File name:

drfone_unlock_setup_full3855.exe

Full analysis: https://app.any.run/tasks/a3fd4f5d-6798-455b-977d-26dc1a6c4ccb
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: October 03, 2024, 08:15:30
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
qrcode
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

3873375A0AAEAFEBC8F2E0B037CAB4CA

SHA1:

31AD239193B130C04540C514BF1F125775B942A8

SHA256:

CC276D5DA0D5426558098AFE87AE7B358403ADC9160FF48CC7D7AB85D7588F73

SSDEEP:

98304:aJFfX3z+2Pwwgpzp5suNP4Uv5+/wDMXCxbNoe6Ple73U6D6VGUEGmutvDFFo5:Qq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • drfone_unlock_setup_full3855.exe (PID: 1568)

    • Reads Internet Explorer settings

      • drfone_unlock_setup_full3855.exe (PID: 1568)

    • Reads Microsoft Outlook installation path

      • drfone_unlock_setup_full3855.exe (PID: 1568)

    • Executable content was dropped or overwritten

      • drfone_unlock_setup_full3855.exe (PID: 1568)
      • drfone_full4008.tmp (PID: 6476)
      • drfone_full4008.exe (PID: 6804)

    • Likely accesses (executes) a file from the Public directory

      • NFWCHK.exe (PID: 6772)
      • drfone_full4008.tmp (PID: 6476)
      • drfone_full4008.exe (PID: 6804)

    • Checks Windows Trust Settings

      • drfone_unlock_setup_full3855.exe (PID: 1568)

    • Potential Corporate Privacy Violation

      • drfone_unlock_setup_full3855.exe (PID: 1568)

    • Connects to unusual port

      • drfone_unlock_setup_full3855.exe (PID: 1568)

    • Process requests binary or script from the Internet

      • drfone_unlock_setup_full3855.exe (PID: 1568)

    • The process drops C-runtime libraries

      • drfone_full4008.tmp (PID: 6476)

    • Process drops legitimate windows executable

      • drfone_full4008.tmp (PID: 6476)

  • INFO

    • Reads the machine GUID from the registry

      • drfone_unlock_setup_full3855.exe (PID: 1568)
      • NFWCHK.exe (PID: 6772)

    • Checks supported languages

      • drfone_unlock_setup_full3855.exe (PID: 1568)
      • NFWCHK.exe (PID: 6772)

    • Reads the computer name

      • drfone_unlock_setup_full3855.exe (PID: 1568)
      • NFWCHK.exe (PID: 6772)

    • Checks proxy server information

      • drfone_unlock_setup_full3855.exe (PID: 1568)

    • Create files in a temporary directory

      • drfone_unlock_setup_full3855.exe (PID: 1568)

    • Creates files in the program directory

      • drfone_unlock_setup_full3855.exe (PID: 1568)

    • Reads the software policy settings

      • drfone_unlock_setup_full3855.exe (PID: 1568)

    • Creates files or folders in the user directory

      • drfone_unlock_setup_full3855.exe (PID: 1568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (16.3)
.exe | Win64 Executable (generic) (14.5)
.dll | Win32 Dynamic Link Library (generic) (3.4)
.exe | Win32 Executable (generic) (2.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:01:13 08:19:46+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 1278976
InitializedDataSize: 1204736
UninitializedDataSize: -
EntryPoint: 0x1069f0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 4.0.4.18
ProductVersionNumber: 4.0.4.18
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: drfone_setup_full3855.exe
FileVersion: 4.0.4.18
LegalCopyright: Copyright©2023 Wondershare. All rights reserved.
ProductName: drfone
ProductVersion: 12.5.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
12
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drfone_unlock_setup_full3855.exe nfwchk.exe no specs conhost.exe no specs svchost.exe sppextcomobj.exe no specs slui.exe slui.exe drfone_full4008.exe drfone_full4008.tmp processkiller.exe conhost.exe no specs drfone_unlock_setup_full3855.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1568"C:\Users\admin\AppData\Local\Temp\drfone_unlock_setup_full3855.exe" C:\Users\admin\AppData\Local\Temp\drfone_unlock_setup_full3855.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
drfone_setup_full3855.exe
Version:
4.0.4.18
Modules
Images
c:\users\admin\appdata\local\temp\drfone_unlock_setup_full3855.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\wldap32.dll
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2632\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—ProcessKiller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3188"C:\Users\admin\AppData\Local\Temp\drfone_unlock_setup_full3855.exe" C:\Users\admin\AppData\Local\Temp\drfone_unlock_setup_full3855.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
drfone_setup_full3855.exe
Exit code:
3221226540
Version:
4.0.4.18
Modules
Images
c:\users\admin\appdata\local\temp\drfone_unlock_setup_full3855.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3728C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4004"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4080"C:\Users\admin\AppData\Local\Temp\is-1DJA1.tmp\ProcessKiller.exe"C:\Users\admin\AppData\Local\Temp\is-1DJA1.tmp\ProcessKiller.exe
drfone_full4008.tmp
User:
admin
Company:
Microsoft
Integrity Level:
HIGH
Description:
ProcessKiller
Exit code:
0
Version:
1.0.0.2
Modules
Images
c:\users\admin\appdata\local\temp\is-1dja1.tmp\processkiller.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4196C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6112\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—NFWCHK.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6476"C:\Users\admin\AppData\Local\Temp\is-7762P.tmp\drfone_full4008.tmp" /SL5="$15007A,459712297,673280,C:\Users\Public\Documents\Wondershare\drfone_full4008.exe" /VERYSILENT /NOPAGE /LANG=ENG /LOG="C:\Users\admin\AppData\Local\Temp\WAE-drfone.log" /installpath: "C:\Program Files (x86)\Wondershare\drfone\" /DIR="C:\Program Files (x86)\Wondershare\drfone\" /WAEWIN=D0366 /PID=3855C:\Users\admin\AppData\Local\Temp\is-7762P.tmp\drfone_full4008.tmp
drfone_full4008.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-7762p.tmp\drfone_full4008.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
Total events
2 652
Read events
2 640
Write events
12
Delete events
0

Modification events

(PID) Process:(1568) drfone_unlock_setup_full3855.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\WafCX
Operation:writeName:3855
Value:
sku-ppc
(PID) Process:(1568) drfone_unlock_setup_full3855.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Wondershare\Wondershare Helper Compact
Operation:writeName:ClientSign
Value:
{915571f6-2c87-4f0f-bc30-62a4d33db063G}
(PID) Process:(1568) drfone_unlock_setup_full3855.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Wondershare\WAF
Operation:writeName:ClientSign
Value:
{915571f6-2c87-4f0f-bc30-62a4d33db063G}
(PID) Process:(1568) drfone_unlock_setup_full3855.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1568) drfone_unlock_setup_full3855.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1568) drfone_unlock_setup_full3855.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1568) drfone_unlock_setup_full3855.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch
Operation:writeName:Version
Value:
WS not running
(PID) Process:(1568) drfone_unlock_setup_full3855.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
(PID) Process:(6476) drfone_full4008.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Wondershare\com.wondershare.drfonewin
Operation:writeName:RemindSwitch
Value:
1
(PID) Process:(6476) drfone_full4008.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Wondershare\com.wondershare.drfonewin
Operation:writeName:TipsEnable
Value:
1
Executable files
495
Suspicious files
7
Text files
2 831
Unknown types
0

Dropped files

PID
Process
Filename
Type
1568drfone_unlock_setup_full3855.exeC:\Users\Public\Documents\Wondershare\drfone_full4008.exe.~P2S —
MD5:—
SHA256:—
1568drfone_unlock_setup_full3855.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\NotoSansSC-Regular[1].otf —
MD5:—
SHA256:—
1568drfone_unlock_setup_full3855.exeC:\Users\Public\Documents\Wondershare\drfone_full4008.exe —
MD5:—
SHA256:—
1568drfone_unlock_setup_full3855.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\en_banner_2[1].pngimage
MD5:23854798B513B470232C136A5F1B23F6
SHA256:421D999B0F4CECD780C91A39E401CC02FA671FDE3B191B3DBCD18E8521F7651F
1568drfone_unlock_setup_full3855.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\jquery-2_1_4.min[1].jstext
MD5:5A78469E930137026167FC0FBA0FE3E6
SHA256:7BB14685F20EF4995672F51029F6BE814F866A035D7869F7DA6756A5FE8AC649
1568drfone_unlock_setup_full3855.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\en_banner_4[1].pngimage
MD5:BD971DFDDCE86F425E731FB2CE368F76
SHA256:EE074106CF678B0C3974C6E44F15E3381D9D8C0C0C57170E46C4AAAAD91F223C
1568drfone_unlock_setup_full3855.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\en_banner_3[1].pngimage
MD5:460C55F875071BA09392D245720380CF
SHA256:A9DE9B576BEC127869DEBF44ED53E6DA16E1095D427E1615C5FD61CBAAFE9E82
1568drfone_unlock_setup_full3855.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\javascript_call_native[1].jstext
MD5:B9DA127236EFDB755F568304B5EF3044
SHA256:01C839C0A9C47DC571175312EBC208EAE6FF28CED3A3EFA13C1EE81CD9764F71
1568drfone_unlock_setup_full3855.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_23FFFDCAABB8E63694AD1202ED02BF57binary
MD5:E085CBFEA095630E758AE72E8B3534AD
SHA256:BDCBE695AAD64E8D135B14278ADF69FEDD2B13F7A3F5B7B996C0C37145799107
1568drfone_unlock_setup_full3855.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\14561BF7422BB6F70A9CB14F5AA8A7DA_6D5FC9FD3617659722A64D73A114DFF7binary
MD5:35D068F3B6C2517C80A001663CDDEAB5
SHA256:A35B068E8D1108DAD6AE035E05F60BC9B77DB4DD4DB57830E327C7C44968641A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
103
DNS requests
26
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2120
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1568
drfone_unlock_setup_full3855.exe
GET
—
8.209.73.211:80
http://platform.wondershare.cc/rest/v2/downloader/runtime/?client_sign={915571f6-2c87-4f0f-bc30-62a4d33db063G}&product_id=3855&wae=4.0.4&platform=win_x64
unknown
—
—
whitelisted
1568
drfone_unlock_setup_full3855.exe
HEAD
200
2.19.126.140:80
http://download.wondershare.net/cbs_down/drfone_full4008.exe
unknown
—
—
whitelisted
1404
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2400
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
1568
drfone_unlock_setup_full3855.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoFmyX1Sz2HlMxmMUd1OKM%3D
unknown
—
—
whitelisted
1568
drfone_unlock_setup_full3855.exe
HEAD
200
2.19.126.135:80
http://download.wondershare.net/cbs_down/drfone_full4008.exe
unknown
—
—
whitelisted
1568
drfone_unlock_setup_full3855.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQlOydjtpho0%2Bholo77zGjGxETUEQQU8JyF%2FaKffY%2FJaLvV1IlNHb7TkP8CEA3EQd5SLWy5mr7JXcu5TKw%3D
unknown
—
—
whitelisted
1568
drfone_unlock_setup_full3855.exe
HEAD
200
2.19.126.140:80
http://download.wondershare.net/cbs_down/drfone_full4008.exe
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1404
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1404
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1568
drfone_unlock_setup_full3855.exe
47.88.57.97:443
pc-api.wondershare.cc
Alibaba US Technology Co., Ltd.
US
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
google.com
  • 142.250.184.206
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.32.72
  • 40.126.32.76
  • 40.126.32.134
  • 40.126.32.68
  • 40.126.32.136
  • 40.126.32.133
  • 40.126.32.140
  • 20.190.160.20
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
pc-api.wondershare.cc
  • 47.88.57.97
malicious
go.microsoft.com
  • 184.28.89.167
whitelisted
platform.wondershare.cc
  • 8.209.73.211
malicious
prod-web.wondershare.cc
  • 47.91.89.51
malicious

Threats

PID
Process
Class
Message
2256
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
2256
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
2256
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
2256
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
2256
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
1568
drfone_unlock_setup_full3855.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1568
drfone_unlock_setup_full3855.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3 ETPRO signatures available at the full report
Process
Message
ProcessKiller.exe
Plan B
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
drfone_unlock_setup_full3855.exe