Edit tour

Windows Analysis Report
AnyDesk.exe

Overview

General Information

Sample Name:	AnyDesk.exe
Analysis ID:	1276407
MD5:	30c9c57aa570088d745fac7bfd05b805
SHA1:	d579d18848859614e219afa6332d410e0ca71fc3
SHA256:	8cd552392bb25546ba58e73d63c4b7c290188ca1060f96c8abf641ae9f5a8383
Infos:

Detection

Score:	51
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Queries information about the installed CPU (vendor, model number etc)

AV process strings found (often used to terminate AV products)

PE file does not import any functions

Sample file is different than original file name gathered from version info

OS version to string mapping found (often used in BOTs)

Detected TCP or UDP traffic on non-standard ports

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Classification

Process Tree

System is w10x64

AnyDesk.exe (PID: 7048 cmdline: C:\Users\user\Desktop\AnyDesk.exe MD5: 30C9C57AA570088D745FAC7BFD05B805)

AnyDesk.exe (PID: 7128 cmdline: "C:\Users\user\Desktop\AnyDesk.exe" --local-service MD5: 30C9C57AA570088D745FAC7BFD05B805)

AnyDesk.exe (PID: 7140 cmdline: "C:\Users\user\Desktop\AnyDesk.exe" --local-control MD5: 30C9C57AA570088D745FAC7BFD05B805)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: AnyDesk.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 185.229.191.44:443 -> 192.168.2.3:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 57.128.101.75:443 -> 192.168.2.3:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 37.59.29.33:443 -> 192.168.2.3:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.229.191.44:443 -> 192.168.2.3:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 37.59.29.33:443 -> 192.168.2.3:49710 version: TLS 1.2

Source: AnyDesk.exe

Static PE information: certificate valid

Source: AnyDesk.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dda-64\privacy_feature\privacy_feature.pdb source: AnyDesk.exe, 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000001.00000002.755433322.0000000000D66000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm-32\win_dwm\win_dwm.pdb source: AnyDesk.exe, 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000001.00000002.755433322.0000000000D66000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_loader\AnyDesk.pdb source: AnyDesk.exe, 00000000.00000002.755691145.0000000000E8F000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000001.00000000.365095933.0000000000E8F000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm-64\win_dwm\win_dwm.pdb source: AnyDesk.exe, 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000001.00000002.755433322.0000000000D66000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dda-32\privacy_feature\privacy_feature.pdb source: AnyDesk.exe, 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000001.00000002.755433322.0000000000D66000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: SAS.pdbR source: AnyDesk.exe, 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000001.00000002.755433322.0000000000D66000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: SAS.pdb source: AnyDesk.exe, 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000001.00000002.755433322.0000000000D66000.00000004.00000001.01000000.00000003.sdmp

Source: Joe Sandbox View

JA3 fingerprint: c91bde19008eefabce276152ccd51457

Source: Joe Sandbox View	IP Address: 185.229.191.44 185.229.191.44
Source: Joe Sandbox View	IP Address: 92.223.88.41 92.223.88.41

Source: global traffic	TCP traffic: 192.168.2.3:49700 -> 185.229.191.44:6568
Source: global traffic	TCP traffic: 192.168.2.3:49703 -> 185.229.191.41:6568
Source: global traffic	TCP traffic: 192.168.2.3:49712 -> 92.223.88.41:6568

Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.759685998.0000000003EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ad.share.fbook.href=https://www.facebook.com/sharer/sharer.php?u=https%3A//anydesk.com/ equals www.facebook.com (Facebook)
Source: AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: ad.share.linkedin.href=https://www.linkedin.com/shareArticle?mini=true&url=https%3A//anydesk.com/&title=Try%20AnyDesk%20Remote%20Desktop&summary=AnyDesk%20is%20a%20small%20and%20quick%20solution%20for%20screen%20sharing%20and%20remote%20collaboration.%20Get%20it%20here%3A%20https%3A//anydesk.com/&source= equals www.linkedin.com (Linkedin)
Source: AnyDesk.exe, 00000000.00000003.364200992.0000000003A8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: hare.linkedin.href=https://www.linkedin.com/shareArticle?mini=true&url=https%3A//anydesk.com/&title=Try%20AnyDesk%20Remote%20Desktop&summary=AnyDesk%20is%20a%20small%20and%20quick%20solution%20for%20screen%20sharing%20and%20remote%20collaboration.%20Get%20it%20here%3A%20https%3A//anydesk.com/&source=io equals www.linkedin.com (Linkedin)
Source: AnyDesk.exe, 00000000.00000002.759685998.0000000003EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.facebook.comp= equals www.facebook.com (Facebook)
Source: AnyDesk.exe, 00000000.00000002.759685998.0000000003EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.linkedin.coma equals www.linkedin.com (Linkedin)

Source: AnyDesk.exe, 00000000.00000003.364602002.00000000041B1000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.759917352.00000000041A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.ado/1b
Source: AnyDesk.exe, 00000000.00000003.364602002.00000000041B1000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.759917352.00000000041A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.c/gb
Source: AnyDesk.exe, 00000000.00000003.364602002.00000000041B1000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.759917352.00000000041A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.cobjb
Source: AnyDesk.exe, 00000002.00000002.754889290.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://support.anydesk.com
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.opengl.org/registry/
Source: AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.openssl.org/)
Source: AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlEC_PRIVATEKEYpublicKeyparametersprivateKeyECPKPARAMETERSvalue
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://anydesk.com
Source: AnyDesk.exe, 00000002.00000002.754889290.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://anydesk.com/
Source: AnyDesk.exe, 00000000.00000003.364184145.0000000003F0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/0
Source: AnyDesk.exe, 00000000.00000003.363883259.0000000003AAE000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.363815806.0000000003AA7000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.364018466.0000000003AAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/:t
Source: AnyDesk.exe, 00000002.00000003.371872603.0000000003545000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000002.00000003.371906397.0000000003558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/c
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://anydesk.com/company#imprint
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://anydesk.com/contact/sales
Source: AnyDesk.exe, 00000002.00000002.754889290.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://anydesk.com/contact/sales)
Source: AnyDesk.exe, 00000000.00000003.364184145.0000000003F0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/fil16
Source: AnyDesk.exe, 00000000.00000003.364184145.0000000003F0F000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.759685998.0000000003EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/le.u6
Source: AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://anydesk.com/order
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://anydesk.com/pricing/teams
Source: AnyDesk.exe, 00000002.00000002.754889290.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://anydesk.com/pricing/teams)
Source: AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://anydesk.com/privacy
Source: AnyDesk.exe, 00000000.00000002.759685998.0000000003EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/privacyt
Source: AnyDesk.exe, 00000002.00000003.371872603.0000000003545000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000002.00000003.371906397.0000000003558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/s0
Source: AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://anydesk.com/terms
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://anydesk.com/update
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://boot-01.net.anydesk.com
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000002.00000002.754889290.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://boot.net.anydesk.comabcdefABCDEFtruefalsetfInvalid
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://console-ui.myanydesk2.on.anydesk.com
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1524/
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1526/
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1914/
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com
Source: AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/
Source: AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/$
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/HelpLinkInstallLocationAnyDesk
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/access
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/backup-alias
Source: AnyDesk.exe, 00000000.00000002.758902921.00000000039D0000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.758205845.000000000188B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/en/share
Source: AnyDesk.exe, 00000000.00000002.758902921.00000000039D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/en/shareBD
Source: AnyDesk.exe, 00000000.00000002.758902921.00000000039D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/en/shareBn
Source: AnyDesk.exe, 00000000.00000002.758902921.00000000039D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/en/shareOC
Source: AnyDesk.exe, 00000000.00000002.758205845.000000000188B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/en/shareV
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/it/abuse
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/it/android
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/it/android-battery
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/lt/abuse
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/lt/android
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/lt/android-battery
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/share
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/wol
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://my.anydesk.com
Source: AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://my.anydesk.com/password-generator.
Source: AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://my.anydesk.com/v2
Source: AnyDesk.exe, 00000000.00000002.759685998.0000000003EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.com/v2e
Source: AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://order.anydesk.com/trial
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://policies.google.com/privacy
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.759685998.0000000003EB0000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://policies.google.com/privacy?hl=$
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://policies.google.com/privacy?hl=it
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.anydesk.com/
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.anydesk.com/AnyDesk_on_macOS
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/account-migration
Source: AnyDesk.exe, 00000000.00000002.759685998.0000000003EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/account-migration.
Source: AnyDesk.exe, 00000000.00000002.759685998.0000000003EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/account-migrationF
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/anydesk-account
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.364281396.0000000003AA1000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/anydesk-for-android-chromeos#troubleshooting
Source: AnyDesk.exe, 00000000.00000002.759685998.0000000003EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/anydesk-for-android-chromeos#troubleshooting3
Source: AnyDesk.exe, 00000000.00000003.364281396.0000000003AA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/anydesk-for-android-chromeos#troubleshootingX
Source: AnyDesk.exe, 00000000.00000002.758902921.00000000039D0000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/my-anydesk-ii#user-management
Source: AnyDesk.exe, 00000000.00000002.758902921.00000000039D0000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/users
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://twitter.com/home?status=Do%20you%20know%20%23AnyDesk?%20AnyDesk%20is%20a%20small%20and%20qui
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html
Source: AnyDesk.exe, 00000000.00000002.758902921.00000000039D0000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/intl/$
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/intl/it/chrome/privacy/eula_text.html
Source: AnyDesk.exe, 00000000.00000003.364200992.0000000003A8B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.linkedin.com/shareArticle?mini=true&url=https%3A//anydesk.com/&title=Try%20AnyDesk%20Rem
Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.nayuki.io/page/qr-code-generator-library

Source: unknown

DNS traffic detected: queries for: boot.net.anydesk.com

Source: unknown	HTTPS traffic detected: 185.229.191.44:443 -> 192.168.2.3:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 57.128.101.75:443 -> 192.168.2.3:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 37.59.29.33:443 -> 192.168.2.3:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.229.191.44:443 -> 192.168.2.3:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 37.59.29.33:443 -> 192.168.2.3:49710 version: TLS 1.2

Source: AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: DirectDrawCreateEx

Source: AnyDesk.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: AnyDesk.exe

Static PE information: No import functions for PE file found

Source: AnyDesk.exe, 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesas.dllj% vs AnyDesk.exe
Source: AnyDesk.exe, 00000001.00000002.755433322.0000000000D66000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesas.dllj% vs AnyDesk.exe

Source: C:\Users\user\Desktop\AnyDesk.exe

File read: C:\Users\user\Desktop\AnyDesk.exe

Jump to behavior

Source: AnyDesk.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\AnyDesk.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\AnyDesk.exe C:\Users\user\Desktop\AnyDesk.exe
Source: C:\Users\user\Desktop\AnyDesk.exe	Process created: C:\Users\user\Desktop\AnyDesk.exe "C:\Users\user\Desktop\AnyDesk.exe" --local-service
Source: C:\Users\user\Desktop\AnyDesk.exe	Process created: C:\Users\user\Desktop\AnyDesk.exe "C:\Users\user\Desktop\AnyDesk.exe" --local-control
Source: C:\Users\user\Desktop\AnyDesk.exe	Process created: C:\Users\user\Desktop\AnyDesk.exe "C:\Users\user\Desktop\AnyDesk.exe" --local-service	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Process created: C:\Users\user\Desktop\AnyDesk.exe "C:\Users\user\Desktop\AnyDesk.exe" --local-control	Jump to behavior

Source: C:\Users\user\Desktop\AnyDesk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2155fee3-2419-4373-b102-6843707eb41f}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM Win32_Processor

Source: C:\Users\user\Desktop\AnyDesk.exe

File created: C:\Users\user\AppData\Roaming\AnyDesk

Jump to behavior

Source: classification engine

Classification label: mal51.evad.winEXE@5/6@16/5

Source: C:\Users\user\Desktop\AnyDesk.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_7048_1475807621_0_mtx
Source: C:\Users\user\Desktop\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_7140_1507849321_1_mtx
Source: C:\Users\user\Desktop\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Session\1\ad_connect_queue_7128_1504493331_mtx
Source: C:\Users\user\Desktop\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_7140_1507849321_0_mtx
Source: C:\Users\user\Desktop\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_7048_1475807621_1_mtx
Source: C:\Users\user\Desktop\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_7113_lsystem_mtx
Source: C:\Users\user\Desktop\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_trace_mtx

Source: C:\Users\user\Desktop\AnyDesk.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\AnyDesk.exe

Window found: window name: SysTabControl32

Jump to behavior

Source: AnyDesk.exe

Static file information: File size 4040776 > 1048576

Source: AnyDesk.exe

Static PE information: certificate valid

Source: AnyDesk.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x3ce200

Source: AnyDesk.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: AnyDesk.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dda-64\privacy_feature\privacy_feature.pdb source: AnyDesk.exe, 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000001.00000002.755433322.0000000000D66000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm-32\win_dwm\win_dwm.pdb source: AnyDesk.exe, 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000001.00000002.755433322.0000000000D66000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_loader\AnyDesk.pdb source: AnyDesk.exe, 00000000.00000002.755691145.0000000000E8F000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000001.00000000.365095933.0000000000E8F000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm-64\win_dwm\win_dwm.pdb source: AnyDesk.exe, 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000001.00000002.755433322.0000000000D66000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dda-32\privacy_feature\privacy_feature.pdb source: AnyDesk.exe, 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000001.00000002.755433322.0000000000D66000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: SAS.pdbR source: AnyDesk.exe, 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000001.00000002.755433322.0000000000D66000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: SAS.pdb source: AnyDesk.exe, 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000001.00000002.755433322.0000000000D66000.00000004.00000001.01000000.00000003.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\AnyDesk.exe	Unpacked PE file: 0.2.AnyDesk.exe.1e0000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\AnyDesk.exe	Unpacked PE file: 1.2.AnyDesk.exe.1e0000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\AnyDesk.exe	Unpacked PE file: 2.2.AnyDesk.exe.1e0000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Source: C:\Users\user\Desktop\AnyDesk.exe	Code function: 0_2_007BC415 push ecx; ret		0_2_007BC428
Source: C:\Users\user\Desktop\AnyDesk.exe	Code function: 0_2_007BC415 push ecx; ret		0_2_007BC428

Source: C:\Users\user\Desktop\AnyDesk.exe

Code function: 0_2_007CA6C7 LoadLibraryW,GetProcAddress,GetProcAddress,RtlEncodePointer,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

0_2_007CA6C7

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\AnyDesk.exe

File opened: C:\Users\user\Desktop\AnyDesk.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\AnyDesk.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Users\user\Desktop\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_PhysicalMemory

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Users\user\Desktop\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_PhysicalMemory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter = TRUE

Source: C:\Users\user\Desktop\AnyDesk.exe TID: 7152	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe TID: 7148	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe TID: 7136	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe TID: 7152	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe TID: 5900	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe TID: 5868	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe TID: 5508	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe TID: 5900	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe TID: 5924	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM Win32_Processor

Source: C:\Users\user\Desktop\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_BaseBoard

Source: C:\Users\user\Desktop\AnyDesk.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: AnyDesk.exe, 00000001.00000002.758251917.00000000016AB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll")

Source: C:\Users\user\Desktop\AnyDesk.exe

Code function: 0_2_007C38F9 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_007C38F9

Source: C:\Users\user\Desktop\AnyDesk.exe

0_2_007CA6C7

Source: C:\Users\user\Desktop\AnyDesk.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\AnyDesk.exe	Code function: 0_2_007C38F9 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_007C38F9
Source: C:\Users\user\Desktop\AnyDesk.exe	Code function: 0_2_007C38F9 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_007C38F9
Source: C:\Users\user\Desktop\AnyDesk.exe	Code function: 0_2_007BAAED _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_007BAAED
Source: C:\Users\user\Desktop\AnyDesk.exe	Code function: 0_2_007BAAED _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_007BAAED

Source: C:\Users\user\Desktop\AnyDesk.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\AnyDesk.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\AnyDesk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\AnyDesk.exe

Code function: 0_2_00654B20 _vswprintf_s,WaitForSingleObject,OutputDebugStringA,_strncmp,_strncmp,_strncpy,_strncpy,GetSystemTime,TlsGetValue,__itow,GetCurrentThreadId,GetCurrentProcessId,__snprintf,SetFilePointer,SetFilePointer,ReadFile,_memmove,SetFilePointer,WriteFile,SetFilePointer,SetEndOfFile,WriteFile,RtlEnterCriticalSection,RaiseException,

0_2_00654B20

Source: AnyDesk.exe, 00000000.00000002.758205845.00000000017DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\192.168.2.1\all\procexp.exe
Source: AnyDesk.exe, 00000000.00000002.758205845.00000000017DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "c:\users\user\desktop\procexp.exe

Source: AnyDesk.exe, 00000001.00000002.755538856.0000000000E11000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: b44b97caebbcaac9745bd6b5822bd03ee298d6bfrelease/win_7.1.xcc0bc82657f3409854116e83c8d7018c
Source: AnyDesk.exe, 00000001.00000002.758205363.00000000013FB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: release/win_7.1.x
Source: AnyDesk.exe, 00000001.00000000.365095933.0000000000E8F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: .itext.text.customcc0bc82657f3409854116e83c8d7018crelease/win_7.1.xb44b97caebbcaac9745bd6b5822bd03ee298d6bf
Source: AnyDesk.exe, 00000001.00000002.758205363.00000000013FB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: b44b97caebbcaac9745bd6b5822bd03ee298d6bfrelease/win_7.1.xcc0bc82657f3409854116e83c8d7018c`

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	421 Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	1 Input Capture	1 System Time Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	431 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	331 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Process Injection	NTDS	331 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Software Packing	DCSync	134 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AnyDesk.exe	0%	ReversingLabs
AnyDesk.exe	0%	Virustotal		Browse

