Malware analysis iOS Andrew LPro A12+.rar Malicious activity

Add for printing

File name:	iOS Andrew LPro A12+.rar
Full analysis:	https://app.any.run/tasks/a381fbd6-e8be-4378-b97c-86fed9ae6672
Verdict:	Malicious activity
Analysis date:	November 02, 2024, 17:30:15
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	arch-exec
Indicators:
MIME:	application/x-rar
File info:	RAR archive data, v5
MD5:	AEEDB08B05BB65F3C5B287D711F6B8DD
SHA1:	48BE878875A66CB05C72A154C871B94B03B39AB0
SHA256:	784024A2500F455AB3EE8CBA1548DB3CF26D946C450754871132E4046A0758DE
SSDEEP:	98304:SdXzcHJHYoDZwcqpDKql404TwL3+b4CqEN70BXeZTCmAQCDSofMrKjmewFCBEOih:E7MQ4uQOExu2MYLgzMaoF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Generic archive extractor
  - WinRAR.exe (PID: 6704)
SUSPICIOUS
- Executable content was dropped or overwritten
  - iOS Andrew LPro A12+ V2.1.exe (PID: 6392)
  - iBypass LPro A12+.exe (PID: 7356)
- Process drops legitimate windows executable
  - iOS Andrew LPro A12+ V2.1.exe (PID: 6392)
- Executes as Windows Service
  - VSSVC.exe (PID: 4080)
INFO
- Manual execution by a user
  - iOS Andrew LPro A12+ V2.1.exe (PID: 7104)
  - iOS Andrew LPro A12+ V2.1.exe (PID: 6392)
  - msedge.exe (PID: 7884)
- Executable content was dropped or overwritten
  - WinRAR.exe (PID: 6704)
  - msiexec.exe (PID: 6176)
  - msiexec.exe (PID: 7144)
- Application launched itself
  - msedge.exe (PID: 7644)
  - msedge.exe (PID: 7884)
- Manages system restore points
  - SrTasks.exe (PID: 5956)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.rar	\|	RAR compressed archive (v5.0) (61.5)
.rar	\|	RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion:	RAR v5
CompressedSize:	10960309
UncompressedSize:	15320937
OperatingSystem:	Win32
ArchivedFileName:	iOS Andrew LPro A12+/iOS Andrew LPro A12+ V2.1.exe

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

183

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

1884

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6164 --field-trial-handle=2436,i,12115822795142731490,5963696887590261490,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Microsoft Edge

Exit code:

Version:

122.0.2365.59

2376

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4296 --field-trial-handle=2436,i,12115822795142731490,5963696887590261490,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Microsoft Edge

Exit code:

Version:

122.0.2365.59

2816

C:\Windows\syswow64\MsiExec.exe -Embedding 546E3203ED8B2D609E2C978B7F67ACCA

C:\Windows\SysWOW64\msiexec.exe

—

msiexec.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows® installer

Exit code:

Version:

5.0.19041.3636 (WinBuild.160101.0800)

3568

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --no-appcompat-clear --mojo-platform-channel-handle=5252 --field-trial-handle=2436,i,12115822795142731490,5963696887590261490,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Microsoft Edge

Version:

122.0.2365.59

4080

C:\WINDOWS\system32\vssvc.exe

C:\Windows\System32\VSSVC.exe

—

services.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Microsoft® Volume Shadow Copy Service

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

5240

C:\Windows\syswow64\MsiExec.exe -Embedding 678B4E6B48ABE25CCB4F5F3B12D15342 C

C:\Windows\SysWOW64\msiexec.exe

—

msiexec.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows® installer

Exit code:

Version:

5.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll

5476

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2480 --field-trial-handle=2436,i,12115822795142731490,5963696887590261490,262144 --variations-seed-version /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft Edge

Version:

122.0.2365.59

5736

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4020 --field-trial-handle=2436,i,12115822795142731490,5963696887590261490,262144 --variations-seed-version /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Microsoft Edge

Version:

122.0.2365.59

5956

C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11

C:\Windows\System32\SrTasks.exe

—

msiexec.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Microsoft® Windows System Protection background tasks.

