File name:

drfone_unlock_setup_full3855.exe

Full analysis: https://app.any.run/tasks/a3fd4f5d-6798-455b-977d-26dc1a6c4ccb
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: October 03, 2024, 08:15:30
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
qrcode
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

3873375A0AAEAFEBC8F2E0B037CAB4CA

SHA1:

31AD239193B130C04540C514BF1F125775B942A8

SHA256:

CC276D5DA0D5426558098AFE87AE7B358403ADC9160FF48CC7D7AB85D7588F73

SSDEEP:

98304:aJFfX3z+2Pwwgpzp5suNP4Uv5+/wDMXCxbNoe6Ple73U6D6VGUEGmutvDFFo5:Qq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • drfone_unlock_setup_full3855.exe (PID: 1568)

    • Reads Internet Explorer settings

      • drfone_unlock_setup_full3855.exe (PID: 1568)

    • Reads Microsoft Outlook installation path

      • drfone_unlock_setup_full3855.exe (PID: 1568)

    • Likely accesses (executes) a file from the Public directory

      • NFWCHK.exe (PID: 6772)
      • drfone_full4008.exe (PID: 6804)
      • drfone_full4008.tmp (PID: 6476)

    • Executable content was dropped or overwritten

      • drfone_unlock_setup_full3855.exe (PID: 1568)
      • drfone_full4008.exe (PID: 6804)
      • drfone_full4008.tmp (PID: 6476)

    • Checks Windows Trust Settings

      • drfone_unlock_setup_full3855.exe (PID: 1568)

    • Potential Corporate Privacy Violation

      • drfone_unlock_setup_full3855.exe (PID: 1568)

    • Process requests binary or script from the Internet

      • drfone_unlock_setup_full3855.exe (PID: 1568)

    • Connects to unusual port

      • drfone_unlock_setup_full3855.exe (PID: 1568)

    • The process drops C-runtime libraries

      • drfone_full4008.tmp (PID: 6476)

    • Process drops legitimate windows executable

      • drfone_full4008.tmp (PID: 6476)

  • INFO

    • Create files in a temporary directory

      • drfone_unlock_setup_full3855.exe (PID: 1568)

    • Checks supported languages

      • drfone_unlock_setup_full3855.exe (PID: 1568)
      • NFWCHK.exe (PID: 6772)

    • Reads the machine GUID from the registry

      • drfone_unlock_setup_full3855.exe (PID: 1568)
      • NFWCHK.exe (PID: 6772)

    • Reads the computer name

      • drfone_unlock_setup_full3855.exe (PID: 1568)
      • NFWCHK.exe (PID: 6772)

    • Checks proxy server information

      • drfone_unlock_setup_full3855.exe (PID: 1568)

    • Creates files in the program directory

      • drfone_unlock_setup_full3855.exe (PID: 1568)

    • Reads the software policy settings

      • drfone_unlock_setup_full3855.exe (PID: 1568)

    • Creates files or folders in the user directory

      • drfone_unlock_setup_full3855.exe (PID: 1568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (16.3)
.exe | Win64 Executable (generic) (14.5)
.dll | Win32 Dynamic Link Library (generic) (3.4)
.exe | Win32 Executable (generic) (2.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:01:13 08:19:46+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 1278976
InitializedDataSize: 1204736
UninitializedDataSize: -
EntryPoint: 0x1069f0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 4.0.4.18
ProductVersionNumber: 4.0.4.18
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: drfone_setup_full3855.exe
FileVersion: 4.0.4.18
LegalCopyright: Copyright©2023 Wondershare. All rights reserved.
ProductName: drfone
ProductVersion: 12.5.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
12
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drfone_unlock_setup_full3855.exe nfwchk.exe no specs conhost.exe no specs svchost.exe sppextcomobj.exe no specs slui.exe slui.exe drfone_full4008.exe drfone_full4008.tmp processkiller.exe conhost.exe no specs drfone_unlock_setup_full3855.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1568"C:\Users\admin\AppData\Local\Temp\drfone_unlock_setup_full3855.exe" C:\Users\admin\AppData\Local\Temp\drfone_unlock_setup_full3855.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
drfone_setup_full3855.exe
Version:
4.0.4.18
Modules
Images
c:\users\admin\appdata\local\temp\drfone_unlock_setup_full3855.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\wldap32.dll
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2632\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—ProcessKiller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3188"C:\Users\admin\AppData\Local\Temp\drfone_unlock_setup_full3855.exe" C:\Users\admin\AppData\Local\Temp\drfone_unlock_setup_full3855.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
drfone_setup_full3855.exe
Exit code:
3221226540
Version:
4.0.4.18
Modules
Images
c:\users\admin\appdata\local\temp\drfone_unlock_setup_full3855.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3728C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4004"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4080"C:\Users\admin\AppData\Local\Temp\is-1DJA1.tmp\ProcessKiller.exe"C:\Users\admin\AppData\Local\Temp\is-1DJA1.tmp\ProcessKiller.exe
drfone_full4008.tmp
User:
admin
Company:
Microsoft
Integrity Level:
HIGH
Description:
ProcessKiller
Exit code:
0
Version:
1.0.0.2
Modules
Images
c:\users\admin\appdata\local\temp\is-1dja1.tmp\processkiller.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4196C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6112\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—NFWCHK.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6476"C:\Users\admin\AppData\Local\Temp\is-7762P.tmp\drfone_full4008.tmp" /SL5="$15007A,459712297,673280,C:\Users\Public\Documents\Wondershare\drfone_full4008.exe" /VERYSILENT /NOPAGE /LANG=ENG /LOG="C:\Users\admin\AppData\Local\Temp\WAE-drfone.log" /installpath: "C:\Program Files (x86)\Wondershare\drfone\" /DIR="C:\Program Files (x86)\Wondershare\drfone\" /WAEWIN=D0366 /PID=3855C:\Users\admin\AppData\Local\Temp\is-7762P.tmp\drfone_full4008.tmp
drfone_full4008.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-7762p.tmp\drfone_full4008.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
Total events
2 652
Read events
2 640
Write events
12
Delete events
0

Modification events

(PID) Process:(1568) drfone_unlock_setup_full3855.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\WafCX
Operation:writeName:3855
Value:
sku-ppc
(PID) Process:(1568) drfone_unlock_setup_full3855.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Wondershare\Wondershare Helper Compact
Operation:writeName:ClientSign
Value:
{915571f6-2c87-4f0f-bc30-62a4d33db063G}
(PID) Process:(1568) drfone_unlock_setup_full3855.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Wondershare\WAF
Operation:writeName:ClientSign
Value:
{915571f6-2c87-4f0f-bc30-62a4d33db063G}
(PID) Process:(1568) drfone_unlock_setup_full3855.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1568) drfone_unlock_setup_full3855.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1568) drfone_unlock_setup_full3855.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1568) drfone_unlock_setup_full3855.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch
Operation:writeName:Version
Value:
WS not running
(PID) Process:(1568) drfone_unlock_setup_full3855.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
(PID) Process:(6476) drfone_full4008.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Wondershare\com.wondershare.drfonewin
Operation:writeName:RemindSwitch
Value:
1
(PID) Process:(6476) drfone_full4008.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Wondershare\com.wondershare.drfonewin
Operation:writeName:TipsEnable
Value:
1
Executable files
495
Suspicious files
7
Text files
2 831
Unknown types
0