Source	Detection	Scanner	Label
http://ns.adobe.c/gb	0%	Avira URL Cloud	safe
http://ns.adobe.cobjb	0%	Avira URL Cloud	safe
https://boot.net.anydesk.comabcdefABCDEFtruefalsetfInvalid	0%	Avira URL Cloud	safe
http://ns.ado/1b	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
boot.net.anydesk.com	185.229.191.44	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://support.anydesk.com/knowledge/users	AnyDesk.exe, 00000000.00000002.758902921.00000000039D0000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://support.anydesk.com/	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://order.anydesk.com/trial	AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://anydesk.com/update	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.google.com/chrome/privacy/eula_text.html	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.google.com/intl/$	AnyDesk.exe, 00000000.00000002.758902921.00000000039D0000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
http://ns.adobe.cobjb	AnyDesk.exe, 00000000.00000003.364602002.00000000041B1000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.759917352.00000000041A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anydesk.com/le.u6	AnyDesk.exe, 00000000.00000003.364184145.0000000003F0F000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.759685998.0000000003EB0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.anydesk.com/lt/abuse	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://help.anydesk.com/lt/android-battery	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://my.anydesk.com	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://help.anydesk.com/it/abuse	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://help.anydesk.com/it/android-battery	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://twitter.com/home?status=Do%20you%20know%20%23AnyDesk?%20AnyDesk%20is%20a%20small%20and%20qui	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://support.anydesk.com/knowledge/my-anydesk-ii#user-management	AnyDesk.exe, 00000000.00000002.758902921.00000000039D0000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://anydesk.com/c	AnyDesk.exe, 00000002.00000003.371872603.0000000003545000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000002.00000003.371906397.0000000003558000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ns.adobe.c/gb	AnyDesk.exe, 00000000.00000003.364602002.00000000041B1000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.759917352.00000000041A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://anydesk.com/	AnyDesk.exe, 00000002.00000002.754889290.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://anydesk.com/privacy	AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://datatracker.ietf.org/ipr/1526/	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.nayuki.io/page/qr-code-generator-library	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://policies.google.com/privacy?hl=it	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://policies.google.com/privacy?hl=$	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.759685998.0000000003EB0000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://help.anydesk.com	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://support.anydesk.com/AnyDesk_on_macOS	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://support.anydesk.com/knowledge/anydesk-for-android-chromeos#troubleshootingX	AnyDesk.exe, 00000000.00000003.364281396.0000000003AA1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://anydesk.com/pricing/teams	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://anydesk.com/0	AnyDesk.exe, 00000000.00000003.364184145.0000000003F0F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://datatracker.ietf.org/ipr/1914/	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://anydesk.com/s0	AnyDesk.exe, 00000002.00000003.371872603.0000000003545000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000002.00000003.371906397.0000000003558000.00000004.00000020.00020000.00000000.sdmp	false		high
https://anydesk.com/terms	AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://help.anydesk.com/en/shareBD	AnyDesk.exe, 00000000.00000002.758902921.00000000039D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.anydesk.com/knowledge/account-migration	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://help.anydesk.com/en/shareV	AnyDesk.exe, 00000000.00000002.758205845.000000000188B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/intl/it/chrome/privacy/eula_text.html	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://anydesk.com/order	AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://help.anydesk.com/backup-alias	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://help.anydesk.com/en/share	AnyDesk.exe, 00000000.00000002.758902921.00000000039D0000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.758205845.000000000188B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://anydesk.com/contact/sales	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://help.anydesk.com/it/android	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://my.anydesk.com/password-generator.	AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://help.anydesk.com/	AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://anydesk.com	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://my.anydesk.com/v2e	AnyDesk.exe, 00000000.00000002.759685998.0000000003EB0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.anydesk.com/en/shareOC	AnyDesk.exe, 00000000.00000002.758902921.00000000039D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://anydesk.com/fil16	AnyDesk.exe, 00000000.00000003.364184145.0000000003F0F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.anydesk.com/knowledge/anydesk-for-android-chromeos#troubleshooting	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.364281396.0000000003AA1000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.opengl.org/registry/	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://anydesk.com/contact/sales)	AnyDesk.exe, 00000002.00000002.754889290.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://help.anydesk.com/lt/android	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://help.anydesk.com/wol	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://anydesk.com/:t	AnyDesk.exe, 00000000.00000003.363883259.0000000003AAE000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.363815806.0000000003AA7000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.364018466.0000000003AAF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.anydesk.com/$	AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://anydesk.com/privacyt	AnyDesk.exe, 00000000.00000002.759685998.0000000003EB0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.anydesk.com/knowledge/account-migrationF	AnyDesk.exe, 00000000.00000002.759685998.0000000003EB0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.anydesk.com/en/shareBn	AnyDesk.exe, 00000000.00000002.758902921.00000000039D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.linkedin.com/shareArticle?mini=true&url=https%3A//anydesk.com/&title=Try%20AnyDesk%20Rem	AnyDesk.exe, 00000000.00000003.364200992.0000000003A8B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://console-ui.myanydesk2.on.anydesk.com	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
http://support.anydesk.com	AnyDesk.exe, 00000002.00000002.754889290.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://help.anydesk.com/HelpLinkInstallLocationAnyDesk	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://boot-01.net.anydesk.com	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
http://ns.ado/1b	AnyDesk.exe, 00000000.00000003.364602002.00000000041B1000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.759917352.00000000041A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://datatracker.ietf.org/ipr/1524/	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://my.anydesk.com/v2	AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://policies.google.com/privacy	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://anydesk.com/company#imprint	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.openssl.org/)	AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://anydesk.com/pricing/teams)	AnyDesk.exe, 00000002.00000002.754889290.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://support.anydesk.com/knowledge/account-migration.	AnyDesk.exe, 00000000.00000002.759685998.0000000003EB0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.anydesk.com/access	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.openssl.org/support/faq.htmlEC_PRIVATEKEYpublicKeyparametersprivateKeyECPKPARAMETERSvalue	AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://support.anydesk.com/knowledge/anydesk-for-android-chromeos#troubleshooting3	AnyDesk.exe, 00000000.00000002.759685998.0000000003EB0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.anydesk.com/share	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://boot.net.anydesk.comabcdefABCDEFtruefalsetfInvalid	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000002.00000002.754889290.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/anydesk-account	AnyDesk.exe, 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.360721835.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000001.00000002.754897787.000000000085E000.00000002.00000001.01000000.00000003.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.229.191.44	boot.net.anydesk.com	Czech Republic	60068	CDN77GB	false
92.223.88.41	unknown	Austria	199524	GCOREAT	false
57.128.101.75	unknown	Belgium	2686	ATGS-MMD-ASUS	false
37.59.29.33	unknown	France	16276	OVHFR	false
185.229.191.41	unknown	Czech Republic	60068	CDN77GB	false

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1276407
Start date and time:	2023-07-20 04:20:42 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	AnyDesk.exe
Detection:	MAL
Classification:	mal51.evad.winEXE@5/6@16/5
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.229.191.44	AnyDesk.exe	Get hash	malicious	Unknown	Browse
	AnyDesk-CM.msi	Get hash	malicious	Unknown	Browse
	AnyDesk (2).exe	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Unknown	Browse
	https://anydesk.com/en/downloads/windows?dv=win_exe	Get hash	malicious	Unknown	Browse
	AnyDesk(1).msi	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Unknown	Browse
	Microsoft.exe	Get hash	malicious	Unknown	Browse
	http://anydesk.com	Get hash	malicious	Unknown	Browse
	https://ms94.yolasite.com/	Get hash	malicious	Unknown	Browse
92.223.88.41	AnyDesk.exe	Get hash	malicious	Unknown	Browse
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse
	Microsoft.exe	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Unknown	Browse
	1.msi	Get hash	malicious	Unknown	Browse
	sJ9Q8UWMAX.exe	Get hash	malicious	CryptOne, Mofksys	Browse
	AnyDesk (5).exe	Get hash	malicious	Unknown	Browse
	AnyDesk (4).exe	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Vidar	Browse
	AnyDesk (1).exe	Get hash	malicious	Unknown	Browse
	Vostel-Anydesk.EXE	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
boot.net.anydesk.com	AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.39
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	49.12.130.236
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse	92.223.88.232
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.41
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.39
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	49.12.130.236
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.44
	92f25a21-b9c1-4aee-af3e-cacf098605e9	Get hash	malicious	Unknown	Browse	185.229.191.41
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	49.12.130.236
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	49.12.130.235
	https://anydesk.com/en/downloads/windows?dv=win_exe	Get hash	malicious	Unknown	Browse	49.12.130.237
	migrate.120.exe	Get hash	malicious	DCRat, EICAR	Browse	49.12.130.235
	AnyDesk.msi	Get hash	malicious	Unknown	Browse	185.229.191.39
	AnyDesk(1).msi	Get hash	malicious	Unknown	Browse	185.229.191.44
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.44
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.41
	AnyDesk261022.exe	Get hash	malicious	Unknown	Browse	49.12.130.237
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	49.12.130.237
	SuspectFile.exe	Get hash	malicious	Unknown	Browse	213.239.219.11

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CDN77GB	https://www.bing.com/ck/a?!&&p=0168e371e1d600fbJmltdHM9MTY4OTcyNDgwMCZpZ3VpZD0yMzgxM2JjNC01MmVkLTYzZmQtMjBkYy0yODk2NTNlZDYyZjQmaW5zaWQ9NTMxNw&ptn=3&hsh=3&fclid=23813bc4-52ed-63fd-20dc-289653ed62f4&u=a1aHR0cHM6Ly93d3cuaGFtZGFyZC5pbi9idXNpbmVzc2VzL2xlYWRlcnNoaXAtdGVhbS8#bWV0aG9kZGV2ZWxvcG1lbnRAY2VyLmdvdi5hdQ==	Get hash	malicious	Unknown	Browse	89.187.165.194
	http://www.avbuyermail.com/jetnet/index.php?bid=cad7g1xe&mid=dc879o4ekqefa&url=//t161726162696e64612e67686f736840687363706f6c792e636f6d.inovateus.pk%2fposh%2f161726162696e64612e67686f736840687363706f6c792e636f6d------%2f31064%2fORdT%2fYXJhYmluZGEuZ2hvc2hAaHNjcG9seS5jb20=	Get hash	malicious	Unknown	Browse	89.187.165.194
	http://www.avbuyermail.com/jetnet/index.php?bid=cad7g1xe&mid=dc879o4ekqefa&url=//t161726162696e64612e67686f736840687363706f6c792e636f6d.inovateus.pk%2fposh%2f161726162696e64612e67686f736840687363706f6c792e636f6d------%2f31064%2fORdT%2fYXJhYmluZGEuZ2hvc2hAaHNjcG9seS5jb20=	Get hash	malicious	Unknown	Browse	89.187.165.194
	https://clickproxy.retailrocket.net/?url=https://jqv8npwUr.sebastianstern.com/?register=enVyYXNraWpAc2NobmVpZGVyLmNvbQ==	Get hash	malicious	Unknown	Browse	89.187.165.194
	https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs//https://hongkongblong.com/new/auth/atgqop/dGhvbWFzLmNhdWxmaWVsZEBnbG9iYWxmb3VuZHJpZXMuY29t	Get hash	malicious	Unknown	Browse	89.187.165.194
	http://www.avbuyermail.com/jetnet/index.php?bid=cad7g1xe&mid=dc879o4ekqefa&url=//t86a72757373656c6c406d7269676c6f62616c2e6f7267%2Einovateus%2Epk%2fposh%2f86a72757373656c6c406d7269676c6f62616c2e6f7267------%2f17641%2fTaXU%2fanJ1c3NlbGxAbXJpZ2xvYmFsLm9yZw==	Get hash	malicious	Unknown	Browse	89.187.165.194
	https://clickproxy.retailrocket.net/?url=http://4Q22cvJ3N.sayxd.com/?register=Y3JhaWcud3VybW5lc3RAdHdpbm1yby5jb20=	Get hash	malicious	Unknown	Browse	89.187.165.194
	https://apiservices.krxd.net/click_tracker/track?kxconfid=whjxbtb0h&kxcampaignid=P.C.C-Class.W206.L.MI&kxplacementid=module2findmycar&kxbrand=MB&clk=https%3A%2F%2Fferrarijournal.com%2Fnew%2Fauth%2FDPPi%2F%2F%2F%2FYW5kcmV3Lmxvb3NsZXlAYXNwZW5sZWFmZW5lcmd5LmNvbQ==	Get hash	malicious	Unknown	Browse	89.187.165.194
	https://clickproxy.retailrocket.net/?url=https://e89HbBihr.creativecraftsanddesigns.com/?register=d2dpbGxAYXJyb3djb250YWluZXIuY29t	Get hash	malicious	Unknown	Browse	89.187.165.194
	https://www.bing.com/ck/a?!&&p=e5c0418b8999194aJmltdHM9MTY4OTcyNDgwMCZpZ3VpZD0wMjVmMTM4Zi03NGNmLTYxMDMtMzVjMi0wMDkzNzUyOTYwOTYmaW5zaWQ9NTQ1MQ&ptn=3&hsh=3&fclid=025f138f-74cf-6103-35c2-009375296096&u=a1aHR0cHM6Ly9jb252ZXJzaW9uZXN5cHJvY2Vzb3MuY29tLw#bG9hbnNAYXZlc3RhcmN1LmNvbQ==	Get hash	malicious	Unknown	Browse	89.187.165.194
	https://clickproxy.retailrocket.net/?url=https://V9w3vLczJ.creativecraftsanddesigns.com/?register=ZHRjZ3JvdXBAc2NobmVpZGVyLmNvbQ==	Get hash	malicious	Unknown	Browse	89.187.165.194
	http://104.21.26.138	Get hash	malicious	Unknown	Browse	89.187.165.194
	Income Statement for you.htm	Get hash	malicious	Unknown	Browse	89.187.165.194
	https://clickproxy.retailrocket.net/?url=https://SG0mfyWOk.samuelpittman.com/?register=aGVtbWluZ2thQHBlbGxhLmNvbQ==	Get hash	malicious	Unknown	Browse	89.187.165.194
	https://clickproxy.retailrocket.net/?url=https://iQT4pi0x1.samuelpittman.com/?register=a3dpbGxlckBwZWxsYS5jb20=	Get hash	malicious	Unknown	Browse	89.187.165.194
	https://simplebooklet.com/caferiva	Get hash	malicious	Unknown	Browse	89.187.165.194
	ATT00001.htm	Get hash	malicious	Unknown	Browse	89.187.165.194
	https://clickproxy.retailrocket.net/?url=https://LGQA4lPh9.affchoice.sa.com/LGQA4lPh9/cnlha2l3Y2h1a0BnbG0uY2E=	Get hash	malicious	Unknown	Browse	89.187.165.194
	https://api.spently.com/api/spently/click?id=105133&store=hotelcollection&type=OI&cid=6272440696998&url=http://t54mlu.ishveda.com/ZGFuZS5hZGVyaG9sdEBhdXRvbWF0aW9uYW55d2hlcmUuY29t	Get hash	malicious	Unknown	Browse	89.187.165.194
GCOREAT	AnyDesk.exe	Get hash	malicious	Unknown	Browse	92.223.88.41
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse	92.223.88.41
	http://reg.ru	Get hash	malicious	Unknown	Browse	92.223.124.62
	x86.elf	Get hash	malicious	Mirai	Browse	185.101.139.100
	http://britobarros.com.de/	Get hash	malicious	Unknown	Browse	92.38.169.194
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	92.223.88.232
	https://hacktotherescue.org/register	Get hash	malicious	Unknown	Browse	92.223.124.62
	https://hacktotherescue.org/register	Get hash	malicious	Unknown	Browse	92.223.124.62
	https://hacktotherescue.org/register	Get hash	malicious	Unknown	Browse	92.223.124.62
	KD_MEDICAL_POLSKA_23053371.exe	Get hash	malicious	FormBook, GuLoader	Browse	92.38.150.138
	s4YvlK74zJ.exe	Get hash	malicious	FormBook, GuLoader	Browse	92.38.150.138
	AnyDesk-CM.msi	Get hash	malicious	Unknown	Browse	92.223.88.7
	mirai.x86	Get hash	malicious	Mirai	Browse	92.38.169.68
	jWo6k2nNpZ.elf	Get hash	malicious	Mirai	Browse	92.38.145.194
	z1Mb_NFEmitida1.msi	Get hash	malicious	Unknown	Browse	5.188.0.116
	TCKOnNwV84.elf	Get hash	malicious	Mirai, Moobot	Browse	92.223.113.37
	uTvMn3UZ4D.elf	Get hash	malicious	Mirai	Browse	5.188.4.199
	BIHBXRSIVW.rCJ.dll	Get hash	malicious	Unknown	Browse	92.38.169.234
	http://jumeirahdubai.ru	Get hash	malicious	Unknown	Browse	92.223.124.62
	RGL5ljMc4b.elf	Get hash	malicious	Mirai	Browse	5.188.4.166

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
c91bde19008eefabce276152ccd51457	AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.44 37.59.29.33 57.128.101.75
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.44 37.59.29.33 57.128.101.75
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.44 37.59.29.33 57.128.101.75
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.44 37.59.29.33 57.128.101.75
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.44 37.59.29.33 57.128.101.75
	AnyDesk (2).exe	Get hash	malicious	Unknown	Browse	185.229.191.44 37.59.29.33 57.128.101.75
	AnyDesk (2).exe	Get hash	malicious	Unknown	Browse	185.229.191.44 37.59.29.33 57.128.101.75
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.44 37.59.29.33 57.128.101.75
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.44 37.59.29.33 57.128.101.75
	92f25a21-b9c1-4aee-af3e-cacf098605e9	Get hash	malicious	Unknown	Browse	185.229.191.44 37.59.29.33 57.128.101.75
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.44 37.59.29.33 57.128.101.75
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.44 37.59.29.33 57.128.101.75
	AnyDesk(1).msi	Get hash	malicious	Unknown	Browse	185.229.191.44 37.59.29.33 57.128.101.75
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.44 37.59.29.33 57.128.101.75
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.44 37.59.29.33 57.128.101.75
	AnyDesk261022.exe	Get hash	malicious	Unknown	Browse	185.229.191.44 37.59.29.33 57.128.101.75
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.44 37.59.29.33 57.128.101.75
	SuspectFile.exe	Get hash	malicious	Unknown	Browse	185.229.191.44 37.59.29.33 57.128.101.75
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.44 37.59.29.33 57.128.101.75

Process:	C:\Users\user\Desktop\AnyDesk.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	59976
Entropy (8bit):	4.3091819072378525
Encrypted:	false
SSDEEP:	384:wS2MVLJKg9m/Zrs+CXo3JD5kpa22EgJfIRZXLbGENxXjsVsugdT9tFx7sm0:w+VLo5s+kQ9il45ytFz0
MD5:	CAFA568D403F3F01CFA61244E9EA6BB6
SHA1:	EFE12D9AC8A040B72385A4C440399699E43C0423
SHA-256:	AC752AF35F7D6D993007E7FF7F950D370134684CA319F42A1FBF2E259B8252D0
SHA-512:	DAB285584F1C27EFFC3D29306C8735A6F886C7402F003CE14E38623D9F0D328D437E15C8DDDDCECAE6E47BA6A272E54A452540973C6254961C7E5A9C8CFFED3D
Malicious:	false
Reputation:	low
Preview:	* * * * * * * * * * * * * * * * * .. info 2023-07-20 11:21:37.408 front 7048 7032 main - AnyDesk Windows Startup .. info 2023-07-20 11:21:37.408 front 7048 7032 main - Version 7.1.13 (release/win_7.1.x b44b97caebbcaac9745bd6b5822bd03ee298d6bf).. info 2023-07-20 11:21:37.408 front 7048 7032 main - * Checksum cc0bc82657f3409854116e83c8d7018c.. info 2023-07-20 11:21:37.408 front 7048 7032 main - * Build 20230627141804.. info 2023-07-20 11:21:37.408 front 7048 7032 main - * Copyright (C) 2023 AnyDesk Software GmbH *.. info 2023-07-20 11:21:37.408 front 7048 7032 main - .. info 2023-07-20 11:21:37.408 front 7048 7032 main - Command Line params: "C:\Users\user\Desktop\AnyDesk.exe".

C:\Users\user\AppData\Roaming\AnyDesk\service.conf

Download File

Process:	C:\Users\user\Desktop\AnyDesk.exe
File Type:	ASCII text, with very long lines (1751)
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	6.0233907652156145
Encrypted:	false
SSDEEP:	48:uISTk3im7K7ewPKppB01skVjFcj6Iw+BAEIpMCuiIGoVf2OFtgArF8vLnJegFXLp:uISTSim7K79PupIdVWeIwu6WClWfNtRG
MD5:	ED74B4AAE8EBB99FEC3FDA195A23DBF6
SHA1:	A3B22D24E1ED10D9FAA545DD5B32C0BB6CA2A09D
SHA-256:	4E7DFCCF8668A8669F0D655CB19E1B48F451465CD412A2B224E6192CB53D3EE8
SHA-512:	DF51BAD998525B670EF250D8A39746A5F2621D8F83CF41DF7C60EBDC8CFF4DF99886252C6A90069E779698680CE512503602A87E07DD2A36EB50EF2858C4F091
Malicious:	false
Reputation:	low
Preview:	ad.anynet.cert=-----BEGIN CERTIFICATE-----\nMIICqDCCAZACAQEwDQYJKoZIhvcNAQELBQAwGTEXMBUGA1UEAwwOQW55RGVzayBD\nbGllbnQwIBcNMjMwNzIwMTEyMTQzWhgPMjA3MzA3MDcxMTIxNDNaMBkxFzAVBgNV\nBAMMDkFueURlc2sgQ2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEAsJf1HmhcqW+n7nQCQ1Vr1UU+2cHQ7PMx6HkiEqgkQu1yPBm3520K1lcs09FT\nwElDGB5owRm3yT8WYOEsH8gkJiv+9oA5KQ4Gv5K97olMN7NJLN7hNuLbUKx7/qK0\nMoXJoNOuDt0Ay4L+z2nFj0CUaM+fc9vXExUrI2t6n0qzv9n2tocw9d2vMEQLSXh0\nGNuDXh5shXoTpoIQZxHQB1eKO5sbCjYMTk93w3rw7aMydx3LrTg/r2Svf24K2hSt\nM4/nHth+xYd4WtTa7fkLM2EY2pjPX3I35TxWIr6reXNFxDqEQolF8LtwrubCirsO\n7eCweT3/QsPJGMHWh6oDbvn5LQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCAQ/FQ\nTzh4f5xWn6OGuaPnAylH4bAMqiV7biXnbwpe1PZjKAtuRprgh84hzXANZAtielY3\n+adAtZjIAd6y1ZMAYwHuR9rVuuY21tyGlzYe8RzYxMQgvArka+UE6UsqvHLMkNVn\neoXaPcAGCwmCh1U4hudG3RA4bNaixVRO6FWAQcA5qS0RFmP3r/B3fE2skhI8tJwQ\ne+UxIglJGsILFOfDpcPJsUb/UQSAD0josbmLgcSUWHgj7nnJW8ubmpZyigVWrq/K\nXN5pTMzaXmWWmq5l3lJqle4hRhlVWRXmpoKL8V7nur6K2+tf67O6N6tQcUVuWQmm\nYrZXp2tvOLqRn5K8\n-----END CERTI

C:\Users\user\AppData\Roaming\AnyDesk\system.conf

Download File

Process:	C:\Users\user\Desktop\AnyDesk.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	424
Entropy (8bit):	4.561213925363702
Encrypted:	false
SSDEEP:	6:owQQS/W2gBS+waqQAmvbahOmQgRQUQgRQPYQgRQOYQgfxPZxi3B6QgfxPg3qg3Bu:ogy+ZqQHvWhOLroBGgFBGt
MD5:	8D79F004C477DA526C73EAA9C48FC6E5
SHA1:	7E67ED9122A0DB5CC8E664B91CBC45AE6EAC84F7
SHA-256:	C40F939F5A812313B45FC9BA59E5DF89C1405594031ACA7B00341E305739A878
SHA-512:	23278399F30AC5AE01038250986D13501E705D7C7F57D3BB6417716C0ABC9B66B713D2ECF1D644A6B5760B5C2CBCB230124A2FEDBD51A7BD358F088136B3C5FC
Malicious:	false
Reputation:	low
Preview:	ad.anynet.fpr=42f5f42765bcab04343f1b3de94f6845aff46d70.ad.anynet.relay.fatal_result=1.0.ad.anynet.relay.state=0.ad.security.frontend_clipboard=1.ad.security.frontend_clipboard_files=1.ad.security.frontend_clipboard_version=1.ad.security.permission_profiles._default.permissions.sas=1.ad.security.permission_profiles._unattended_access.permissions.sas=1.ad.security.permission_profiles.version=1.ad.security.update_version=1.

C:\Users\user\AppData\Roaming\AnyDesk\user.conf

Download File

Process:	C:\Users\user\Desktop\AnyDesk.exe
File Type:	ASCII text, with very long lines (508)
Category:	dropped
Size (bytes):	1907
Entropy (8bit):	4.668027766155329
Encrypted:	false
SSDEEP:	48:2R6/KiONnwRYnQfyenwqzc4ifCKxGtlOLc8ggl:2R6/KRNnwbPnNzRKUA
MD5:	AC114104376A421F18FAC4CF99DFA83A
SHA1:	91B6ECE8FA2147275E765C170DEC8956B1C22B60
SHA-256:	2E6F798A17715E5A00EE9958826F81A98139EB886484C2C6A3BADB4896A63FB3
SHA-512:	D0714908572544F14774857D9EF3CC9CF607FE6F8E1F3668DB67341A2A7479964F1E0BD2A4BB3029B4D3342CC87502945B758F6DCCE71312B31A40BDBA1D9F19
Malicious:	false
Reputation:	low
Preview:	ad.account.info=6fa74c609a01f31f1f670668df954f4642a4aae8018a18daa2b109d42c830cf7ba23c5d0cdbfa6d90ff648310f1fa2df0b53d2e90e4e008262013ecaea92a01ded15f7ee311889f37566b4e0379c4778ab13f6aa10664e9210e78ba7f42fc27374ab0862b47b212f41cf5778b89c88f2285bb902e8a073ae7096e3788b6820cf3eeec52ea21557f2c484a3dd16ce6470f0d949a4643ab38d386faa0596c718188f3b93f3cc7671843e9264f2b5de77e1777411cc97f00c499eb37bbdcd671daccd80a327f3a59f4458b9834e96e9aa7538b22b1714c67c59fd63ada0f7f1ce930d1f2357496625e4d14d7d14af0c280f54f53db92aac.ad.invite.created_list_encrypted=6fa74c609a01f31f1f670668df954f4642a4aae8018a18da91e3b0987a0cb1f7a681ed6b1bfe3db30bf648310f1fa2df0b53d2e90e4e008262013ecaea929c190afcfea3d02334fb56df9fb7597be70a3c6597712e213a1cc285e32f866dc27374ab0862b47b212f41cf5778b89c9aaa174e1832c2a9c44269876f7df41d60d46add51545f5715b08acd5b022ed85470f0d9ad241ba294925a4066cc93376a270b40806804e93b56378b3878960ebd4e449c118aaea7fea3c6b29de0433a0ac6c651c61ada50bff6c869ea269958cc579c959cacc8a81e6d96ba3164dcbcc8ec487d0b7c3b

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms (copy)

Download File

Process:	C:\Users\user\Desktop\AnyDesk.exe
File Type:	data
Category:	dropped
Size (bytes):	3202
Entropy (8bit):	3.233430031184595
Encrypted:	false
SSDEEP:	24:jTFnlN0AX9mEsOpfgyVWoymuTFnlN0AXEnIsOpfgyLBjDymU:jBlZX9rsmYZoynBlZXyIsmY+NyH
MD5:	5DC3A91FF35B0B3346D824558520AB53
SHA1:	D38689DD0A91EBE6F64A8F4C0C1B68677DE8A994
SHA-256:	CE1B538E525F45A9ED0C74775F9E2DC7EC4A95E6521759160700A13C5918EFFA
SHA-512:	0092FB51EBBC810566FC38355F97883F9CCDA5FD69AED203966A3FC6448FEF65D86B4EB654806C0C2E6A7C270AC697182E2A5CAD11EA35DE15294D23039B59A5
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.@.. ...jb.....]/X.....gVW....H.=..........................P.O. .:i.....+00.:...:..,.LB.)...A&...&......N....-...C\|.......Y......b.2.H.=..V.Z .AnyDesk.exe.H.......U...V.Z.....Y....................P...A.n.y.D.e.s.k...e.x.e.......Q...............-.......P...........Y.oX.....C:\Users\user\Desktop\AnyDesk.exe....O.p.e.n. .a. .n.e.w. .A.n.y.D.e.s.k. .w.i.n.d.o.w...".C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.D.e.s.k.t.o.p.\.A.n.y.D.e.s.k...e.x.e.........%USERPROFILE%\Desktop\AnyDesk.exe...................................................................................................................................................................................................................................%.U.S.E.R.P.R.O.F.I.L.E.%.\.D.e.s.k.t.o.p.\.A.n.y.D.e.s.k...e.x.e..........................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UIPE613PREQBT8ELO3WS.temp

Download File

Process:	C:\Users\user\Desktop\AnyDesk.exe
File Type:	data
Category:	dropped
Size (bytes):	3202
Entropy (8bit):	3.233430031184595
Encrypted:	false
SSDEEP:	24:jTFnlN0AX9mEsOpfgyVWoymuTFnlN0AXEnIsOpfgyLBjDymU:jBlZX9rsmYZoynBlZXyIsmY+NyH
MD5:	5DC3A91FF35B0B3346D824558520AB53
SHA1:	D38689DD0A91EBE6F64A8F4C0C1B68677DE8A994
SHA-256:	CE1B538E525F45A9ED0C74775F9E2DC7EC4A95E6521759160700A13C5918EFFA
SHA-512:	0092FB51EBBC810566FC38355F97883F9CCDA5FD69AED203966A3FC6448FEF65D86B4EB654806C0C2E6A7C270AC697182E2A5CAD11EA35DE15294D23039B59A5
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.@.. ...jb.....]/X.....gVW....H.=..........................P.O. .:i.....+00.:...:..,.LB.)...A&...&......N....-...C\|.......Y......b.2.H.=..V.Z .AnyDesk.exe.H.......U...V.Z.....Y....................P...A.n.y.D.e.s.k...e.x.e.......Q...............-.......P...........Y.oX.....C:\Users\user\Desktop\AnyDesk.exe....O.p.e.n. .a. .n.e.w. .A.n.y.D.e.s.k. .w.i.n.d.o.w...".C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.D.e.s.k.t.o.p.\.A.n.y.D.e.s.k...e.x.e.........%USERPROFILE%\Desktop\AnyDesk.exe...................................................................................................................................................................................................................................%.U.S.E.R.P.R.O.F.I.L.E.%.\.D.e.s.k.t.o.p.\.A.n.y.D.e.s.k...e.x.e..........................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9991565509956315
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	AnyDesk.exe
File size:	4'040'776 bytes
MD5:	30c9c57aa570088d745fac7bfd05b805
SHA1:	d579d18848859614e219afa6332d410e0ca71fc3
SHA256:	8cd552392bb25546ba58e73d63c4b7c290188ca1060f96c8abf641ae9f5a8383
SHA512:	182dc736cf09e8b4e063b29c839999ab28506a71e22173484f9dbc9bf9472456406aa0c8de542d85436200317175f9e32d65f1bb1e567b8c717860348fd3b52c
SSDEEP:	98304:oOmZb0bHkeaRs4WpcF8uztWOiiROB4/Oo1sRF:rmZb0bEds4XFR0OiC/GT
TLSH:	2A1633506BF882E1D1371AB4AE5FE2143F598CFE15F602699C2BA554CDF7C106CC3AA8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........h.}.;.}.;.}.;..";.}.;..#;.}.;...;.}.;...;.}.;Rich.}.;........................PE..L......d.........."......*...8=............

File Icon


Icon Hash:	499669d8d82916a8

Static PE Info

General

Entrypoint:	0x401ce9
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x649AD37F [Tue Jun 27 12:18:07 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	12/12/2021 4:00:00 PM 1/8/2025 3:59:59 PM
Subject Chain	CN=philandro Software GmbH, O=philandro Software GmbH, L=Stuttgart, S=Baden-W\xfcrttemberg, C=DE
Version:	3
Thumbprint MD5:	EAE713DFC05244CF4301BF1C9F68B1BE
Thumbprint SHA-1:	9CD1DDB78ED05282353B20CDFE8FA0A4FB6C1ECE
Thumbprint SHA-256:	9D7620A4CEBA92370E8828B3CB1007AEFF63AB36A2CBE5F044FDDE14ABAB1EBF
Serial:	0DBF152DEAF0B981A8A938D53F769DB8

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 64h
push esi
lea ecx, dword ptr [ebp-64h]
call 00007F650C782023h
lea eax, dword ptr [ebp-64h]
mov ecx, eax
mov dword ptr [0147E0E8h], eax
call 00007F650C781EE1h
test al, al
jne 00007F650C782644h
mov esi, 000003E8h
lea ecx, dword ptr [ebp-64h]
call 00007F650C781ECFh
mov eax, esi
pop esi
leave
ret
lea eax, dword ptr [ebp-64h]
push eax
lea ecx, dword ptr [ebp-30h]
call 00007F650C781D03h
lea eax, dword ptr [ebp-30h]
mov ecx, eax
mov dword ptr [0147E0ECh], eax
call 00007F650C781C9Bh
test al, al
jne 00007F650C782641h
lea ecx, dword ptr [ebp-30h]
call 00007F650C781C80h
mov esi, 000003E9h
jmp 00007F650C7825F7h
cmp dword ptr [ebp-10h], 00000000h
je 00007F650C78263Ah
push 00000800h
call dword ptr [ebp-10h]
cmp dword ptr [ebp-0Ch], 00000000h
je 00007F650C78263Ah
push 00008001h
call dword ptr [ebp-0Ch]
lea eax, dword ptr [ebp-64h]
push eax
lea esi, dword ptr [ebp-30h]
call 00007F650C782585h
pop ecx
mov esi, eax
push esi
call dword ptr [ebp-20h]
lea ecx, dword ptr [ebp-30h]
call 00007F650C781C42h
jmp 00007F650C7825BEh
mov edx, dword ptr [esp+04h]
push ebx
mov ebx, dword ptr [esp+10h]
push esi
xor esi, esi
test ebx, ebx
je 00007F650C782661h
push edi
mov edi, dword ptr [esp+14h]
sub edi, 0147E0F0h
imul edx, edx, 0019660Dh
add edx, 3C6EF35Fh
mov eax, edx
shr eax, 0Ch

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ C ] VS2010 build 30319
[RES] VS2010 SP1 build 40219
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x107f000	0x4850	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x3d6200	0x4648	.itext
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1084000	0x84	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xcaf000	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2835	0x2a00	False	0.5949590773809523	data	6.514751266666443	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x4000	0xcaae00	0x0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xcaf000	0x2fa	0x400	False	0.7255859375	Matlab v4 mat-file (little endian) \234\362\312, numeric, rows 1687868287, columns 0, imaginary	5.646642643065067	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcb0000	0x3ce4f4	0x3ce200	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x107f000	0x4850	0x4a00	False	0.5123521959459459	data	6.017834090303233	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1084000	0x300	0x400	False	0.1455078125	data	1.181265380704217	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x107f280	0x1b8e	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9167848029486816
RT_ICON	0x1080e10	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 0	English	United States	0.299390243902439
RT_ICON	0x1081478	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	United States	0.478494623655914
RT_ICON	0x1081760	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 0	English	United States	0.48155737704918034
RT_ICON	0x1081948	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	United States	0.597972972972973
RT_ICON	0x1081ac0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.09404315196998124
RT_ICON	0x1082b68	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.2047872340425532
RT_GROUP_ICON	0x1081a70	0x4c	data	English	United States	0.8026315789473685
RT_GROUP_ICON	0x1082fd0	0x22	data	English	United States	1.0588235294117647
RT_VERSION	0x1082ff8	0x250	data	English	United States	0.4814189189189189
RT_MANIFEST	0x1083248	0x606	XML 1.0 document, ASCII text	English	United States	0.45395590142671854

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2023 04:21:44.508284092 CEST	49698	443	192.168.2.3	185.229.191.44
Jul 20, 2023 04:21:44.508371115 CEST	443	49698	185.229.191.44	192.168.2.3
Jul 20, 2023 04:21:44.508505106 CEST	49698	443	192.168.2.3	185.229.191.44
Jul 20, 2023 04:21:44.527431965 CEST	49698	443	192.168.2.3	185.229.191.44
Jul 20, 2023 04:21:44.527493000 CEST	443	49698	185.229.191.44	192.168.2.3
Jul 20, 2023 04:21:44.601816893 CEST	443	49698	185.229.191.44	192.168.2.3
Jul 20, 2023 04:21:44.601963997 CEST	49698	443	192.168.2.3	185.229.191.44
Jul 20, 2023 04:21:44.602659941 CEST	49698	443	192.168.2.3	185.229.191.44
Jul 20, 2023 04:21:44.602679014 CEST	443	49698	185.229.191.44	192.168.2.3
Jul 20, 2023 04:21:44.603099108 CEST	443	49698	185.229.191.44	192.168.2.3
Jul 20, 2023 04:21:44.603187084 CEST	49698	443	192.168.2.3	185.229.191.44
Jul 20, 2023 04:21:44.743422031 CEST	49698	443	192.168.2.3	185.229.191.44
Jul 20, 2023 04:21:46.608315945 CEST	49699	80	192.168.2.3	185.229.191.41
Jul 20, 2023 04:21:46.632329941 CEST	80	49699	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:46.632591009 CEST	49699	80	192.168.2.3	185.229.191.41
Jul 20, 2023 04:21:46.647543907 CEST	49699	80	192.168.2.3	185.229.191.41
Jul 20, 2023 04:21:46.671425104 CEST	80	49699	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:46.673980951 CEST	80	49699	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:46.674027920 CEST	80	49699	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:46.674067974 CEST	80	49699	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:46.674112082 CEST	80	49699	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:46.674153090 CEST	80	49699	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:46.674156904 CEST	49699	80	192.168.2.3	185.229.191.41
Jul 20, 2023 04:21:46.674156904 CEST	49699	80	192.168.2.3	185.229.191.41
Jul 20, 2023 04:21:46.687314987 CEST	49699	80	192.168.2.3	185.229.191.41
Jul 20, 2023 04:21:46.711287022 CEST	80	49699	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:46.711378098 CEST	80	49699	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:46.711473942 CEST	49699	80	192.168.2.3	185.229.191.41
Jul 20, 2023 04:21:46.818458080 CEST	49699	80	192.168.2.3	185.229.191.41
Jul 20, 2023 04:21:46.842176914 CEST	49700	6568	192.168.2.3	185.229.191.44
Jul 20, 2023 04:21:46.842318058 CEST	80	49699	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:46.866453886 CEST	6568	49700	185.229.191.44	192.168.2.3
Jul 20, 2023 04:21:46.866763115 CEST	49700	6568	192.168.2.3	185.229.191.44
Jul 20, 2023 04:21:46.880647898 CEST	49700	6568	192.168.2.3	185.229.191.44
Jul 20, 2023 04:21:46.904834986 CEST	6568	49700	185.229.191.44	192.168.2.3
Jul 20, 2023 04:21:46.906748056 CEST	6568	49700	185.229.191.44	192.168.2.3
Jul 20, 2023 04:21:46.906810045 CEST	6568	49700	185.229.191.44	192.168.2.3
Jul 20, 2023 04:21:46.906850100 CEST	6568	49700	185.229.191.44	192.168.2.3
Jul 20, 2023 04:21:46.907032013 CEST	49700	6568	192.168.2.3	185.229.191.44
Jul 20, 2023 04:21:46.926800966 CEST	49700	6568	192.168.2.3	185.229.191.44
Jul 20, 2023 04:21:46.951251984 CEST	6568	49700	185.229.191.44	192.168.2.3
Jul 20, 2023 04:21:46.951309919 CEST	6568	49700	185.229.191.44	192.168.2.3
Jul 20, 2023 04:21:46.951472998 CEST	49700	6568	192.168.2.3	185.229.191.44
Jul 20, 2023 04:21:47.020446062 CEST	49700	6568	192.168.2.3	185.229.191.44
Jul 20, 2023 04:21:47.044703960 CEST	6568	49700	185.229.191.44	192.168.2.3
Jul 20, 2023 04:21:51.495388031 CEST	49701	443	192.168.2.3	57.128.101.75
Jul 20, 2023 04:21:51.495464087 CEST	443	49701	57.128.101.75	192.168.2.3
Jul 20, 2023 04:21:51.495552063 CEST	49701	443	192.168.2.3	57.128.101.75
Jul 20, 2023 04:21:51.520397902 CEST	49701	443	192.168.2.3	57.128.101.75
Jul 20, 2023 04:21:51.520456076 CEST	443	49701	57.128.101.75	192.168.2.3
Jul 20, 2023 04:21:51.576134920 CEST	443	49701	57.128.101.75	192.168.2.3
Jul 20, 2023 04:21:51.576304913 CEST	49701	443	192.168.2.3	57.128.101.75
Jul 20, 2023 04:21:51.576946020 CEST	49701	443	192.168.2.3	57.128.101.75
Jul 20, 2023 04:21:51.576968908 CEST	443	49701	57.128.101.75	192.168.2.3
Jul 20, 2023 04:21:51.577317953 CEST	443	49701	57.128.101.75	192.168.2.3
Jul 20, 2023 04:21:51.577399015 CEST	49701	443	192.168.2.3	57.128.101.75
Jul 20, 2023 04:21:51.699194908 CEST	49701	443	192.168.2.3	57.128.101.75
Jul 20, 2023 04:21:51.755748034 CEST	49702	80	192.168.2.3	185.229.191.41
Jul 20, 2023 04:21:51.779958010 CEST	80	49702	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:51.780073881 CEST	49702	80	192.168.2.3	185.229.191.41
Jul 20, 2023 04:21:51.789145947 CEST	49702	80	192.168.2.3	185.229.191.41
Jul 20, 2023 04:21:51.813349009 CEST	80	49702	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:51.815725088 CEST	80	49702	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:51.815751076 CEST	80	49702	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:51.815773964 CEST	80	49702	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:51.815794945 CEST	80	49702	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:51.815808058 CEST	49702	80	192.168.2.3	185.229.191.41
Jul 20, 2023 04:21:51.815818071 CEST	80	49702	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:51.815841913 CEST	49702	80	192.168.2.3	185.229.191.41
Jul 20, 2023 04:21:51.826652050 CEST	49702	80	192.168.2.3	185.229.191.41
Jul 20, 2023 04:21:51.850982904 CEST	80	49702	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:51.851013899 CEST	80	49702	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:51.851094007 CEST	49702	80	192.168.2.3	185.229.191.41
Jul 20, 2023 04:21:51.929193974 CEST	49702	80	192.168.2.3	185.229.191.41
Jul 20, 2023 04:21:51.953453064 CEST	80	49702	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:52.065089941 CEST	49703	6568	192.168.2.3	185.229.191.41
Jul 20, 2023 04:21:52.089370012 CEST	6568	49703	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:52.089504004 CEST	49703	6568	192.168.2.3	185.229.191.41
Jul 20, 2023 04:21:52.098431110 CEST	49703	6568	192.168.2.3	185.229.191.41
Jul 20, 2023 04:21:52.122529030 CEST	6568	49703	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:52.125252008 CEST	6568	49703	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:52.125319958 CEST	6568	49703	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:52.125365019 CEST	6568	49703	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:52.125407934 CEST	49703	6568	192.168.2.3	185.229.191.41
Jul 20, 2023 04:21:52.151503086 CEST	49703	6568	192.168.2.3	185.229.191.41
Jul 20, 2023 04:21:52.176034927 CEST	6568	49703	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:52.176088095 CEST	6568	49703	185.229.191.41	192.168.2.3
Jul 20, 2023 04:21:52.176227093 CEST	49703	6568	192.168.2.3	185.229.191.41
Jul 20, 2023 04:21:53.344791889 CEST	49703	6568	192.168.2.3	185.229.191.41
Jul 20, 2023 04:21:53.369101048 CEST	6568	49703	185.229.191.41	192.168.2.3
Jul 20, 2023 04:22:07.349869013 CEST	49704	443	192.168.2.3	37.59.29.33
Jul 20, 2023 04:22:07.349980116 CEST	443	49704	37.59.29.33	192.168.2.3
Jul 20, 2023 04:22:07.350110054 CEST	49704	443	192.168.2.3	37.59.29.33
Jul 20, 2023 04:22:07.369487047 CEST	49704	443	192.168.2.3	37.59.29.33
Jul 20, 2023 04:22:07.369541883 CEST	443	49704	37.59.29.33	192.168.2.3
Jul 20, 2023 04:22:07.423022985 CEST	443	49704	37.59.29.33	192.168.2.3
Jul 20, 2023 04:22:07.423130035 CEST	49704	443	192.168.2.3	37.59.29.33
Jul 20, 2023 04:22:07.423842907 CEST	49704	443	192.168.2.3	37.59.29.33
Jul 20, 2023 04:22:07.423868895 CEST	443	49704	37.59.29.33	192.168.2.3
Jul 20, 2023 04:22:07.424345016 CEST	443	49704	37.59.29.33	192.168.2.3
Jul 20, 2023 04:22:07.424459934 CEST	49704	443	192.168.2.3	37.59.29.33
Jul 20, 2023 04:22:07.528835058 CEST	49704	443	192.168.2.3	37.59.29.33
Jul 20, 2023 04:22:07.565360069 CEST	49705	80	192.168.2.3	185.229.191.41
Jul 20, 2023 04:22:07.589204073 CEST	80	49705	185.229.191.41	192.168.2.3
Jul 20, 2023 04:22:07.592865944 CEST	49705	80	192.168.2.3	185.229.191.41
Jul 20, 2023 04:22:07.603523016 CEST	49705	80	192.168.2.3	185.229.191.41
Jul 20, 2023 04:22:07.627398014 CEST	80	49705	185.229.191.41	192.168.2.3
Jul 20, 2023 04:22:07.629625082 CEST	80	49705	185.229.191.41	192.168.2.3
Jul 20, 2023 04:22:07.629666090 CEST	80	49705	185.229.191.41	192.168.2.3
Jul 20, 2023 04:22:07.629705906 CEST	80	49705	185.229.191.41	192.168.2.3
Jul 20, 2023 04:22:07.629757881 CEST	80	49705	185.229.191.41	192.168.2.3
Jul 20, 2023 04:22:07.629811049 CEST	80	49705	185.229.191.41	192.168.2.3
Jul 20, 2023 04:22:07.629829884 CEST	49705	80	192.168.2.3	185.229.191.41
Jul 20, 2023 04:22:07.629829884 CEST	49705	80	192.168.2.3	185.229.191.41
Jul 20, 2023 04:22:07.642312050 CEST	49705	80	192.168.2.3	185.229.191.41
Jul 20, 2023 04:22:07.666215897 CEST	80	49705	185.229.191.41	192.168.2.3
Jul 20, 2023 04:22:07.666260958 CEST	80	49705	185.229.191.41	192.168.2.3
Jul 20, 2023 04:22:07.666476011 CEST	49705	80	192.168.2.3	185.229.191.41
Jul 20, 2023 04:22:07.742494106 CEST	49705	80	192.168.2.3	185.229.191.41
Jul 20, 2023 04:22:07.766396999 CEST	80	49705	185.229.191.41	192.168.2.3
Jul 20, 2023 04:22:07.795233011 CEST	49706	6568	192.168.2.3	185.229.191.44
Jul 20, 2023 04:22:07.819680929 CEST	6568	49706	185.229.191.44	192.168.2.3
Jul 20, 2023 04:22:07.823220968 CEST	49706	6568	192.168.2.3	185.229.191.44
Jul 20, 2023 04:22:07.841196060 CEST	49706	6568	192.168.2.3	185.229.191.44
Jul 20, 2023 04:22:07.865545988 CEST	6568	49706	185.229.191.44	192.168.2.3
Jul 20, 2023 04:22:07.867481947 CEST	6568	49706	185.229.191.44	192.168.2.3
Jul 20, 2023 04:22:07.867551088 CEST	6568	49706	185.229.191.44	192.168.2.3
Jul 20, 2023 04:22:07.867577076 CEST	6568	49706	185.229.191.44	192.168.2.3
Jul 20, 2023 04:22:07.867894888 CEST	49706	6568	192.168.2.3	185.229.191.44
Jul 20, 2023 04:22:07.885936975 CEST	49706	6568	192.168.2.3	185.229.191.44
Jul 20, 2023 04:22:07.910337925 CEST	6568	49706	185.229.191.44	192.168.2.3
Jul 20, 2023 04:22:07.910392046 CEST	6568	49706	185.229.191.44	192.168.2.3
Jul 20, 2023 04:22:07.910682917 CEST	49706	6568	192.168.2.3	185.229.191.44
Jul 20, 2023 04:22:08.095330954 CEST	49706	6568	192.168.2.3	185.229.191.44
Jul 20, 2023 04:22:08.119621992 CEST	6568	49706	185.229.191.44	192.168.2.3
Jul 20, 2023 04:22:56.588929892 CEST	49707	443	192.168.2.3	185.229.191.44
Jul 20, 2023 04:22:56.589015007 CEST	443	49707	185.229.191.44	192.168.2.3
Jul 20, 2023 04:22:56.589132071 CEST	49707	443	192.168.2.3	185.229.191.44
Jul 20, 2023 04:22:56.602488041 CEST	49707	443	192.168.2.3	185.229.191.44
Jul 20, 2023 04:22:56.602551937 CEST	443	49707	185.229.191.44	192.168.2.3
Jul 20, 2023 04:22:56.666904926 CEST	443	49707	185.229.191.44	192.168.2.3
Jul 20, 2023 04:22:56.667022943 CEST	49707	443	192.168.2.3	185.229.191.44
Jul 20, 2023 04:22:56.668831110 CEST	49707	443	192.168.2.3	185.229.191.44
Jul 20, 2023 04:22:56.668859005 CEST	443	49707	185.229.191.44	192.168.2.3
Jul 20, 2023 04:22:56.669090033 CEST	443	49707	185.229.191.44	192.168.2.3
Jul 20, 2023 04:22:56.669171095 CEST	49707	443	192.168.2.3	185.229.191.44
Jul 20, 2023 04:22:56.741542101 CEST	49707	443	192.168.2.3	185.229.191.44
Jul 20, 2023 04:22:56.777203083 CEST	49708	80	192.168.2.3	37.59.29.33
Jul 20, 2023 04:22:56.797069073 CEST	80	49708	37.59.29.33	192.168.2.3
Jul 20, 2023 04:22:56.797169924 CEST	49708	80	192.168.2.3	37.59.29.33
Jul 20, 2023 04:22:56.806111097 CEST	49708	80	192.168.2.3	37.59.29.33
Jul 20, 2023 04:22:56.826040030 CEST	80	49708	37.59.29.33	192.168.2.3
Jul 20, 2023 04:22:56.828754902 CEST	80	49708	37.59.29.33	192.168.2.3
Jul 20, 2023 04:22:56.828803062 CEST	80	49708	37.59.29.33	192.168.2.3
Jul 20, 2023 04:22:56.828844070 CEST	80	49708	37.59.29.33	192.168.2.3
Jul 20, 2023 04:22:56.828882933 CEST	49708	80	192.168.2.3	37.59.29.33
Jul 20, 2023 04:22:56.828883886 CEST	80	49708	37.59.29.33	192.168.2.3
Jul 20, 2023 04:22:56.828927040 CEST	80	49708	37.59.29.33	192.168.2.3
Jul 20, 2023 04:22:56.828933954 CEST	49708	80	192.168.2.3	37.59.29.33
Jul 20, 2023 04:22:56.839869976 CEST	49708	80	192.168.2.3	37.59.29.33
Jul 20, 2023 04:22:56.860040903 CEST	80	49708	37.59.29.33	192.168.2.3
Jul 20, 2023 04:22:56.860116005 CEST	80	49708	37.59.29.33	192.168.2.3
Jul 20, 2023 04:22:56.860183001 CEST	49708	80	192.168.2.3	37.59.29.33
Jul 20, 2023 04:22:56.931952953 CEST	49708	80	192.168.2.3	37.59.29.33
Jul 20, 2023 04:22:56.952044964 CEST	80	49708	37.59.29.33	192.168.2.3
Jul 20, 2023 04:22:56.964164019 CEST	49709	6568	192.168.2.3	185.229.191.44
Jul 20, 2023 04:22:56.988485098 CEST	6568	49709	185.229.191.44	192.168.2.3
Jul 20, 2023 04:22:56.988610983 CEST	49709	6568	192.168.2.3	185.229.191.44
Jul 20, 2023 04:22:56.998657942 CEST	49709	6568	192.168.2.3	185.229.191.44
Jul 20, 2023 04:22:57.022912979 CEST	6568	49709	185.229.191.44	192.168.2.3
Jul 20, 2023 04:22:57.025410891 CEST	6568	49709	185.229.191.44	192.168.2.3
Jul 20, 2023 04:22:57.025474072 CEST	6568	49709	185.229.191.44	192.168.2.3
Jul 20, 2023 04:22:57.025512934 CEST	6568	49709	185.229.191.44	192.168.2.3
Jul 20, 2023 04:22:57.025547028 CEST	49709	6568	192.168.2.3	185.229.191.44
Jul 20, 2023 04:22:57.042558908 CEST	49709	6568	192.168.2.3	185.229.191.44
Jul 20, 2023 04:22:57.066950083 CEST	6568	49709	185.229.191.44	192.168.2.3
Jul 20, 2023 04:22:57.067008972 CEST	6568	49709	185.229.191.44	192.168.2.3
Jul 20, 2023 04:22:57.067095995 CEST	49709	6568	192.168.2.3	185.229.191.44
Jul 20, 2023 04:22:57.196892023 CEST	49709	6568	192.168.2.3	185.229.191.44
Jul 20, 2023 04:22:57.221180916 CEST	6568	49709	185.229.191.44	192.168.2.3
Jul 20, 2023 04:23:46.493890047 CEST	49710	443	192.168.2.3	37.59.29.33
Jul 20, 2023 04:23:46.493959904 CEST	443	49710	37.59.29.33	192.168.2.3
Jul 20, 2023 04:23:46.494060993 CEST	49710	443	192.168.2.3	37.59.29.33
Jul 20, 2023 04:23:46.512049913 CEST	49710	443	192.168.2.3	37.59.29.33
Jul 20, 2023 04:23:46.512109041 CEST	443	49710	37.59.29.33	192.168.2.3
Jul 20, 2023 04:23:46.567923069 CEST	443	49710	37.59.29.33	192.168.2.3
Jul 20, 2023 04:23:46.568166018 CEST	49710	443	192.168.2.3	37.59.29.33
Jul 20, 2023 04:23:46.569058895 CEST	49710	443	192.168.2.3	37.59.29.33
Jul 20, 2023 04:23:46.569096088 CEST	443	49710	37.59.29.33	192.168.2.3
Jul 20, 2023 04:23:46.569449902 CEST	443	49710	37.59.29.33	192.168.2.3
Jul 20, 2023 04:23:46.569531918 CEST	49710	443	192.168.2.3	37.59.29.33
Jul 20, 2023 04:23:46.650856972 CEST	49710	443	192.168.2.3	37.59.29.33
Jul 20, 2023 04:23:46.685480118 CEST	49711	80	192.168.2.3	92.223.88.41
Jul 20, 2023 04:23:46.705705881 CEST	80	49711	92.223.88.41	192.168.2.3
Jul 20, 2023 04:23:46.705830097 CEST	49711	80	192.168.2.3	92.223.88.41
Jul 20, 2023 04:23:46.714478016 CEST	49711	80	192.168.2.3	92.223.88.41
Jul 20, 2023 04:23:46.734745026 CEST	80	49711	92.223.88.41	192.168.2.3
Jul 20, 2023 04:23:46.736746073 CEST	80	49711	92.223.88.41	192.168.2.3
Jul 20, 2023 04:23:46.736799002 CEST	80	49711	92.223.88.41	192.168.2.3
Jul 20, 2023 04:23:46.736824989 CEST	80	49711	92.223.88.41	192.168.2.3
Jul 20, 2023 04:23:46.736861944 CEST	80	49711	92.223.88.41	192.168.2.3
Jul 20, 2023 04:23:46.736901045 CEST	80	49711	92.223.88.41	192.168.2.3
Jul 20, 2023 04:23:46.737008095 CEST	49711	80	192.168.2.3	92.223.88.41
Jul 20, 2023 04:23:46.737008095 CEST	49711	80	192.168.2.3	92.223.88.41
Jul 20, 2023 04:23:46.757889032 CEST	49711	80	192.168.2.3	92.223.88.41
Jul 20, 2023 04:23:46.778275967 CEST	80	49711	92.223.88.41	192.168.2.3
Jul 20, 2023 04:23:46.778328896 CEST	80	49711	92.223.88.41	192.168.2.3
Jul 20, 2023 04:23:46.778557062 CEST	49711	80	192.168.2.3	92.223.88.41
Jul 20, 2023 04:23:46.863405943 CEST	49711	80	192.168.2.3	92.223.88.41
Jul 20, 2023 04:23:46.883546114 CEST	80	49711	92.223.88.41	192.168.2.3
Jul 20, 2023 04:23:46.903990030 CEST	49712	6568	192.168.2.3	92.223.88.41
Jul 20, 2023 04:23:46.924293995 CEST	6568	49712	92.223.88.41	192.168.2.3
Jul 20, 2023 04:23:46.924606085 CEST	49712	6568	192.168.2.3	92.223.88.41
Jul 20, 2023 04:23:46.938725948 CEST	49712	6568	192.168.2.3	92.223.88.41
Jul 20, 2023 04:23:46.958836079 CEST	6568	49712	92.223.88.41	192.168.2.3
Jul 20, 2023 04:23:46.960918903 CEST	6568	49712	92.223.88.41	192.168.2.3
Jul 20, 2023 04:23:46.960974932 CEST	6568	49712	92.223.88.41	192.168.2.3
Jul 20, 2023 04:23:46.961014032 CEST	6568	49712	92.223.88.41	192.168.2.3
Jul 20, 2023 04:23:46.961230993 CEST	49712	6568	192.168.2.3	92.223.88.41
Jul 20, 2023 04:23:46.985233068 CEST	49712	6568	192.168.2.3	92.223.88.41
Jul 20, 2023 04:23:47.005678892 CEST	6568	49712	92.223.88.41	192.168.2.3
Jul 20, 2023 04:23:47.005737066 CEST	6568	49712	92.223.88.41	192.168.2.3
Jul 20, 2023 04:23:47.006030083 CEST	49712	6568	192.168.2.3	92.223.88.41
Jul 20, 2023 04:23:47.128794909 CEST	49712	6568	192.168.2.3	92.223.88.41
Jul 20, 2023 04:23:47.148950100 CEST	6568	49712	92.223.88.41	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2023 04:21:44.474221945 CEST	52387	53	192.168.2.3	8.8.8.8
Jul 20, 2023 04:21:44.497905970 CEST	53	52387	8.8.8.8	192.168.2.3
Jul 20, 2023 04:21:44.791834116 CEST	56924	53	192.168.2.3	8.8.8.8
Jul 20, 2023 04:21:45.789474010 CEST	56924	53	192.168.2.3	8.8.8.8
Jul 20, 2023 04:21:46.601661921 CEST	53	56924	8.8.8.8	192.168.2.3
Jul 20, 2023 04:21:46.601716042 CEST	53	56924	8.8.8.8	192.168.2.3
Jul 20, 2023 04:21:46.824690104 CEST	60625	53	192.168.2.3	8.8.8.8
Jul 20, 2023 04:21:46.839764118 CEST	53	60625	8.8.8.8	192.168.2.3
Jul 20, 2023 04:21:51.449608088 CEST	49302	53	192.168.2.3	8.8.8.8
Jul 20, 2023 04:21:51.464301109 CEST	53	49302	8.8.8.8	192.168.2.3
Jul 20, 2023 04:21:51.726771116 CEST	53975	53	192.168.2.3	8.8.8.8
Jul 20, 2023 04:21:51.750112057 CEST	53	53975	8.8.8.8	192.168.2.3
Jul 20, 2023 04:21:51.939615965 CEST	51139	53	192.168.2.3	8.8.8.8
Jul 20, 2023 04:21:51.963174105 CEST	53	51139	8.8.8.8	192.168.2.3
Jul 20, 2023 04:22:07.307276964 CEST	52955	53	192.168.2.3	8.8.8.8
Jul 20, 2023 04:22:07.336116076 CEST	53	52955	8.8.8.8	192.168.2.3
Jul 20, 2023 04:22:07.537039042 CEST	60582	53	192.168.2.3	8.8.8.8
Jul 20, 2023 04:22:07.560698032 CEST	53	60582	8.8.8.8	192.168.2.3
Jul 20, 2023 04:22:07.753387928 CEST	57134	53	192.168.2.3	8.8.8.8
Jul 20, 2023 04:22:07.776995897 CEST	53	57134	8.8.8.8	192.168.2.3
Jul 20, 2023 04:22:56.553925991 CEST	62050	53	192.168.2.3	8.8.8.8
Jul 20, 2023 04:22:56.568928003 CEST	53	62050	8.8.8.8	192.168.2.3
Jul 20, 2023 04:22:56.748831987 CEST	56042	53	192.168.2.3	8.8.8.8
Jul 20, 2023 04:22:56.763518095 CEST	53	56042	8.8.8.8	192.168.2.3
Jul 20, 2023 04:22:56.937903881 CEST	59636	53	192.168.2.3	8.8.8.8
Jul 20, 2023 04:22:56.961601973 CEST	53	59636	8.8.8.8	192.168.2.3
Jul 20, 2023 04:23:46.453996897 CEST	55638	53	192.168.2.3	8.8.8.8
Jul 20, 2023 04:23:46.482753038 CEST	53	55638	8.8.8.8	192.168.2.3
Jul 20, 2023 04:23:46.662797928 CEST	57704	53	192.168.2.3	8.8.8.8
Jul 20, 2023 04:23:46.682969093 CEST	53	57704	8.8.8.8	192.168.2.3
Jul 20, 2023 04:23:46.875030041 CEST	65320	53	192.168.2.3	8.8.8.8
Jul 20, 2023 04:23:46.898776054 CEST	53	65320	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 20, 2023 04:21:44.474221945 CEST	192.168.2.3	8.8.8.8	0x5ac	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:21:44.791834116 CEST	192.168.2.3	8.8.8.8	0x5bee	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:21:45.789474010 CEST	192.168.2.3	8.8.8.8	0x5bee	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:21:46.824690104 CEST	192.168.2.3	8.8.8.8	0x18ff	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:21:51.449608088 CEST	192.168.2.3	8.8.8.8	0x2379	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:21:51.726771116 CEST	192.168.2.3	8.8.8.8	0xb6b9	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:21:51.939615965 CEST	192.168.2.3	8.8.8.8	0x18b9	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:22:07.307276964 CEST	192.168.2.3	8.8.8.8	0x23d9	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:22:07.537039042 CEST	192.168.2.3	8.8.8.8	0xb27a	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:22:07.753387928 CEST	192.168.2.3	8.8.8.8	0xf785	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:22:56.553925991 CEST	192.168.2.3	8.8.8.8	0x6415	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:22:56.748831987 CEST	192.168.2.3	8.8.8.8	0x2ff8	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:22:56.937903881 CEST	192.168.2.3	8.8.8.8	0xcdb	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:23:46.453996897 CEST	192.168.2.3	8.8.8.8	0xfb9b	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:23:46.662797928 CEST	192.168.2.3	8.8.8.8	0xa4cf	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:23:46.875030041 CEST	192.168.2.3	8.8.8.8	0x330b	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 20, 2023 04:21:44.497905970 CEST	8.8.8.8	192.168.2.3	0x5ac	No error (0)	boot.net.anydesk.com	185.229.191.44	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:21:46.601661921 CEST	8.8.8.8	192.168.2.3	0x5bee	No error (0)	boot.net.anydesk.com	185.229.191.41	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:21:46.601716042 CEST	8.8.8.8	192.168.2.3	0x5bee	No error (0)	boot.net.anydesk.com	57.128.101.75	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:21:46.839764118 CEST	8.8.8.8	192.168.2.3	0x18ff	No error (0)	boot.net.anydesk.com	185.229.191.44	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:21:51.464301109 CEST	8.8.8.8	192.168.2.3	0x2379	No error (0)	boot.net.anydesk.com	57.128.101.75	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:21:51.750112057 CEST	8.8.8.8	192.168.2.3	0xb6b9	No error (0)	boot.net.anydesk.com	185.229.191.41	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:21:51.963174105 CEST	8.8.8.8	192.168.2.3	0x18b9	No error (0)	boot.net.anydesk.com	185.229.191.41	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:22:07.336116076 CEST	8.8.8.8	192.168.2.3	0x23d9	No error (0)	boot.net.anydesk.com	37.59.29.33	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:22:07.560698032 CEST	8.8.8.8	192.168.2.3	0xb27a	No error (0)	boot.net.anydesk.com	185.229.191.41	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:22:07.776995897 CEST	8.8.8.8	192.168.2.3	0xf785	No error (0)	boot.net.anydesk.com	185.229.191.44	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:22:56.568928003 CEST	8.8.8.8	192.168.2.3	0x6415	No error (0)	boot.net.anydesk.com	185.229.191.44	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:22:56.763518095 CEST	8.8.8.8	192.168.2.3	0x2ff8	No error (0)	boot.net.anydesk.com	37.59.29.33	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:22:56.961601973 CEST	8.8.8.8	192.168.2.3	0xcdb	No error (0)	boot.net.anydesk.com	185.229.191.44	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:23:46.482753038 CEST	8.8.8.8	192.168.2.3	0xfb9b	No error (0)	boot.net.anydesk.com	37.59.29.33	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:23:46.682969093 CEST	8.8.8.8	192.168.2.3	0xa4cf	No error (0)	boot.net.anydesk.com	92.223.88.41	A (IP address)	IN (0x0001)	false
Jul 20, 2023 04:23:46.898776054 CEST	8.8.8.8	192.168.2.3	0x330b	No error (0)	boot.net.anydesk.com	92.223.88.41	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49699	185.229.191.41	80	C:\Users\user\Desktop\AnyDesk.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 04:21:46.647543907 CEST	5	OUT	Data Raw: 16 03 01 01 0d 01 00 01 09 03 03 bb e3 ad c0 13 5b 3b c9 eb 5a a8 de 98 83 58 b2 a1 fb b5 27 59 d8 97 2d 44 b4 41 44 29 88 53 57 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: [;ZX'Y-DAD)SWn0,($kjih98762.*&=5/+'#g@?>32101-)%</r#
Jul 20, 2023 04:21:46.673980951 CEST	5	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 a5 8e 28 31 f9 e4 6f ce 7b 64 a8 10 07 c7 11 9c 0a 8e bd c0 8a 6c 7a 22 44 4f 57 4e 47 52 44 01 20 dc d8 85 d7 e6 11 4b 9e 07 8d 83 64 61 16 04 6d 36 44 92 81 cd 4c 09 80 31 48 aa 08 22 62 20 b9 c0 2c 00 00 0b ff Data Ascii: WS(1o{dlz"DOWNGRD Kdam6DL1H"b ,C0?0'0vtS$0*H0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0181118021423Z281115021
Jul 20, 2023 04:21:46.674027920 CEST	6	IN	Data Raw: e6 e8 20 b9 4b 8b bb 63 de 6f 65 6a 9f 5d d7 c1 97 9b 2d 30 4e 9a 81 85 b4 1c 92 a6 ed d8 7a f9 df 9d 03 b3 90 9c 78 a9 c8 ba 0e 3c ac ec 14 db 7d 51 b3 97 06 b9 f6 77 60 ab fe 59 83 af 8e 97 56 29 c7 db 7e 71 79 d1 c7 f7 da b6 c8 f7 af 8f 24 e0 Data Ascii: Kcoej]-0Nzx<}Qw`YV)~qy$ZG\|'SO^jl$\|XM+")+{n\&9S\|4xLp\|aZ.qDL\vq$;OroCs4\|z\8[TRxU>R
Jul 20, 2023 04:21:46.674067974 CEST	7	IN	Data Raw: 35 35 5a 17 0d 32 34 30 34 30 38 30 32 33 37 35 35 5a 30 48 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 4e 65 74 20 52 6f 6f 74 20 43 41 31 20 30 1e 06 03 55 04 0a 0c 17 70 68 69 6c 61 6e 64 72 6f 20 53 6f 66 74 77 61 72 65 20 47 6d 62 48 31 0b 30 Data Ascii: 55Z240408023755Z0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0"0*H0AZ T7;h8m&i6p4p]\|Zx1\{ZQ/3'h;jlaV
Jul 20, 2023 04:21:46.674112082 CEST	7	IN	Data Raw: 3c 1f 22 91 25 17 15 cc 42 82 da 3b a8 39 c7 2a 50 ca d9 4c a0 8c 95 33 75 03 70 b8 df a0 c9 b2 b2 8b 1b 38 83 79 32 c3 12 da 33 96 42 f4 91 11 aa c6 26 31 bc ea 43 8a 30 54 65 c5 43 9e 50 3b fa 91 93 0e 9d 3b 23 4a 3d 43 c1 c6 22 9b 68 af 2f fc Data Ascii: <"%B;9PL3up8y23B&1C0TeCP;;#J=C"h/R"j.P0N0UeyXW6\bG0U#0eyXW6\bG0U00HG`4%(^0VGv T=#
Jul 20, 2023 04:21:46.674153090 CEST	8	IN	Data Raw: ca b6 9b 39 e6 cf 27 d0 2c 99 74 d4 ca de 47 88 ed df f7 9c 3b ac 8a 62 d2 75 90 d9 00 81 d3 f8 c2 47 8e 9a bd 87 6d ce e5 9a 7f 28 76 a4 77 c6 3f b9 bf 4d f1 cb df 0f 2c 73 fe b4 60 e3 26 5e 83 f2 ae 36 56 94 e9 a7 9d a1 3d ca 5d 6e 3d 5d a8 6f Data Ascii: 9',tG;buGm(vw?M,s`&^6V=]n=]oh'g4E4{%QT?*Qd9wsfI+\+Wfp;q.Lgr:>4m`=D^!`l.:s&jA<O7A^>hz{\|h,g
Jul 20, 2023 04:21:46.687314987 CEST	9	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 33 30 37 32 30 31 31 32 31 Data Ascii: 000H010UAnyDesk Client0 230720112143Z20730707112143Z010UAnyDesk Client0"0H0h\otCUkE>1y"$Br<mW,SICh?`,$&+9)L7I
Jul 20, 2023 04:21:46.711287022 CEST	9	IN	Data Raw: 15 03 03 00 02 02 2d Data Ascii: -

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49702	185.229.191.41	80	C:\Users\user\Desktop\AnyDesk.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 04:21:51.789145947 CEST	19	OUT	Data Raw: 16 03 01 01 0d 01 00 01 09 03 03 e5 03 8b 39 e0 79 e2 9e 19 6f 46 a8 d1 a8 9f 55 7e af 94 18 aa 0f d4 96 c1 64 49 85 5f 61 76 10 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: 9yoFU~dI_avn0,($kjih98762.*&=5/+'#g@?>32101-)%</r#
Jul 20, 2023 04:21:51.815725088 CEST	20	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 3e 0d 7f ea 2d d1 8f b9 d5 1a 05 6f d3 7c 54 0c a1 87 a8 d3 ef ee f5 f3 44 4f 57 4e 47 52 44 01 20 00 76 32 3b c8 1e 73 db 24 58 dd de c5 13 aa c5 bf 85 a9 d2 c2 c3 2c 0f a3 1d 8a 2a 26 67 b7 fd c0 2c 00 00 0b ff Data Ascii: WS>-o\|TDOWNGRD v2;s$X,&g,C0?0'0vtS$0H0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0181118021423Z281115021
Jul 20, 2023 04:21:51.815751076 CEST	20	IN	Data Raw: e6 e8 20 b9 4b 8b bb 63 de 6f 65 6a 9f 5d d7 c1 97 9b 2d 30 4e 9a 81 85 b4 1c 92 a6 ed d8 7a f9 df 9d 03 b3 90 9c 78 a9 c8 ba 0e 3c ac ec 14 db 7d 51 b3 97 06 b9 f6 77 60 ab fe 59 83 af 8e 97 56 29 c7 db 7e 71 79 d1 c7 f7 da b6 c8 f7 af 8f 24 e0 Data Ascii: Kcoej]-0Nzx<}Qw`YV)~qy$ZG\|'SO^jl$\|XM+")+{n\&9S\|4xLp\|aZ.qDL\vq$;OroCs4\|z\8[TRxU>R
Jul 20, 2023 04:21:51.815773964 CEST	21	IN	Data Raw: 35 35 5a 17 0d 32 34 30 34 30 38 30 32 33 37 35 35 5a 30 48 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 4e 65 74 20 52 6f 6f 74 20 43 41 31 20 30 1e 06 03 55 04 0a 0c 17 70 68 69 6c 61 6e 64 72 6f 20 53 6f 66 74 77 61 72 65 20 47 6d 62 48 31 0b 30 Data Ascii: 55Z240408023755Z0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0"0*H0AZ T7;h8m&i6p4p]\|Zx1\{ZQ/3'h;jlaV
Jul 20, 2023 04:21:51.815794945 CEST	22	IN	Data Raw: 3c 1f 22 91 25 17 15 cc 42 82 da 3b a8 39 c7 2a 50 ca d9 4c a0 8c 95 33 75 03 70 b8 df a0 c9 b2 b2 8b 1b 38 83 79 32 c3 12 da 33 96 42 f4 91 11 aa c6 26 31 bc ea 43 8a 30 54 65 c5 43 9e 50 3b fa 91 93 0e 9d 3b 23 4a 3d 43 c1 c6 22 9b 68 af 2f fc Data Ascii: <"%B;9PL3up8y23B&1C0TeCP;;#J=C"h/R"j.P0N0UeyXW6\bG0U#0eyXW6\bG0U00HG`4%(^0VGv T=#
Jul 20, 2023 04:21:51.815818071 CEST	22	IN	Data Raw: ca b6 9b 39 e6 cf 27 d0 2c 99 74 d4 ca de 47 88 ed df f7 9c 3b ac 8a 62 d2 75 90 d9 00 81 d3 f8 c2 47 8e 9a bd 87 6d ce e5 9a 7f 28 76 a4 77 c6 3f b9 bf 4d f1 cb df 0f 2c 73 fe b4 60 e3 26 5e 83 f2 ae 36 56 94 e9 a7 9d a1 3d ca 5d 6e 3d 5d a8 6f Data Ascii: 9',tG;buGm(vw?M,s`&^6V=]n=]oh'g4E4{%QT?*Qd9wsfI+\+Wfp;q.Lgr:>4m`=D^!`l.:s&jA'O q'&uyns=Oi.DDq'\|Q
Jul 20, 2023 04:21:51.826652050 CEST	23	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 33 30 37 32 30 31 31 32 31 Data Ascii: 000H010UAnyDesk Client0 230720112143Z20730707112143Z010UAnyDesk Client0"0H0h\otCUkE>1y"$Br<mW,SICh?`,$&+9)L7I
Jul 20, 2023 04:21:51.850982904 CEST	23	IN	Data Raw: 15 03 03 00 02 02 2d Data Ascii: -

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49705	185.229.191.41	80	C:\Users\user\Desktop\AnyDesk.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 04:22:07.603523016 CEST	34	OUT	Data Raw: 16 03 01 01 0d 01 00 01 09 03 03 08 a2 d7 c0 72 d5 77 16 66 61 0e 09 72 e1 fe bf ba 91 ce 8d c7 26 ea a8 c7 c0 5c 88 51 cc 78 00 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: rwfar&\Qxn0,($kjih98762.*&=5/+'#g@?>32101-)%</r#
Jul 20, 2023 04:22:07.629625082 CEST	34	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 97 0a 10 10 f1 61 20 2e 62 4a 3f 33 86 9b 92 da a7 3a 47 13 c7 66 bb 6d 44 4f 57 4e 47 52 44 01 20 00 45 7d 09 7c 03 9f 55 a7 14 72 56 36 8b 15 03 ad 0c 48 db fe af 88 8c 7c ab 7a 2a 1a 18 cb 92 c0 2c 00 00 0b ff Data Ascii: WSa .bJ?3:GfmDOWNGRD E}\|UrV6H\|z,C0?0'0vtS$0H0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0181118021423Z281115021
Jul 20, 2023 04:22:07.629666090 CEST	35	IN	Data Raw: e6 e8 20 b9 4b 8b bb 63 de 6f 65 6a 9f 5d d7 c1 97 9b 2d 30 4e 9a 81 85 b4 1c 92 a6 ed d8 7a f9 df 9d 03 b3 90 9c 78 a9 c8 ba 0e 3c ac ec 14 db 7d 51 b3 97 06 b9 f6 77 60 ab fe 59 83 af 8e 97 56 29 c7 db 7e 71 79 d1 c7 f7 da b6 c8 f7 af 8f 24 e0 Data Ascii: Kcoej]-0Nzx<}Qw`YV)~qy$ZG\|'SO^jl$\|XM+")+{n\&9S\|4xLp\|aZ.qDL\vq$;OroCs4\|z\8[TRxU>R
Jul 20, 2023 04:22:07.629705906 CEST	36	IN	Data Raw: 35 35 5a 17 0d 32 34 30 34 30 38 30 32 33 37 35 35 5a 30 48 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 4e 65 74 20 52 6f 6f 74 20 43 41 31 20 30 1e 06 03 55 04 0a 0c 17 70 68 69 6c 61 6e 64 72 6f 20 53 6f 66 74 77 61 72 65 20 47 6d 62 48 31 0b 30 Data Ascii: 55Z240408023755Z0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0"0*H0AZ T7;h8m&i6p4p]\|Zx1\{ZQ/3'h;jlaV
Jul 20, 2023 04:22:07.629757881 CEST	36	IN	Data Raw: 3c 1f 22 91 25 17 15 cc 42 82 da 3b a8 39 c7 2a 50 ca d9 4c a0 8c 95 33 75 03 70 b8 df a0 c9 b2 b2 8b 1b 38 83 79 32 c3 12 da 33 96 42 f4 91 11 aa c6 26 31 bc ea 43 8a 30 54 65 c5 43 9e 50 3b fa 91 93 0e 9d 3b 23 4a 3d 43 c1 c6 22 9b 68 af 2f fc Data Ascii: <"%B;9PL3up8y23B&1C0TeCP;;#J=C"h/R"j.P0N0UeyXW6\bG0U#0eyXW6\bG0U00HG`4%(^0VGv T=#
Jul 20, 2023 04:22:07.629811049 CEST	37	IN	Data Raw: ca b6 9b 39 e6 cf 27 d0 2c 99 74 d4 ca de 47 88 ed df f7 9c 3b ac 8a 62 d2 75 90 d9 00 81 d3 f8 c2 47 8e 9a bd 87 6d ce e5 9a 7f 28 76 a4 77 c6 3f b9 bf 4d f1 cb df 0f 2c 73 fe b4 60 e3 26 5e 83 f2 ae 36 56 94 e9 a7 9d a1 3d ca 5d 6e 3d 5d a8 6f Data Ascii: 9',tG;buGm(vw?M,s`&^6V=]n=]oh'g4E4{%QT?*Qd9wsfI+\+Wfp;q.Lgr:>4m`=D^!`l.:s&jAy-qA~y:<AX'Yb`eh"
Jul 20, 2023 04:22:07.642312050 CEST	38	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 33 30 37 32 30 31 31 32 31 Data Ascii: 000H010UAnyDesk Client0 230720112143Z20730707112143Z010UAnyDesk Client0"0H0h\otCUkE>1y"$Br<mW,SICh?`,$&+9)L7I
Jul 20, 2023 04:22:07.666215897 CEST	38	IN	Data Raw: 15 03 03 00 02 02 2d Data Ascii: -

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49708	37.59.29.33	80	C:\Users\user\Desktop\AnyDesk.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 04:22:56.806111097 CEST	50	OUT	Data Raw: 16 03 01 01 0d 01 00 01 09 03 03 56 c5 69 bf 91 9d c6 8c e3 e9 bc a6 d4 e8 72 4a aa c3 36 7b e3 ad cd c3 22 47 58 e9 fd 90 c5 ea 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: VirJ6{"GXn0,($kjih98762.*&=5/+'#g@?>32101-)%</r#
Jul 20, 2023 04:22:56.828754902 CEST	51	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 30 0c 2c cc 45 30 ff 4c 59 cb 87 5b db 83 75 31 9b 1d ea b3 7c a0 d0 0e 44 4f 57 4e 47 52 44 01 20 f7 35 41 d8 61 2f 13 ca b9 83 2e 98 ee 59 1f 58 ef 0e a3 92 f1 74 dd 29 6a 3e 85 80 6b c4 62 0f c0 2c 00 00 0b ff Data Ascii: WS0,E0LY[u1\|DOWNGRD 5Aa/.YXt)j>kb,C0?0'0vtS$0*H0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0181118021423Z281115021
Jul 20, 2023 04:22:56.828803062 CEST	51	IN	Data Raw: e6 e8 20 b9 4b 8b bb 63 de 6f 65 6a 9f 5d d7 c1 97 9b 2d 30 4e 9a 81 85 b4 1c 92 a6 ed d8 7a f9 df 9d 03 b3 90 9c 78 a9 c8 ba 0e 3c ac ec 14 db 7d 51 b3 97 06 b9 f6 77 60 ab fe 59 83 af 8e 97 56 29 c7 db 7e 71 79 d1 c7 f7 da b6 c8 f7 af 8f 24 e0 Data Ascii: Kcoej]-0Nzx<}Qw`YV)~qy$ZG\|'SO^jl$\|XM+")+{n\&9S\|4xLp\|aZ.qDL\vq$;OroCs4\|z\8[TRxU>R
Jul 20, 2023 04:22:56.828844070 CEST	52	IN	Data Raw: 35 35 5a 17 0d 32 34 30 34 30 38 30 32 33 37 35 35 5a 30 48 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 4e 65 74 20 52 6f 6f 74 20 43 41 31 20 30 1e 06 03 55 04 0a 0c 17 70 68 69 6c 61 6e 64 72 6f 20 53 6f 66 74 77 61 72 65 20 47 6d 62 48 31 0b 30 Data Ascii: 55Z240408023755Z0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0"0*H0AZ T7;h8m&i6p4p]\|Zx1\{ZQ/3'h;jlaV
Jul 20, 2023 04:22:56.828883886 CEST	53	IN	Data Raw: 3c 1f 22 91 25 17 15 cc 42 82 da 3b a8 39 c7 2a 50 ca d9 4c a0 8c 95 33 75 03 70 b8 df a0 c9 b2 b2 8b 1b 38 83 79 32 c3 12 da 33 96 42 f4 91 11 aa c6 26 31 bc ea 43 8a 30 54 65 c5 43 9e 50 3b fa 91 93 0e 9d 3b 23 4a 3d 43 c1 c6 22 9b 68 af 2f fc Data Ascii: <"%B;9PL3up8y23B&1C0TeCP;;#J=C"h/R"j.P0N0UeyXW6\bG0U#0eyXW6\bG0U00HG`4%(^0VGv T=#
Jul 20, 2023 04:22:56.828927040 CEST	53	IN	Data Raw: ca b6 9b 39 e6 cf 27 d0 2c 99 74 d4 ca de 47 88 ed df f7 9c 3b ac 8a 62 d2 75 90 d9 00 81 d3 f8 c2 47 8e 9a bd 87 6d ce e5 9a 7f 28 76 a4 77 c6 3f b9 bf 4d f1 cb df 0f 2c 73 fe b4 60 e3 26 5e 83 f2 ae 36 56 94 e9 a7 9d a1 3d ca 5d 6e 3d 5d a8 6f Data Ascii: 9',tG;buGm(vw?M,s`&^6V=]n=]oh'g4E4{%QT?*Qd9wsfI+\+Wfp;q.Lgr:>4m`=D^!`l.:s&jA\|Z'\TVW ia>bl{ho
Jul 20, 2023 04:22:56.839869976 CEST	54	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 33 30 37 32 30 31 31 32 31 Data Ascii: 000H010UAnyDesk Client0 230720112143Z20730707112143Z010UAnyDesk Client0"0H0h\otCUkE>1y"$Br<mW,SICh?`,$&+9)L7I
Jul 20, 2023 04:22:56.860040903 CEST	54	IN	Data Raw: 15 03 03 00 02 02 2d Data Ascii: -

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49711	92.223.88.41	80	C:\Users\user\Desktop\AnyDesk.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 04:23:46.714478016 CEST	65	OUT	Data Raw: 16 03 01 01 0d 01 00 01 09 03 03 d5 04 58 5b d0 25 e0 3d 04 a2 e3 96 6e be 62 b4 f7 fb 19 df 23 f0 48 5c 7c 16 3b 13 41 cd a9 8d 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: X[%=nb#H\\|;An0,($kjih98762.*&=5/+'#g@?>32101-)%</r#
Jul 20, 2023 04:23:46.736746073 CEST	66	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 79 6a 9b 7d ea 2d 98 b4 5a 61 cf 07 ca 72 9a 66 ca 15 9b 44 a2 2e 15 de 44 4f 57 4e 47 52 44 01 20 81 ce 83 77 a6 3e b8 21 dd b6 d7 0e 13 1d d4 04 d5 18 a3 a2 99 50 1a aa 70 bf 57 ca 21 52 6a b7 c0 2c 00 00 0b ff Data Ascii: WSyj}-ZarfD.DOWNGRD w>!PpW!Rj,C0?0'0vtS$0*H0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0181118021423Z281115021
Jul 20, 2023 04:23:46.736799002 CEST	66	IN	Data Raw: e6 e8 20 b9 4b 8b bb 63 de 6f 65 6a 9f 5d d7 c1 97 9b 2d 30 4e 9a 81 85 b4 1c 92 a6 ed d8 7a f9 df 9d 03 b3 90 9c 78 a9 c8 ba 0e 3c ac ec 14 db 7d 51 b3 97 06 b9 f6 77 60 ab fe 59 83 af 8e 97 56 29 c7 db 7e 71 79 d1 c7 f7 da b6 c8 f7 af 8f 24 e0 Data Ascii: Kcoej]-0Nzx<}Qw`YV)~qy$ZG\|'SO^jl$\|XM+")+{n\&9S\|4xLp\|aZ.qDL\vq$;OroCs4\|z\8[TRxU>R
Jul 20, 2023 04:23:46.736824989 CEST	67	IN	Data Raw: 35 35 5a 17 0d 32 34 30 34 30 38 30 32 33 37 35 35 5a 30 48 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 4e 65 74 20 52 6f 6f 74 20 43 41 31 20 30 1e 06 03 55 04 0a 0c 17 70 68 69 6c 61 6e 64 72 6f 20 53 6f 66 74 77 61 72 65 20 47 6d 62 48 31 0b 30 Data Ascii: 55Z240408023755Z0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0"0*H0AZ T7;h8m&i6p4p]\|Zx1\{ZQ/3'h;jlaV
Jul 20, 2023 04:23:46.736861944 CEST	67	IN	Data Raw: 3c 1f 22 91 25 17 15 cc 42 82 da 3b a8 39 c7 2a 50 ca d9 4c a0 8c 95 33 75 03 70 b8 df a0 c9 b2 b2 8b 1b 38 83 79 32 c3 12 da 33 96 42 f4 91 11 aa c6 26 31 bc ea 43 8a 30 54 65 c5 43 9e 50 3b fa 91 93 0e 9d 3b 23 4a 3d 43 c1 c6 22 9b 68 af 2f fc Data Ascii: <"%B;9PL3up8y23B&1C0TeCP;;#J=C"h/R"j.P0N0UeyXW6\bG0U#0eyXW6\bG0U00HG`4%(^0VGv T=#
Jul 20, 2023 04:23:46.736901045 CEST	68	IN	Data Raw: ca b6 9b 39 e6 cf 27 d0 2c 99 74 d4 ca de 47 88 ed df f7 9c 3b ac 8a 62 d2 75 90 d9 00 81 d3 f8 c2 47 8e 9a bd 87 6d ce e5 9a 7f 28 76 a4 77 c6 3f b9 bf 4d f1 cb df 0f 2c 73 fe b4 60 e3 26 5e 83 f2 ae 36 56 94 e9 a7 9d a1 3d ca 5d 6e 3d 5d a8 6f Data Ascii: 9',tG;buGm(vw?M,s`&^6V=]n=]oh'g4E4{%QT?*Qd9wsfI+\+Wfp;q.Lgr:>4m`=D^!`l.:s&jA!4YGH"&XM#Z{/3%o.
Jul 20, 2023 04:23:46.757889032 CEST	69	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 33 30 37 32 30 31 31 32 31 Data Ascii: 000H010UAnyDesk Client0 230720112143Z20730707112143Z010UAnyDesk Client0"0H0h\otCUkE>1y"$Br<mW,SICh?`,$&+9)L7I
Jul 20, 2023 04:23:46.778275967 CEST	69	IN	Data Raw: 15 03 03 00 02 02 2d Data Ascii: -

Target ID:	0
Start time:	04:21:35
Start date:	20/07/2023
Path:	C:\Users\user\Desktop\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\AnyDesk.exe
Imagebase:	0x1e0000
File size:	4'040'776 bytes
MD5 hash:	30C9C57AA570088D745FAC7BFD05B805
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	04:21:38
Start date:	20/07/2023
Path:	C:\Users\user\Desktop\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AnyDesk.exe" --local-service
Imagebase:	0x1e0000
File size:	4'040'776 bytes
MD5 hash:	30C9C57AA570088D745FAC7BFD05B805
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	2
Start time:	04:21:38
Start date:	20/07/2023
Path:	C:\Users\user\Desktop\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AnyDesk.exe" --local-control
Imagebase:	0x1e0000
File size:	4'040'776 bytes
MD5 hash:	30C9C57AA570088D745FAC7BFD05B805
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Function 00654B20 Relevance: 70.4, APIs: 24, Strings: 16, Instructions: 361filesynchronizationtimeCOMMON

Download Yara Rule

APIs

_vswprintf_s.LIBCMT ref: 00654B87
WaitForSingleObject.KERNEL32(00000000,00000BB8), ref: 00654BA9
OutputDebugStringA.KERNEL32(AnyDesk: Mutex broken!), ref: 00654BD5
_strncmp.LIBCMT ref: 00654C17
_strncmp.LIBCMT ref: 00654C33
_strncpy.LIBCMT ref: 00654CC9
_strncpy.LIBCMT ref: 00654CE2
GetSystemTime.KERNEL32(?), ref: 00654D20
TlsGetValue.KERNEL32(00000023), ref: 00654D2A
__itow.LIBCMT ref: 00654D5C
GetCurrentThreadId.KERNEL32 ref: 00654DDA
GetCurrentProcessId.KERNEL32(00000000), ref: 00654DE1
__snprintf.LIBCMT ref: 00654E24
SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000002), ref: 00654E42
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00654E7B
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00654E8D
_memmove.LIBCMT ref: 00654EC1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00654ED3
WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00654EEC
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00654EFB
SetEndOfFile.KERNEL32(00000000), ref: 00654F05
WriteFile.KERNELBASE(00000000,?,?,?,00000000), ref: 00654F3B
RtlEnterCriticalSection.NTDLL(00E0F0D0), ref: 00654F97
RaiseException.KERNEL32(00002329,00000000,00000000,00000000), ref: 00654FA8

Strings

auth, xrefs: 00654DB1
AnyDesk: Mutex broken!, xrefs: 00654BD0
AnyDesk: Wait failed., xrefs: 00654BC2
invalid, xrefs: 00654DC6
front, xrefs: 00654DE8
intern, xrefs: 00654D87
debug, xrefs: 00654D8E
crash, xrefs: 00654DAA
warning, xrefs: 00654D9C, 00654E10
%d times: %s, xrefs: 00654C8B
info, xrefs: 00654D95
%7s %4i-%02i-%02i %02i:%02i:%02i.%03i %10s %6lu %6lu %4s %32s - %s, xrefs: 00654D69
AnyDesk: Timeout in trace., xrefs: 00654BC9
verbose, xrefs: 00654DBF
explode, xrefs: 00654DB8
error, xrefs: 00654DA3

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.754034174.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754054008.00000000001E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755691145.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755701667.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.758027102.000000000125F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: File$Pointer$CurrentWrite_strncmp_strncpy$CriticalDebugEnterExceptionObjectOutputProcessRaiseReadSectionSingleStringSystemThreadTimeValueWait__itow__snprintf_memmove_vswprintf_s
String ID: %d times: %s$%7s %4i-%02i-%02i %02i:%02i:%02i.%03i %10s %6lu %6lu %4s %32s - %s$AnyDesk: Mutex broken!$AnyDesk: Timeout in trace.$AnyDesk: Wait failed.$auth$crash$debug$error$explode$front$info$intern$invalid$verbose$warning
API String ID: 4093955403-2797980505
Opcode ID: 6e17c59fb72dca283b8895ed493402ab2ce80f030f5e2c052d687ce6f5a0f31d
Instruction ID: ca85d99a0f58cf666974d188e98c66a9082685a9ea28303e829f8c044d7e4a54
Opcode Fuzzy Hash: 6e17c59fb72dca283b8895ed493402ab2ce80f030f5e2c052d687ce6f5a0f31d
Instruction Fuzzy Hash: E2D1E3B1A00304ABDB14CF54DC88BEA7779BF88305F1445A9FE059B385DB74D988CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00654B20 Relevance: 68.6, APIs: 23, Strings: 16, Instructions: 361filesynchronizationtimeCOMMON

Download Yara Rule

APIs

_vswprintf_s.LIBCMT ref: 00654B87
WaitForSingleObject.KERNEL32(00000000,00000BB8), ref: 00654BA9
OutputDebugStringA.KERNEL32(AnyDesk: Mutex broken!), ref: 00654BD5
_strncmp.LIBCMT ref: 00654C17
_strncmp.LIBCMT ref: 00654C33
_strncpy.LIBCMT ref: 00654CC9
_strncpy.LIBCMT ref: 00654CE2
GetSystemTime.KERNEL32(?), ref: 00654D20
TlsGetValue.KERNEL32(00000023), ref: 00654D2A
__itow.LIBCMT ref: 00654D5C
GetCurrentThreadId.KERNEL32 ref: 00654DDA
GetCurrentProcessId.KERNEL32(00000000), ref: 00654DE1
__snprintf.LIBCMT ref: 00654E24
SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000002), ref: 00654E42
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00654E7B
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00654E8D
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00654ED3
WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00654EEC
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00654EFB
SetEndOfFile.KERNEL32(00000000), ref: 00654F05
WriteFile.KERNELBASE(00000000,?,?,?,00000000), ref: 00654F3B
EnterCriticalSection.KERNEL32(00E0F0D0), ref: 00654F97
RaiseException.KERNEL32(00002329,00000000,00000000,00000000), ref: 00654FA8

Strings

%d times: %s, xrefs: 00654C8B
crash, xrefs: 00654DAA
AnyDesk: Timeout in trace., xrefs: 00654BC9
intern, xrefs: 00654D87
invalid, xrefs: 00654DC6
AnyDesk: Wait failed., xrefs: 00654BC2
warning, xrefs: 00654D9C, 00654E10
AnyDesk: Mutex broken!, xrefs: 00654BD0
error, xrefs: 00654DA3
info, xrefs: 00654D95
%7s %4i-%02i-%02i %02i:%02i:%02i.%03i %10s %6lu %6lu %4s %32s - %s, xrefs: 00654D69
auth, xrefs: 00654DB1
explode, xrefs: 00654DB8
debug, xrefs: 00654D8E
front, xrefs: 00654DE8
verbose, xrefs: 00654DBF