Version:

10.0.19041.1 (WinBuild.160101.0800)

6164

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6360 --field-trial-handle=2436,i,12115822795142731490,5963696887590261490,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Microsoft Edge

Exit code:

Version:

122.0.2365.59

Add for printing

Total events

3 576

Read events

3 532

Write events

Delete events

Modification events


(PID) Process:	(6704) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	1
Value: C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:	(6704) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	0
Value: C:\Users\admin\AppData\Local\Temp\iOS Andrew LPro A12+.rar
(PID) Process:	(6704) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	name
Value: 120
(PID) Process:	(6704) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	size
Value: 80
(PID) Process:	(6704) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	type
Value: 120
(PID) Process:	(6704) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	mtime
Value: 100
(PID) Process:	(6176) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\TypeLib
Operation:	write	Name:	Version
Value: 1.1
(PID) Process:	(6176) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\TypeLib
Operation:	write	Name:	Version
Value: 1.1
(PID) Process:	(6176) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Volatile\00\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{03022430-ABC4-11D0-BDE2-00AA001A1953}\TypeLib
Operation:	write	Name:	Version
Value: 1.1
(PID) Process:	(6176) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Volatile\00\MACHINE\SOFTWARE\Classes\Interface\{03022430-ABC4-11D0-BDE2-00AA001A1953}\TypeLib
Operation:	write	Name:	Version
Value: 1.1

Add for printing

Executable files

Suspicious files

135

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
6392	iOS Andrew LPro A12+ V2.1.exe	C:\Users\admin\AppData\Roaming\iBypass LPro A12+\iBypass LPro A12+ V2.1 2.1.0\install\holder0.aiph		—
		MD5:—	SHA256:—
6392	iOS Andrew LPro A12+ V2.1.exe	C:\Users\admin\AppData\Local\Temp\MSIA18.tmp		executable
		MD5:B27A994E40BEE85C14D3227EA91696A9	SHA256:EBF432E9B8068E139E85E2C26A1D67238B3C6071158CD43F4926029BA187C190
6392	iOS Andrew LPro A12+ V2.1.exe	C:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_6392\insticon		image
		MD5:66C842AF0B4FC1C918F531D2E1087B82	SHA256:48278165490487EE414BE65E20501B19A65EDAF1B6F473EB7D8C55023175EC88
6392	iOS Andrew LPro A12+ V2.1.exe	C:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_6392\info		image
		MD5:554FF4C199562515D758C9ABFF5C2943	SHA256:9AE4A96BF2A349667E844ACC1E2AC4F89361A6182268438F4D063DF3A6FC47BC
6392	iOS Andrew LPro A12+ V2.1.exe	C:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_6392\dialog.jpg		image
		MD5:D1880A8297F8F1FF8CB4EE2DC1058A17	SHA256:893454CC12EB3B298CF50E5915F890C86A314FCE41CA3062C524EBB83349161F
6392	iOS Andrew LPro A12+ V2.1.exe	C:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_6392\exclamic		image
		MD5:3DBA38E7A6085876E79F162F9985618C	SHA256:593F94EF1405422B3E453F4422B22C990D84303668D60344C6FD257318E92428
6392	iOS Andrew LPro A12+ V2.1.exe	C:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_6392\removico		image
		MD5:20D25E871A244B94574C47726DE745D6	SHA256:88DD7EE9FA22ECDBDC6B3D47DB83BC3D72360AEB43588E6A9A008B224389CB1C
6392	iOS Andrew LPro A12+ V2.1.exe	C:\Users\admin\AppData\Local\Temp\MSI9B9.tmp		executable
		MD5:BDA991D64E27606AC1D3ABB659A0B33B	SHA256:FFEA8222126B77F8DA93E27EDBADEB8B97FB023EF0D6A51522C35688F66283CA
6392	iOS Andrew LPro A12+ V2.1.exe	C:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_6392\New		image
		MD5:C23CBF002D82192481B61ED7EC0890F4	SHA256:4F92E804A11453382EBFF7FB0958879BAE88FE3366306911DEC9D811CD306EED
6392	iOS Andrew LPro A12+ V2.1.exe	C:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_6392\custicon		image
		MD5:3EAEBDADE778394F06B29659C9C01ED7	SHA256:719E644C31D0CC6B891F6A1253655DFBA39A3B78E06D24817BE1D8492B172B48

