24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 39:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T428,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample cb08d87a69ac… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample cb08d87a69ac…. Threat score 100/100. 0/0 AV engines flagged this file. 9 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/cb08d87a69ac178d92abdebee9f3e5df2b0261850da853c9535b4d6067f8bce6","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","cb08d87a69ac178d92abdebee9f3e5df2b0261850da853c9535b4d6067f8bce6"],"about":{"@type":"SoftwareApplication","name":"AnyDroid_Setup.exe","applicationCategory":["peexe","executable"],"identifier":"cb08d87a69ac178d92abdebee9f3e5df2b0261850da853c9535b4d6067f8bce6","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":0},"behavioralIndicators":{"malicious":9,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T525,"AnyDroid_Setup.tmp" queries volume information of "C:\" at 00065195-00003288-00000046-13131804 "AnyDroid_Setup.tmp" queries volume information of "C:\Program Files (x86)\AnyDroid\AnyDroid.exe" at 00065195-00003288-00000046-13142956 "AnyDroid.exe" queries volume information of "C:\Program Files (x86)\AnyDroid\iMobieHelper.dll" at 00069971-00003188-00000046-3835894 "AnyDroid.exe" queries volume information of "C:\Program Files (x86)\AnyDroid\log4net.dll" at 00069971-00003188-00000046-4025565 "AnyDroid.exe" queries volume information of "C:\Program Files (x86)\AnyDroid\CommonModelLibrary.dll" at 00069971-00003188-00000046-4157591 "AnyDroid.exe" queries volume information of "C:\Program Files (x86)\AnyDroid\AnyDroid.exe" at 00069971-00003188-00000046-12757084400906648 "AnyDroid.exe" queries volume information of "C:\Program Files (x86)\AnyDroid\AnyDroid.exe" at 00070002-00003092-00000046-1561869 "AnyDroid.exe" queries volume information of "C:\Program Files (x86)\AnyDroid\iMobieHelper.dll" at 00070002-00003092-00000046-2873859 "AnyDroid.exe" queries volume information of "C:\Program Files (x86)\AnyDroid\log4net.dll" at 00070002-00003092-00000046-3045948 "AnyDroid.exe" queries volume information of "C:\Program Files (x86)\AnyDroid\CommonModelLibrary.dll" at 00070002-00003092-00000046-315490126:T61f,Antivirus vendors marked dropped file "is-7U1H5.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"), Antivirus vendors marked dropped file "is-8FOK9.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"), Antivirus vendors marked dropped file "is-OJ8T9.tmp" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "is-2M2A8.tmp" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "is-VR6EM.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"), Antivirus vendors marked dropped file "is-89VSQ.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"), Antivirus vendors marked dropped file "is-VKHPO.tmp" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "is-MUU4F.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"), Antivirus vendors marked dropped file "is-8QL2O.tmp" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "is-LIKP1.tmp" as clean (type is "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"), Antivirus vendors marked dropped file "is-H1IT8.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows")27:T452,"AnyDroid_Setup.tmp" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "AnyDroid_Setup.tmp" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}") "AnyDroid_Setup.tmp" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "AnyDroid_Setup.tmp" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "AnyDroid_Setup.tmp" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "AnyDroid_Setup.tmp" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "AnyDroid_Setup.tmp" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "AnyDroid_Setup.tmp" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS")28:T78c,"AnyDroid .lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Archive ctime=Mon Jun 28 13:49:25 2021 mtime=Mon Jun 28 13:49:26 2021 atime=Mon Jun 28 08:12:34 2021 length=16917688 window=hide" "desktop.ini" has type "empty" "unins000.dat" has type "data" "is-7U1H5.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "is-8FOK9.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "is-DS6NJ.tmp" has type "PNG image data 14 x 14 8-bit/color RGBA non-interlaced" "is-59B2N.tmp" has type "UTF-8 Unicode (with BOM) text with very long lines with CRLF line terminators" "is-OJ8T9.tmp" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "is-BLV9A.tmp" has type "PNG image data 14 x 14 8-bit/color RGBA non-interlaced" "is-2M2A8.tmp" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "is-9SC2E.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "is-VR6EM.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "is-HG96U.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "is-89VSQ.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "is-VKHPO.tmp" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "is-MUU4F.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "is-8QL2O.tmp" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "is-4PNDM.tmp" has type "PNG image data 14 x 14 8-bit/color RGBA non-interlaced" "is-LIKP1.tmp" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "is-H1IT8.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"29:T59a,"AnyDroid_Setup.exe" touched file "C:\Windows\SysWOW64\en-US\KernelBase.dll.mui" "AnyDroid_Setup.exe" touched file "C:\Windows\syswow64\en\KERNELBASE.dll.mui" "AnyDroid_Setup.exe" touched file "C:\Windows\SysWOW64\netmsg.dll" "AnyDroid_Setup.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "AnyDroid_Setup.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "AnyDroid_Setup.tmp" touched file "C:\Windows\SysWOW64\tzres.dll" "AnyDroid_Setup.tmp" touched file "C:\Windows\Fonts\StaticCache.dat" "AnyDroid_Setup.tmp" touched file "C:\Windows\SysWOW64\en-US\user32.dll.mui" "AnyDroid_Setup.tmp" touched file "C:\Windows\SysWOW64\en-US\KernelBase.dll.mui" "AnyDroid_Setup.tmp" touched file "C:\Windows\syswow64\en\KERNELBASE.dll.mui" "AnyDroid_Setup.tmp" touched file "C:\Windows\SysWOW64\netmsg.dll" "AnyDroid_Setup.tmp" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "AnyDroid_Setup.tmp" touched file "C:\Windows\SysWOW64\en-US\msctf.dll.mui" "AnyDroid_Setup.tmp" touched file "C:\Windows\winsxs\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\comctl32.dll.mui" "AnyDroid_Setup.tmp" touched file "C:\Windows\SysWOW64\imageres.dll" "AnyDroid_Setup.tmp" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "AnyDroid_Setup.tmp" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db"2a:T7ef,Pattern match: "https://jrsoftware.org/ishelp/index.php?topic=setupcmdline" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "ns.adobe.com/xap/1.0/" Pattern match: "http://ns.adobe.com/xap/1.0/" Pattern match: "adobe.com/xap/1.0/mm/" Pattern match: "ww.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "http://schemas.microsoft.com/winfx/2006/xaml/presentation" Pattern match: "http://schemas.microsoft.com/winfx/2006/xaml" Pattern match: "http://schemas.microsoft.com/netfx/2007/xaml/presentation" Pattern match: "https://www.imobie.com/fr/anydroid/" Pattern match: "https://www.imobie.com/faq/anydroid-faqs.htm" Pattern match: "https://www.imobie.com/fr/faq/anydroid-faqs.htm" Pattern match: "https://www.imobie.com/faq/anydroid-faqs.htm#part2" Pattern match: "https://www.imobie.com/fr/anydroid/guide.htm" Pattern match: "https://www.imobie.com/fr/anydroid/buy-time-limited-offer.htm" Pattern match: "https://www.imobie.com/fr/landing/anydroid-official-exclusive-offer.htm?license={0}&os=win&v={1}&source={2" Pattern match: "https://www.imobie.com/guide/how-to-do-if-anydroid-fails-to-install-apk-on-android-device.htm" Pattern match: "https://www.imobie.com/guide/anydroid/how-to-get-verification-code-and-sign-in-two-factor-authentication.htm" Pattern match: "http://imobie.com/guide/anydroid/how-to-turn-off-icloud-connection-in-device.htm" Pattern match: "https://www.facebook.com/iMobieFrance" Pattern match: "https://twitter.com/imobie_france" Pattern match: "https://www.youtube.com/c/iMobieFrance" Pattern match: "https://www.imobie.fr/guide/anytrans/what-data-will-be-overwritten.htm" Pattern match: "http://www.youtube.com/" Pattern match: "http://www.bbc.com/" Pattern match: "http://www.break.com/" Pattern match: "http://www.dailymotion.com/" Pattern match: "http://www.metacafe.com/" Pattern match: "https://vimeo.com/" Pattern match: "http://www.Instagram.com/" Pattern match: "http://www.Vine.co/" Pattern match: "https://account.imobie.com/"2b:T41e,"AnyDroid_Setup.tmp" queried SystemProcessInformation at 00065195-00003288-00000033-5793371 "AnyDroid_Setup.tmp" queried SystemProcessInformation at 00065195-00003288-00000033-5793639 "AnyDroid.exe" queried SystemProcessInformation at 00069971-00003188-00000033-4010614 "AnyDroid.exe" queried SystemProcessInformation at 00069971-00003188-00000033-4013437 "AnyDroid.exe" queried SystemProcessInformation at 00069971-00003188-00000033-4171818 "AnyDroid.exe" queried SystemProcessInformation at 00069971-00003188-00000033-4174152 "AnyDroid.exe" queried SystemProcessInformation at 00069971-00003188-00000033-4174676 "AnyDroid.exe" queried SystemProcessInformation at 00070002-00003092-00000033-3026263 "AnyDroid.exe" queried SystemProcessInformation at 00070002-00003092-00000033-3033950 "AnyDroid.exe" queried SystemProcessInformation at 00070002-00003092-00000033-3167424 "AnyDroid.exe" queried SystemProcessInformation at 00070002-00003092-00000033-3169842 "AnyDroid.exe" queried SystemProcessInformation at 00070002-00003092-00000033-31704322c:T4e1,"is-7U1H5.