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E5000, based on PE: true

Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: File$Pointer$CurrentWrite_strncmp_strncpy$CriticalDebugEnterExceptionObjectOutputProcessRaiseReadSectionSingleStringSystemThreadTimeValueWait__itow__snprintf_vswprintf_s
String ID: %d times: %s$%7s %4i-%02i-%02i %02i:%02i:%02i.%03i %10s %6lu %6lu %4s %32s - %s$AnyDesk: Mutex broken!$AnyDesk: Timeout in trace.$AnyDesk: Wait failed.$auth$crash$debug$error$explode$front$info$intern$invalid$verbose$warning
API String ID: 2471867934-2797980505
Opcode ID: 6e17c59fb72dca283b8895ed493402ab2ce80f030f5e2c052d687ce6f5a0f31d
Instruction ID: ca85d99a0f58cf666974d188e98c66a9082685a9ea28303e829f8c044d7e4a54
Opcode Fuzzy Hash: 6e17c59fb72dca283b8895ed493402ab2ce80f030f5e2c052d687ce6f5a0f31d
Instruction Fuzzy Hash: E2D1E3B1A00304ABDB14CF54DC88BEA7779BF88305F1445A9FE059B385DB74D988CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00654A00 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,?), ref: 00654A57
GetLastError.KERNEL32(?), ref: 00654A5D
CreateFileW.KERNELBASE(035C7BB0,C0000000,00000007,00000000,00000004,00000000,00000000,?), ref: 00654A99
GetLastError.KERNEL32 ref: 00654AAD
RevertToSelf.ADVAPI32 ref: 00654AD9
CloseHandle.KERNEL32(FFFFFFFF), ref: 00654AED

Part of subcall function 006547F0: GetCurrentProcess.KERNEL32(0000000C,?,00E0F0D0,?,00E0F0D0), ref: 00654806
Part of subcall function 006547F0: OpenProcessToken.ADVAPI32(00000000), ref: 0065480D
Part of subcall function 006547F0: GetTokenInformation.KERNELBASE(FFFFFFFF,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 00654832
Part of subcall function 006547F0: GetLastError.KERNEL32 ref: 00654838
Part of subcall function 006547F0: CloseHandle.KERNEL32(FFFFFFFF,?,00000000,00000000), ref: 00654850

Part of subcall function 006547A0: GetCurrentThread.KERNEL32 ref: 006547B6
Part of subcall function 006547A0: OpenThreadToken.ADVAPI32(00000000,?,00654A38,?), ref: 006547BD
Part of subcall function 006547A0: CloseHandle.KERNEL32(?,?,00654A38,?), ref: 006547D6

Part of subcall function 006548B0: GetCurrentProcessId.KERNEL32(?,00E0F0D0,00E0F0D0), ref: 006548D6
Part of subcall function 006548B0: ProcessIdToSessionId.KERNEL32(00000000), ref: 006548DD
Part of subcall function 006548B0: ImpersonateLoggedOnUser.ADVAPI32(00000000), ref: 00654912

Strings

Couldn't impersonate (%08lx)., xrefs: 00654A64
Couldn't open the trace file (%08lx)., xrefs: 00654AB4

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.754034174.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754054008.00000000001E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755691145.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755701667.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.758027102.000000000125F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: CloseHandleProcess$CurrentErrorLastToken$OpenThread$CreateFileImpersonateInformationLoggedRevertSelfSessionUser
String ID: Couldn't impersonate (%08lx).$Couldn't open the trace file (%08lx).
API String ID: 432512558-3770443821
Opcode ID: 7236af6e59c34e850337743eae2533856ae2d5c7c305aaaf1872197ab7bc94bb
Instruction ID: 64cfb409c0f0dd7a84973822d28d2f48ccf541f9746e088b1a7abaf10a6ab569
Opcode Fuzzy Hash: 7236af6e59c34e850337743eae2533856ae2d5c7c305aaaf1872197ab7bc94bb
Instruction Fuzzy Hash: 642129301883406BEB645B749C097953B95BF0132FF048385FDA4923D9EBB495CD879A

Uniqueness

Uniqueness Score: -1.00%

Function 00654A00 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,?), ref: 00654A57
GetLastError.KERNEL32(?), ref: 00654A5D
CreateFileW.KERNELBASE(035C7BB0,C0000000,00000007,00000000,00000004,00000000,00000000,?), ref: 00654A99
GetLastError.KERNEL32 ref: 00654AAD
RevertToSelf.ADVAPI32 ref: 00654AD9
CloseHandle.KERNEL32(FFFFFFFF), ref: 00654AED

Part of subcall function 006547F0: GetCurrentProcess.KERNEL32(0000000C,?,00E0F0D0,?,00E0F0D0), ref: 00654806
Part of subcall function 006547F0: OpenProcessToken.ADVAPI32(00000000), ref: 0065480D
Part of subcall function 006547F0: GetTokenInformation.KERNELBASE(FFFFFFFF,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 00654832
Part of subcall function 006547F0: GetLastError.KERNEL32 ref: 00654838
Part of subcall function 006547F0: CloseHandle.KERNEL32(FFFFFFFF,?,00000000,00000000), ref: 00654850

Part of subcall function 006547A0: GetCurrentThread.KERNEL32 ref: 006547B6
Part of subcall function 006547A0: OpenThreadToken.ADVAPI32(00000000,?,00654A38,?), ref: 006547BD
Part of subcall function 006547A0: CloseHandle.KERNEL32(?,?,00654A38,?), ref: 006547D6

Part of subcall function 006548B0: GetCurrentProcessId.KERNEL32(?,00E0F0D0,00E0F0D0), ref: 006548D6
Part of subcall function 006548B0: ProcessIdToSessionId.KERNEL32(00000000), ref: 006548DD
Part of subcall function 006548B0: ImpersonateLoggedOnUser.ADVAPI32(00000000), ref: 00654912

Strings

Couldn't open the trace file (%08lx)., xrefs: 00654AB4
Couldn't impersonate (%08lx)., xrefs: 00654A64

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E5000, based on PE: true

Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: CloseHandleProcess$CurrentErrorLastToken$OpenThread$CreateFileImpersonateInformationLoggedRevertSelfSessionUser
String ID: Couldn't impersonate (%08lx).$Couldn't open the trace file (%08lx).
API String ID: 432512558-3770443821
Opcode ID: 7236af6e59c34e850337743eae2533856ae2d5c7c305aaaf1872197ab7bc94bb
Instruction ID: 64cfb409c0f0dd7a84973822d28d2f48ccf541f9746e088b1a7abaf10a6ab569
Opcode Fuzzy Hash: 7236af6e59c34e850337743eae2533856ae2d5c7c305aaaf1872197ab7bc94bb
Instruction Fuzzy Hash: 642129301883406BEB645B749C097953B95BF0132FF048385FDA4923D9EBB495CD879A

Uniqueness

Uniqueness Score: -1.00%

Function 00658970 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32(00658AB7,00000000,?,0069AD2A,?,?,?,0081D058,000000FF,006BE32B), ref: 00658979
TlsGetValue.KERNEL32(?,?,00658AB7,00000000,?,0069AD2A,?,?,?,0081D058,000000FF,006BE32B), ref: 00658991
GetLastError.KERNEL32(?,0069AD2A,?,?,?,0081D058,000000FF,006BE32B), ref: 0065899D
_memset.LIBCMT ref: 006589C9
TlsSetValue.KERNEL32(?,00000000), ref: 006589D8

Strings

Please contact support@anydesk.com (A), xrefs: 00658989
Please contact support@anydesk.com (B), xrefs: 006589A7

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.754034174.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754054008.00000000001E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755691145.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755701667.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.758027102.000000000125F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: Value$AllocErrorLast_memset
String ID: Please contact support@anydesk.com (A)$Please contact support@anydesk.com (B)
API String ID: 4091103580-43624127
Opcode ID: 808e69a9f6922165b37be5171210d764c548a11ee2a506526f9a146d02f65404
Instruction ID: 7a9b71996f63dafa84d53a33254dde867dcd1703d82f78b69e04e0025b91b7d1
Opcode Fuzzy Hash: 808e69a9f6922165b37be5171210d764c548a11ee2a506526f9a146d02f65404
Instruction Fuzzy Hash: 77016DB0B042215FCA206BBD7C0DBDB3A59BF047A6F055550FD04E7394DB28CD458AD2

Uniqueness

Uniqueness Score: -1.00%

Function 00658970 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32(00658AB7,00000000,?,0069AD2A,?,?,?,0081D058,000000FF,006BE32B), ref: 00658979
TlsGetValue.KERNEL32(?,?,00658AB7,00000000,?,0069AD2A,?,?,?,0081D058,000000FF,006BE32B), ref: 00658991
GetLastError.KERNEL32(?,0069AD2A,?,?,?,0081D058,000000FF,006BE32B), ref: 0065899D
_memset.LIBCMT ref: 006589C9
TlsSetValue.KERNEL32(?,00000000), ref: 006589D8

Strings

Please contact support@anydesk.com (B), xrefs: 006589A7
Please contact support@anydesk.com (A), xrefs: 00658989

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E5000, based on PE: true

Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: Value$AllocErrorLast_memset
String ID: Please contact support@anydesk.com (A)$Please contact support@anydesk.com (B)
API String ID: 4091103580-43624127
Opcode ID: 808e69a9f6922165b37be5171210d764c548a11ee2a506526f9a146d02f65404
Instruction ID: 7a9b71996f63dafa84d53a33254dde867dcd1703d82f78b69e04e0025b91b7d1
Opcode Fuzzy Hash: 808e69a9f6922165b37be5171210d764c548a11ee2a506526f9a146d02f65404
Instruction Fuzzy Hash: 77016DB0B042215FCA206BBD7C0DBDB3A59BF047A6F055550FD04E7394DB28CD458AD2

Uniqueness

Uniqueness Score: -1.00%

Function 006547F0 Relevance: 12.1, APIs: 8, Instructions: 81COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000C,?,00E0F0D0,?,00E0F0D0), ref: 00654806
OpenProcessToken.ADVAPI32(00000000), ref: 0065480D
GetTokenInformation.KERNELBASE(FFFFFFFF,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 00654832
GetLastError.KERNEL32 ref: 00654838
CloseHandle.KERNEL32(FFFFFFFF,?,00000000,00000000), ref: 00654850
GetTokenInformation.KERNELBASE(FFFFFFFF,00000001(TokenIntegrityLevel),?,00000000,00000000), ref: 0065487A
FindCloseChangeNotification.KERNELBASE(FFFFFFFF,?,00000000,00000000), ref: 0065488D
IsWellKnownSid.ADVAPI32(?,00000016,?,00000000,00000000), ref: 00654898

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.754034174.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754054008.00000000001E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755691145.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755701667.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.758027102.000000000125F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: Token$CloseInformationProcess$ChangeCurrentErrorFindHandleKnownLastNotificationOpenWell
String ID:
API String ID: 3729429321-0
Opcode ID: 1ff7f9c609ce90b518f8226656905b80a8a5e2d1ced564da397a3449b3c499fa
Instruction ID: c8ee0638ddcca473c20f8c39332aa495b8d9f4d3b56cd99a3c764035d14ff17e
Opcode Fuzzy Hash: 1ff7f9c609ce90b518f8226656905b80a8a5e2d1ced564da397a3449b3c499fa
Instruction Fuzzy Hash: 69219531A00209BBDF24DBA5DC89BEE777DEB44726F100294F919E32D0EA34DE498661

Uniqueness

Uniqueness Score: -1.00%

Function 006547F0 Relevance: 12.1, APIs: 8, Instructions: 81COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000C,?,00E0F0D0,?,00E0F0D0), ref: 00654806
OpenProcessToken.ADVAPI32(00000000), ref: 0065480D
GetTokenInformation.KERNELBASE(FFFFFFFF,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 00654832
GetLastError.KERNEL32 ref: 00654838
CloseHandle.KERNEL32(FFFFFFFF,?,00000000,00000000), ref: 00654850
GetTokenInformation.KERNELBASE(FFFFFFFF,00000001(TokenIntegrityLevel),?,00000000,00000000), ref: 0065487A
FindCloseChangeNotification.KERNELBASE(FFFFFFFF,?,00000000,00000000), ref: 0065488D
IsWellKnownSid.ADVAPI32(?,00000016,?,00000000,00000000), ref: 00654898

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E5000, based on PE: true

Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: Token$CloseInformationProcess$ChangeCurrentErrorFindHandleKnownLastNotificationOpenWell
String ID:
API String ID: 3729429321-0
Opcode ID: 1ff7f9c609ce90b518f8226656905b80a8a5e2d1ced564da397a3449b3c499fa
Instruction ID: c8ee0638ddcca473c20f8c39332aa495b8d9f4d3b56cd99a3c764035d14ff17e
Opcode Fuzzy Hash: 1ff7f9c609ce90b518f8226656905b80a8a5e2d1ced564da397a3449b3c499fa
Instruction Fuzzy Hash: 69219531A00209BBDF24DBA5DC89BEE777DEB44726F100294F919E32D0EA34DE498661

Uniqueness

Uniqueness Score: -1.00%

Function 007B3449 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 007B3457

Part of subcall function 007B2E11: __FF_MSGBANNER.LIBCMT ref: 007B2E2A
Part of subcall function 007B2E11: __NMSG_WRITE.LIBCMT ref: 007B2E31
Part of subcall function 007B2E11: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 007B2E56

_free.LIBCMT ref: 007B346A

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.754034174.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754054008.00000000001E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755691145.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755701667.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.758027102.000000000125F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 921742a7061394c6ecdf8dadc06960754608895e990ca451b4f5f0b45ffe8ea3
Instruction ID: 529c6914f1d98016b87a25e35a547e4eedbc62aaa29fbccf15ff4cfea1eda1c7
Opcode Fuzzy Hash: 921742a7061394c6ecdf8dadc06960754608895e990ca451b4f5f0b45ffe8ea3
Instruction Fuzzy Hash: E011C632504611EBCB2B3B74AC097FA3B94AF843B1F204965F8489B151EA3CCEC18690

Uniqueness

Uniqueness Score: -1.00%

Function 006BE340 Relevance: 7.5, APIs: 5, Instructions: 44comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 006BE359
SetEvent.KERNEL32(?,?,?,?,0081D058,000000FF,006BE32B), ref: 006BE371
OleUninitialize.OLE32(?,?,?,0081D058,000000FF,006BE32B), ref: 006BE397
TlsGetValue.KERNEL32(?,?,?,?,0081D058,000000FF,006BE32B), ref: 006BE3A7
TlsSetValue.KERNEL32(?,00000000), ref: 006BE3BF

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.754034174.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754054008.00000000001E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755691145.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755701667.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.758027102.000000000125F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: Value$EventInitializeUninitialize
String ID:
API String ID: 566941487-0
Opcode ID: 025ab91d98ff6f438b582c16eb3c65a364d9456363f624f99b6cd8247454a6b2
Instruction ID: 4933bc8d6f15ab6be991ebf5230c0ec180ad3cf92ef2394fde8f1b257466d4e2
Opcode Fuzzy Hash: 025ab91d98ff6f438b582c16eb3c65a364d9456363f624f99b6cd8247454a6b2
Instruction Fuzzy Hash: 86017CF5600780ABD714AF64DC0AB8F7AA9FB44B15F40492DF816C3791EB39E5048B52

Uniqueness

Uniqueness Score: -1.00%

Function 006BE340 Relevance: 7.5, APIs: 5, Instructions: 44comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 006BE359
SetEvent.KERNEL32(?,?,?,?,0081D058,000000FF,006BE32B), ref: 006BE371
OleUninitialize.OLE32(?,?,?,0081D058,000000FF,006BE32B), ref: 006BE397
TlsGetValue.KERNEL32(?,?,?,?,0081D058,000000FF,006BE32B), ref: 006BE3A7
TlsSetValue.KERNEL32(?,00000000), ref: 006BE3BF

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E5000, based on PE: true

Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: Value$EventInitializeUninitialize
String ID:
API String ID: 566941487-0
Opcode ID: 025ab91d98ff6f438b582c16eb3c65a364d9456363f624f99b6cd8247454a6b2
Instruction ID: 4933bc8d6f15ab6be991ebf5230c0ec180ad3cf92ef2394fde8f1b257466d4e2
Opcode Fuzzy Hash: 025ab91d98ff6f438b582c16eb3c65a364d9456363f624f99b6cd8247454a6b2
Instruction Fuzzy Hash: 86017CF5600780ABD714AF64DC0AB8F7AA9FB44B15F40492DF816C3791EB39E5048B52

Uniqueness

Uniqueness Score: -1.00%

Function 001E19FE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 71memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,00000028,00000004,00000000,001E1CCE,?), ref: 001E1A84
VirtualProtect.KERNELBASE(?,00000028,00000000,00000000), ref: 001E1A9B

Strings

.text, xrefs: 001E1A22
.itext, xrefs: 001E1A54

Memory Dump Source

Source File: 00000000.00000002.754054008.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.754034174.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755691145.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755701667.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.758027102.000000000125F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: ProtectVirtual
String ID: .itext$.text
API String ID: 544645111-3616233406
Opcode ID: 74ce0cd50155d71dc77191982885c5d2f1000c3d6a698e34811674743fdaabd4
Instruction ID: 0d656eca4f70b408d403a79f6aa0c45c9dce2139474d45a64a8f2d0ebf1812a7
Opcode Fuzzy Hash: 74ce0cd50155d71dc77191982885c5d2f1000c3d6a698e34811674743fdaabd4
Instruction Fuzzy Hash: E211E17A641B80BAC720CF92DC81ABEB3F8EB44740F048539F946E7141E370E984D760

Uniqueness

Uniqueness Score: -1.00%

Function 006C0D10 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(advapi32.dll,00E0F0D0,?,0065512D), ref: 006C0D29
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 006C0D49
_free.LIBCMT ref: 006C0D74

Part of subcall function 007B1DCE: RtlFreeHeap.NTDLL(00000000,00000000,?,006BE3B3,00000000,?,?,?,0081D058,000000FF,006BE32B), ref: 007B1DE4

Strings

advapi32.dll, xrefs: 006C0D28, 006C0D50

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.754034174.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754054008.00000000001E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755691145.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755701667.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.758027102.000000000125F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: ErrorFreeHeapLastLibraryLoad_free
String ID: advapi32.dll
API String ID: 1383136612-4050573280
Opcode ID: c1cfdc07158009a4f26bf9f9851a4c8c83e4e702f9acc513b7931505c0653158
Instruction ID: f06763f85fa9190edec61aee6f84e0d2873d9e9c1c928bf22f410d1d0c338462
Opcode Fuzzy Hash: c1cfdc07158009a4f26bf9f9851a4c8c83e4e702f9acc513b7931505c0653158
Instruction Fuzzy Hash: C8016DB0504B41EFDB01AF68DD09B6BBBE9FF44704F44492CF895C2281E738E5048B92

Uniqueness

Uniqueness Score: -1.00%

Function 006C0D10 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(advapi32.dll,00E0F0D0,?,0065512D), ref: 006C0D29
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 006C0D49
_free.LIBCMT ref: 006C0D74

Part of subcall function 007B1DCE: RtlFreeHeap.NTDLL(00000000,00000000,?,006BE3B3,00000000,?,?,?,0081D058,000000FF,006BE32B), ref: 007B1DE4

Strings

advapi32.dll, xrefs: 006C0D28, 006C0D50

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E5000, based on PE: true

Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: ErrorFreeHeapLastLibraryLoad_free
String ID: advapi32.dll
API String ID: 1383136612-4050573280
Opcode ID: c1cfdc07158009a4f26bf9f9851a4c8c83e4e702f9acc513b7931505c0653158
Instruction ID: f06763f85fa9190edec61aee6f84e0d2873d9e9c1c928bf22f410d1d0c338462
Opcode Fuzzy Hash: c1cfdc07158009a4f26bf9f9851a4c8c83e4e702f9acc513b7931505c0653158
Instruction Fuzzy Hash: C8016DB0504B41EFDB01AF68DD09B6BBBE9FF44704F44492CF895C2281E738E5048B92

Uniqueness

Uniqueness Score: -1.00%

Function 006C0D90 Relevance: 4.5, APIs: 3, Instructions: 38COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(D0AA70B8,000000FF,006551A0,?), ref: 006C0DB3
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 006C0DD1
_free.LIBCMT ref: 006C0DFB

Part of subcall function 007B1DCE: RtlFreeHeap.NTDLL(00000000,00000000,?,006BE3B3,00000000,?,?,?,0081D058,000000FF,006BE32B), ref: 007B1DE4

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.754034174.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754054008.00000000001E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755691145.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755701667.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.758027102.000000000125F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: Free$ErrorHeapLastLibrary_free
String ID:
API String ID: 1013596455-0
Opcode ID: 6504f170d9f3761be1c80f8e397ba57c20cec0da1b9c42b9866b1ac85274e972
Instruction ID: 1099321968aa382891c017308c1bbad556762e566d377895a3d7b6737d956009
Opcode Fuzzy Hash: 6504f170d9f3761be1c80f8e397ba57c20cec0da1b9c42b9866b1ac85274e972
Instruction Fuzzy Hash: F70128B1548781EBD714DB28D949B6BBBE9EB44B04F048D2CF89583281EB38D508CA92

Uniqueness

Uniqueness Score: -1.00%

Function 006C0D90 Relevance: 4.5, APIs: 3, Instructions: 38COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(D0AA70B8,000000FF,006551A0,?), ref: 006C0DB3
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 006C0DD1
_free.LIBCMT ref: 006C0DFB

Part of subcall function 007B1DCE: RtlFreeHeap.NTDLL(00000000,00000000,?,006BE3B3,00000000,?,?,?,0081D058,000000FF,006BE32B), ref: 007B1DE4

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E5000, based on PE: true

Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: Free$ErrorHeapLastLibrary_free
String ID:
API String ID: 1013596455-0
Opcode ID: 6504f170d9f3761be1c80f8e397ba57c20cec0da1b9c42b9866b1ac85274e972
Instruction ID: 1099321968aa382891c017308c1bbad556762e566d377895a3d7b6737d956009
Opcode Fuzzy Hash: 6504f170d9f3761be1c80f8e397ba57c20cec0da1b9c42b9866b1ac85274e972
Instruction Fuzzy Hash: F70128B1548781EBD714DB28D949B6BBBE9EB44B04F048D2CF89583281EB38D508CA92

Uniqueness

Uniqueness Score: -1.00%

Function 001E1000 Relevance: 1.6, APIs: 1, Instructions: 107memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,001E1B87,?,?,?,00C9AE00,001E4000,00CAAE00,?), ref: 001E1045

Memory Dump Source

Source File: 00000000.00000002.754054008.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.754034174.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755691145.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755701667.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.758027102.000000000125F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8ad0bd426fc4e14450ebb4a25b13beb1236773bfd8cb879707df8a141987a14b
Instruction ID: 54761177000f3280d4f00f7910b52bc26caca93adfcee139e58bbd275b6124c0
Opcode Fuzzy Hash: 8ad0bd426fc4e14450ebb4a25b13beb1236773bfd8cb879707df8a141987a14b
Instruction Fuzzy Hash: 444162B1600B41DFC724CF26C480A6AB7F5FF58300B15892EE59A87B51E375F885CB94

Uniqueness

Uniqueness Score: -1.00%

Function 007C0E3A Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 007C0E7D

Part of subcall function 007B7E11: __getptd_noexit.LIBCMT ref: 007B7E11

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.754034174.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754054008.00000000001E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755691145.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755701667.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.758027102.000000000125F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: 3d8f96ccdaca469e3cde31a65c198db06d94b27c15be9d75c9a17f6236fac5ee
Instruction ID: 1c581ea095ebca03258d8d7056ff19f970a903c6f0af85d567e133cd25ae1580
Opcode Fuzzy Hash: 3d8f96ccdaca469e3cde31a65c198db06d94b27c15be9d75c9a17f6236fac5ee
Instruction Fuzzy Hash: 8F01BC35281215DEEB29AF26EC04F6B3798AF81760F044E6DE8159A2A0D778DC0087D0

Uniqueness

Uniqueness Score: -1.00%

Function 007C0E3A Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,007BC61A,00000000,?,00000000,00000000,00000000,?,007BBBFD,00000001,00000214,?,006BE3B3), ref: 007C0E7D

Part of subcall function 007B7E11: __getptd_noexit.LIBCMT ref: 007B7E11

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E5000, based on PE: true

Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: 3d8f96ccdaca469e3cde31a65c198db06d94b27c15be9d75c9a17f6236fac5ee
Instruction ID: 1c581ea095ebca03258d8d7056ff19f970a903c6f0af85d567e133cd25ae1580
Opcode Fuzzy Hash: 3d8f96ccdaca469e3cde31a65c198db06d94b27c15be9d75c9a17f6236fac5ee
Instruction Fuzzy Hash: 8F01BC35281215DEEB29AF26EC04F6B3798AF81760F044E6DE8159A2A0D778DC0087D0

Uniqueness

Uniqueness Score: -1.00%

Function 007B187A Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

Part of subcall function 007B88A1: __lock.LIBCMT ref: 007B88A3

__onexit_nolock.LIBCMT ref: 007B1892

Part of subcall function 007B1793: RtlDecodePointer.NTDLL(00E0E280), ref: 007B17A8
Part of subcall function 007B1793: RtlDecodePointer.NTDLL ref: 007B17B5
Part of subcall function 007B1793: __realloc_crt.LIBCMT ref: 007B17F2
Part of subcall function 007B1793: __realloc_crt.LIBCMT ref: 007B1808
Part of subcall function 007B1793: RtlEncodePointer.NTDLL(00000000), ref: 007B181A
Part of subcall function 007B1793: RtlEncodePointer.NTDLL(88735C9C), ref: 007B182E
Part of subcall function 007B1793: RtlEncodePointer.NTDLL(-00000004), ref: 007B1836

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.754034174.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754054008.00000000001E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755691145.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755701667.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.758027102.000000000125F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: Pointer$Encode$Decode__realloc_crt$__lock__onexit_nolock
String ID:
API String ID: 3536590627-0
Opcode ID: 9cd0044eb54b81a033b0f69306856660e54284963a22f9da685293f954cf2775
Instruction ID: e49268b8b053002ca51c566a25cfcde2281d411b178650d0b282c3c63adf9eb6
Opcode Fuzzy Hash: 9cd0044eb54b81a033b0f69306856660e54284963a22f9da685293f954cf2775
Instruction Fuzzy Hash: A6D01730C00208EBDB51BBB4C84A7ED7AB06F00360FA08224B0206A1D2CB784A019A42

Uniqueness

Uniqueness Score: -1.00%

Function 001E1E47 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,?,?,?,?,?,?,?,?,?,?), ref: 001E1E5A

Memory Dump Source

Source File: 00000000.00000002.754054008.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.754034174.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755691145.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755701667.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.758027102.000000000125F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 722487abafa2aa7fe7a2b97ebcdf7c96eaf21c411cc9b0b2ed849caaf068380e
Instruction ID: a0b96f6f22ae37a3c573544786e36b4ab6a660cf8f21fa9ca7e2c01393dee882
Opcode Fuzzy Hash: 722487abafa2aa7fe7a2b97ebcdf7c96eaf21c411cc9b0b2ed849caaf068380e
Instruction Fuzzy Hash: 6BC04C36504222EFCB505F94F84CED6BFA4FF48765F068844F24997075C7309985CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001E1E30 Relevance: 1.5, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,?,001E1CD9,?,?), ref: 001E1E44

Memory Dump Source

Source File: 00000000.00000002.754054008.00000000001E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.754034174.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755691145.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755701667.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.758027102.000000000125F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 56edc7cb021cecf31ea5bbac919d9f964c63399dea68fcd26ce47e517e1ad725
Instruction ID: fe334bb8925e44280d0be03eba1d0ed1c3a4a44bfc44f2ea0612260657863031
Opcode Fuzzy Hash: 56edc7cb021cecf31ea5bbac919d9f964c63399dea68fcd26ce47e517e1ad725
Instruction Fuzzy Hash: 19C04C35114211EFCB519F54E88CF15BBE4FB88B15F054484F119C7264C63099009B52

Uniqueness

Uniqueness Score: -1.00%

Function 007BBA5E Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 007BBA60

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.754034174.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754054008.00000000001E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755691145.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755701667.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.758027102.000000000125F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 973a668acb3be6cf8afaa4fed982f163581d47a39b62adb2ac2ac1b95859eb04
Instruction ID: 6713ded726f824ffbbb91e2a699c131020a8bd706f400bb828ffd7bed6344937
Opcode Fuzzy Hash: 973a668acb3be6cf8afaa4fed982f163581d47a39b62adb2ac2ac1b95859eb04
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 007BBA5E Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,007CA6ED,00E0E308,00000314,00000000,?,?,?,?,?,007BADDB,00E0E308,Microsoft Visual C++ Runtime Library,00012010), ref: 007BBA60

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E5000, based on PE: true

Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 973a668acb3be6cf8afaa4fed982f163581d47a39b62adb2ac2ac1b95859eb04
Instruction ID: 6713ded726f824ffbbb91e2a699c131020a8bd706f400bb828ffd7bed6344937
Opcode Fuzzy Hash: 973a668acb3be6cf8afaa4fed982f163581d47a39b62adb2ac2ac1b95859eb04
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 007C38F9 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 007CCA3A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 007CCA4F
UnhandledExceptionFilter.KERNEL32(00867B44), ref: 007CCA5A
GetCurrentProcess.KERNEL32(C0000409), ref: 007CCA76
TerminateProcess.KERNEL32(00000000), ref: 007CCA7D

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.754034174.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754054008.00000000001E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755691145.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755701667.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.758027102.000000000125F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 43293af0f280e5e8c29bfe9fdd2c2e02008d4764dc05b79c466b28fb836ddf88
Instruction ID: 93bc06a50a5ad369710700ee705a5bdb53ff05e8c8c7a51184e343b527c786a9
Opcode Fuzzy Hash: 43293af0f280e5e8c29bfe9fdd2c2e02008d4764dc05b79c466b28fb836ddf88
Instruction Fuzzy Hash: 0C2103B8410308DFD708DF66FD89A547BB4FB08305F10486AE819A7360E7B659C9CF56

Uniqueness

Uniqueness Score: -1.00%

Function 007C38F9 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 007CCA3A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 007CCA4F
UnhandledExceptionFilter.KERNEL32(00867B44), ref: 007CCA5A
GetCurrentProcess.KERNEL32(C0000409), ref: 007CCA76
TerminateProcess.KERNEL32(00000000), ref: 007CCA7D

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E5000, based on PE: true

Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 43293af0f280e5e8c29bfe9fdd2c2e02008d4764dc05b79c466b28fb836ddf88
Instruction ID: 93bc06a50a5ad369710700ee705a5bdb53ff05e8c8c7a51184e343b527c786a9
Opcode Fuzzy Hash: 43293af0f280e5e8c29bfe9fdd2c2e02008d4764dc05b79c466b28fb836ddf88
Instruction Fuzzy Hash: 0C2103B8410308DFD708DF66FD89A547BB4FB08305F10486AE819A7360E7B659C9CF56

Uniqueness

Uniqueness Score: -1.00%

Function 004242D0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 006C0D10: LoadLibraryW.KERNELBASE(advapi32.dll,00E0F0D0,?,0065512D), ref: 006C0D29
Part of subcall function 006C0D10: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 006C0D49
Part of subcall function 006C0D10: _free.LIBCMT ref: 006C0D74

GetProcAddress.KERNEL32(00000000,ConvertStringSecurityDescriptorToSecurityDescriptorW), ref: 004242F6
GetProcAddress.KERNEL32(00426560,OpenEventLogA), ref: 00424310
GetProcAddress.KERNEL32(0042ED80,CloseEventLog), ref: 0042432A
GetProcAddress.KERNEL32(0064F960,ReportEventA), ref: 00424344
GetProcAddress.KERNEL32(00426570,CreateProcessWithTokenW), ref: 0042435E

Strings

advapi32.dll, xrefs: 004242D4
ReportEventA, xrefs: 0042433E
ConvertStringSecurityDescriptorToSecurityDescriptorW, xrefs: 004242F0
CreateProcessWithTokenW, xrefs: 00424358
OpenEventLogA, xrefs: 0042430A
CloseEventLog, xrefs: 00424324

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.754034174.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754054008.00000000001E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755691145.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755701667.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.758027102.000000000125F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: AddressProc$ErrorLastLibraryLoad_free
String ID: CloseEventLog$ConvertStringSecurityDescriptorToSecurityDescriptorW$CreateProcessWithTokenW$OpenEventLogA$ReportEventA$advapi32.dll
API String ID: 1327587910-3518705215
Opcode ID: 059faddfc10c68309d280ba2e7b71d04b9e7196d2253d18151612642cef86550
Instruction ID: a90c875adbcfde57d837c49966f76bebe88b3919109edd2b3cf9ed7eac2be9e4
Opcode Fuzzy Hash: 059faddfc10c68309d280ba2e7b71d04b9e7196d2253d18151612642cef86550
Instruction Fuzzy Hash: 0511BE70B01627A69B50DE6AAD00F176AE8EF90B90754443AEC15E7344E778EC518BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004242D0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 006C0D10: LoadLibraryW.KERNELBASE(advapi32.dll,00E0F0D0,?,0065512D), ref: 006C0D29
Part of subcall function 006C0D10: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 006C0D49
Part of subcall function 006C0D10: _free.LIBCMT ref: 006C0D74

GetProcAddress.KERNEL32(00000000,ConvertStringSecurityDescriptorToSecurityDescriptorW), ref: 004242F6
GetProcAddress.KERNEL32(00426560,OpenEventLogA), ref: 00424310
GetProcAddress.KERNEL32(0042ED80,CloseEventLog), ref: 0042432A
GetProcAddress.KERNEL32(0064F960,ReportEventA), ref: 00424344
GetProcAddress.KERNEL32(00426570,CreateProcessWithTokenW), ref: 0042435E

Strings

advapi32.dll, xrefs: 004242D4
CreateProcessWithTokenW, xrefs: 00424358
OpenEventLogA, xrefs: 0042430A
CloseEventLog, xrefs: 00424324
ReportEventA, xrefs: 0042433E
ConvertStringSecurityDescriptorToSecurityDescriptorW, xrefs: 004242F0

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E5000, based on PE: true

Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: AddressProc$ErrorLastLibraryLoad_free
String ID: CloseEventLog$ConvertStringSecurityDescriptorToSecurityDescriptorW$CreateProcessWithTokenW$OpenEventLogA$ReportEventA$advapi32.dll
API String ID: 1327587910-3518705215
Opcode ID: 059faddfc10c68309d280ba2e7b71d04b9e7196d2253d18151612642cef86550
Instruction ID: a90c875adbcfde57d837c49966f76bebe88b3919109edd2b3cf9ed7eac2be9e4
Opcode Fuzzy Hash: 059faddfc10c68309d280ba2e7b71d04b9e7196d2253d18151612642cef86550
Instruction Fuzzy Hash: 0511BE70B01627A69B50DE6AAD00F176AE8EF90B90754443AEC15E7344E778EC518BA8

Uniqueness

Uniqueness Score: -1.00%

Function 007BB264 Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 007BB270

Part of subcall function 007BBC4B: __getptd_noexit.LIBCMT ref: 007BBC4E
Part of subcall function 007BBC4B: __amsg_exit.LIBCMT ref: 007BBC5B

__amsg_exit.LIBCMT ref: 007BB290
__lock.LIBCMT ref: 007BB2A0
InterlockedDecrement.KERNEL32(?), ref: 007BB2BD
_free.LIBCMT ref: 007BB2D0
InterlockedIncrement.KERNEL32(035C1608), ref: 007BB2E8

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.754034174.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754054008.00000000001E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755691145.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755701667.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.758027102.000000000125F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 5362f0794ceb9700fef4ba3f5c4c65d138e55c22e5a294d9428bcfbee9a65fec
Instruction ID: da97c8f85a4395ec26596be68429c720b726e51f12aed01be69331a311d0a75d
Opcode Fuzzy Hash: 5362f0794ceb9700fef4ba3f5c4c65d138e55c22e5a294d9428bcfbee9a65fec
Instruction Fuzzy Hash: C6016D32E01721EBDB26AF64994A7DD77A0BF00751F440119EC04A7690DBBCAD45CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 007BB264 Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 007BB270

Part of subcall function 007BBC4B: __getptd_noexit.LIBCMT ref: 007BBC4E
Part of subcall function 007BBC4B: __amsg_exit.LIBCMT ref: 007BBC5B

__amsg_exit.LIBCMT ref: 007BB290
__lock.LIBCMT ref: 007BB2A0
InterlockedDecrement.KERNEL32(?), ref: 007BB2BD
_free.LIBCMT ref: 007BB2D0
InterlockedIncrement.KERNEL32(035C1608), ref: 007BB2E8

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E5000, based on PE: true

Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: c0a20e2327574d35d1f63028ca82b8382071ddefd6456915bc2d8f31fb40e9a7
Instruction ID: da97c8f85a4395ec26596be68429c720b726e51f12aed01be69331a311d0a75d
Opcode Fuzzy Hash: c0a20e2327574d35d1f63028ca82b8382071ddefd6456915bc2d8f31fb40e9a7
Instruction Fuzzy Hash: C6016D32E01721EBDB26AF64994A7DD77A0BF00751F440119EC04A7690DBBCAD45CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 007CAEDF Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 007CAF13
__isleadbyte_l.LIBCMT ref: 007CAF46
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?,?,?), ref: 007CAF77
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?,?,?), ref: 007CAFE5

Memory Dump Source

Source File: 00000000.00000002.754087693.00000000001E6000.00000020.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.754034174.00000000001E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754054008.00000000001E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754071083.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.754911482.000000000085E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755426440.0000000000D66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755531909.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755569823.0000000000E18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755578773.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755691145.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.755701667.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.758027102.000000000125F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_AnyDesk.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 40f8dec0e2936f910dcf5dae14b710b6bb97b5bb4a84748a0b45d726cd90a979
Instruction ID: 833badcfff1567b2aa9e43fe2140744e65d6d7a2e2f1f653af5d98271e77bc05
Opcode Fuzzy Hash: 40f8dec0e2936f910dcf5dae14b710b6bb97b5bb4a84748a0b45d726cd90a979
Instruction Fuzzy Hash: 31319DB1A00249FFDB20DFA4C884EAA3BA5AF0131AB1885ADF4618B191E734DD40DB52

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AnyDesk.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\AnyDesk\ad.trace

C:\Users\user\AppData\Roaming\AnyDesk\service.conf

C:\Users\user\AppData\Roaming\AnyDesk\system.conf

C:\Users\user\AppData\Roaming\AnyDesk\user.conf

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UIPE613PREQBT8ELO3WS.temp

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
AnyDesk.exe