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
6944	svchost.exe	GET	200	23.48.23.173:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
6944	svchost.exe	GET	200	69.192.161.161:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
624	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
6336	SIHClient.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted
6336	SIHClient.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted
—	—	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
5036	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
6944	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
5488	MoUsoCoreWorker.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
3396	RUXIMICS.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4360	SearchApp.exe	92.123.104.40:443	www.bing.com	Akamai International B.V.	DE	whitelisted
—	—	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
6944	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
6944	svchost.exe	23.48.23.173:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
6944	svchost.exe	69.192.161.161:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	20.73.194.208 4.231.128.59 51.104.136.2	whitelisted
www.bing.com	92.123.104.40 92.123.104.59 92.123.104.38 92.123.104.67 92.123.104.63 92.123.104.64 92.123.104.7 92.123.104.47 92.123.104.51 104.126.37.185 104.126.37.186 104.126.37.162 104.126.37.161 104.126.37.153 104.126.37.171 104.126.37.144 104.126.37.169 104.126.37.123	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
google.com	142.250.185.174	whitelisted
crl.microsoft.com	23.48.23.173 23.48.23.180 23.48.23.177 23.48.23.159 23.48.23.145 23.48.23.194	whitelisted
www.microsoft.com	69.192.161.161 184.30.21.171	whitelisted
login.live.com	40.126.31.69 20.190.159.71 20.190.159.2 20.190.159.73 40.126.31.67 40.126.31.71 20.190.159.0 40.126.31.73	whitelisted
th.bing.com	92.123.104.47 92.123.104.62 92.123.104.34 92.123.104.32 92.123.104.33 92.123.104.53 92.123.104.60 92.123.104.49 92.123.104.46	whitelisted
go.microsoft.com	69.192.162.125	whitelisted
slscr.update.microsoft.com	4.245.163.56	whitelisted

Threats

PID	Process	Class	Message
—	—	Misc activity	ET INFO File Sharing Related Domain in DNS Lookup (mega .nz)
—	—	Misc activity	ET INFO File Sharing Related Domain in DNS Lookup (mega .nz)
—	—	Misc activity	ET INFO File Sharing Domain Observed in TLS SNI (mega .nz)
—	—	Misc activity	ET INFO Observed DNS Query to Filesharing Service (mega .co .nz)
—	—	Misc activity	ET INFO Observed DNS Query to Filesharing Service (mega .co .nz)
—	—	Misc activity	ET INFO File Sharing Domain Observed in TLS SNI (mega .nz)
—	—	Misc activity	ET INFO File Sharing Related Domain in DNS Lookup (mega .nz)
—	—	Misc activity	ET INFO File Sharing Related Domain in DNS Lookup (mega .nz)
—	—	Misc activity	ET INFO File Sharing Domain Observed in TLS SNI (mega .nz)
—	—	Misc activity	ET INFO Observed DNS Query to Filesharing Service (mega .co .nz)

Add for printing

No debug info

General Info

iOS Andrew LPro A12+.rar

AEEDB08B05BB65F3C5B287D711F6B8DD

48BE878875A66CB05C72A154C871B94B03B39AB0

784024A2500F455AB3EE8CBA1548DB3CF26D946C450754871132E4046A0758DE

98304:SdXzcHJHYoDZwcqpDKql404TwL3+b4CqEN70BXeZTCmAQCDSofMrKjmewFCBEOih:E7MQ4uQOExu2MYLgzMaoF

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Generic archive extractor

SUSPICIOUS

Executable content was dropped or overwritten

Process drops legitimate windows executable

Executes as Windows Service

INFO

Manual execution by a user

Executable content was dropped or overwritten

Application launched itself

Manages system restore points

Malware configuration

Static information

TRiD

EXIF

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Modules

Information

Modules

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings