Edit tour

Windows Analysis Report
livechat.exe

Overview

General Information

Sample Name:	livechat.exe
Analysis ID:	1291241
MD5:	30c9c57aa570088d745fac7bfd05b805
SHA1:	d579d18848859614e219afa6332d410e0ca71fc3
SHA256:	8cd552392bb25546ba58e73d63c4b7c290188ca1060f96c8abf641ae9f5a8383
Infos:

Detection

Score:	51
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses 32bit PE files

Tries to disable installed Antivirus / HIPS / PFW

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Queries information about the installed CPU (vendor, model number etc)

PE file does not import any functions

Sample file is different than original file name gathered from version info

OS version to string mapping found (often used in BOTs)

Tries to load missing DLLs

Detected TCP or UDP traffic on non-standard ports

Creates a window with clipboard capturing capabilities

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Creates a process in suspended mode (likely to inject code)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Classification

Process Tree

System is w7x64

livechat.exe (PID: 1808 cmdline: C:\Users\user\Desktop\livechat.exe MD5: 30C9C57AA570088D745FAC7BFD05B805)

livechat.exe (PID: 2236 cmdline: "C:\Users\user\Desktop\livechat.exe" --local-service MD5: 30C9C57AA570088D745FAC7BFD05B805)

livechat.exe (PID: 2512 cmdline: "C:\Users\user\Desktop\livechat.exe" --local-control MD5: 30C9C57AA570088D745FAC7BFD05B805)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: livechat.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 49.12.130.235:443 -> 192.168.2.22:49164 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.223.88.232:443 -> 192.168.2.22:49167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.223.88.41:443 -> 192.168.2.22:49170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.223.88.41:443 -> 192.168.2.22:49173 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.223.88.41:443 -> 192.168.2.22:49177 version: TLS 1.2

Source: livechat.exe

Static PE information: certificate valid

Source: livechat.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dda-64\privacy_feature\privacy_feature.pdb source: livechat.exe, 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748502343.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm-32\win_dwm\win_dwm.pdb source: livechat.exe, 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748502343.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_loader\AnyDesk.pdb source: livechat.exe, 00000000.00000002.748670498.0000000000DCF000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000000.356130739.0000000000DCF000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm-64\win_dwm\win_dwm.pdb source: livechat.exe, 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748502343.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dda-32\privacy_feature\privacy_feature.pdb source: livechat.exe, 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748502343.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: SAS.pdbR source: livechat.exe, 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748502343.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: SAS.pdb source: livechat.exe, 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748502343.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp

Source: Joe Sandbox View

JA3 fingerprint: c91bde19008eefabce276152ccd51457

Source: Joe Sandbox View	IP Address: 92.223.88.232 92.223.88.232
Source: Joe Sandbox View	IP Address: 92.223.88.41 92.223.88.41

Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 185.229.191.41:6568
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 49.12.130.236:6568
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 92.223.88.41:6568
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 49.12.130.235:6568

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49177 -> 443

Source: livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ad.share.fbook.href=https://www.facebook.com/sharer/sharer.php?u=https%3A//anydesk.com/ equals www.facebook.com (Facebook)
Source: livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ad.share.linkedin.href=https://www.linkedin.com/shareArticle?mini=true&url=https%3A//anydesk.com/&title=Try%20AnyDesk%20Remote%20Desktop&summary=AnyDesk%20is%20a%20small%20and%20quick%20solution%20for%20screen%20sharing%20and%20remote%20collaboration.%20Get%20it%20here%3A%20https%3A//anydesk.com/&source= equals www.linkedin.com (Linkedin)
Source: livechat.exe, 00000000.00000002.751546899.00000000015DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: livechat.exe, 00000000.00000002.751546899.00000000015DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.linkedin.comf equals www.linkedin.com (Linkedin)

Source: livechat.exe, 00000000.00000002.752250597.0000000001976000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobedek
Source: livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://support.anydesk.com
Source: livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.opengl.org/registry/
Source: livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.openssl.org/)
Source: livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://anydesk.com
Source: livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://anydesk.com/
Source: livechat.exe, 00000000.00000002.752485240.0000000003B90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/9
Source: livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/company#imprint
Source: livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/contact/sales
Source: livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://anydesk.com/contact/sales)
Source: livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://anydesk.com/order
Source: livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/pricing/teams
Source: livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://anydesk.com/pricing/teams)
Source: livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://anydesk.com/privacy
Source: livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://anydesk.com/terms
Source: livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://anydesk.com/update
Source: livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://boot-01.net.anydesk.com
Source: livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000003.358213598.0000000001530000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://boot.net.anydesk.comabcdefABCDEFtruefalsetfInvalid
Source: livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://console-ui.myanydesk2.on.anydesk.com
Source: livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1524/
Source: livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1526/
Source: livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1914/
Source: livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com
Source: livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/
Source: livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/$
Source: livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/HelpLinkInstallLocationAnyDesk
Source: livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/access
Source: livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/backup-alias
Source: livechat.exe, 00000000.00000002.751892651.0000000001727000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.751546899.00000000015DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/en/share
Source: livechat.exe, 00000000.00000002.751546899.00000000015DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/en/shared
Source: livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/it/abuse
Source: livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/it/android
Source: livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/it/android-battery
Source: livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/lt/abuse
Source: livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/lt/android
Source: livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/lt/android-battery
Source: livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/share
Source: livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/wol
Source: livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.com
Source: livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://my.anydesk.com/password-generator.
Source: livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.com/v2
Source: livechat.exe, 00000000.00000002.751546899.000000000156D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.com/v2.t
Source: livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://order.anydesk.com/trial
Source: livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://policies.google.com/privacy
Source: livechat.exe, 00000000.00000002.751546899.000000000156D000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.751546899.00000000015DE000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/privacy?hl=$
Source: livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://policies.google.com/privacy?hl=it
Source: livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.anydesk.com/
Source: livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.anydesk.com/AnyDesk_on_macOS
Source: livechat.exe, 00000000.00000002.751546899.000000000156D000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/account-migration
Source: livechat.exe, 00000000.00000002.751546899.00000000015DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/account-migration.
Source: livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/anydesk-account
Source: livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000000.00000002.752485240.0000000003B90000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/anydesk-for-android-chromeos#troubleshooting
Source: livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/my-anydesk-ii#user-management
Source: livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/users
Source: livechat.exe, 00000000.00000002.751546899.000000000156D000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/home?status=Do%20you%20know%20%23AnyDesk?%20AnyDesk%20is%20a%20small%20and%20qui
Source: livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html
Source: livechat.exe, 00000000.00000002.751546899.000000000156D000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/$
Source: livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/intl/it/chrome/privacy/eula_text.html
Source: livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.linkedin.com/shareArticle?mini=true&url=https%3A//anydesk.com/&title=Try%20AnyDesk%20Rem
Source: livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.nayuki.io/page/qr-code-generator-library

Source: unknown

DNS traffic detected: queries for: boot.net.anydesk.com

Source: unknown	HTTPS traffic detected: 49.12.130.235:443 -> 192.168.2.22:49164 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.223.88.232:443 -> 192.168.2.22:49167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.223.88.41:443 -> 192.168.2.22:49170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.223.88.41:443 -> 192.168.2.22:49173 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.223.88.41:443 -> 192.168.2.22:49177 version: TLS 1.2

Source: livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: DirectDrawCreateEx

Source: C:\Users\user\Desktop\livechat.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: livechat.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: livechat.exe

Static PE information: No import functions for PE file found

Source: livechat.exe, 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesas.dllj% vs livechat.exe
Source: livechat.exe, 00000000.00000003.354635646.000000000170D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentshrui.dll.muij% vs livechat.exe
Source: livechat.exe, 00000002.00000002.748502343.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesas.dllj% vs livechat.exe

Source: C:\Users\user\Desktop\livechat.exe

Section loaded: shcore.dll

Jump to behavior

Source: C:\Users\user\Desktop\livechat.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Memory allocated: 771D0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Memory allocated: 771D0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Memory allocated: 771D0000 page execute and read and write	Jump to behavior

Source: C:\Users\user\Desktop\livechat.exe

File read: C:\Users\user\Desktop\livechat.exe

Jump to behavior

Source: livechat.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\livechat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\livechat.exe C:\Users\user\Desktop\livechat.exe
Source: C:\Users\user\Desktop\livechat.exe	Process created: C:\Users\user\Desktop\livechat.exe "C:\Users\user\Desktop\livechat.exe" --local-service
Source: C:\Users\user\Desktop\livechat.exe	Process created: C:\Users\user\Desktop\livechat.exe "C:\Users\user\Desktop\livechat.exe" --local-control
Source: C:\Users\user\Desktop\livechat.exe	Process created: C:\Users\user\Desktop\livechat.exe "C:\Users\user\Desktop\livechat.exe" --local-service	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Process created: C:\Users\user\Desktop\livechat.exe "C:\Users\user\Desktop\livechat.exe" --local-control	Jump to behavior

Source: C:\Users\user\Desktop\livechat.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\livechat.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM Win32_Processor

Source: C:\Users\user\Desktop\livechat.exe

File created: C:\Users\user\AppData\Roaming\AnyDesk

Jump to behavior

Source: classification engine

Classification label: mal51.evad.winEXE@5/6@15/5

Source: C:\Users\user\Desktop\livechat.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\livechat.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_2512_728737765_0_mtx
Source: C:\Users\user\Desktop\livechat.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_1808_693949704_1_mtx
Source: C:\Users\user\Desktop\livechat.exe	Mutant created: \Sessions\1\BaseNamedObjects\Session\1\ad_connect_queue_2236_724057756_mtx
Source: C:\Users\user\Desktop\livechat.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_7113_lsystem_mtx
Source: C:\Users\user\Desktop\livechat.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_2512_728737765_1_mtx
Source: C:\Users\user\Desktop\livechat.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_1808_693949704_0_mtx
Source: C:\Users\user\Desktop\livechat.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_trace_mtx

Source: C:\Users\user\Desktop\livechat.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: C:\Users\user\Desktop\livechat.exe

Window found: window name: SysTabControl32

Jump to behavior

Source: livechat.exe

Static file information: File size 4040776 > 1048576

Source: livechat.exe

Static PE information: certificate valid

Source: livechat.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x3ce200

Source: livechat.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: livechat.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dda-64\privacy_feature\privacy_feature.pdb source: livechat.exe, 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748502343.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm-32\win_dwm\win_dwm.pdb source: livechat.exe, 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748502343.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_loader\AnyDesk.pdb source: livechat.exe, 00000000.00000002.748670498.0000000000DCF000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000000.356130739.0000000000DCF000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm-64\win_dwm\win_dwm.pdb source: livechat.exe, 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748502343.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dda-32\privacy_feature\privacy_feature.pdb source: livechat.exe, 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748502343.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: SAS.pdbR source: livechat.exe, 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748502343.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: SAS.pdb source: livechat.exe, 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748502343.0000000000CA6000.00000004.00000001.01000000.00000003.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\livechat.exe	Unpacked PE file: 0.2.livechat.exe.120000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\livechat.exe	Unpacked PE file: 2.2.livechat.exe.120000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\livechat.exe	Unpacked PE file: 3.2.livechat.exe.120000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Source: C:\Users\user\Desktop\livechat.exe

Code function: 0_2_006FC415 push ecx; ret

0_2_006FC428

Source: C:\Users\user\Desktop\livechat.exe

Code function: 0_2_0070A6C7 LoadLibraryW,GetProcAddress,GetProcAddress,RtlEncodePointer,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

0_2_0070A6C7

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\livechat.exe

File opened: C:\Users\user\Desktop\livechat.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\livechat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Users\user\Desktop\livechat.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_PhysicalMemory

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Users\user\Desktop\livechat.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_PhysicalMemory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\livechat.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\livechat.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter = TRUE

Source: C:\Users\user\Desktop\livechat.exe TID: 2704	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe TID: 3048	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe TID: 3168	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe TID: 976	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe TID: 2704	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe TID: 3168	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe TID: 3120	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe TID: 3120	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe TID: 3136	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe TID: 3140	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe TID: 3144	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe TID: 3136	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\livechat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\livechat.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM Win32_Processor

Source: C:\Users\user\Desktop\livechat.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_BaseBoard

Source: C:\Users\user\Desktop\livechat.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\livechat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\livechat.exe

Code function: 0_2_006FAAED _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_006FAAED

Source: C:\Users\user\Desktop\livechat.exe

0_2_0070A6C7

Source: C:\Users\user\Desktop\livechat.exe

Memory protected: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\livechat.exe	Code function: 0_2_006FAAED _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_006FAAED
Source: C:\Users\user\Desktop\livechat.exe	Code function: 0_2_007038F9 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_007038F9

Source: C:\Users\user\Desktop\livechat.exe

File opened: Windows Firewall: C:\Windows\SysWOW64\FirewallAPI.dll

Jump to behavior

Source: C:\Users\user\Desktop\livechat.exe	Process created: C:\Users\user\Desktop\livechat.exe "C:\Users\user\Desktop\livechat.exe" --local-service			Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Process created: C:\Users\user\Desktop\livechat.exe "C:\Users\user\Desktop\livechat.exe" --local-control			Jump to behavior

Source: C:\Users\user\Desktop\livechat.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Queries volume information: C:\Users\user\Desktop\livechat.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\livechat.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\livechat.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\livechat.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\livechat.exe

Code function: 0_2_00594B20 _vswprintf_s,WaitForSingleObject,OutputDebugStringA,_strncmp,_strncmp,_strncpy,_strncpy,GetSystemTime,TlsGetValue,__itow,GetCurrentThreadId,GetCurrentProcessId,__snprintf,SetFilePointer,SetFilePointer,ReadFile,_memmove,SetFilePointer,WriteFile,SetFilePointer,SetEndOfFile,WriteFile,RtlEnterCriticalSection,RaiseException,

0_2_00594B20

Source: livechat.exe, 00000003.00000002.748573593.0000000000D51000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: b44b97caebbcaac9745bd6b5822bd03ee298d6bfrelease/win_7.1.xcc0bc82657f3409854116e83c8d7018c
Source: livechat.exe, 00000003.00000002.748573593.0000000000D51000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: release/win_7.1.x
Source: livechat.exe, 00000002.00000002.751679074.000000000152C000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: b44b97caebbcaac9745bd6b5822bd03ee298d6bfrelease/win_7.1.xcc0bc82657f3409854116e83c8d7018c0
Source: livechat.exe, 00000002.00000000.356130739.0000000000DCF000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: .itext.text.customcc0bc82657f3409854116e83c8d7018crelease/win_7.1.xb44b97caebbcaac9745bd6b5822bd03ee298d6bf

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	421 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	1 Input Capture	1 System Time Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	LSASS Memory	42 Security Software Discovery	Remote Desktop Protocol	1 Clipboard Data	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	331 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	331 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Software Packing	DCSync	134 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
livechat.exe	0%	ReversingLabs
livechat.exe	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://ns.adobedek	0%	Avira URL Cloud	safe
https://boot.net.anydesk.comabcdefABCDEFtruefalsetfInvalid	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
boot.net.anydesk.com	49.12.130.235	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://support.anydesk.com/knowledge/users	livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.anydesk.com/	livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://order.anydesk.com/trial	livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://anydesk.com/update	livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.google.com/chrome/privacy/eula_text.html	livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.google.com/intl/$	livechat.exe, 00000000.00000002.751546899.000000000156D000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.anydesk.com/lt/abuse	livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://help.anydesk.com/lt/android-battery	livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://my.anydesk.com	livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.anydesk.com/it/abuse	livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://help.anydesk.com/it/android-battery	livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://twitter.com/home?status=Do%20you%20know%20%23AnyDesk?%20AnyDesk%20is%20a%20small%20and%20qui	livechat.exe, 00000000.00000002.751546899.000000000156D000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://my.anydesk.com/v2.t	livechat.exe, 00000000.00000002.751546899.000000000156D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.anydesk.com/knowledge/my-anydesk-ii#user-management	livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://anydesk.com/	livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://anydesk.com/privacy	livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://datatracker.ietf.org/ipr/1526/	livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.nayuki.io/page/qr-code-generator-library	livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://policies.google.com/privacy?hl=it	livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://policies.google.com/privacy?hl=$	livechat.exe, 00000000.00000002.751546899.000000000156D000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.751546899.00000000015DE000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.anydesk.com	livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.anydesk.com/AnyDesk_on_macOS	livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://anydesk.com/pricing/teams	livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.anydesk.com/en/shared	livechat.exe, 00000000.00000002.751546899.00000000015DE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://datatracker.ietf.org/ipr/1914/	livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://anydesk.com/terms	livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://support.anydesk.com/knowledge/account-migration	livechat.exe, 00000000.00000002.751546899.000000000156D000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://anydesk.com/9	livechat.exe, 00000000.00000002.752485240.0000000003B90000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/intl/it/chrome/privacy/eula_text.html	livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://anydesk.com/order	livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://help.anydesk.com/backup-alias	livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://help.anydesk.com/en/share	livechat.exe, 00000000.00000002.751892651.0000000001727000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.751546899.00000000015DE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://anydesk.com/contact/sales	livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.anydesk.com/it/android	livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://my.anydesk.com/password-generator.	livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://help.anydesk.com/	livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://anydesk.com	livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://support.anydesk.com/knowledge/anydesk-for-android-chromeos#troubleshooting	livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000000.00000002.752485240.0000000003B90000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.opengl.org/registry/	livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://anydesk.com/contact/sales)	livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://help.anydesk.com/lt/android	livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://help.anydesk.com/wol	livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://help.anydesk.com/$	livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.linkedin.com/shareArticle?mini=true&url=https%3A//anydesk.com/&title=Try%20AnyDesk%20Rem	livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://console-ui.myanydesk2.on.anydesk.com	livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://support.anydesk.com	livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://help.anydesk.com/HelpLinkInstallLocationAnyDesk	livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://boot-01.net.anydesk.com	livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://datatracker.ietf.org/ipr/1524/	livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://my.anydesk.com/v2	livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://policies.google.com/privacy	livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://anydesk.com/company#imprint	livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.openssl.org/)	livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://anydesk.com/pricing/teams)	livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://support.anydesk.com/knowledge/account-migration.	livechat.exe, 00000000.00000002.751546899.00000000015DE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.anydesk.com/access	livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://help.anydesk.com/share	livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false		high
http://ns.adobedek	livechat.exe, 00000000.00000002.752250597.0000000001976000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://boot.net.anydesk.comabcdefABCDEFtruefalsetfInvalid	livechat.exe, 00000000.00000003.352057710.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000003.358213598.0000000001530000.00000004.00000020.00020000.00000000.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.748011249.000000000079E000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/anydesk-account	livechat.exe, 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000002.00000002.748017981.000000000079E000.00000002.00000001.01000000.00000003.sdmp, livechat.exe, 00000003.00000002.751754465.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
92.223.88.232	unknown	Austria	199524	GCOREAT	false
92.223.88.41	unknown	Austria	199524	GCOREAT	false
49.12.130.235	boot.net.anydesk.com	Germany	24940	HETZNER-ASDE	false
49.12.130.236	unknown	Germany	24940	HETZNER-ASDE	false
185.229.191.41	unknown	Czech Republic	60068	CDN77GB	false

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1291241
Start date and time:	2023-08-15 06:47:33 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	livechat.exe
Detection:	MAL
Classification:	mal51.evad.winEXE@5/6@15/5
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 209.197.3.8, 8.238.191.254, 8.238.190.126, 67.27.237.126, 8.238.137.126, 67.27.237.254
Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, wu-bg-shim.trafficmanager.net
Report creation exceeded maximum time and may have missing disassembly code information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
92.223.88.232	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Unknown	Browse
	Microsoft.exe	Get hash	malicious	Unknown	Browse
	AnyDesk (4).exe	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Vidar	Browse
	AnyDesk (1).exe	Get hash	malicious	Unknown	Browse
	AnyDeskUninst5265.exe	Get hash	malicious	Unknown	Browse
	Vostel-Anydesk.EXE	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Unknown	Browse
	AnyDesk_ETS_WIN.exe	Get hash	malicious	Unknown	Browse
	nqG4It8G4V.exe	Get hash	malicious	Unknown	Browse
92.223.88.41	AnyDesk.exe	Get hash	malicious	Unknown	Browse
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse
	Microsoft.exe	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Unknown	Browse
	1.msi	Get hash	malicious	Unknown	Browse
	sJ9Q8UWMAX.exe	Get hash	malicious	CryptOne, Mofksys	Browse
	AnyDesk (5).exe	Get hash	malicious	Unknown	Browse
	AnyDesk (4).exe	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Vidar	Browse
	AnyDesk (1).exe	Get hash	malicious	Unknown	Browse
	Vostel-Anydesk.EXE	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
boot.net.anydesk.com	AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.39
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	49.12.130.236
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse	92.223.88.232
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.41
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.39
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	49.12.130.236
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.44
	92f25a21-b9c1-4aee-af3e-cacf098605e9	Get hash	malicious	Unknown	Browse	185.229.191.41
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	49.12.130.236
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	49.12.130.235
	https://anydesk.com/en/downloads/windows?dv=win_exe	Get hash	malicious	Unknown	Browse	49.12.130.237
	migrate.120.exe	Get hash	malicious	DCRat, EICAR	Browse	49.12.130.235
	AnyDesk.msi	Get hash	malicious	Unknown	Browse	185.229.191.39
	AnyDesk(1).msi	Get hash	malicious	Unknown	Browse	185.229.191.44

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GCOREAT	FhykODbaLL.elf	Get hash	malicious	Mirai	Browse	92.38.145.176
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	92.223.88.41
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse	92.223.88.41
	http://reg.ru	Get hash	malicious	Unknown	Browse	92.223.124.62
	x86.elf	Get hash	malicious	Mirai	Browse	185.101.139.100
	http://britobarros.com.de/	Get hash	malicious	Unknown	Browse	92.38.169.194
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	92.223.88.232
	https://hacktotherescue.org/register	Get hash	malicious	Unknown	Browse	92.223.124.62
	https://hacktotherescue.org/register	Get hash	malicious	Unknown	Browse	92.223.124.62
	https://hacktotherescue.org/register	Get hash	malicious	Unknown	Browse	92.223.124.62
	KD_MEDICAL_POLSKA_23053371.exe	Get hash	malicious	FormBook, GuLoader	Browse	92.38.150.138
	s4YvlK74zJ.exe	Get hash	malicious	FormBook, GuLoader	Browse	92.38.150.138
	AnyDesk-CM.msi	Get hash	malicious	Unknown	Browse	92.223.88.7
	mirai.x86	Get hash	malicious	Mirai	Browse	92.38.169.68
	jWo6k2nNpZ.elf	Get hash	malicious	Mirai	Browse	92.38.145.194
	z1Mb_NFEmitida1.msi	Get hash	malicious	Unknown	Browse	5.188.0.116
	TCKOnNwV84.elf	Get hash	malicious	Mirai, Moobot	Browse	92.223.113.37
GCOREAT	FhykODbaLL.elf	Get hash	malicious	Mirai	Browse	92.38.145.176
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	92.223.88.41
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse	92.223.88.41
	http://reg.ru	Get hash	malicious	Unknown	Browse	92.223.124.62
	x86.elf	Get hash	malicious	Mirai	Browse	185.101.139.100
	http://britobarros.com.de/	Get hash	malicious	Unknown	Browse	92.38.169.194
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	92.223.88.232
	https://hacktotherescue.org/register	Get hash	malicious	Unknown	Browse	92.223.124.62
	https://hacktotherescue.org/register	Get hash	malicious	Unknown	Browse	92.223.124.62
	https://hacktotherescue.org/register	Get hash	malicious	Unknown	Browse	92.223.124.62
	KD_MEDICAL_POLSKA_23053371.exe	Get hash	malicious	FormBook, GuLoader	Browse	92.38.150.138
	s4YvlK74zJ.exe	Get hash	malicious	FormBook, GuLoader	Browse	92.38.150.138
	AnyDesk-CM.msi	Get hash	malicious	Unknown	Browse	92.223.88.7
	mirai.x86	Get hash	malicious	Mirai	Browse	92.38.169.68
	jWo6k2nNpZ.elf	Get hash	malicious	Mirai	Browse	92.38.145.194
	z1Mb_NFEmitida1.msi	Get hash	malicious	Unknown	Browse	5.188.0.116
	TCKOnNwV84.elf	Get hash	malicious	Mirai, Moobot	Browse	92.223.113.37

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
c91bde19008eefabce276152ccd51457	AnyDesk.exe	Get hash	malicious	Unknown	Browse	49.12.130.235 92.223.88.232 92.223.88.41
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	49.12.130.235 92.223.88.232 92.223.88.41
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse	49.12.130.235 92.223.88.232 92.223.88.41
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	49.12.130.235 92.223.88.232 92.223.88.41
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	49.12.130.235 92.223.88.232 92.223.88.41
	AnyDesk (2).exe	Get hash	malicious	Unknown	Browse	49.12.130.235 92.223.88.232 92.223.88.41
	AnyDesk (2).exe	Get hash	malicious	Unknown	Browse	49.12.130.235 92.223.88.232 92.223.88.41
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	49.12.130.235 92.223.88.232 92.223.88.41
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	49.12.130.235 92.223.88.232 92.223.88.41
	92f25a21-b9c1-4aee-af3e-cacf098605e9	Get hash	malicious	Unknown	Browse	49.12.130.235 92.223.88.232 92.223.88.41
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	49.12.130.235 92.223.88.232 92.223.88.41
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	49.12.130.235 92.223.88.232 92.223.88.41
	AnyDesk(1).msi	Get hash	malicious	Unknown	Browse	49.12.130.235 92.223.88.232 92.223.88.41
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	49.12.130.235 92.223.88.232 92.223.88.41

