
TCP/UDP connections
157
DNS requests
41
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2304
iexplore.exe
GET
200
142.250.186.99:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECRXdf7EU7SwCgAAAAD%2FZgs%3D
US
der
471 b
whitelisted
2304
iexplore.exe
GET
200
142.250.186.99:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEHE9M93bDAqpCgAAAAD%2FYCw%3D
US
der
471 b
whitelisted
2304
iexplore.exe
GET
200
142.250.186.99:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDcT7pkfCURlwoAAAAA%2F2RA
US
der
472 b
whitelisted
2884
activation-unlocker.exe
GET
200
208.95.112.1:80
http://ip-api.com/csv
unknown
text
152 b
malicious
4072
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
2884
activation-unlocker.exe
GET
301
104.18.24.249:80
http://www.tenorshare.com/downloads/service/softwarelog.txt
US
html
469 b
whitelisted
2304
iexplore.exe
GET
200
142.250.186.99:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDWojVyl%2F4MzgoAAAAA%2F2Au
US
der
472 b
whitelisted
2304
iexplore.exe
GET
200
142.250.186.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
2304
iexplore.exe
GET
200
142.250.186.99:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
2304
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2304
iexplore.exe
104.18.25.142:443
www.passfab.com
Cloudflare Inc
US
unknown
2304
iexplore.exe
8.248.145.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
2304
iexplore.exe
67.27.158.126:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
malicious
2304
iexplore.exe
104.89.32.83:80
x1.c.lencr.org
Akamai Technologies, Inc.
NL
suspicious
4072
iexplore.exe
13.107.21.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
4072
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2304
iexplore.exe
92.123.224.124:80
r3.o.lencr.org
Akamai International B.V.
—
unknown
2304
iexplore.exe
142.250.185.78:443
www.google-analytics.com
Google Inc.
US
whitelisted
2304
iexplore.exe
74.125.133.156:443
stats.g.doubleclick.net
Google Inc.
US
whitelisted
2304
iexplore.exe
142.250.185.196:443
www.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.passfab.com
  • 104.18.25.142
  • 104.18.24.142
suspicious
ctldl.windowsupdate.com
  • 8.248.145.254
  • 67.27.233.126
  • 8.253.204.121
  • 67.26.75.254
  • 67.27.159.254
  • 67.27.158.126
  • 8.253.95.121
  • 67.26.137.254
  • 67.27.159.126
  • 8.248.119.254
whitelisted
x1.c.lencr.org
  • 104.89.32.83
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 13.107.21.200
  • 204.79.197.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
r3.o.lencr.org
  • 92.123.224.124
  • 92.123.224.113
shared
www.tenorshare.com
  • 104.18.24.249
  • 104.18.25.249
whitelisted
static.cloudflareinsights.com
  • 104.16.95.65
  • 104.16.94.65
whitelisted
www.googletagmanager.com
  • 142.250.181.232
whitelisted

Threats

PID
Process
Class
Message
2884
activation-unlocker.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
2884
activation-unlocker.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
2884
activation-unlocker.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
2884
activation-unlocker.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
3428
PassFab Activation Unlocker.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
3 ETPRO signatures available at the full report
Process
Message
PassFab Activation Unlocker.exe
log4net:ERROR XmlHierarchyConfigurator: No appender named [ConsoleAppender] could be found.
PassFab Activation Unlocker.exe
log4net:ERROR Appender named [ConsoleAppender] not found.
PassFab Activation Unlocker.exe
Note: UAC is active
PassFab Activation Unlocker.exe
log4net:ERROR XmlHierarchyConfigurator: No appender named [ConsoleAppender] could be found.
PassFab Activation Unlocker.exe
log4net:ERROR Appender named [ConsoleAppender] not found.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.passfab.com/products/remove-activation-lock.html