Dropped files

PID
Process
Filename
Type
1568drfone_unlock_setup_full3855.exeC:\Users\Public\Documents\Wondershare\drfone_full4008.exe.~P2S —
MD5:—
SHA256:—
1568drfone_unlock_setup_full3855.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\NotoSansSC-Regular[1].otf —
MD5:—
SHA256:—
1568drfone_unlock_setup_full3855.exeC:\Users\Public\Documents\Wondershare\drfone_full4008.exe —
MD5:—
SHA256:—
1568drfone_unlock_setup_full3855.exeC:\Users\admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.logtext
MD5:BB8A32946002BE35391CFE6F7475FA9A
SHA256:22EDD0581E68F61C80A8CB5195356BB6BF8D5C0D4C1A9CC997D528E4E4A31C74
1568drfone_unlock_setup_full3855.exeC:\Users\Public\Documents\Wondershare\NFWCHK.exe.configxml
MD5:5BABF2A106C883A8E216F768DB99AD51
SHA256:9E676A617EB0D0535AC05A67C0AE0C0E12D4E998AB55AC786A031BFC25E28300
1568drfone_unlock_setup_full3855.exeC:\Users\Public\Documents\Wondershare\NFWCHK.exeexecutable
MD5:27CFB3990872CAA5930FA69D57AEFE7B
SHA256:43881549228975C7506B050BCE4D9B671412D3CDC08C7516C9DBBB7F50C25146
1568drfone_unlock_setup_full3855.exeC:\Users\admin\AppData\Local\Temp\wsduilib.logtext
MD5:DFD83422EEBD945132F71F8203B6DDF4
SHA256:FC57D60C4BFCA8EC3877E61811ED4399C1550159C9EE009A2C405834BAC5147A
1568drfone_unlock_setup_full3855.exeC:\Users\Public\Documents\Wondershare\WAE_DOWNTASK_3855.xmlxml
MD5:2108B5D39D37C65DF3110C5AAD83F81E
SHA256:B19E920F356A49DB0D062396F81F74BA8CFC7EF67A6FC937273778D0B7F63F8A
1568drfone_unlock_setup_full3855.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\jquery-2_1_4.min[1].jstext
MD5:5A78469E930137026167FC0FBA0FE3E6
SHA256:7BB14685F20EF4995672F51029F6BE814F866A035D7869F7DA6756A5FE8AC649
6476drfone_full4008.tmpC:\Users\admin\AppData\Local\Temp\is-1DJA1.tmp\WSUtilities.dllexecutable
MD5:A0CEFE160F504402B5148580C5B912BF
SHA256:4333DAE45B166E2EC59C49A46FF6ABE3342D9191EBAFDA9B53803E639E33F1D1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
103
DNS requests
26
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1568
drfone_unlock_setup_full3855.exe
GET
206
2.19.126.140:80
http://download.wondershare.net/cbs_down/drfone_full4008.exe
unknown
—
—
whitelisted
1568
drfone_unlock_setup_full3855.exe
GET
—
2.19.126.135:80
http://download.wondershare.net/cbs_down/drfone_full4008.exe
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1568
drfone_unlock_setup_full3855.exe
HEAD
200
2.19.126.140:80
http://download.wondershare.net/cbs_down/drfone_full4008.exe
unknown
—
—
whitelisted
1568
drfone_unlock_setup_full3855.exe
GET
—
8.209.73.211:80
http://platform.wondershare.cc/rest/v2/downloader/runtime/?client_sign={915571f6-2c87-4f0f-bc30-62a4d33db063G}&product_id=3855&wae=4.0.4&platform=win_x64
unknown
—
—
whitelisted
1404
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2120
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1568
drfone_unlock_setup_full3855.exe
HEAD
200
2.19.126.135:80
http://download.wondershare.net/cbs_down/drfone_full4008.exe
unknown
—
—
whitelisted
1568
drfone_unlock_setup_full3855.exe
GET
—
2.19.126.135:80
http://download.wondershare.net/cbs_down/drfone_full4008.exe
unknown
—
—
whitelisted
2872
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1404
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1404
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1568
drfone_unlock_setup_full3855.exe
47.88.57.97:443
pc-api.wondershare.cc
Alibaba US Technology Co., Ltd.
US
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
google.com
  • 142.250.184.206
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.32.72
  • 40.126.32.76
  • 40.126.32.134
  • 40.126.32.68
  • 40.126.32.136
  • 40.126.32.133
  • 40.126.32.140
  • 20.190.160.20
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
pc-api.wondershare.cc
  • 47.88.57.97
malicious
go.microsoft.com
  • 184.28.89.167
whitelisted
platform.wondershare.cc
  • 8.209.73.211
malicious
prod-web.wondershare.cc
  • 47.91.89.51
malicious

Threats

PID
Process
Class
Message
2256
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
2256
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
2256
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
2256
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
2256
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
1568
drfone_unlock_setup_full3855.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1568
drfone_unlock_setup_full3855.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3 ETPRO signatures available at the full report
Process
Message
ProcessKiller.exe
Plan B
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
drfone_unlock_setup_full3855.exe