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "is-8FOK9.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "is-OJ8T9.tmp" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "is-2M2A8.tmp" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "is-9SC2E.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "is-VR6EM.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "is-HG96U.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "is-89VSQ.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "is-VKHPO.tmp" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "is-MUU4F.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "is-8QL2O.tmp" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "is-LIKP1.tmp" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "is-H1IT8.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"2d:T787,"AnyDroid_Setup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\is-3PCJL.tmp\AnyDroid_Setup.tmp" with delete access "AnyDroid_Setup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\is-3PCJL.tmp" with delete access "AnyDroid_Setup.tmp" opened "C:\Program Files (x86)\AnyDroid\is-S3DU8.tmp" with delete access "AnyDroid_Setup.tmp" opened "C:\Program Files (x86)\AnyDroid\is-0JMG7.tmp" with delete access "AnyDroid_Setup.tmp" opened "C:\Program Files (x86)\AnyDroid\is-288MB.tmp" with delete access "AnyDroid_Setup.tmp" opened "C:\Program Files (x86)\AnyDroid\is-PJGI5.tmp" with delete access "AnyDroid_Setup.tmp" opened "C:\Program Files (x86)\AnyDroid\is-O70FH.tmp" with delete access "AnyDroid_Setup.tmp" opened "C:\Program Files (x86)\AnyDroid\is-1FLC5.tmp" with delete access "AnyDroid_Setup.tmp" opened "C:\Program Files (x86)\AnyDroid\is-H7OU7.tmp" with delete access "AnyDroid_Setup.tmp" opened "C:\Program Files (x86)\AnyDroid\is-FNN6Q.tmp" with delete access "AnyDroid_Setup.tmp" opened "C:\Program Files (x86)\AnyDroid\is-2M2A8.tmp" with delete access "AnyDroid_Setup.tmp" opened "C:\Program Files (x86)\AnyDroid\AnyDroid.exe" with delete access "AnyDroid_Setup.tmp" opened "C:\Program Files (x86)\AnyDroid\is-8H1DS.tmp" with delete access "AnyDroid_Setup.tmp" opened "C:\Program Files (x86)\AnyDroid\is-FLGJA.tmp" with delete access "AnyDroid_Setup.tmp" opened "C:\Program Files (x86)\AnyDroid\is-VR6EM.tmp" with delete access "AnyDroid_Setup.tmp" opened "C:\Program Files (x86)\AnyDroid\is-VJSIE.tmp" with delete access "AnyDroid_Setup.tmp" opened "C:\Program Files (x86)\AnyDroid\is-7U1H5.tmp" with delete access "AnyDroid_Setup.tmp" opened "C:\Program Files (x86)\AnyDroid\is-HG96U.tmp" with delete access "AnyDroid_Setup.tmp" opened "C:\Program Files (x86)\AnyDroid\is-GD214.tmp" with delete access "AnyDroid_Setup.tmp" opened "C:\Program Files (x86)\AnyDroid\is-9Q269.tmp" with delete access2e:Ta42,"AnyDroid_Setup.exe" wrote bytes "711157007a3b5600ab8b02007f950200fc8c0200729602006cc805001ecd53007d265300" to virtual address "0x76A707E4" (part of module "USER32.DLL") "AnyDroid_Setup.exe" wrote bytes "c0dff8761cf9f776ccf8f7760d64f97600000000c011057500000000fc3e057500000000e0130575000000009457937525e0f876c6e0f87600000000bc6a927500000000cf3105750000000093199375000000002c32057500000000" to virtual address "0x756E1000" (part of module "NSI.DLL") "AnyDroid_Setup.tmp" wrote bytes "711157007a3b5600ab8b02007f950200fc8c0200729602006cc805001ecd53007d265300" to virtual address "0x76A707E4" (part of module "USER32.DLL") "AnyDroid_Setup.tmp" wrote bytes "c0dff8761cf9f776ccf8f7760d64f97600000000c011057500000000fc3e057500000000e0130575000000009457937525e0f876c6e0f87600000000bc6a927500000000cf3105750000000093199375000000002c32057500000000" to virtual address "0x756E1000" (part of module "NSI.DLL") "AnyDroid.exe" wrote bytes "5470352c84990000" to virtual address "0xEF30FA70" (part of module "CLR.DLL") "AnyDroid.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEEB42570" (part of module "CLR.DLL") "AnyDroid.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEEB42533" (part of module "CLR.DLL") "AnyDroid.exe" wrote bytes "65488b0425e8140000" to virtual address "0xEEB42C1B" (part of module "CLR.DLL") "AnyDroid.exe" wrote bytes "65488b0425e8140000" to virtual address "0xEEB42C5B" (part of module "CLR.DLL") "AnyDroid.exe" wrote bytes "65488b0425e0140000" to virtual address "0xEEB42BA0" (part of module "CLR.DLL") "AnyDroid.exe" wrote bytes "65488b0425e0140000" to virtual address "0xEEB42BC0" (part of module "CLR.DLL") "AnyDroid.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEEB426A3" (part of module "CLR.DLL") "AnyDroid.exe" wrote bytes "65488b0425e0140000" to virtual address "0xEEB42B83" (part of module "CLR.DLL") "AnyDroid.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEEB429CC" (part of module "CLR.DLL") "AnyDroid.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEEB426ED" (part of module "CLR.DLL") "AnyDroid.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEEB4264E" (part of module "CLR.DLL") "AnyDroid.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEEB428CA" (part of module "CLR.DLL") "AnyDroid.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEEB425EB" (part of module "CLR.DLL") "AnyDroid.exe" wrote bytes "65488b0425e8140000" to virtual address "0xEEB42C8B" (part of module "CLR.DLL") "AnyDroid.exe" wrote bytes "65488b0425e8140000" to virtual address "0xEEB42CCB" (part of module "CLR.DLL")2f:T670,"AnyDroid_Setup.exe" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-3PCJL.tmp\AnyDroid_Setup.tmp" (Handle: 252) "AnyDroid_Setup.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-3PCJL.tmp\AnyDroid_Setup.tmp" (Handle: 252) "AnyDroid_Setup.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-3PCJL.tmp\AnyDroid_Setup.tmp" (Handle: 252) "AnyDroid_Setup.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-3PCJL.tmp\AnyDroid_Setup.tmp" (Handle: 252) "AnyDroid_Setup.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-3PCJL.tmp\AnyDroid_Setup.tmp" (Handle: 252) "AnyDroid_Setup.tmp" wrote 32 bytes to a remote process "C:\Program Files (x86)\AnyDroid\AnyDroid.exe" (Handle: 708) "AnyDroid_Setup.tmp" wrote 52 bytes to a remote process "C:\Program Files (x86)\AnyDroid\AnyDroid.exe" (Handle: 708) "AnyDroid_Setup.tmp" wrote 4 bytes to a remote process "C:\Program Files (x86)\AnyDroid\AnyDroid.exe" (Handle: 708) "AnyDroid_Setup.tmp" wrote 8 bytes to a remote process "C:\Program Files (x86)\AnyDroid\AnyDroid.exe" (Handle: 708) "AnyDroid_Setup.tmp" wrote 32 bytes to a remote process "C:\Program Files (x86)\AnyDroid\AnyDroid.exe" (Handle: 552) "AnyDroid_Setup.tmp" wrote 52 bytes to a remote process "C:\Program Files (x86)\AnyDroid\AnyDroid.exe" (Handle: 552) "AnyDroid_Setup.tmp" wrote 4 bytes to a remote process "C:\Program Files (x86)\AnyDroid\AnyDroid.exe" (Handle: 552) "AnyDroid_Setup.tmp" wrote 8 bytes to a remote process "C:\Program Files (x86)\AnyDroid\AnyDroid.exe" (Handle: 552)30:T7e5,"AnyDroid.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "AnyDroid.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "AnyDroid.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "AnyDroid.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "AnyDroid.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "AnyDroid.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "AnyDroid.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "AnyDroid.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "AnyDroid.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "AnyDroid.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "AnyDroid.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "AnyDroid.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "AnyDroid.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "AnyDroid.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "AnyDroid.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "AnyDroid.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "AnyDroid.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "AnyDroid.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "AnyDroid.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "AnyDroid.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")31:T4a7,"AnyDroid.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "AnyDroid.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "AnyDroid.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "AnyDroid.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "AnyDroid.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "AnyDroid.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "AnyDroid.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "AnyDroid.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "AnyDroid.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "AnyDroid.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "AnyDroid.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "")32:T8fd,"AnyDroid.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "AnyDroid.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "AnyDroid.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "AnyDroid.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "AnyDroid.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "AnyDroid.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "AnyDroid.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "AnyDroid.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "AnyDroid.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "AnyDroid.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "AnyDroid.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "AnyDroid.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "AnyDroid.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "AnyDroid.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "AnyDroid.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "AnyDroid.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "AnyDroid.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "AnyDroid.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "AnyDroid.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "AnyDroid.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")33:Td40,Found malicious artifacts related to "67.225.249.166": ... URL: http://dl.imobie.com/anytrans-ios-it-setup.exe (AV positives: 1/93 scanned on 02/02/2022 07:00:17) URL: http://dl.imobie.com/anytrans-ios-fr-setup.exe (AV positives: 1/93 scanned on 01/26/2022 09:13:50) URL: http://dl.imobie.com/anytrans-ios-ar-setup.exe (AV positives: 1/93 scanned on 01/26/2022 08:38:02) URL: http://dl.imobie.com/anytrans-ios-es-setup.exe (AV positives: 1/93 scanned on 01/23/2022 05:05:29) URL: http://dl.imobie.com/anytrans-ios-jp-setup.exe (AV positives: 1/93 scanned on 01/17/2022 08:00:43) File SHA256: 3c6dad3076e7e7719b968e24a83694f960c9d1a0a63233af4a6baac0b339e36c (AV positives: 1/71 scanned on 01/21/2022 09:59:44) File SHA256: 8b4fc76620a435cb9b25fa9251082643dc150061c8cb89804105200c8cee9cd4 (AV positives: 1/71 scanned on 01/20/2022 04:36:13) File SHA256: 0ba34c77c87e57df46b70b349863f0d439896862409e2697cd9e662c2329ca96 (AV positives: 1/72 scanned on 01/20/2022 05:01:47) File SHA256: 8069a73d6778eb1ffc5dc84e96a11ef1e7ab513ed49e9c9fc912ff6d39d134ac (AV positives: 2/72 scanned on 01/18/2022 02:54:13) File SHA256: 6efefcb62b0dec9953acda59958271e25f232664b86acc587872568457267fc6 (AV positives: 1/72 scanned on 01/17/2022 05:01:31) File SHA256: 81e0cd0c85d811f735b246e6d0ef86ed8a9204a80d0bb5bc9fbfad96d2a81e37 (Date: 12/09/2021 19:35:17) File SHA256: c5bfa6a7f49d3109b6f6dbcf339037eec30e162d8394ab7344a72f9cc667cebf (Date: 11/24/2021 01:07:04) File SHA256: 98ec7efa93e3fb32367f525d1b2c8cedfd0fa8ad88e19a8c2a76bc5e1cd093c2 (Date: 10/28/2021 11:18:34) File SHA256: 3d3e205eac24079308fee7f2893d9df5636c60153c3cdab80d052e721cfebcb3 (Date: 08/21/2021 11:55:52) File SHA256: 1c5673da46b35028fc3d034cca51997e1979b345c0617ca673aa3b3633da64dc (Date: 06/15/2021 21:37:00) Found malicious artifacts related to "172.104.130.191": ... URL: http://dlde.imobie.com/phoneclean-setup.exe (AV positives: 1/70 scanned on 05/22/2019 01:23:03) File SHA256: 81e0cd0c85d811f735b246e6d0ef86ed8a9204a80d0bb5bc9fbfad96d2a81e37 (Date: 12/09/2021 19:35:17) File SHA256: 72603a1880f54de7d1ba82bcfadf6af9a1faeeadaf71ddad86c2f88bd0713529 (AV positives: 1/74 scanned on 07/16/2021 16:08:16) File SHA256: fb94c54414a7c6ed16582bfb7eeea82e0bc708e2a314e91f8540e3c90050d0db (AV positives: 1/76 scanned on 01/08/2021 00:01:13) File SHA256: d21e943401d3fbf81beab8398ed28efd3405afdfb04f98a634155de7dd524b06 (AV positives: 3/67 scanned on 08/12/2019 12:52:39) File SHA256: 4def4c54aea493997cc858303400dfb9b7cd3d781b806592a8932604643f3b2f (AV positives: 12/72 scanned on 07/17/2019 16:59:54) Found malicious artifacts related to "172.104.67.70": ... File SHA256: 31902a1bd10405f04d62cb8bde4cee896ba536081c7c0578860da70b3722d2a9 (AV positives: 1/72 scanned on 01/26/2022 09:10:01) File SHA256: 30696f73f58334955717790a97663fd0858b607457917462d2b0c28d927df4b3 (AV positives: 1/73 scanned on 01/03/2022 05:28:55) File SHA256: bfa17d4e8ed6ab99e196c5a403eb13ddf9af863fb238b12be35fe9fe349ea598 (AV positives: 1/73 scanned on 12/17/2021 12:28:37) File SHA256: 81e0cd0c85d811f735b246e6d0ef86ed8a9204a80d0bb5bc9fbfad96d2a81e37 (Date: 12/09/2021 19:35:17) File SHA256: 3a4763aed0bf292f4fc6414458628fcd262d4d724016471c6c5898b11171af10 (AV positives: 1/70 scanned on 12/06/2021 15:02:30) File SHA256: 27717b095001ea0545bb87294abd735c9e097210a22c5c4f5d4e9775049ae385 (AV positives: 2/68 scanned on 12/05/2021 09:04:57)34:Td40,Found malicious artifacts related to "67.225.249.166": ... URL: http://dl.imobie.com/anytrans-ios-it-setup.exe (AV positives: 1/93 scanned on 02/02/2022 07:00:17) URL: http://dl.imobie.com/anytrans-ios-fr-setup.exe (AV positives: 1/93 scanned on 01/26/2022 09:13:50) URL: http://dl.imobie.com/anytrans-ios-ar-setup.exe (AV positives: 1/93 scanned on 01/26/2022 08:38:02) URL: http://dl.imobie.com/anytrans-ios-es-setup.exe (AV positives: 1/93 scanned on 01/23/2022 05:05:29) URL: http://dl.imobie.com/anytrans-ios-jp-setup.exe (AV positives: 1/93 scanned on 01/17/2022 08:00:43) File SHA256: 3c6dad3076e7e7719b968e24a83694f960c9d1a0a63233af4a6baac0b339e36c (AV positives: 1/71 scanned on 01/21/2022 09:59:44) File SHA256: 8b4fc76620a435cb9b25fa9251082643dc150061c8cb89804105200c8cee9cd4 (AV positives: 1/71 scanned on 01/20/2022 04:36:13) File SHA256: 0ba34c77c87e57df46b70b349863f0d439896862409e2697cd9e662c2329ca96 (AV positives: 1/72 scanned on 01/20/2022 05:01:47) File SHA256: 8069a73d6778eb1ffc5dc84e96a11ef1e7ab513ed49e9c9fc912ff6d39d134ac (AV positives: 2/72 scanned on 01/18/2022 02:54:13) File SHA256: 6efefcb62b0dec9953acda59958271e25f232664b86acc587872568457267fc6 (AV positives: 1/72 scanned on 01/17/2022 05:01:31) File SHA256: 81e0cd0c85d811f735b246e6d0ef86ed8a9204a80d0bb5bc9fbfad96d2a81e37 (Date: 12/09/2021 19:35:17) File SHA256: c5bfa6a7f49d3109b6f6dbcf339037eec30e162d8394ab7344a72f9cc667cebf (Date: 11/24/2021 01:07:04) File SHA256: 98ec7efa93e3fb32367f525d1b2c8cedfd0fa8ad88e19a8c2a76bc5e1cd093c2 (Date: 10/28/2021 11:18:34) File SHA256: 3d3e205eac24079308fee7f2893d9df5636c60153c3cdab80d052e721cfebcb3 (Date: 08/21/2021 11:55:52) File SHA256: 1c5673da46b35028fc3d034cca51997e1979b345c0617ca673aa3b3633da64dc (Date: 06/15/2021 21:37:00) Found malicious artifacts related to "172.104.130.191": ... URL: http://dlde.imobie.com/phoneclean-setup.exe (AV positives: 1/70 scanned on 05/22/2019 01:23:03) File SHA256: 81e0cd0c85d811f735b246e6d0ef86ed8a9204a80d0bb5bc9fbfad96d2a81e37 (Date: 12/09/2021 19:35:17) File SHA256: 72603a1880f54de7d1ba82bcfadf6af9a1faeeadaf71ddad86c2f88bd0713529 (AV positives: 1/74 scanned on 07/16/2021 16:08:16) File SHA256: fb94c54414a7c6ed16582bfb7eeea82e0bc708e2a314e91f8540e3c90050d0db (AV positives: 1/76 scanned on 01/08/2021 00:01:13) File SHA256: d21e943401d3fbf81beab8398ed28efd3405afdfb04f98a634155de7dd524b06 (AV positives: 3/67 scanned on 08/12/2019 12:52:39) File SHA256: 4def4c54aea493997cc858303400dfb9b7cd3d781b806592a8932604643f3b2f (AV positives: 12/72 scanned on 07/17/2019 16:59:54) Found malicious artifacts related to "172.104.67.70": ... File SHA256: 31902a1bd10405f04d62cb8bde4cee896ba536081c7c0578860da70b3722d2a9 (AV positives: 1/72 scanned on 01/26/2022 09:10:01) File SHA256: 30696f73f58334955717790a97663fd0858b607457917462d2b0c28d927df4b3 (AV positives: 1/73 scanned on 01/03/2022 05:28:55) File SHA256: bfa17d4e8ed6ab99e196c5a403eb13ddf9af863fb238b12be35fe9fe349ea598 (AV positives: 1/73 scanned on 12/17/2021 12:28:37) File SHA256: 81e0cd0c85d811f735b246e6d0ef86ed8a9204a80d0bb5bc9fbfad96d2a81e37 (Date: 12/09/2021 19:35:17) File SHA256: 3a4763aed0bf292f4fc6414458628fcd262d4d724016471c6c5898b11171af10 (AV positives: 1/70 scanned on 12/06/2021 15:02:30) File SHA256: 27717b095001ea0545bb87294abd735c9e097210a22c5c4f5d4e9775049ae385 (AV positives: 2/68 scanned on 12/05/2021 09:04:57)35:T6f6,Spawned process "AnyDroid_Setup.exe" (UID: 00000000-00004024) Spawned process "AnyDroid_Setup.tmp" with commandline "/SL5="$30196 61801427 780800 C:\AnyDroid_Setup.exe"" (UID: 00000000-00003824) Spawned process "AnyDroid.exe" (UID: 00000000-00002540) Spawned process "aapt.exe" with commandline "dump badging imobieservice.apk" (UID: 00000000-00001716) Spawned process "BugReport.exe" with commandline "{||IconPath||:||iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAIZSURBVDhPjZJPSFRRFIffLghrUYFD4GxskQnTxohqUYv+ULnQhSaYBBG0alVtkqiQMO59zK5NtAgMillGocMMM2rWiDbVzLzxOWkWmlMkhZqmlfN+nXPfu89RJPrB987l3O8ceHANCsqpSISxKSY3hO/W+4R7qM1HsDVhoiIuNiamz6Zy1yzgxvaExLaE+C/YLVtiIJA0EegVqEwKVU9mu6CzVPqD4dlPuFKIuo5HoM90F+waCCP4XKCqXyBI1Oe6cKvYq4Z/rPxSVefJV1s5TBXN8CwtkKgeED46N0a7UR3vwMVMBNb8Z68LtI9FfZdnjZqUxO6XAjUEV8700ix29FzD5meXsaX7KnbG2jG+OKPuMvNF5TJ7aNYIDUqEBgX2Elx10nOTkBNxnM8+RDB5Hbff96j+Iv0We6EU+7Sgbliibkj4lMchzI9x1L7oQOeHqOqN/5xZ9WnWOJSWOPhK4ADBVefuVB/2k7Rv6A7YyS1Mq37024hyFdQ3jryROPxa+HBWnBJarPtoyt3DpcJjpOYmVN9xHFywH7huWoBnjRP5MI5nBI6+FThG/CuPvqSUw/AMz6qHVJ81cSorcJooLn/3dDfLpd+wFqYgJ5+qe/ZcvIfEnyZ6lo2WRIMl0JDz0Geu62jMSzXjL2BuIoJm28QZW6B5RJCwWvVZQQ67es5foDk3FkbbqMTZgkSrTXjntndS3a31DfwFKVaog7wvXjEAAAAASUVORK5CYII=||,||ProductName||:||AnyDroid||,||Language||:||en-US||,||LogZipName||:||LogZip||,||IsScreenCapture||:false,||ProcessId||:-1,||ContainFolderList||:[{||ParentFolderPath||:||C:\\Users\\16GA7UL\\AppData\\Roaming\\iMobie\\AnyDroid||,||ChildFileName||:[||ErrorLog||]}]}" (UID: 00000000-00000876) Spawned process "WerFault.exe" with commandline "-u -p 2540 -s 2500" (UID: 00000000-00002924) Spawned process "dismhost.exe" with commandline "{B9C925DC-AA94-4998-813F-5D5D5385394F}" (UID: 00000000-00003336)36:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4iI5gAAAAAAAAePjwAAB4iIiOZoAAAAAAAH+PgHAHiIiI5miIAAAAAAB4+PCHB4iIiGaI/wAAAAAAf4+AeHiIiIho///wAAAAAHj48Id4iIiAD/+IgAAAAAB/j4B4eIiIAAB3eIAAAAAAePjwh3d3dwAAiHdwAAAAAH+PgHh/+I7gCI+IgAAAAAB///CHf47md4iI+IAAAAAAf//weHfuZ3iIiI8AAAAAAH//8IeH5meIiIiICIiIAAB///CIiHZ3iIiIgAAAiHAAf//wiIgHd4iIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH9ERERERET4cAAAAAd3dwB/TohmZszE+HAAAAAAf//wf0/ohmZsxPhwAAAAAAd3dw9O/ohmZsT4cAAAAAAAAAB/T+/ohmZk+HAAAAAAAAAAf07+/ohmZPhwAAAAAAAAAH9I7+/ohmT4cAAAAAAAAAB/SI7+/ohk+HAAAAAAAAAAf0iI7+/ohPhwAAAAAAAAAH9ERERERET4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==37:T473,{||IconPath||:||iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAIZSURBVDhPjZJPSFRRFIffLghrUYFD4GxskQnTxohqUYv+ULnQhSaYBBG0alVtkqiQMO59zK5NtAgMillGocMMM2rWiDbVzLzxOWkWmlMkhZqmlfN+nXPfu89RJPrB987l3O8ceHANCsqpSISxKSY3hO/W+4R7qM1HsDVhoiIuNiamz6Zy1yzgxvaExLaE+C/YLVtiIJA0EegVqEwKVU9mu6CzVPqD4dlPuFKIuo5HoM90F+waCCP4XKCqXyBI1Oe6cKvYq4Z/rPxSVefJV1s5TBXN8CwtkKgeED46N0a7UR3vwMVMBNb8Z68LtI9FfZdnjZqUxO6XAjUEV8700ix29FzD5meXsaX7KnbG2jG+OKPuMvNF5TJ7aNYIDUqEBgX2Elx10nOTkBNxnM8+RDB5Hbff96j+Iv0We6EU+7Sgbliibkj4lMchzI9x1L7oQOeHqOqN/5xZ9WnWOJSWOPhK4ADBVefuVB/2k7Rv6A7YyS1Mq37024hyFdQ3jryROPxa+HBWnBJarPtoyt3DpcJjpOYmVN9xHFywH7huWoBnjRP5MI5nBI6+FThG/CuPvqSUw/AMz6qHVJ81cSorcJooLn/3dDfLpd+wFqYgJ5+qe/ZcvIfEnyZ6lo2WRIMl0JDz0Geu62jMSzXjL2BuIoJm28QZW6B5RJCwWvVZQQ67es5foDk3FkbbqMTZgkSrTXjntndS3a31DfwFKVaog7wvXjEAAAAASUVORK5CYII=||,||ProductName||:||AnyDroid||,||Language||:||en-US||,||LogZipName||:||LogZip||,||IsScreenCapture||:false,||ProcessId||:-1,||ContainFolderList||:[{||ParentFolderPath||:||C:\\Users\\16GA7UL\\AppData\\Roaming\\iMobie\\AnyDroid||,||ChildFileName||:[||ErrorLog||]}]}38:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4iI5gAAAAAAAAePjwAAB4iIiOZoAAAAAAAH+PgHAHiIiI5miIAAAAAAB4+PCHB4iIiGaI/wAAAAAAf4+AeHiIiIho///wAAAAAHj48Id4iIiAD/+IgAAAAAB/j4B4eIiIAAB3eIAAAAAAePjwh3d3dwAAiHdwAAAAAH+PgHh/+I7gCI+IgAAAAAB///CHf47md4iI+IAAAAAAf//weHfuZ3iIiI8AAAAAAH//8IeH5meIiIiICIiIAAB///CIiHZ3iIiIgAAAiHAAf//wiIgHd4iIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH9ERERERET4cAAAAAd3dwB/TohmZszE+HAAAAAAf//wf0/ohmZsxPhwAAAAAAd3dw9O/ohmZsT4cAAAAAAAAAB/T+/ohmZk+HAAAAAAAAAAf07+/ohmZPhwAAAAAAAAAH9I7+/ohmT4cAAAAAAAAAB/SI7+/ohk+HAAAAAAAAAAf0iI7+/ohPhwAAAAAAAAAH9ERERERET4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"cb08d87a69ac178d92abdebee9f3e5df2b0261850da853c9535b4d6067f8bce6","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790620045034,"unified_at":"2026-09-28T18:27:25.034Z","metadata":{"hashes":{"sha256":"cb08d87a69ac178d92abdebee9f3e5df2b0261850da853c9535b4d6067f8bce6","sha1":"771629132b34da2754cc9caee1b2d3c4e18b81f3","md5":"f512c6db36d39d213eeb5f5c02a0a7f9","sha512":"1f54523c78b7390a8d6acce85843e07c5f2974e8ef0b2b2ef8c8fc44918c3cedb32448d5a05e8e27a77a5f493c34ad01a4d8580460fc14fed7b54953a861491b","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"AnyDroid_Setup.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":62627703,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1624894315000,"last_seen":1713426943000,"last_multi_scan":1713426943000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["rat","cert:fusioncore","fusioncore","phonzy","tnega"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":0},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":22},"sandbox_signatures":{"informative_count":32,"suspicious_count":21,"malicious_count":9,"total":62},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"malicious","value":"Modifies System Certificates Settings"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/techniques/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/techniques/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Queries volume information of an entire harddrive"}],"sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"suspicious","value":"Queries the display settings of system associated file extensions"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Process deletes itself"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"tactic":"Defense Evasion","technique":"NTFS File Attributes","attack_id":"T1564.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/004","identifiers":[{"type":"malicious","value":"Checks for a resource fork (ADS) file"}],"sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver"}],"sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$25","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"AnyDroid_Setup.tmp\" queries volume information of \"C:\\\" at 00065195-00003288-00000046-13131804","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"AnyDroid_Setup.tmp\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{8C4DAAD0-0A3D-46DA-A884-EF1971E53EDA}_IS1\")\n \"AnyDroid_Setup.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ANYDROID_SETUP.TMP\")\n \"AnyDroid_Setup.tmp\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ANYDROID_SETUP.TMP\")\n \"AnyDroid_Setup.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{8C4DAAD0-0A3D-46DA-A884-EF1971E53EDA}_IS1\")\n \"AnyDroid_Setup.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{8C4DAAD0-0A3D-46DA-A884-EF1971E53EDA}_IS1\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/63 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"AnyDroid_Setup.exe\" created file \"%TEMP%\\is-3PCJL.tmp\\AnyDroid_Setup.tmp\"\n \"AnyDroid_Setup.tmp\" created file \"%TEMP%\\is-3ENNA.tmp\\_isetup\\_setup64.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"\n \"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"\n \"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$26","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"AnyDroid.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at ED540000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$27","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"AnyDroid_Setup.tmp\" (UID: 00065195-00003288) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"AnyDroid_Setup.tmp\" (UID: 00065195-00003288) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"AnyDroid_Setup.tmp\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"AnyDroid_Setup.tmp\" with commandline \"/SL5=\"$3022E\n61801427\n780800\nC:\\AnyDroid_Setup.exe\"\" (UID: 00065195-00003288)\n Spawned process \"AnyDroid.exe\" (UID: 00069971-00003188)\n Spawned process \"AnyDroid.exe\" (UID: 00070002-00003092)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"AnyDroid_Setup.tmp\" with commandline \"/SL5=\"$3022E\n61801427\n780800\nC:\\AnyDroid_Setup.exe\"\" (UID: 00065195-00003288)\n Spawned process \"AnyDroid.exe\" (UID: 00069971-00003188)\n Spawned process \"AnyDroid.exe\" (UID: 00070002-00003092)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"AnyDroid_Setup.exe\" connecting to \"\\ThemeApiPort\"\n \"AnyDroid_Setup.tmp\" connecting to \"\\ThemeApiPort\"\n \"AnyDroid.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$28","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$29","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2a","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"https://www.facebook.com/iMobieFrance\" (Indicator: \"facebook.com\")\n \"https://twitter.com/imobie_france\" (Indicator: \"twitter\")\n \"https://www.youtube.com/c/iMobieFrance\" (Indicator: \"youtube\")\n \"YouTube\" (Indicator: \"youtube\")\n \"http://www.youtube.com/\" (Indicator: \"youtube\")\n \"YouTube\" (Indicator: \"youtube\")\n \"Twitter\" (Indicator: \"twitter\")\n \"Twitter\" (Indicator: \"twitter\")\n \"Twitter\" (Indicator: \"twitter\")\n \"YouTube\" (Indicator: \"youtube\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"AnyDroid_Setup.tmp\" opened \"\\Device\\KsecDD\"\n \"AnyDroid.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"is-7U1H5.tmp\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"is-8FOK9.tmp\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"is-9SC2E.tmp\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"is-VR6EM.tmp\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"is-HG96U.tmp\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"is-89VSQ.tmp\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"is-MUU4F.tmp\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"is-LIKP1.tmp\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"is-H1IT8.tmp\" was detected as \"Microsoft visual C# / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"AnyDroid.exe\" at 00069971-00003188-00000033-2236321\n \"AnyDroid.exe\" at 00070002-00003092-00000033-24500494","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"AnyDroid.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"AnyDroid_Setup.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"AnyDroid.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"AnyDroid.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$2c","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\AnyDroid_Setup.exe\" marked \"%TEMP%\\is-3PCJL.tmp\\AnyDroid_Setup.tmp\" for deletion\n \"C:\\AnyDroid_Setup.exe\" marked \"%TEMP%\\is-3PCJL.tmp\" for deletion\n \"%TEMP%\\is-3PCJL.tmp\\AnyDroid_Setup.tmp\" marked \"C:\\Program Files (x86)\\AnyDroid\\AnyDroid.exe\" for deletion\n \"%TEMP%\\is-3PCJL.tmp\\AnyDroid_Setup.tmp\" marked \"%TEMP%\\is-3ENNA.tmp\\_isetup\\_setup64.tmp\" for deletion\n \"%TEMP%\\is-3PCJL.tmp\\AnyDroid_Setup.tmp\" marked \"%TEMP%\\is-3ENNA.tmp\\_isetup\" for deletion\n \"%TEMP%\\is-3PCJL.tmp\\AnyDroid_Setup.tmp\" marked \"%TEMP%\\is-3ENNA.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2d","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"is-8FOK9.tmp\" claimed CRC 126178 while the actual is CRC 292522\n \"is-OJ8T9.tmp\" claimed CRC 614026 while the actual is CRC 126178\n \"is-2M2A8.tmp\" claimed CRC 77279 while the actual is CRC 614026\n \"is-9SC2E.tmp\" claimed CRC 62802 while the actual is CRC 77279\n \"is-VR6EM.tmp\" claimed CRC 121511 while the actual is CRC 62802\n \"is-HG96U.tmp\" claimed CRC 82094 while the actual is CRC 121511\n \"is-89VSQ.tmp\" claimed CRC 343084 while the actual is CRC 82094\n \"is-VKHPO.tmp\" claimed CRC 1874361 while the actual is CRC 343084\n \"is-MUU4F.tmp\" claimed CRC 250608 while the actual is CRC 1874361\n \"is-8QL2O.tmp\" claimed CRC 69177 while the actual is CRC 250608\n \"is-LIKP1.tmp\" claimed CRC 938341 while the actual is CRC 69177\n \"is-H1IT8.tmp\" claimed CRC 112871 while the actual is CRC 938341","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"IsDebuggerPresent\n UnhandledExceptionFilter\n GetProcAddress\n GetModuleHandleW\n TerminateProcess\n Sleep\n LoadLibraryW\n GetTickCount\n GetDriveTypeW\n GetFileAttributesA\n GetDriveTypeA\n GetFileAttributesW\n WriteFile\n OutputDebugStringW\n OutputDebugStringA\n GetModuleFileNameW\n GetModuleFileNameA\n CreateThread\n ExitThread\n GetVersionExW\n VirtualProtect\n LoadLibraryA\n CreateDirectoryA\n DeleteFileA\n GetStartupInfoW\n CreateDirectoryW\n DeleteFileW\n FindFirstFileExA\n FindNextFileW\n FindNextFileA\n FindFirstFileExW\n CreateFileW\n CreateFileA\n GetCommandLineW\n GetCommandLineA\n GetModuleHandleA\n CreateProcessA\n SleepEx\n CreateProcessW\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2e","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"AnyDroid_Setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"AnyDroid_Setup.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"AnyDroid.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"AnyDroid_Setup.tmp\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\Applications\\AnyDroid.exe\"\n \"AnyDroid_Setup.tmp\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$2f","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"Bolonyokte\" classified file \"all.bstring\" as \"rat\" based on indicators: \"login,en ligne,Power\" (Author: Jean-Philippe Teissier / @Jipe_)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"AnyDroid_Setup.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"AnyDroid_Setup.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"AnyDroid_Setup.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"AnyDroid_Setup.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"AnyDroid.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"AnyDroid.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"aapt.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"BugReport.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 3, Severity: 3) categorized as \"Unknown Traffic\"\n Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 3, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$31","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"AnyDroid.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"crt.usertrust.com\"\n \"dl.imobie.com\"\n \"dlde.imobie.com\"\n \"dljp.imobie.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"67.225.249.166:443\"\n \"91.199.212.52:80\"\n \"172.217.4.78:443\"\n \"67.225.249.166:80\"\n \"172.104.130.191:80\"\n \"172.104.67.70:80\"\n \"172.104.130.191:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /USERTrustRSAAddTrustCA.crt HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crt.usertrust.com\"\n \"GET /module/ HTTP/1.1\nHost: dl.imobie.com\nConnection: Keep-Alive\"\n \"GET /module/ HTTP/1.1\nHost: dlde.imobie.com\nConnection: Keep-Alive\"\n \"GET /module/ HTTP/1.1\nHost: dljp.imobie.com\nConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"BugReport.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 610D0000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"AnyDroid.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"BugReport.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"AnyDroid.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"BugReport.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Process deletes itself","description":"\"%PROGRAMFILES%\\AnyDroid\\AnyDroid.exe\" deletes itself","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-27","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"vboxvideo.inf\" (Indicator: \"vbox\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"AnyDroid.exe\" read file \"%APPDATA%\\iMobie\\AnyDroid\\Backup\\Config.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 67.225.249.166 on port 443 is sent without HTTP header\n TCP traffic to 91.199.212.52 on port 80 is sent without HTTP header\n TCP traffic to 172.217.4.78 on port 443 is sent without HTTP header\n TCP traffic to 67.225.249.166 on port 80 is sent without HTTP header\n TCP traffic to 172.104.130.191 on port 80 is sent without HTTP header\n TCP traffic to 172.104.67.70 on port 80 is sent without HTTP header\n TCP traffic to 172.104.130.191 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"aapt.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"aapt.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSAPPCOMPAT\")","origin":"Registry Access","mitre_attack_id":"T1021.001","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$32","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"AnyDroid.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"AnyDroid.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"BugReport.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"BugReport.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"AnyDroid.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"BugReport.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"AnyDroid.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"AnyDroid.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"2/66 Antivirus vendors marked dropped file \"is-T37IK.tmp\" as malicious (classified as \"Trojan.Shelma.Win64\" with 3% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$33","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$34","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"\"AnyDroid.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4\"; Key: \"BLOB\")\n \"AnyDroid.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\"; Key: \"AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4\")\n \"AnyDroid.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\D1EB23A46D17D68FD92564C2F1F1601764D8E349\"; Key: \"BLOB\")\n \"AnyDroid.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\"; Key: \"D1EB23A46D17D68FD92564C2F1F1601764D8E349\")\n \"AnyDroid.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\"; Key: \"BLOB\")\n \"AnyDroid.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"AnyDroid.exe\" checked file \"C:\"","origin":"API Call","mitre_attack_id":"T1564.004","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$35","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]}]},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":19,"imported_dlls_count":191,"dropped_files_count":0,"extracted_files_count":39,"files_written_count":139,"files_deleted_count":0,"registry_keys_created_count":7,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":7,"dns_resolutions_count":4,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["rat","cert:fusioncore","fusioncore","phonzy","tnega"],"sample_flags":["Multi-Process","Extracted Files","Network Traffic","Sample Crashed"],"sandbox_reports":[{"id":"61fa7985cd284236de593be9","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["GBR","USA"],"submit_name":"AnyDroid_Setup.exe","analysis_start_time":"2022-02-02T12:31:29+00:00","indicators_count":{"informative":30,"suspicious":32,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"60d9eb69c4d97e3bd261a48d","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":80,"submit_name":"AnyDroid_Setup.exe","analysis_start_time":"2021-06-28T15:47:22+00:00","indicators_count":{"informative":20,"suspicious":21,"malicious":3},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"67.225.249.166","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"address":"91.199.212.52","port":80,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"address":"172.217.4.78","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"address":"67.225.249.166","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"address":"172.104.130.191","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"address":"172.104.67.70","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"address":"172.104.130.191","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]}],"dns_resolutions":[{"domain":"crt.usertrust.com","address":"91.199.212.52","ttl":891,"country":"United Kingdom","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Comodo Group, Inc.","registrar_name_servers":"NS0.COMODODNS.COM","registrar_creation_date":"1997-12-05T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"domain":"dl.imobie.com","address":"67.225.249.166","ttl":3600,"country":"United States","registrar_name":"ENOM, INC.","registrar_organization":"IMOBIE INC.","registrar_name_servers":"DNS1.REGISTRAR-SERVERS.COM","registrar_creation_date":"2011-12-03T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"domain":"dlde.imobie.com","address":"172.104.130.191","ttl":3600,"country":"United States","registrar_name":"ENOM, INC.","registrar_organization":"IMOBIE INC.","registrar_name_servers":"DNS1.REGISTRAR-SERVERS.COM","registrar_creation_date":"2011-12-03T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"domain":"dljp.imobie.com","address":"172.104.67.70","ttl":3600,"country":"United States","registrar_name":"ENOM, INC.","registrar_organization":"IMOBIE INC.","registrar_name_servers":"DNS1.REGISTRAR-SERVERS.COM","registrar_creation_date":"2011-12-03T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]}],"http_requests":[{"host":"crt.usertrust.com","host_ip":"91.199.212.52:80","url":"/USERTrustRSAAddTrustCA.crt","method":"GET","header":"GET /USERTrustRSAAddTrustCA.crt HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crt.usertrust.com","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"host":"dl.imobie.com","host_ip":"67.225.249.166:80","url":"/module/","method":"GET","header":"GET /module/ HTTP/1.1\nHost: dl.imobie.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}],"processes":[{"pid":4024,"ppid":0,"name":"AnyDroid_Setup.exe","command_line":"","sha256":"cb08d87a69ac178d92abdebee9f3e5df2b0261850da853c9535b4d6067f8bce6","normalized_path":"C:\\AnyDroid_Setup.exe","uid":"00000000-00004024","icon":"$36"},{"pid":3824,"ppid":4024,"name":"AnyDroid_Setup.tmp","command_line":"/SL5=\"$30196,61801427,780800,C:\\AnyDroid_Setup.exe\"","sha256":"259cfa7d164baf595c058d08695549083fcb1619202d7f6989961b189af80bfe","normalized_path":"%TEMP%\\is-S19NJ.tmp\\AnyDroid_Setup.tmp","parent_uid":"00000000-00004024","uid":"00000000-00003824"},{"pid":2540,"ppid":3824,"name":"AnyDroid.exe","command_line":"","sha256":"e2e106e66ce009485a8f92eef949147e693b2d5a2b16a9f91020631beb6331e9","normalized_path":"%PROGRAMFILES%\\AnyDroid\\AnyDroid.exe","parent_uid":"00000000-00003824","uid":"00000000-00002540"},{"pid":1716,"ppid":2540,"name":"aapt.exe","command_line":"dump badging imobieservice.apk","sha256":"2aa146fcbdef0752114ea7d2fbcfa0c0e81add39e822ea36f17a93040f5c66a4","normalized_path":"%PROGRAMFILES%\\AnyDroid\\aapt.exe","parent_uid":"00000000-00002540","uid":"00000000-00001716"},{"pid":876,"ppid":2540,"name":"BugReport.exe","command_line":"$37","sha256":"5c2d88246a0ee287cceb679ac1d53077108b87429438df19fb792a4fd728fbae","normalized_path":"%PROGRAMFILES%\\AnyDroid\\BugReport.exe","parent_uid":"00000000-00002540","uid":"00000000-00000876"},{"pid":2924,"ppid":2540,"name":"WerFault.exe","command_line":"-u -p 2540 -s 2500","sha256":"08bace187a0225e10677de9aa6738a7118be3e5cad6dc45fb8d3366a61bb343c","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002540","uid":"00000000-00002924"},{"pid":3336,"ppid":0,"name":"dismhost.exe","command_line":"{B9C925DC-AA94-4998-813F-5D5D5385394F}","sha256":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11","normalized_path":"%WINDIR%\\TEMP\\D682C076-DE45-495E-9E33-BA8A4DEC745A\\dismhost.exe","uid":"00000000-00003336","icon":"$38"}],"all_imported_dlls":["oleaut32.dll","wkscli.dll","imm32.dll","apphelp.dll","comctl32.dll","ncrypt.dll","slc.dll","kernel32.dll","msvcrt.dll","sspicli.dll","version.dll","msctf.dll","tzres.dll","winsta.dll","imageres.dll","ntdll.dll","user32.dll","wow64win.dll","profapi.dll","Wldap32.dll","ntshrui.dll","DWrite.dll","clrjit.dll","lpk.dll","netmsg.dll","sfc.dll","sfc_os.dll","nlssorting.dll","rpcss.dll","System.Core.ni.dll","rpcrt4.dll","cryptbase.dll","ole32.dll","wow64cpu.dll","bcrypt.dll","propsys.dll","clr.dll","webio.dll","msasn1.dll","cscapi.dll","tiptsf.dll","wpfgfx_v0400.dll","vcruntime140_clr0400.dll","winhttp.dll","shfolder.dll","dui70.dll","WindowsBase.ni.dll","msvcp140_clr0400.dll","api-ms-win-core-xstate-l2-1-0.dll","PresentationFramework.Aero.ni.dll","RpcRtRemote.dll","srvcli.dll","ws2_32.dll","bcryptprimitives.dll","cfgmgr32.dll","devobj.dll","devrtl.dll","System.Drawing.ni.dll","System.Windows.Forms.ni.dll","sechost.dll","usp10.dll","nsi.dll","wtsapi32.dll","ExplorerFrame.dll","System.ni.dll","wow64.dll","KernelBase.dll","mpr.dll","duser.dll","VxSSL64.dll","mscoreei.dll","mscorrc.dll","psapi.dll","api-ms-win-core-synch-l1-2-0.dll","uxtheme.dll","comdlg32.dll","mscoree.dll","PresentationNative_v0400.dll","PresentationCore.ni.dll","netutils.dll","setupapi.dll","PresentationFramework.ni.dll","dwmapi.dll","RstrtMgr.dll","ntmarta.dll","mscorlib.ni.dll","System.Xaml.ni.dll","System.Configuration.ni.dll","System.Xml.ni.dll","ucrtbase_clr0400.dll","shlwapi.dll","netapi32.dll","shell32.dll","clbcatq.dll","linkinfo.dll","advapi32.dll","cryptsp.dll","rsaenh.dll","gdi32.dll","wintrust.dll","AirTrafficHost.dll","dbghelp.dll","WindowsCodecs.dll","powrprof.dll","oleaccrc.dll","wininet.dll","log4net.dll","wdscore.dll","SSShim.dll","DismCorePS.dll","CloudModernUI.dll","dhcpcsvc.dll","LogProvider.dll","cabinet.dll","PresentationFramework-SystemXml.ni.dll","credssp.dll","userenv.dll","AdCommLibrary.dll","UIAutomationTypes.dll","DrUpdate.dll","wbemsvc.dll","System.Numerics.dll","fastprox.dll","wshqos.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","SensApi.dll","FWPUCLNT.DLL","Newtonsoft.Json.dll","GdiPlus.dll","System.Data.dll","UIAutomationProvider.dll","System.Data.SQLite.DLL","System.Data.ni.dll","iMobieConnector.dll","CbsCore.dll","ARUsbLibrary.dll","DllRegSvrLibrary.dll","api-ms-win-downlevel-version-l1-1-0.dll","crypt32.dll","mscorsecimpl.dll","imagehlp.dll","winnsi.dll","dhcpcsvc6.dll","d3d8thk.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","normaliz.dll","OSProvider.dll","winmm.dll","drvstore.dll","iMobiePodLib.dll","msctfui.dll","WMINet_Utils.dll","oleacc.dll","wbemprox.dll","SPInf.dll","rtutils.dll","riched20.dll","diasymreader.dll","AdHttpCommLibrary.dll","rasapi32.dll","iTunesMobileDevice.dll","api-ms-win-downlevel-user32-l1-1-0.dll","cryptnet.dll","urlmon.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","WSHTCPIP.DLL","DismProv.dll","iMobieHelper.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","CloudManagerment.dll","wbemcomn.dll","System.Management.ni.dll","rasman.dll","d3d9.dll","wmiutils.dll","System.Runtime.Serialization.dll","rasadhlp.dll","DmiProvider.dll","CommonModelLibrary.dll","mswsock.dll","IPHLPAPI.DLL","UIAutomationCore.dll","wship6.dll","dnsapi.dll","schannel.dll","HttpLib.dll","iertutil.dll","secur32.dll","gpapi.dll","ntdsapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"AnyDroid .lnk","sha256":"c6368df5c910f414ae5492bf6b3cb74bf62390bf57f71dc54fa7187509cf6728","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"is-ATBN4.tmp","sha256":"c147c177226effc653ad447e917f6c30cb278f0a63b392aebf8c23d10549c42c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"name":"is-CNODS.tmp","sha256":"ea9e2a196b6f8c8f5203ba48dbde1df1e8fbc5ee29245ee38531a93d745981f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"name":"is-A9HJK.tmp","sha256":"7f4a6b3f3796b83b045aa30e959949ae4e93382006862438ede0961967d8e554","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"name":"is-ETEKG.tmp","sha256":"522736ac04baef564a0395a17c85ec4e02355a5117aafa1ae096f99f768347e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"name":"is-6OBRO.tmp","sha256":"d657627e4b1b0c027af2d88f52691d96646a62a2e0ded0638cf2b5d4679f7a43","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"name":"is-SKECK.tmp","sha256":"9ffacd225ce10c7805121bb8478fc5bcd3d0d3303efcc9089c5f5d5800540214","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"name":"is-59B2N.tmp","sha256":"30577cb94ffee04ed9a8c13ecca7e2edaf1cfc8d3da0e64424fa0d2baa6e3706","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"name":"is-KKADQ.tmp","sha256":"3741f223523afdb2e114107d3e9edc42ce71453fc6dd439aeb63bb62a6186df6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"name":"is-11A0D.tmp","sha256":"531586521be9f4799f19ecf68926625acd813035f891a787370ad8ad610b4ed8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"name":"is-29VEH.tmp","sha256":"aeeab766575727d064f73eb1fe19fcffa11b533da26d2669d3232bc49ad1c0ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"name":"is-70M8D.tmp","sha256":"a78c449547e691502209798b4f6b59d796749da73ce3918ba0d0003d25de2cb4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"name":"is-I3E11.tmp","sha256":"2c8d549229b4e02ed3f8fc0ca7e897a136ab90848d549d65608506a6541f5731","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"name":"is-5EBHI.tmp","sha256":"19875c46ca4ed493e4b6a91aa3409dfad589fdd5578de644b4e7055a1f3a90f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"name":"is-832O1.tmp","sha256":"52e8e8daecc9a02958c5afb5819c72525623e310e5cdca186adb66135f5c0985","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"name":"is-CU1UN.tmp","sha256":"112089c93b11c5d5e8a55b504241b589baaa003908ddd1f2e4a8031cdf961c61","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"name":"is-PCN4N.tmp","sha256":"6b45c7530a0e0633e8b618472659186e3dbcf6dfbbf8a602a78c2022a01e4488","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"name":"is-3R898.tmp","sha256":"d1d47190dd5604a09490ce195e0b5050ef115348ad4a2b6294fcd922fcca3381","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"name":"is-4NM31.tmp","sha256":"9b9b8d8b939543cac985d5f2b42f49f3005cda407d5ee8f566ae164e69216670","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"name":"is-4PNDM.tmp","sha256":"87271c07b695f94a6ad37602b9f1ad5f4f86b59c63545dcf1cf0d288b144fb2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"name":"is-T37IK.tmp","sha256":"5ec9447486e9c2dfe7a5576a1dd4619dde02da541142009eca5b666c50df6a7f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"dismhost.exe.61FA7D9F.bin","sha256":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"is-G216N.tmp","sha256":"55962c5d46fd9f91bb545cd7ae9ad59db10e179aca8c9bf22d253003deed2bae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"is-JUOL7.tmp","sha256":"8a7786d355c8699c532db373847a57959ff0b33a926730c5b98c925661b7fe25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"is-9C5UR.tmp","sha256":"9b1be4e67db23c6f39cb5700e859dbe5584af7cd829e18c831c87f155afbab58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"is-IDB83.tmp","sha256":"e98eb5ab63d735178fff2a6bd58cb44017872951d457b1bc5e832294e693b41e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"is-C3VCV.tmp","sha256":"57939d04c7053de627842f33d1c379c2b01e5ab0508bc82515564fa832c2e2e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"is-ODF9U.tmp","sha256":"39012016b0a147db6ed6e5536457365cf0fe6a301892290d0305d12ef16f9932","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"is-1QR9Q.tmp","sha256":"5d7feba414d2714e8428e715c09289309a8c98b25393ee35d9e2e1c7a5b67459","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"Tar2558.tmp","sha256":"bdd5111162a6fa25682e18fa74e37e676d49cafcb5b7207e98e5256d1ef0d003","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"is-R0NLD.tmp","sha256":"16915c98ed61a98de9351bc95085e0b336ff51bae1df2e0a69cfee4f9ff4e9eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"is-3ILON.tmp","sha256":"87271c07b695f94a6ad37602b9f1ad5f4f86b59c63545dcf1cf0d288b144fb2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"77EC63BDA74BD0D0E0426DC8F8008506","sha256":"879de8836ef2882454c763232bf825091393f779390972751f7aa60aa49bc0e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"is-MGJM0.tmp","sha256":"a78c449547e691502209798b4f6b59d796749da73ce3918ba0d0003d25de2cb4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"log_system.log","sha256":"a7731afc72c7da05f776d657a083bef344259a3c168996e31f3d329c3b0cf632","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"378B079587A9184B2E2AB859CB263F40_524AD1B9B08D3C6450727265AE77B7D2","sha256":"72e8507b4364ab1a82daa26b9cfb9be117717704eadf9ee39048b52dfa9083cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"7D11549FC90445E1CE90F96A21958A17_254BB73C3A26934C45BDA84CCD61C16D","sha256":"6cb471816e39b5f36583d96c7046da10718129c530479cb41dbb56c61a7450dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"is-K5308.tmp","sha256":"792037bf8654590af0f0c807aff883820d06effd9c7146dc24e0fa6ec55b10a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"anydroid-config-win_c.plist","sha256":"eb94e6c026e7f0c0df7e8316b8d5bec6bd0a8cd58014b1044cc73e3748d0b6d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\AnyDroid.exe.config","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\AnyDroid.exe","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\4beb1eeca20b27d4bd1bb9880f03cc2a\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\5ee35debfc22f727e70e4479ddcbc045\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\syswow64\\en\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\SysWOW64\\netmsg.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\comctl32.dll.mui","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Presentatio1c9175f8#\\ee2116004e04b90716386df97999feed\\PresentationFramework.Aero.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\iMobieHelper.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\log4net.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\CommonModelLibrary.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%LOCALAPPDATA%\\Programs","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%LOCALAPPDATA%\\Programs\\Common","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%USERPROFILE%\\Saved Games","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\SysWOW64\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\AdCommLibrary.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\iMobieUpdate.exe","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\iTunesMobileDevice.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\ja-JP\\iMobiePodLib.resources.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\zlib.net.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\adb.exe","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\AdbWinApi.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\AirTrafficHost.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\HttpLib.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\ICSharpCode.SharpZipLib.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\iMobieHEIFHelper.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\DllRegSvrLibrary.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\InboundRules.exe","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\zh-CN\\iMobiePodLib.resources.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\Interop.PortableDeviceApiLib.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\LzfseLibray.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\InstallDriveHelp.exe","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\msvcp100d.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\opencv_world330.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\DPInst32.exe","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\DriverInstall.exe","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\SendMail.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\IBackupLibrary.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\MediaInfo.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\msvcr100d.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\7z.exe","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\OperationSystemVersionLib.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\System.Data.SQLite.DLL","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\VideoDownload.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\aapt.exe","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\AdHttpCommLibrary.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\msvcr100.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\opencv_ffmpeg330_64.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\PBKDF2Library.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\QRCoder.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\websocket-sharp.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\7z.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\AdbWinUsbApi.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\ffmpeg.static.exe","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\iMobiePodLib.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\VEntryMain.exe","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\BugReport.exe","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\en-US\\iMobiePodLib.resources.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\msvcp100.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\SqliteDAO.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\zlib1.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\UpdateHelper.exe","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\CloudManagerment.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\CloudModernUI.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\DeviceRecoverDLL.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\Google.ProtocolBuffers.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\iMobieDownloader.exe","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\DownloadHelp.exe","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\DPInst_x64.exe","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\iMobieAnalyze.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\Ionic.Zlib.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\Newtonsoft.Json.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\ARUsbLibrary.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\icu.net.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\iMobieConnector.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\iOS9iCloud.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\Microsoft.Expression.Drawing.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\AdDriver.exe","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\NamePipe.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\temp","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\unins000.dat","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"C:\\AnyDroid_Setup.exe","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%TEMP%\\is-3PCJL.tmp\\AnyDroid_Setup.tmp","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\en-US","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\htmltemp\\bookmark\\img","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\htmltemp\\message\\img","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\Language","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\Language\\English","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\Language\\Español","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\Language\\Français","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\Language\\العربية","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\Language\\日本語","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\zh-CN","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001f.db","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\SysWOW64\\shell32.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\syswow64\\en\\SHELL32.dll.mui","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\AnyDroid .lnk","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\assembly\\pubpol201.dat","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\ec5e61c1f67279c3ebe8bd1160c680a7\\PresentationFramework.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\40bd456a59a4969ec46e7d7fef6b5e32\\WindowsBase.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\0d59b0e237d7519417de10cd84bda4e7\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\PresentationCore\\2e48700efecd23d15226baaa35a854bb\\PresentationCore.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\0212deecd5dfa435c6588fd68900ab8c\\System.Xaml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\htmltemp","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\htmltemp\\bookmark","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\htmltemp\\message","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\ja-JP","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)\\AnyDroid\\Language\\Deutsch","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"%PROGRAMFILES%\\(x86)","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\DIRECT3D\\MOSTRECENTAPPLICATION\\","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E96E-E325-11CE-BFC1-08002BE10318}\\0002\\","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"60d9eb69c4d97e3bd261a48d"},{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"Local\\__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"Local\\__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"\\BaseNamedObjects\\Global\\WdsSetupLogInit","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"\\BaseNamedObjects\\Global\\SetupLog","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]},{"name":"\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"61fa7985cd284236de593be9"}]}]}},"report_ids":{"sandbox_job_ids":["61fa7985cd284236de593be9","60d9eb69c4d97e3bd261a48d"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample cb08d87a69ac… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample cb08d87a69ac…. Threat score 100/100. 0/0 AV engines flagged this file. 9 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/cb08d87a69ac178d92abdebee9f3e5df2b0261850da853c9535b4d6067f8bce6"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample cb08d87a69ac… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample cb08d87a69ac…. Threat score 100/100. 0/0 AV engines flagged this file. 9 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/cb08d87a69ac178d92abdebee9f3e5df2b0261850da853c9535b4d6067f8bce6"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample cb08d87a69ac… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample cb08d87a69ac…. Threat score 100/100. 0/0 AV engines flagged this file. 9 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L39","11",{}]]