Process:	C:\Users\user\Desktop\livechat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	58887
Entropy (8bit):	4.335819244689175
Encrypted:	false
SSDEEP:	384:QJbtuCdHL0tO/6fl7ye0RCcDXj+svJzwg6kCPoPuDK8d:QptuqHyfQ2ctzSbK8d
MD5:	8D273B627CA8BB610411E7339A90C2A0
SHA1:	FAAEF31C7CF4E8FCD55867DF1E06E5B18F5F2B63
SHA-256:	C77D3638E597E0821E50AB6DB5D97748EAC36F2D71311C6797522C03C02D2E13
SHA-512:	547DB541ABDB04C15BDC7713C8609F5780C93648A3184059295D3D3A8ADF9E1E6CE6F2D807466895A8AA23F4AD82AA4EF29FA7AC58B0A190B8FB4B873E152581
Malicious:	false
Reputation:	low
Preview:	* * * * * * * * * * * * * * * * * .. info 2023-08-15 13:48:26.835 front 1808 1812 main - AnyDesk Windows Startup .. info 2023-08-15 13:48:26.835 front 1808 1812 main - Version 7.1.13 (release/win_7.1.x b44b97caebbcaac9745bd6b5822bd03ee298d6bf).. info 2023-08-15 13:48:26.835 front 1808 1812 main - * Checksum cc0bc82657f3409854116e83c8d7018c.. info 2023-08-15 13:48:26.835 front 1808 1812 main - * Build 20230627141804.. info 2023-08-15 13:48:26.835 front 1808 1812 main - * Copyright (C) 2023 AnyDesk Software GmbH *.. info 2023-08-15 13:48:26.835 front 1808 1812 main - .. info 2023-08-15 13:48:26.835 front 1808 1812 main - Command Line params: "C:\Users\user\Desktop\livechat.exe"

C:\Users\user\AppData\Roaming\AnyDesk\service.conf

Download File

Process:	C:\Users\user\Desktop\livechat.exe
File Type:	ASCII text, with very long lines (1747)
Category:	dropped
Size (bytes):	2762
Entropy (8bit):	6.02807612561272
Encrypted:	false
SSDEEP:	48:uISTT7iT6/oSHbmGDPINeAkhU+j01CQzoTiIMHhBaptztjKC7+CiaY6OV8D9WndW:uISTXiTOoSHNDP6eAk1YTHhIPzIOiaYg
MD5:	B98C9520F44726D142E5072B4BD1E2C9
SHA1:	3850D2CB5330A53588584445ABE922B014E52A0D
SHA-256:	76CBD310C00AA486418B1EA31F656DB6DBE5B022040037FE8F038F6042A9859F
SHA-512:	735BF3AB71E69A1066C1E4C6033329CAEA1B95FBFF7458D6B88A9DCDB114590B0F4E78ED3D4DCDE886D9B26BB042BE418002A998560E392C9785027B6C08F72F
Malicious:	false
Reputation:	low
Preview:	ad.anynet.cert=-----BEGIN CERTIFICATE-----\nMIICqDCCAZACAQEwDQYJKoZIhvcNAQELBQAwGTEXMBUGA1UEAwwOQW55RGVzayBD\nbGllbnQwIBcNMjMwODE1MTM0ODMwWhgPMjA3MzA4MDIxMzQ4MzBaMBkxFzAVBgNV\nBAMMDkFueURlc2sgQ2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEA59P6/Vp0Oy76C8HJSoaJM3Ecl8+DWWpjgoQA6qCIASeDGJzAwAt5WeAHpqda\nD3/RlsEitlQlsAUSal/I2h4Iil9Jny88uJifsWZpssL04vo4cc8ecjX1GjKVv7YF\nSAlxEq+RDOmzcjGWYBZTm3T0/cgaDelo3aJcZFubj7nT1eoR73oJZiX/QmeuMW6v\nD5RwJNxEdLITmqxAsUNym8YS6B+BksDaLXsCvhVLlYjtQB8ZtiCWXjYE0J0eLKwV\nzaRh+4PXbLmWUxwjDb0I4BKI/tG60TepAgGHwePnd7r8Cg5fOqAM1bWjLi/Hv37Z\nQviCLHfW2BG1+nHELZ+0haq8VQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQALLMna\nGeg7gFmGStSK6FuTKXubigKEz+euZYzc9bosKSBUN+ZLPoCJCN4FFOIOj8fSLUFv\nP2uuhfJaIsevLk0w2W1x6i4wipktQklr8s4ZJzUt/e6Pep0PpW0uAEDvvOda+jSt\n8J+3HOpIqmou0AufoLysQfPyPqXsxOQYdbJb/J/Ksm/Wh94lWCIj18daSYKZ1tkQ\nY3Hz9vlS4zk9YZT9g21lJ9XmD+t5yt+sSFKfbc3pfMutenW2b2Y00TN7RONhVOIa\nlfdoyDGXdeR8ajQSuiIkQWVMXKQiDYYSYTcS8pq+b4WkcZRp+D4AYz2vEbDWQ4kb\nNzBJBfmqY7eDIB2T\n-----END CERTI

C:\Users\user\AppData\Roaming\AnyDesk\system.conf

Download File

Process:	C:\Users\user\Desktop\livechat.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	424
Entropy (8bit):	4.541392201749728
Encrypted:	false
SSDEEP:	6:owlCDocaqQAmvbahOmQgRQUQgRQPYQgRQOYQgfxPZxi3B6QgfxPg3qg3B6QgfxPt:o0CD6qQHvWhOLroBGgFBGt
MD5:	102E3A98FAF64561AC7692D586F6BD62
SHA1:	35BF4F0B63009EDF3A8AE9AF1720C5DCCF53D445
SHA-256:	27539C143DCE4D98B0A106987D22191B81CC266729A37F92CE3C9B5F59ABDEFE
SHA-512:	901E57CB38D2B4F8F603C74D424B7DD52885F745910A9E01520415A2E7316AC41A49C5902696EA964F85AFFBEAB7209D55A5FC2D92E792DFB290621C51F19732
Malicious:	false
Reputation:	low
Preview:	ad.anynet.fpr=ab21329e8af85c14fd5410e6e93355dd92010002.ad.anynet.relay.fatal_result=1.0.ad.anynet.relay.state=0.ad.security.frontend_clipboard=1.ad.security.frontend_clipboard_files=1.ad.security.frontend_clipboard_version=1.ad.security.permission_profiles._default.permissions.sas=1.ad.security.permission_profiles._unattended_access.permissions.sas=1.ad.security.permission_profiles.version=1.ad.security.update_version=1.

C:\Users\user\AppData\Roaming\AnyDesk\user.conf

Download File

Process:	C:\Users\user\Desktop\livechat.exe
File Type:	ASCII text, with very long lines (508)
Category:	dropped
Size (bytes):	1907
Entropy (8bit):	4.663598908268163
Encrypted:	false
SSDEEP:	48:2tkBDaInXhUddTacmzenXYsVHT6PYVMclOLc8gGl:2tkB+Inytacbn9uPuMf
MD5:	DBA03E72AAC0032E42A6DC5C097FAB2B
SHA1:	B1FD632CA6F1A6CCFB313F48F6268148F549F9E8
SHA-256:	9D9B6753D2B214D3682A9E7694D5CFF54DF72CF8352C87288DAF3CF3AA4C8925
SHA-512:	C6B1EA77D0A98DE8904DEAE27CD739E0ED9509A2F3EEC0CB6070F695A96BF38687475A034E2CE4A86399EFF845DF5CB9F569B01E03BE8757AE5A9FA69EC5ABD1
Malicious:	false
Reputation:	low
Preview:	ad.account.info=6fa74c609a01f31f1f670668df954f4642a4aae8018a18da3f52cf1f281161fa8f943b1e69272c800ff648310f1fa2df0b53d2e90e4e008262013ecaea920627b2574767375869dfdecb29c1bc3934ab08d832e306617042ea244263ac2ec27374ab0862b47b212f41cf5778b89c005cee42fdd8946f54aed32d4b2df75916421688db622fdab40363c236746fb96470f0d9fe4c26133e03427ffafca63dfe7ce0626b63e4d999eae39c2722ecb5e7ee442211cc97f0851754b670925d2f2dffc28c167c8e1c30c725e583e6a0efd7331ae419fd3738af6470869b64467ea64fb6b207596b37179411d1a45fb41eb375c9c56c1652cc.ad.invite.created_list_encrypted=6fa74c609a01f31f1f670668df954f4642a4aae8018a18da2583d9f0a7438fff83970c5eca6a26920bf648310f1fa2df0b53d2e90e4e008262013ecaea922b6b52ed6e91c165dac1fa7b267c6fefe66fd969b52fa56c5db97025ea6fe4b4c27374ab0862b47b212f41cf5778b89c7ff1fbdff72ee2eb0805d3ea8af8bc0956da896646e45f68b3b000a8714583c85470f0d9adafe3e70fd9fc7fba1c1d78eedc09ec806804e97dbeef8441cd62c536fd1688302744289bef2594c7bf9bcce3c27b6e4fa429b3089d107f17e344877743e7229ab6fcbfe31dd93c25949247622d9c5de128c3

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms (copy)

Download File

Process:	C:\Users\user\Desktop\livechat.exe
File Type:	data
Category:	dropped
Size (bytes):	3066
Entropy (8bit):	2.9590238531135635
Encrypted:	false
SSDEEP:	24:244F21mzOOFWoNk7544F28nfOO1jDNk7c:H4y60oNiS4DfJNic
MD5:	8D425FBEF3AF5EF78F1915FF20C38EBA
SHA1:	CF06DA5FC25EC962FF2090665947FA8C6BB2DD93
SHA-256:	CA4A8134AE4428E2BEDF485D4079D310E9E79A93C7604EB909EE6F9584AD6B9E
SHA-512:	E48BDBE52EB12112BC3B7F240AE512D6DBBBD7DCE967B425489B96A5045635D327C9BBDA70B70D9108F0D76E5E55C063BCE3866A06BBFFF3E903783A3F87A09E
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.@ . ...}...r...}...r...V..(....H.=.....................d.b.2.H.=..W.n .livechat.exe..F.......WE..WE.*.........................l.i.v.e.c.h.a.t...e.x.e.......v...............-...8...[.............V.....C:\Users\..#...................\\648351\Users.user\Desktop\livechat.exe...O.p.e.n. .a. .n.e.w. .A.n.y.D.e.s.k. .w.i.n.d.o.w...#.C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.D.e.s.k.t.o.p.\.l.i.v.e.c.h.a.t...e.x.e.........%USERPROFILE%\Desktop\livechat.exe..................................................................................................................................................................................................................................%.U.S.E.R.P.R.O.F.I.L.E.%.\.D.e.s.k.t.o.p.\.l.i.v.e.c.h.a.t...e.x.e...............................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7PE6VXJP6DLBIUEF42WE.temp

Download File

Process:	C:\Users\user\Desktop\livechat.exe
File Type:	data
Category:	dropped
Size (bytes):	3066
Entropy (8bit):	2.9590238531135635
Encrypted:	false
SSDEEP:	24:244F21mzOOFWoNk7544F28nfOO1jDNk7c:H4y60oNiS4DfJNic
MD5:	8D425FBEF3AF5EF78F1915FF20C38EBA
SHA1:	CF06DA5FC25EC962FF2090665947FA8C6BB2DD93
SHA-256:	CA4A8134AE4428E2BEDF485D4079D310E9E79A93C7604EB909EE6F9584AD6B9E
SHA-512:	E48BDBE52EB12112BC3B7F240AE512D6DBBBD7DCE967B425489B96A5045635D327C9BBDA70B70D9108F0D76E5E55C063BCE3866A06BBFFF3E903783A3F87A09E
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.@ . ...}...r...}...r...V..(....H.=.....................d.b.2.H.=..W.n .livechat.exe..F.......WE..WE.*.........................l.i.v.e.c.h.a.t...e.x.e.......v...............-...8...[.............V.....C:\Users\..#...................\\648351\Users.user\Desktop\livechat.exe...O.p.e.n. .a. .n.e.w. .A.n.y.D.e.s.k. .w.i.n.d.o.w...#.C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.D.e.s.k.t.o.p.\.l.i.v.e.c.h.a.t...e.x.e.........%USERPROFILE%\Desktop\livechat.exe..................................................................................................................................................................................................................................%.U.S.E.R.P.R.O.F.I.L.E.%.\.D.e.s.k.t.o.p.\.l.i.v.e.c.h.a.t...e.x.e...............................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9991565509956315
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	livechat.exe
File size:	4'040'776 bytes
MD5:	30c9c57aa570088d745fac7bfd05b805
SHA1:	d579d18848859614e219afa6332d410e0ca71fc3
SHA256:	8cd552392bb25546ba58e73d63c4b7c290188ca1060f96c8abf641ae9f5a8383
SHA512:	182dc736cf09e8b4e063b29c839999ab28506a71e22173484f9dbc9bf9472456406aa0c8de542d85436200317175f9e32d65f1bb1e567b8c717860348fd3b52c
SSDEEP:	98304:oOmZb0bHkeaRs4WpcF8uztWOiiROB4/Oo1sRF:rmZb0bEds4XFR0OiC/GT
TLSH:	2A1633506BF882E1D1371AB4AE5FE2143F598CFE15F602699C2BA554CDF7C106CC3AA8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........h.}.;.}.;.}.;..";.}.;..#;.}.;...;.}.;...;.}.;Rich.}.;........................PE..L......d.........."......*...8=............

File Icon


Icon Hash:	499669d8d82916a8

Static PE Info

General

Entrypoint:	0x401ce9
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x649AD37F [Tue Jun 27 12:18:07 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	12/12/2021 4:00:00 PM 1/8/2025 3:59:59 PM
Subject Chain	CN=philandro Software GmbH, O=philandro Software GmbH, L=Stuttgart, S=Baden-W\xfcrttemberg, C=DE
Version:	3
Thumbprint MD5:	EAE713DFC05244CF4301BF1C9F68B1BE
Thumbprint SHA-1:	9CD1DDB78ED05282353B20CDFE8FA0A4FB6C1ECE
Thumbprint SHA-256:	9D7620A4CEBA92370E8828B3CB1007AEFF63AB36A2CBE5F044FDDE14ABAB1EBF
Serial:	0DBF152DEAF0B981A8A938D53F769DB8

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 64h
push esi
lea ecx, dword ptr [ebp-64h]
call 00007F4FE8751B53h
lea eax, dword ptr [ebp-64h]
mov ecx, eax
mov dword ptr [0147E0E8h], eax
call 00007F4FE8751A11h
test al, al
jne 00007F4FE8752174h
mov esi, 000003E8h
lea ecx, dword ptr [ebp-64h]
call 00007F4FE87519FFh
mov eax, esi
pop esi
leave
ret
lea eax, dword ptr [ebp-64h]
push eax
lea ecx, dword ptr [ebp-30h]
call 00007F4FE8751833h
lea eax, dword ptr [ebp-30h]
mov ecx, eax
mov dword ptr [0147E0ECh], eax
call 00007F4FE87517CBh
test al, al
jne 00007F4FE8752171h
lea ecx, dword ptr [ebp-30h]
call 00007F4FE87517B0h
mov esi, 000003E9h
jmp 00007F4FE8752127h
cmp dword ptr [ebp-10h], 00000000h
je 00007F4FE875216Ah
push 00000800h
call dword ptr [ebp-10h]
cmp dword ptr [ebp-0Ch], 00000000h
je 00007F4FE875216Ah
push 00008001h
call dword ptr [ebp-0Ch]
lea eax, dword ptr [ebp-64h]
push eax
lea esi, dword ptr [ebp-30h]
call 00007F4FE87520B5h
pop ecx
mov esi, eax
push esi
call dword ptr [ebp-20h]
lea ecx, dword ptr [ebp-30h]
call 00007F4FE8751772h
jmp 00007F4FE87520EEh
mov edx, dword ptr [esp+04h]
push ebx
mov ebx, dword ptr [esp+10h]
push esi
xor esi, esi
test ebx, ebx
je 00007F4FE8752191h
push edi
mov edi, dword ptr [esp+14h]
sub edi, 0147E0F0h
imul edx, edx, 0019660Dh
add edx, 3C6EF35Fh
mov eax, edx
shr eax, 0Ch

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ C ] VS2010 build 30319
[RES] VS2010 SP1 build 40219
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x107f000	0x4850	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x3d6200	0x4648	.itext
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1084000	0x84	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xcaf000	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2835	0x2a00	False	0.5949590773809523	data	6.514751266666443	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x4000	0xcaae00	0x0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xcaf000	0x2fa	0x400	False	0.7255859375	Matlab v4 mat-file (little endian) \234\362\312, numeric, rows 1687868287, columns 0, imaginary	5.646642643065067	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcb0000	0x3ce4f4	0x3ce200	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x107f000	0x4850	0x4a00	False	0.5123521959459459	data	6.017834090303233	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1084000	0x300	0x400	False	0.1455078125	data	1.181265380704217	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x107f280	0x1b8e	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9167848029486816
RT_ICON	0x1080e10	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 0	English	United States	0.299390243902439
RT_ICON	0x1081478	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	United States	0.478494623655914
RT_ICON	0x1081760	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 0	English	United States	0.48155737704918034
RT_ICON	0x1081948	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	United States	0.597972972972973
RT_ICON	0x1081ac0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.09404315196998124
RT_ICON	0x1082b68	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.2047872340425532
RT_GROUP_ICON	0x1081a70	0x4c	data	English	United States	0.8026315789473685
RT_GROUP_ICON	0x1082fd0	0x22	data	English	United States	1.0588235294117647
RT_VERSION	0x1082ff8	0x250	data	English	United States	0.4814189189189189
RT_MANIFEST	0x1083248	0x606	XML 1.0 document, ASCII text	English	United States	0.45395590142671854

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 15, 2023 06:48:31.882922888 CEST	49164	443	192.168.2.22	49.12.130.235
Aug 15, 2023 06:48:31.883002996 CEST	443	49164	49.12.130.235	192.168.2.22
Aug 15, 2023 06:48:31.883651018 CEST	49164	443	192.168.2.22	49.12.130.235
Aug 15, 2023 06:48:31.930392027 CEST	49164	443	192.168.2.22	49.12.130.235
Aug 15, 2023 06:48:31.930449009 CEST	443	49164	49.12.130.235	192.168.2.22
Aug 15, 2023 06:48:32.002444983 CEST	443	49164	49.12.130.235	192.168.2.22
Aug 15, 2023 06:48:32.002590895 CEST	49164	443	192.168.2.22	49.12.130.235
Aug 15, 2023 06:48:32.006171942 CEST	49164	443	192.168.2.22	49.12.130.235
Aug 15, 2023 06:48:32.006196022 CEST	443	49164	49.12.130.235	192.168.2.22
Aug 15, 2023 06:48:32.006422043 CEST	443	49164	49.12.130.235	192.168.2.22
Aug 15, 2023 06:48:32.006720066 CEST	49164	443	192.168.2.22	49.12.130.235
Aug 15, 2023 06:48:32.058820009 CEST	49164	443	192.168.2.22	49.12.130.235
Aug 15, 2023 06:48:32.085545063 CEST	49165	80	192.168.2.22	49.12.130.235
Aug 15, 2023 06:48:32.107865095 CEST	80	49165	49.12.130.235	192.168.2.22
Aug 15, 2023 06:48:32.108040094 CEST	49165	80	192.168.2.22	49.12.130.235
Aug 15, 2023 06:48:32.126732111 CEST	49165	80	192.168.2.22	49.12.130.235
Aug 15, 2023 06:48:32.149089098 CEST	80	49165	49.12.130.235	192.168.2.22
Aug 15, 2023 06:48:32.151719093 CEST	80	49165	49.12.130.235	192.168.2.22
Aug 15, 2023 06:48:32.151762962 CEST	80	49165	49.12.130.235	192.168.2.22
Aug 15, 2023 06:48:32.151799917 CEST	80	49165	49.12.130.235	192.168.2.22
Aug 15, 2023 06:48:32.151823044 CEST	49165	80	192.168.2.22	49.12.130.235
Aug 15, 2023 06:48:32.151838064 CEST	80	49165	49.12.130.235	192.168.2.22
Aug 15, 2023 06:48:32.151879072 CEST	80	49165	49.12.130.235	192.168.2.22
Aug 15, 2023 06:48:32.151889086 CEST	49165	80	192.168.2.22	49.12.130.235
Aug 15, 2023 06:48:32.164609909 CEST	49165	80	192.168.2.22	49.12.130.235
Aug 15, 2023 06:48:32.187566996 CEST	80	49165	49.12.130.235	192.168.2.22
Aug 15, 2023 06:48:32.187621117 CEST	80	49165	49.12.130.235	192.168.2.22
Aug 15, 2023 06:48:32.187700987 CEST	49165	80	192.168.2.22	49.12.130.235
Aug 15, 2023 06:48:32.250919104 CEST	49165	80	192.168.2.22	49.12.130.235
Aug 15, 2023 06:48:32.273418903 CEST	80	49165	49.12.130.235	192.168.2.22
Aug 15, 2023 06:48:32.300904036 CEST	49166	6568	192.168.2.22	185.229.191.41
Aug 15, 2023 06:48:32.325258970 CEST	6568	49166	185.229.191.41	192.168.2.22
Aug 15, 2023 06:48:32.325432062 CEST	49166	6568	192.168.2.22	185.229.191.41
Aug 15, 2023 06:48:32.358880997 CEST	49166	6568	192.168.2.22	185.229.191.41
Aug 15, 2023 06:48:32.383471012 CEST	6568	49166	185.229.191.41	192.168.2.22
Aug 15, 2023 06:48:32.385617971 CEST	6568	49166	185.229.191.41	192.168.2.22
Aug 15, 2023 06:48:32.385660887 CEST	6568	49166	185.229.191.41	192.168.2.22
Aug 15, 2023 06:48:32.385767937 CEST	6568	49166	185.229.191.41	192.168.2.22
Aug 15, 2023 06:48:32.385817051 CEST	6568	49166	185.229.191.41	192.168.2.22
Aug 15, 2023 06:48:32.385827065 CEST	49166	6568	192.168.2.22	185.229.191.41
Aug 15, 2023 06:48:32.385869026 CEST	6568	49166	185.229.191.41	192.168.2.22
Aug 15, 2023 06:48:32.385917902 CEST	49166	6568	192.168.2.22	185.229.191.41
Aug 15, 2023 06:48:32.397340059 CEST	49166	6568	192.168.2.22	185.229.191.41
Aug 15, 2023 06:48:32.421847105 CEST	6568	49166	185.229.191.41	192.168.2.22
Aug 15, 2023 06:48:32.421890020 CEST	6568	49166	185.229.191.41	192.168.2.22
Aug 15, 2023 06:48:32.422029972 CEST	49166	6568	192.168.2.22	185.229.191.41
Aug 15, 2023 06:48:32.506670952 CEST	49166	6568	192.168.2.22	185.229.191.41
Aug 15, 2023 06:48:32.531116009 CEST	6568	49166	185.229.191.41	192.168.2.22
Aug 15, 2023 06:48:37.316629887 CEST	49167	443	192.168.2.22	92.223.88.232
Aug 15, 2023 06:48:37.316699982 CEST	443	49167	92.223.88.232	192.168.2.22
Aug 15, 2023 06:48:37.316802979 CEST	49167	443	192.168.2.22	92.223.88.232
Aug 15, 2023 06:48:37.338500977 CEST	49167	443	192.168.2.22	92.223.88.232
Aug 15, 2023 06:48:37.338546991 CEST	443	49167	92.223.88.232	192.168.2.22
Aug 15, 2023 06:48:37.395750046 CEST	443	49167	92.223.88.232	192.168.2.22
Aug 15, 2023 06:48:37.395894051 CEST	49167	443	192.168.2.22	92.223.88.232
Aug 15, 2023 06:48:37.397392035 CEST	49167	443	192.168.2.22	92.223.88.232
Aug 15, 2023 06:48:37.397416115 CEST	443	49167	92.223.88.232	192.168.2.22
Aug 15, 2023 06:48:37.397752047 CEST	443	49167	92.223.88.232	192.168.2.22
Aug 15, 2023 06:48:37.397835016 CEST	49167	443	192.168.2.22	92.223.88.232
Aug 15, 2023 06:48:37.427294970 CEST	49167	443	192.168.2.22	92.223.88.232
Aug 15, 2023 06:48:37.468202114 CEST	49168	80	192.168.2.22	92.223.88.232
Aug 15, 2023 06:48:37.488682985 CEST	80	49168	92.223.88.232	192.168.2.22
Aug 15, 2023 06:48:37.488866091 CEST	49168	80	192.168.2.22	92.223.88.232
Aug 15, 2023 06:48:37.502417088 CEST	49168	80	192.168.2.22	92.223.88.232
Aug 15, 2023 06:48:37.522970915 CEST	80	49168	92.223.88.232	192.168.2.22
Aug 15, 2023 06:48:37.524790049 CEST	80	49168	92.223.88.232	192.168.2.22
Aug 15, 2023 06:48:37.524843931 CEST	80	49168	92.223.88.232	192.168.2.22
Aug 15, 2023 06:48:37.524883986 CEST	80	49168	92.223.88.232	192.168.2.22
Aug 15, 2023 06:48:37.525051117 CEST	49168	80	192.168.2.22	92.223.88.232
Aug 15, 2023 06:48:37.545222998 CEST	49168	80	192.168.2.22	92.223.88.232
Aug 15, 2023 06:48:37.566121101 CEST	80	49168	92.223.88.232	192.168.2.22
Aug 15, 2023 06:48:37.566209078 CEST	80	49168	92.223.88.232	192.168.2.22
Aug 15, 2023 06:48:37.566411018 CEST	49168	80	192.168.2.22	92.223.88.232
Aug 15, 2023 06:48:37.652621984 CEST	49168	80	192.168.2.22	92.223.88.232
Aug 15, 2023 06:48:37.673084974 CEST	80	49168	92.223.88.232	192.168.2.22
Aug 15, 2023 06:48:37.740778923 CEST	49169	6568	192.168.2.22	49.12.130.236
Aug 15, 2023 06:48:37.763571978 CEST	6568	49169	49.12.130.236	192.168.2.22
Aug 15, 2023 06:48:37.763818979 CEST	49169	6568	192.168.2.22	49.12.130.236
Aug 15, 2023 06:48:37.802822113 CEST	49169	6568	192.168.2.22	49.12.130.236
Aug 15, 2023 06:48:37.825668097 CEST	6568	49169	49.12.130.236	192.168.2.22
Aug 15, 2023 06:48:37.827835083 CEST	6568	49169	49.12.130.236	192.168.2.22
Aug 15, 2023 06:48:37.827872992 CEST	6568	49169	49.12.130.236	192.168.2.22
Aug 15, 2023 06:48:37.827899933 CEST	6568	49169	49.12.130.236	192.168.2.22
Aug 15, 2023 06:48:37.827950001 CEST	49169	6568	192.168.2.22	49.12.130.236
Aug 15, 2023 06:48:37.839346886 CEST	49169	6568	192.168.2.22	49.12.130.236
Aug 15, 2023 06:48:37.862417936 CEST	6568	49169	49.12.130.236	192.168.2.22
Aug 15, 2023 06:48:37.862463951 CEST	6568	49169	49.12.130.236	192.168.2.22
Aug 15, 2023 06:48:37.862567902 CEST	49169	6568	192.168.2.22	49.12.130.236
Aug 15, 2023 06:48:37.896586895 CEST	49169	6568	192.168.2.22	49.12.130.236
Aug 15, 2023 06:48:37.919343948 CEST	6568	49169	49.12.130.236	192.168.2.22
Aug 15, 2023 06:48:51.385102034 CEST	49170	443	192.168.2.22	92.223.88.41
Aug 15, 2023 06:48:51.385142088 CEST	443	49170	92.223.88.41	192.168.2.22
Aug 15, 2023 06:48:51.385322094 CEST	49170	443	192.168.2.22	92.223.88.41
Aug 15, 2023 06:48:51.401144028 CEST	49170	443	192.168.2.22	92.223.88.41
Aug 15, 2023 06:48:51.401176929 CEST	443	49170	92.223.88.41	192.168.2.22
Aug 15, 2023 06:48:51.456650972 CEST	443	49170	92.223.88.41	192.168.2.22
Aug 15, 2023 06:48:51.456765890 CEST	49170	443	192.168.2.22	92.223.88.41
Aug 15, 2023 06:48:51.459487915 CEST	49170	443	192.168.2.22	92.223.88.41
Aug 15, 2023 06:48:51.459502935 CEST	443	49170	92.223.88.41	192.168.2.22
Aug 15, 2023 06:48:51.459929943 CEST	443	49170	92.223.88.41	192.168.2.22
Aug 15, 2023 06:48:51.460002899 CEST	49170	443	192.168.2.22	92.223.88.41
Aug 15, 2023 06:48:51.509404898 CEST	49170	443	192.168.2.22	92.223.88.41
Aug 15, 2023 06:48:51.546001911 CEST	49171	80	192.168.2.22	92.223.88.232
Aug 15, 2023 06:48:51.566543102 CEST	80	49171	92.223.88.232	192.168.2.22
Aug 15, 2023 06:48:51.566773891 CEST	49171	80	192.168.2.22	92.223.88.232
Aug 15, 2023 06:48:51.581813097 CEST	49171	80	192.168.2.22	92.223.88.232
Aug 15, 2023 06:48:51.602313995 CEST	80	49171	92.223.88.232	192.168.2.22
Aug 15, 2023 06:48:51.604188919 CEST	80	49171	92.223.88.232	192.168.2.22
Aug 15, 2023 06:48:51.604219913 CEST	80	49171	92.223.88.232	192.168.2.22
Aug 15, 2023 06:48:51.604239941 CEST	80	49171	92.223.88.232	192.168.2.22
Aug 15, 2023 06:48:51.604409933 CEST	49171	80	192.168.2.22	92.223.88.232
Aug 15, 2023 06:48:51.624496937 CEST	49171	80	192.168.2.22	92.223.88.232
Aug 15, 2023 06:48:51.645709038 CEST	80	49171	92.223.88.232	192.168.2.22
Aug 15, 2023 06:48:51.645766020 CEST	80	49171	92.223.88.232	192.168.2.22
Aug 15, 2023 06:48:51.646028996 CEST	49171	80	192.168.2.22	92.223.88.232
Aug 15, 2023 06:48:51.693538904 CEST	49171	80	192.168.2.22	92.223.88.232
Aug 15, 2023 06:48:51.714102030 CEST	80	49171	92.223.88.232	192.168.2.22
Aug 15, 2023 06:48:51.731597900 CEST	49172	6568	192.168.2.22	92.223.88.41
Aug 15, 2023 06:48:51.752099991 CEST	6568	49172	92.223.88.41	192.168.2.22
Aug 15, 2023 06:48:51.752291918 CEST	49172	6568	192.168.2.22	92.223.88.41
Aug 15, 2023 06:48:51.765619993 CEST	49172	6568	192.168.2.22	92.223.88.41
Aug 15, 2023 06:48:51.786251068 CEST	6568	49172	92.223.88.41	192.168.2.22
Aug 15, 2023 06:48:51.788081884 CEST	6568	49172	92.223.88.41	192.168.2.22
Aug 15, 2023 06:48:51.788136959 CEST	6568	49172	92.223.88.41	192.168.2.22
Aug 15, 2023 06:48:51.788181067 CEST	6568	49172	92.223.88.41	192.168.2.22
Aug 15, 2023 06:48:51.788285017 CEST	49172	6568	192.168.2.22	92.223.88.41
Aug 15, 2023 06:48:51.813600063 CEST	49172	6568	192.168.2.22	92.223.88.41
Aug 15, 2023 06:48:51.834752083 CEST	6568	49172	92.223.88.41	192.168.2.22
Aug 15, 2023 06:48:51.834835052 CEST	6568	49172	92.223.88.41	192.168.2.22
Aug 15, 2023 06:48:51.834988117 CEST	49172	6568	192.168.2.22	92.223.88.41
Aug 15, 2023 06:48:51.893935919 CEST	49172	6568	192.168.2.22	92.223.88.41
Aug 15, 2023 06:48:51.914494038 CEST	6568	49172	92.223.88.41	192.168.2.22
Aug 15, 2023 06:49:34.384979963 CEST	49173	443	192.168.2.22	92.223.88.41
Aug 15, 2023 06:49:34.385046959 CEST	443	49173	92.223.88.41	192.168.2.22
Aug 15, 2023 06:49:34.385138035 CEST	49173	443	192.168.2.22	92.223.88.41
Aug 15, 2023 06:49:34.400163889 CEST	49173	443	192.168.2.22	92.223.88.41
Aug 15, 2023 06:49:34.400204897 CEST	443	49173	92.223.88.41	192.168.2.22
Aug 15, 2023 06:49:34.454215050 CEST	443	49173	92.223.88.41	192.168.2.22
Aug 15, 2023 06:49:34.454381943 CEST	49173	443	192.168.2.22	92.223.88.41
Aug 15, 2023 06:49:34.456758022 CEST	49173	443	192.168.2.22	92.223.88.41
Aug 15, 2023 06:49:34.456785917 CEST	443	49173	92.223.88.41	192.168.2.22
Aug 15, 2023 06:49:34.457087040 CEST	443	49173	92.223.88.41	192.168.2.22
Aug 15, 2023 06:49:34.457160950 CEST	49173	443	192.168.2.22	92.223.88.41
Aug 15, 2023 06:49:34.497407913 CEST	49173	443	192.168.2.22	92.223.88.41
Aug 15, 2023 06:49:34.539185047 CEST	49174	80	192.168.2.22	49.12.130.235
Aug 15, 2023 06:49:34.562365055 CEST	80	49174	49.12.130.235	192.168.2.22
Aug 15, 2023 06:49:34.562572956 CEST	49174	80	192.168.2.22	49.12.130.235
Aug 15, 2023 06:49:34.573987961 CEST	49174	80	192.168.2.22	49.12.130.235
Aug 15, 2023 06:49:34.597157001 CEST	80	49174	49.12.130.235	192.168.2.22
Aug 15, 2023 06:49:34.601001024 CEST	80	49174	49.12.130.235	192.168.2.22
Aug 15, 2023 06:49:34.601079941 CEST	80	49174	49.12.130.235	192.168.2.22
Aug 15, 2023 06:49:34.601135015 CEST	80	49174	49.12.130.235	192.168.2.22
Aug 15, 2023 06:49:34.601191998 CEST	80	49174	49.12.130.235	192.168.2.22
Aug 15, 2023 06:49:34.601242065 CEST	80	49174	49.12.130.235	192.168.2.22
Aug 15, 2023 06:49:34.601327896 CEST	49174	80	192.168.2.22	49.12.130.235
Aug 15, 2023 06:49:34.601327896 CEST	49174	80	192.168.2.22	49.12.130.235
Aug 15, 2023 06:49:34.621819019 CEST	49174	80	192.168.2.22	49.12.130.235
Aug 15, 2023 06:49:34.645045042 CEST	80	49174	49.12.130.235	192.168.2.22
Aug 15, 2023 06:49:34.645078897 CEST	80	49174	49.12.130.235	192.168.2.22
Aug 15, 2023 06:49:34.645172119 CEST	49174	80	192.168.2.22	49.12.130.235
Aug 15, 2023 06:49:34.689728975 CEST	49174	80	192.168.2.22	49.12.130.235
Aug 15, 2023 06:49:34.712721109 CEST	80	49174	49.12.130.235	192.168.2.22
Aug 15, 2023 06:49:34.731012106 CEST	49175	6568	192.168.2.22	49.12.130.235
Aug 15, 2023 06:49:34.754139900 CEST	6568	49175	49.12.130.235	192.168.2.22
Aug 15, 2023 06:49:34.754215002 CEST	49175	6568	192.168.2.22	49.12.130.235
Aug 15, 2023 06:49:34.762346983 CEST	49175	6568	192.168.2.22	49.12.130.235
Aug 15, 2023 06:49:34.785080910 CEST	6568	49175	49.12.130.235	192.168.2.22
Aug 15, 2023 06:49:34.788023949 CEST	6568	49175	49.12.130.235	192.168.2.22
Aug 15, 2023 06:49:34.788058043 CEST	6568	49175	49.12.130.235	192.168.2.22
Aug 15, 2023 06:49:34.788074970 CEST	6568	49175	49.12.130.235	192.168.2.22
Aug 15, 2023 06:49:34.788188934 CEST	49175	6568	192.168.2.22	49.12.130.235
Aug 15, 2023 06:49:34.811399937 CEST	49175	6568	192.168.2.22	49.12.130.235
Aug 15, 2023 06:49:34.834155083 CEST	6568	49175	49.12.130.235	192.168.2.22
Aug 15, 2023 06:49:34.834182024 CEST	6568	49175	49.12.130.235	192.168.2.22
Aug 15, 2023 06:49:34.834422112 CEST	49175	6568	192.168.2.22	49.12.130.235
Aug 15, 2023 06:49:34.880327940 CEST	49175	6568	192.168.2.22	49.12.130.235
Aug 15, 2023 06:49:34.903183937 CEST	6568	49175	49.12.130.235	192.168.2.22
Aug 15, 2023 06:50:45.394979000 CEST	49177	443	192.168.2.22	92.223.88.41
Aug 15, 2023 06:50:45.395023108 CEST	443	49177	92.223.88.41	192.168.2.22
Aug 15, 2023 06:50:45.395203114 CEST	49177	443	192.168.2.22	92.223.88.41
Aug 15, 2023 06:50:45.409029961 CEST	49177	443	192.168.2.22	92.223.88.41
Aug 15, 2023 06:50:45.409056902 CEST	443	49177	92.223.88.41	192.168.2.22
Aug 15, 2023 06:50:45.468251944 CEST	443	49177	92.223.88.41	192.168.2.22
Aug 15, 2023 06:50:45.468425989 CEST	49177	443	192.168.2.22	92.223.88.41
Aug 15, 2023 06:50:45.469743967 CEST	49177	443	192.168.2.22	92.223.88.41
Aug 15, 2023 06:50:45.469763994 CEST	443	49177	92.223.88.41	192.168.2.22
Aug 15, 2023 06:50:45.470168114 CEST	443	49177	92.223.88.41	192.168.2.22
Aug 15, 2023 06:50:45.470263004 CEST	49177	443	192.168.2.22	92.223.88.41
Aug 15, 2023 06:50:45.704591036 CEST	49177	443	192.168.2.22	92.223.88.41
Aug 15, 2023 06:50:45.733907938 CEST	49178	80	192.168.2.22	92.223.88.41
Aug 15, 2023 06:50:45.754364967 CEST	80	49178	92.223.88.41	192.168.2.22
Aug 15, 2023 06:50:45.754463911 CEST	49178	80	192.168.2.22	92.223.88.41
Aug 15, 2023 06:50:45.763545990 CEST	49178	80	192.168.2.22	92.223.88.41
Aug 15, 2023 06:50:45.784843922 CEST	80	49178	92.223.88.41	192.168.2.22
Aug 15, 2023 06:50:45.786745071 CEST	80	49178	92.223.88.41	192.168.2.22
Aug 15, 2023 06:50:45.786808014 CEST	80	49178	92.223.88.41	192.168.2.22
Aug 15, 2023 06:50:45.786840916 CEST	80	49178	92.223.88.41	192.168.2.22
Aug 15, 2023 06:50:45.786860943 CEST	80	49178	92.223.88.41	192.168.2.22
Aug 15, 2023 06:50:45.786892891 CEST	80	49178	92.223.88.41	192.168.2.22
Aug 15, 2023 06:50:45.786921024 CEST	49178	80	192.168.2.22	92.223.88.41
Aug 15, 2023 06:50:45.799259901 CEST	49178	80	192.168.2.22	92.223.88.41
Aug 15, 2023 06:50:45.819789886 CEST	80	49178	92.223.88.41	192.168.2.22
Aug 15, 2023 06:50:45.819832087 CEST	80	49178	92.223.88.41	192.168.2.22
Aug 15, 2023 06:50:45.819917917 CEST	49178	80	192.168.2.22	92.223.88.41
Aug 15, 2023 06:50:45.907671928 CEST	49178	80	192.168.2.22	92.223.88.41
Aug 15, 2023 06:50:45.928145885 CEST	80	49178	92.223.88.41	192.168.2.22
Aug 15, 2023 06:50:45.937537909 CEST	49179	6568	192.168.2.22	49.12.130.236
Aug 15, 2023 06:50:45.960822105 CEST	6568	49179	49.12.130.236	192.168.2.22
Aug 15, 2023 06:50:45.960957050 CEST	49179	6568	192.168.2.22	49.12.130.236
Aug 15, 2023 06:50:45.971092939 CEST	49179	6568	192.168.2.22	49.12.130.236
Aug 15, 2023 06:50:45.993822098 CEST	6568	49179	49.12.130.236	192.168.2.22
Aug 15, 2023 06:50:45.996736050 CEST	6568	49179	49.12.130.236	192.168.2.22
Aug 15, 2023 06:50:45.996761084 CEST	6568	49179	49.12.130.236	192.168.2.22
Aug 15, 2023 06:50:45.996787071 CEST	6568	49179	49.12.130.236	192.168.2.22
Aug 15, 2023 06:50:45.996800900 CEST	6568	49179	49.12.130.236	192.168.2.22
Aug 15, 2023 06:50:45.996813059 CEST	6568	49179	49.12.130.236	192.168.2.22
Aug 15, 2023 06:50:45.996857882 CEST	49179	6568	192.168.2.22	49.12.130.236
Aug 15, 2023 06:50:45.996857882 CEST	49179	6568	192.168.2.22	49.12.130.236
Aug 15, 2023 06:50:46.008624077 CEST	49179	6568	192.168.2.22	49.12.130.236
Aug 15, 2023 06:50:46.032532930 CEST	6568	49179	49.12.130.236	192.168.2.22
Aug 15, 2023 06:50:46.032567978 CEST	6568	49179	49.12.130.236	192.168.2.22
Aug 15, 2023 06:50:46.032623053 CEST	49179	6568	192.168.2.22	49.12.130.236
Aug 15, 2023 06:50:46.078350067 CEST	49179	6568	192.168.2.22	49.12.130.236
Aug 15, 2023 06:50:46.101998091 CEST	6568	49179	49.12.130.236	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 15, 2023 06:48:31.794975996 CEST	54719	53	192.168.2.22	8.8.8.8
Aug 15, 2023 06:48:31.818660975 CEST	53	54719	8.8.8.8	192.168.2.22
Aug 15, 2023 06:48:32.066459894 CEST	49881	53	192.168.2.22	8.8.8.8
Aug 15, 2023 06:48:32.081852913 CEST	53	49881	8.8.8.8	192.168.2.22
Aug 15, 2023 06:48:32.281542063 CEST	54998	53	192.168.2.22	8.8.8.8
Aug 15, 2023 06:48:32.296669006 CEST	53	54998	8.8.8.8	192.168.2.22
Aug 15, 2023 06:48:37.258038998 CEST	52781	53	192.168.2.22	8.8.8.8
Aug 15, 2023 06:48:37.281791925 CEST	53	52781	8.8.8.8	192.168.2.22
Aug 15, 2023 06:48:37.439814091 CEST	63926	53	192.168.2.22	8.8.8.8
Aug 15, 2023 06:48:37.463609934 CEST	53	63926	8.8.8.8	192.168.2.22
Aug 15, 2023 06:48:37.707189083 CEST	65510	53	192.168.2.22	8.8.8.8
Aug 15, 2023 06:48:37.731978893 CEST	53	65510	8.8.8.8	192.168.2.22
Aug 15, 2023 06:48:51.356440067 CEST	62672	53	192.168.2.22	8.8.8.8
Aug 15, 2023 06:48:51.372061014 CEST	53	62672	8.8.8.8	192.168.2.22
Aug 15, 2023 06:48:51.520697117 CEST	56475	53	192.168.2.22	8.8.8.8
Aug 15, 2023 06:48:51.541033030 CEST	53	56475	8.8.8.8	192.168.2.22
Aug 15, 2023 06:48:51.702800035 CEST	49384	53	192.168.2.22	8.8.8.8
Aug 15, 2023 06:48:51.726766109 CEST	53	49384	8.8.8.8	192.168.2.22
Aug 15, 2023 06:49:34.353532076 CEST	54842	53	192.168.2.22	8.8.8.8
Aug 15, 2023 06:49:34.369153023 CEST	53	54842	8.8.8.8	192.168.2.22
Aug 15, 2023 06:49:34.511739969 CEST	58105	53	192.168.2.22	8.8.8.8
Aug 15, 2023 06:49:34.535772085 CEST	53	58105	8.8.8.8	192.168.2.22
Aug 15, 2023 06:49:34.698950052 CEST	64928	53	192.168.2.22	8.8.8.8
Aug 15, 2023 06:49:34.722986937 CEST	53	64928	8.8.8.8	192.168.2.22
Aug 15, 2023 06:50:45.361629009 CEST	57390	53	192.168.2.22	8.8.8.8
Aug 15, 2023 06:50:45.377839088 CEST	53	57390	8.8.8.8	192.168.2.22
Aug 15, 2023 06:50:45.714335918 CEST	58095	53	192.168.2.22	8.8.8.8
Aug 15, 2023 06:50:45.730376005 CEST	53	58095	8.8.8.8	192.168.2.22
Aug 15, 2023 06:50:45.918450117 CEST	54261	53	192.168.2.22	8.8.8.8
Aug 15, 2023 06:50:45.935054064 CEST	53	54261	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 15, 2023 06:48:31.794975996 CEST	192.168.2.22	8.8.8.8	0x566f	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:48:32.066459894 CEST	192.168.2.22	8.8.8.8	0x6486	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:48:32.281542063 CEST	192.168.2.22	8.8.8.8	0xe6ad	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:48:37.258038998 CEST	192.168.2.22	8.8.8.8	0x4613	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:48:37.439814091 CEST	192.168.2.22	8.8.8.8	0xc3dc	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:48:37.707189083 CEST	192.168.2.22	8.8.8.8	0x5c12	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:48:51.356440067 CEST	192.168.2.22	8.8.8.8	0x3b8a	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:48:51.520697117 CEST	192.168.2.22	8.8.8.8	0x9eec	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:48:51.702800035 CEST	192.168.2.22	8.8.8.8	0xbd97	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:49:34.353532076 CEST	192.168.2.22	8.8.8.8	0xc860	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:49:34.511739969 CEST	192.168.2.22	8.8.8.8	0x58bf	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:49:34.698950052 CEST	192.168.2.22	8.8.8.8	0x73fc	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:50:45.361629009 CEST	192.168.2.22	8.8.8.8	0xf1b1	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:50:45.714335918 CEST	192.168.2.22	8.8.8.8	0xe0d3	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:50:45.918450117 CEST	192.168.2.22	8.8.8.8	0x79da	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Aug 15, 2023 06:48:31.818660975 CEST	8.8.8.8	192.168.2.22	0x566f	No error (0)	boot.net.anydesk.com	49.12.130.235	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:48:32.081852913 CEST	8.8.8.8	192.168.2.22	0x6486	No error (0)	boot.net.anydesk.com	49.12.130.235	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:48:32.296669006 CEST	8.8.8.8	192.168.2.22	0xe6ad	No error (0)	boot.net.anydesk.com	185.229.191.41	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:48:37.281791925 CEST	8.8.8.8	192.168.2.22	0x4613	No error (0)	boot.net.anydesk.com	92.223.88.232	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:48:37.463609934 CEST	8.8.8.8	192.168.2.22	0xc3dc	No error (0)	boot.net.anydesk.com	92.223.88.232	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:48:37.731978893 CEST	8.8.8.8	192.168.2.22	0x5c12	No error (0)	boot.net.anydesk.com	49.12.130.236	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:48:51.372061014 CEST	8.8.8.8	192.168.2.22	0x3b8a	No error (0)	boot.net.anydesk.com	92.223.88.41	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:48:51.541033030 CEST	8.8.8.8	192.168.2.22	0x9eec	No error (0)	boot.net.anydesk.com	92.223.88.232	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:48:51.726766109 CEST	8.8.8.8	192.168.2.22	0xbd97	No error (0)	boot.net.anydesk.com	92.223.88.41	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:49:34.369153023 CEST	8.8.8.8	192.168.2.22	0xc860	No error (0)	boot.net.anydesk.com	92.223.88.41	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:49:34.535772085 CEST	8.8.8.8	192.168.2.22	0x58bf	No error (0)	boot.net.anydesk.com	49.12.130.235	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:49:34.722986937 CEST	8.8.8.8	192.168.2.22	0x73fc	No error (0)	boot.net.anydesk.com	49.12.130.235	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:50:45.377839088 CEST	8.8.8.8	192.168.2.22	0xf1b1	No error (0)	boot.net.anydesk.com	92.223.88.41	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:50:45.730376005 CEST	8.8.8.8	192.168.2.22	0xe0d3	No error (0)	boot.net.anydesk.com	92.223.88.41	A (IP address)	IN (0x0001)	false
Aug 15, 2023 06:50:45.935054064 CEST	8.8.8.8	192.168.2.22	0x79da	No error (0)	boot.net.anydesk.com	49.12.130.236	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49165	49.12.130.235	80	C:\Users\user\Desktop\livechat.exe

Timestamp	kBytes transferred	Direction	Data
Aug 15, 2023 06:48:32.126732111 CEST	6	OUT	Data Raw: 16 03 01 01 0d 01 00 01 09 03 03 c1 33 4f 15 b5 2a 64 71 f8 15 32 f1 a2 19 ab 29 2e 46 3e 5b 18 26 87 ea 70 66 26 07 ea 38 16 db 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: 3Odq2).F>[&pf&8n0,($kjih98762.&=5/+'#g@?>32101-)%</r#
Aug 15, 2023 06:48:32.151719093 CEST	7	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 62 9e 1c b0 b0 8a f5 1a 16 e2 ee 2c 43 ba 67 92 85 1c 73 f2 5d d9 fd e7 44 4f 57 4e 47 52 44 01 20 9d c5 48 2a 87 3f d0 15 6d d3 df 7a da d8 ca cf 0b 7c f3 f7 80 9e aa e6 ef 2f 82 33 34 da ad 23 c0 2c 00 00 0b ff Data Ascii: WSb,Cgs]DOWNGRD H?mz\|/34#,C0?0'0vtS$0H0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0181118021423Z281115021
Aug 15, 2023 06:48:32.151762962 CEST	8	IN	Data Raw: e6 e8 20 b9 4b 8b bb 63 de 6f 65 6a 9f 5d d7 c1 97 9b 2d 30 4e 9a 81 85 b4 1c 92 a6 ed d8 7a f9 df 9d 03 b3 90 9c 78 a9 c8 ba 0e 3c ac ec 14 db 7d 51 b3 97 06 b9 f6 77 60 ab fe 59 83 af 8e 97 56 29 c7 db 7e 71 79 d1 c7 f7 da b6 c8 f7 af 8f 24 e0 Data Ascii: Kcoej]-0Nzx<}Qw`YV)~qy$ZG\|'SO^jl$\|XM+")+{n\&9S\|4xLp\|aZ.qDL\vq$;OroCs4\|z\8[TRxU>R
Aug 15, 2023 06:48:32.151799917 CEST	8	IN	Data Raw: 35 35 5a 17 0d 32 34 30 34 30 38 30 32 33 37 35 35 5a 30 48 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 4e 65 74 20 52 6f 6f 74 20 43 41 31 20 30 1e 06 03 55 04 0a 0c 17 70 68 69 6c 61 6e 64 72 6f 20 53 6f 66 74 77 61 72 65 20 47 6d 62 48 31 0b 30 Data Ascii: 55Z240408023755Z0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0"0*H0AZ T7;h8m&i6p4p]\|Zx1\{ZQ/3'h;jlaV
Aug 15, 2023 06:48:32.151838064 CEST	9	IN	Data Raw: 3c 1f 22 91 25 17 15 cc 42 82 da 3b a8 39 c7 2a 50 ca d9 4c a0 8c 95 33 75 03 70 b8 df a0 c9 b2 b2 8b 1b 38 83 79 32 c3 12 da 33 96 42 f4 91 11 aa c6 26 31 bc ea 43 8a 30 54 65 c5 43 9e 50 3b fa 91 93 0e 9d 3b 23 4a 3d 43 c1 c6 22 9b 68 af 2f fc Data Ascii: <"%B;9PL3up8y23B&1C0TeCP;;#J=C"h/R"j.P0N0UeyXW6\bG0U#0eyXW6\bG0U00HG`4%(^0VGv T=#
Aug 15, 2023 06:48:32.151879072 CEST	9	IN	Data Raw: ca b6 9b 39 e6 cf 27 d0 2c 99 74 d4 ca de 47 88 ed df f7 9c 3b ac 8a 62 d2 75 90 d9 00 81 d3 f8 c2 47 8e 9a bd 87 6d ce e5 9a 7f 28 76 a4 77 c6 3f b9 bf 4d f1 cb df 0f 2c 73 fe b4 60 e3 26 5e 83 f2 ae 36 56 94 e9 a7 9d a1 3d ca 5d 6e 3d 5d a8 6f Data Ascii: 9',tG;buGm(vw?M,s`&^6V=]n=]oh'g4E4{%QT?Qd9wsfI+\+Wfp;q.Lgr:>4m`=D^!`l.:s&jAI2S,kujOE&p eP
Aug 15, 2023 06:48:32.164609909 CEST	10	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 33 30 38 31 35 31 33 34 38 Data Ascii: 000H010UAnyDesk Client0 230815134830Z20730802134830Z010UAnyDesk Client0"0H0Zt;.J3qYjc'yYZ"T%j__I/<fi8
Aug 15, 2023 06:48:32.187566996 CEST	11	IN	Data Raw: 15 03 03 00 02 02 2d Data Ascii: -

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49168	92.223.88.232	80	C:\Users\user\Desktop\livechat.exe

Timestamp	kBytes transferred	Direction	Data
Aug 15, 2023 06:48:37.502417088 CEST	21	OUT	Data Raw: 16 03 01 01 0d 01 00 01 09 03 03 0e cf d9 8b 05 46 6a 86 a1 72 30 d3 09 65 4d 65 5a c7 7e 8b 2c d9 31 80 79 be d3 a3 d0 7f 8c 89 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: Fjr0eMeZ~,1yn0,($kjih98762.*&=5/+'#g@?>32101-)%</r#
Aug 15, 2023 06:48:37.524790049 CEST	22	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 ec fa a8 48 99 be 34 3a 63 cd a7 7f 41 d0 7a 1f 56 55 54 e3 0d ff be e3 44 4f 57 4e 47 52 44 01 20 f3 4f ca c7 36 f8 a1 f5 d8 c3 2b ac c7 2d 9e d0 a5 24 0d 05 a3 82 bd bf 96 14 66 5d 92 71 85 fa c0 2c 00 00 0b ff Data Ascii: WSH4:cAzVUTDOWNGRD O6+-$f]q,C0?0'0vtS$0*H0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0181118021423Z281115021
Aug 15, 2023 06:48:37.524843931 CEST	24	IN	Data Raw: 5a eb 51 2f 97 bf f6 fb 33 27 90 b3 d8 e4 e0 cd 68 3b 6a 87 6c a6 0d e7 d8 bd 61 df 56 6b 2a e1 1c 2b f5 9f bf 85 dd 8c 5b 06 1e 71 7f ba 4a a6 40 b0 77 17 ea 2c 3f 5b 94 14 85 2e ad 11 61 ab 88 f6 01 bb b3 47 6b e2 81 18 f1 8e 39 e6 d8 7b 0c 63 Data Ascii: ZQ/3'h;jlaVk*+[qJ@w,?[.aGk9{cpu'-5={{Hy8-&~K2vf/bj@kXScuxI#ph3/L^}a}4AkP+g_R4gs@lo67Jv"rR}uMU#[~.K_e
Aug 15, 2023 06:48:37.524883986 CEST	24	IN	Data Raw: 17 70 68 69 6c 61 6e 64 72 6f 20 53 6f 66 74 77 61 72 65 20 47 6d 62 48 31 0b 30 09 06 03 55 04 06 13 02 44 45 16 03 03 00 04 0e 00 00 00 Data Ascii: philandro Software GmbH10UDE
Aug 15, 2023 06:48:37.545222998 CEST	25	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 33 30 38 31 35 31 33 34 38 Data Ascii: 000H010UAnyDesk Client0 230815134830Z20730802134830Z010UAnyDesk Client0"0H0Zt;.J3qYjc'yYZ"T%j__I/<fi8
Aug 15, 2023 06:48:37.566121101 CEST	25	IN	Data Raw: 15 03 03 00 02 02 2d Data Ascii: -

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49171	92.223.88.232	80	C:\Users\user\Desktop\livechat.exe

Timestamp	kBytes transferred	Direction	Data
Aug 15, 2023 06:48:51.581813097 CEST	35	OUT	Data Raw: 16 03 01 01 0d 01 00 01 09 03 03 25 4e 4e 30 3d de dc 67 80 92 ad 5c 90 8a 78 dd 63 4d 63 57 e1 d1 78 82 c2 1a ee 18 40 ae 13 fc 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: %NN0=g\xcMcWx@n0,($kjih98762.*&=5/+'#g@?>32101-)%</r#
Aug 15, 2023 06:48:51.604188919 CEST	37	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 42 17 cf ba f0 be 29 ed 03 4c ff 45 13 6f dd 97 70 93 8c f7 6d e4 ce 35 44 4f 57 4e 47 52 44 01 20 cd 92 e8 23 a4 5b cc 15 05 78 91 c6 89 1b f7 8c 1e b7 80 45 15 a9 a8 99 5b 91 60 88 a2 70 4a cc c0 2c 00 00 0b ff Data Ascii: WSB)LEopm5DOWNGRD #[xE[`pJ,C0?0'0vtS$0*H0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0181118021423Z281115021
Aug 15, 2023 06:48:51.604219913 CEST	38	IN	Data Raw: 5a eb 51 2f 97 bf f6 fb 33 27 90 b3 d8 e4 e0 cd 68 3b 6a 87 6c a6 0d e7 d8 bd 61 df 56 6b 2a e1 1c 2b f5 9f bf 85 dd 8c 5b 06 1e 71 7f ba 4a a6 40 b0 77 17 ea 2c 3f 5b 94 14 85 2e ad 11 61 ab 88 f6 01 bb b3 47 6b e2 81 18 f1 8e 39 e6 d8 7b 0c 63 Data Ascii: ZQ/3'h;jlaVk*+[qJ@w,?[.aGk9{cpu'-5={{Hy8-&~K2vf/bj@kXScuxI#ph3/L^}a}4AkP+g_R4gs@lo67Jv"rR}uMU#[~.K_e
Aug 15, 2023 06:48:51.604239941 CEST	38	IN	Data Raw: 17 70 68 69 6c 61 6e 64 72 6f 20 53 6f 66 74 77 61 72 65 20 47 6d 62 48 31 0b 30 09 06 03 55 04 06 13 02 44 45 16 03 03 00 04 0e 00 00 00 Data Ascii: philandro Software GmbH10UDE
Aug 15, 2023 06:48:51.624496937 CEST	39	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 33 30 38 31 35 31 33 34 38 Data Ascii: 000H010UAnyDesk Client0 230815134830Z20730802134830Z010UAnyDesk Client0"0H0Zt;.J3qYjc'yYZ"T%j__I/<fi8
Aug 15, 2023 06:48:51.645709038 CEST	39	IN	Data Raw: 15 03 03 00 02 02 2d Data Ascii: -

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49174	49.12.130.235	80	C:\Users\user\Desktop\livechat.exe

Timestamp	kBytes transferred	Direction	Data
Aug 15, 2023 06:49:34.573987961 CEST	50	OUT	Data Raw: 16 03 01 01 0d 01 00 01 09 03 03 59 de 5a 49 0c b3 c1 bb 38 03 97 2a c8 30 84 90 7b 91 44 c8 df 3a 91 67 b0 71 32 4d 00 71 9b 25 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: YZI80{D:gq2Mq%n0,($kjih98762.&=5/+'#g@?>32101-)%</r#
Aug 15, 2023 06:49:34.601001024 CEST	51	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 81 1a 7f e8 32 4b ce 0c e1 55 fa 65 c2 d7 75 b3 f4 69 40 8f ba 6e 48 a3 44 4f 57 4e 47 52 44 01 20 4f 97 d4 7c 0d de 2f 80 e1 07 4f 08 3c ef 5f 1d de f3 1a 1f b7 ef fa fa 99 5a 6e 75 9c 7e 28 22 c0 2c 00 00 0b ff Data Ascii: WS2KUeui@nHDOWNGRD O\|/O<_Znu~(",C0?0'0vtS$0*H0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0181118021423Z281115021
Aug 15, 2023 06:49:34.601079941 CEST	52	IN	Data Raw: e6 e8 20 b9 4b 8b bb 63 de 6f 65 6a 9f 5d d7 c1 97 9b 2d 30 4e 9a 81 85 b4 1c 92 a6 ed d8 7a f9 df 9d 03 b3 90 9c 78 a9 c8 ba 0e 3c ac ec 14 db 7d 51 b3 97 06 b9 f6 77 60 ab fe 59 83 af 8e 97 56 29 c7 db 7e 71 79 d1 c7 f7 da b6 c8 f7 af 8f 24 e0 Data Ascii: Kcoej]-0Nzx<}Qw`YV)~qy$ZG\|'SO^jl$\|XM+")+{n\&9S\|4xLp\|aZ.qDL\vq$;OroCs4\|z\8[TRxU>R
Aug 15, 2023 06:49:34.601135015 CEST	52	IN	Data Raw: 35 35 5a 17 0d 32 34 30 34 30 38 30 32 33 37 35 35 5a 30 48 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 4e 65 74 20 52 6f 6f 74 20 43 41 31 20 30 1e 06 03 55 04 0a 0c 17 70 68 69 6c 61 6e 64 72 6f 20 53 6f 66 74 77 61 72 65 20 47 6d 62 48 31 0b 30 Data Ascii: 55Z240408023755Z0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0"0*H0AZ T7;h8m&i6p4p]\|Zx1\{ZQ/3'h;jlaV
Aug 15, 2023 06:49:34.601191998 CEST	53	IN	Data Raw: 3c 1f 22 91 25 17 15 cc 42 82 da 3b a8 39 c7 2a 50 ca d9 4c a0 8c 95 33 75 03 70 b8 df a0 c9 b2 b2 8b 1b 38 83 79 32 c3 12 da 33 96 42 f4 91 11 aa c6 26 31 bc ea 43 8a 30 54 65 c5 43 9e 50 3b fa 91 93 0e 9d 3b 23 4a 3d 43 c1 c6 22 9b 68 af 2f fc Data Ascii: <"%B;9PL3up8y23B&1C0TeCP;;#J=C"h/R"j.P0N0UeyXW6\bG0U#0eyXW6\bG0U00HG`4%(^0VGv T=#
Aug 15, 2023 06:49:34.601242065 CEST	53	IN	Data Raw: ca b6 9b 39 e6 cf 27 d0 2c 99 74 d4 ca de 47 88 ed df f7 9c 3b ac 8a 62 d2 75 90 d9 00 81 d3 f8 c2 47 8e 9a bd 87 6d ce e5 9a 7f 28 76 a4 77 c6 3f b9 bf 4d f1 cb df 0f 2c 73 fe b4 60 e3 26 5e 83 f2 ae 36 56 94 e9 a7 9d a1 3d ca 5d 6e 3d 5d a8 6f Data Ascii: 9',tG;buGm(vw?M,s`&^6V=]n=]oh'g4E4{%QT?*Qd9wsfI+\+Wfp;q.Lgr:>4m`=D^!`l.:s&jAH`y67dW=
Aug 15, 2023 06:49:34.621819019 CEST	54	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 33 30 38 31 35 31 33 34 38 Data Ascii: 000H010UAnyDesk Client0 230815134830Z20730802134830Z010UAnyDesk Client0"0H0Zt;.J3qYjc'yYZ"T%j__I/<fi8
Aug 15, 2023 06:49:34.645045042 CEST	54	IN	Data Raw: 15 03 03 00 02 02 2d Data Ascii: -

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.22	49178	92.223.88.41	80	C:\Users\user\Desktop\livechat.exe

Timestamp	kBytes transferred	Direction	Data
Aug 15, 2023 06:50:45.763545990 CEST	65	OUT	Data Raw: 16 03 01 01 0d 01 00 01 09 03 03 01 15 c6 38 42 c1 23 b1 4a eb 71 e8 4f f6 76 95 56 72 67 8e 9e c1 47 82 07 eb 27 39 99 9a 5a 2c 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: 8B#JqOvVrgG'9Z,n0,($kjih98762.*&=5/+'#g@?>32101-)%</r#
Aug 15, 2023 06:50:45.786745071 CEST	66	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 b4 dc 1c 24 f8 f8 39 33 fa 03 f2 e6 d3 8c 25 db 1c 66 b0 00 c0 23 e4 d9 44 4f 57 4e 47 52 44 01 20 c0 54 81 c7 ed 48 8a 3a be 7b cb 93 cb eb f3 0f c1 44 d1 13 3c dd 9a b4 a5 7d fe 4c 86 7a dd 6e c0 2c 00 00 0b ff Data Ascii: WS$93%f#DOWNGRD TH:{D<}Lzn,C0?0'0vtS$0*H0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0181118021423Z281115021
Aug 15, 2023 06:50:45.786808014 CEST	66	IN	Data Raw: e6 e8 20 b9 4b 8b bb 63 de 6f 65 6a 9f 5d d7 c1 97 9b 2d 30 4e 9a 81 85 b4 1c 92 a6 ed d8 7a f9 df 9d 03 b3 90 9c 78 a9 c8 ba 0e 3c ac ec 14 db 7d 51 b3 97 06 b9 f6 77 60 ab fe 59 83 af 8e 97 56 29 c7 db 7e 71 79 d1 c7 f7 da b6 c8 f7 af 8f 24 e0 Data Ascii: Kcoej]-0Nzx<}Qw`YV)~qy$ZG\|'SO^jl$\|XM+")+{n\&9S\|4xLp\|aZ.qDL\vq$;OroCs4\|z\8[TRxU>R
Aug 15, 2023 06:50:45.786840916 CEST	67	IN	Data Raw: 35 35 5a 17 0d 32 34 30 34 30 38 30 32 33 37 35 35 5a 30 48 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 4e 65 74 20 52 6f 6f 74 20 43 41 31 20 30 1e 06 03 55 04 0a 0c 17 70 68 69 6c 61 6e 64 72 6f 20 53 6f 66 74 77 61 72 65 20 47 6d 62 48 31 0b 30 Data Ascii: 55Z240408023755Z0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0"0*H0AZ T7;h8m&i6p4p]\|Zx1\{ZQ/3'h;jlaV
Aug 15, 2023 06:50:45.786860943 CEST	67	IN	Data Raw: 3c 1f 22 91 25 17 15 cc 42 82 da 3b a8 39 c7 2a 50 ca d9 4c a0 8c 95 33 75 03 70 b8 df a0 c9 b2 b2 8b 1b 38 83 79 32 c3 12 da 33 96 42 f4 91 11 aa c6 26 31 bc ea 43 8a 30 54 65 c5 43 9e 50 3b fa 91 93 0e 9d 3b 23 4a 3d 43 c1 c6 22 9b 68 af 2f fc Data Ascii: <"%B;9PL3up8y23B&1C0TeCP;;#J=C"h/R"j.P0N0UeyXW6\bG0U#0eyXW6\bG0U00HG`4%(^0VGv T=#
Aug 15, 2023 06:50:45.786892891 CEST	68	IN	Data Raw: ca b6 9b 39 e6 cf 27 d0 2c 99 74 d4 ca de 47 88 ed df f7 9c 3b ac 8a 62 d2 75 90 d9 00 81 d3 f8 c2 47 8e 9a bd 87 6d ce e5 9a 7f 28 76 a4 77 c6 3f b9 bf 4d f1 cb df 0f 2c 73 fe b4 60 e3 26 5e 83 f2 ae 36 56 94 e9 a7 9d a1 3d ca 5d 6e 3d 5d a8 6f Data Ascii: 9',tG;buGm(vw?M,s`&^6V=]n=]oh'g4E4{%QT?*Qd9wsfI+\+Wfp;q.Lgr:>4m`=D^!`l.:s&jA\-ipEt=N{`
Aug 15, 2023 06:50:45.799259901 CEST	69	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 33 30 38 31 35 31 33 34 38 Data Ascii: 000H010UAnyDesk Client0 230815134830Z20730802134830Z010UAnyDesk Client0"0H0Zt;.J3qYjc'yYZ"T%j__I/<fi8
Aug 15, 2023 06:50:45.819789886 CEST	69	IN	Data Raw: 15 03 03 00 02 02 2d Data Ascii: -

Target ID:	0
Start time:	06:48:24
Start date:	15/08/2023
Path:	C:\Users\user\Desktop\livechat.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\livechat.exe
Imagebase:	0x120000
File size:	4'040'776 bytes
MD5 hash:	30C9C57AA570088D745FAC7BFD05B805
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	06:48:27
Start date:	15/08/2023
Path:	C:\Users\user\Desktop\livechat.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\livechat.exe" --local-service
Imagebase:	0x120000
File size:	4'040'776 bytes
MD5 hash:	30C9C57AA570088D745FAC7BFD05B805
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	06:48:28
Start date:	15/08/2023
Path:	C:\Users\user\Desktop\livechat.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\livechat.exe" --local-control
Imagebase:	0x120000
File size:	4'040'776 bytes
MD5 hash:	30C9C57AA570088D745FAC7BFD05B805
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Function 00594B20 Relevance: 70.4, APIs: 24, Strings: 16, Instructions: 361filesynchronizationtimeCOMMON

Download Yara Rule

APIs

_vswprintf_s.LIBCMT ref: 00594B87
WaitForSingleObject.KERNEL32(00000000,00000BB8), ref: 00594BA9
OutputDebugStringA.KERNEL32(AnyDesk: Mutex broken!), ref: 00594BD5
_strncmp.LIBCMT ref: 00594C17
_strncmp.LIBCMT ref: 00594C33
_strncpy.LIBCMT ref: 00594CC9
_strncpy.LIBCMT ref: 00594CE2
GetSystemTime.KERNEL32(?), ref: 00594D20
TlsGetValue.KERNEL32(0000001C), ref: 00594D2A
__itow.LIBCMT ref: 00594D5C
GetCurrentThreadId.KERNEL32(?,?,?), ref: 00594DDA
GetCurrentProcessId.KERNEL32(00000000), ref: 00594DE1
__snprintf.LIBCMT ref: 00594E24
SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000002), ref: 00594E42
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00594E7B
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00594E8D
_memmove.LIBCMT ref: 00594EC1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00594ED3
WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00594EEC
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00594EFB
SetEndOfFile.KERNEL32(00000000), ref: 00594F05
WriteFile.KERNELBASE(00000000,?,?,?,00000000), ref: 00594F3B
RtlEnterCriticalSection.NTDLL(00D4F0D0), ref: 00594F97
RaiseException.KERNEL32(00002329,00000000,00000000,00000000), ref: 00594FA8

Strings

%d times: %s, xrefs: 00594C8B
crash, xrefs: 00594DAA
explode, xrefs: 00594DB8
front, xrefs: 00594DE8
invalid, xrefs: 00594DC6
auth, xrefs: 00594DB1
%7s %4i-%02i-%02i %02i:%02i:%02i.%03i %10s %6lu %6lu %4s %32s - %s, xrefs: 00594D69
warning, xrefs: 00594D9C
error, xrefs: 00594DA3, 00594E10
intern, xrefs: 00594D87
debug, xrefs: 00594D8E
info, xrefs: 00594D95
AnyDesk: Wait failed., xrefs: 00594BC2
AnyDesk: Mutex broken!, xrefs: 00594BD0
AnyDesk: Timeout in trace., xrefs: 00594BC9
verbose, xrefs: 00594DBF

Memory Dump Source

Source File: 00000000.00000002.747359303.0000000000126000.00000020.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.747294089.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747309017.0000000000121000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747345083.0000000000125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748598921.0000000000D58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748611635.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748670498.0000000000DCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748679438.0000000000DD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.751019727.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_livechat.jbxd

Similarity

API ID: File$Pointer$CurrentWrite_strncmp_strncpy$CriticalDebugEnterExceptionObjectOutputProcessRaiseReadSectionSingleStringSystemThreadTimeValueWait__itow__snprintf_memmove_vswprintf_s
String ID: %d times: %s$%7s %4i-%02i-%02i %02i:%02i:%02i.%03i %10s %6lu %6lu %4s %32s - %s$AnyDesk: Mutex broken!$AnyDesk: Timeout in trace.$AnyDesk: Wait failed.$auth$crash$debug$error$explode$front$info$intern$invalid$verbose$warning
API String ID: 4093955403-2797980505
Opcode ID: 7fc2aef7d10cc846b6649d66d4828e0450d45169227e0dbfba823ba711e96641
Instruction ID: 5bfe0c728d05cb9ab59e60283af07bb3285a3c8f550fd944b0a1dd66f28b1510
Opcode Fuzzy Hash: 7fc2aef7d10cc846b6649d66d4828e0450d45169227e0dbfba823ba711e96641
Instruction Fuzzy Hash: 64D1D0B1A00208AFDF14CF64DC84FAA7BA9BF49310F148569FA05AB285D778DD42CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00594A00 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF), ref: 00594A57
GetLastError.KERNEL32(?), ref: 00594A5D
CreateFileW.KERNELBASE(0156EDF0,C0000000,00000007,00000000,00000004,00000000,00000000), ref: 00594A99
GetLastError.KERNEL32 ref: 00594AAD
RevertToSelf.ADVAPI32 ref: 00594AD9
CloseHandle.KERNEL32(FFFFFFFF), ref: 00594AED

Part of subcall function 005947F0: GetCurrentProcess.KERNEL32(0000000C,?,00D4F0D0,?,00D4F0D0), ref: 00594806
Part of subcall function 005947F0: OpenProcessToken.ADVAPI32(00000000), ref: 0059480D
Part of subcall function 005947F0: GetTokenInformation.KERNELBASE(FFFFFFFF,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 00594832
Part of subcall function 005947F0: GetLastError.KERNEL32 ref: 00594838
Part of subcall function 005947F0: CloseHandle.KERNEL32(FFFFFFFF), ref: 00594850

Part of subcall function 005947A0: GetCurrentThread.KERNEL32(000F01FF,00000001,?,00D4F0D0,?,00594A38,?), ref: 005947B6
Part of subcall function 005947A0: OpenThreadToken.ADVAPI32(00000000,?,00594A38,?), ref: 005947BD
Part of subcall function 005947A0: CloseHandle.KERNEL32(?), ref: 005947D6

Part of subcall function 005948B0: GetCurrentProcessId.KERNEL32(?,00D4F0D0,00D4F0D0), ref: 005948D6
Part of subcall function 005948B0: ProcessIdToSessionId.KERNEL32(00000000), ref: 005948DD
Part of subcall function 005948B0: ImpersonateLoggedOnUser.ADVAPI32(00000000), ref: 00594912

Strings

Couldn't impersonate (%08lx)., xrefs: 00594A64
Couldn't open the trace file (%08lx)., xrefs: 00594AB4

Memory Dump Source

Source File: 00000000.00000002.747359303.0000000000126000.00000020.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.747294089.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747309017.0000000000121000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747345083.0000000000125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748598921.0000000000D58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748611635.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748670498.0000000000DCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748679438.0000000000DD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.751019727.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_livechat.jbxd

Similarity

API ID: CloseHandleProcess$CurrentErrorLastToken$OpenThread$CreateFileImpersonateInformationLoggedRevertSelfSessionUser
String ID: Couldn't impersonate (%08lx).$Couldn't open the trace file (%08lx).
API String ID: 432512558-3770443821
Opcode ID: 3c8743bd8d93b2a39ce3a065868a36cfdf9cf2492fe9b406a5fc5e9e81afb818
Instruction ID: 1aaf45b2e68010ebcb75d15b2e13409b5ca808ae3cee3c31b49ffd85b007ef09
Opcode Fuzzy Hash: 3c8743bd8d93b2a39ce3a065868a36cfdf9cf2492fe9b406a5fc5e9e81afb818
Instruction Fuzzy Hash: C221F7305847416BEF209B74AC0DB593F99BF4232CF048355F9A4921D1E3B49C978FAA

Uniqueness

Uniqueness Score: -1.00%

Function 005947F0 Relevance: 12.1, APIs: 8, Instructions: 81COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000C,?,00D4F0D0,?,00D4F0D0), ref: 00594806
OpenProcessToken.ADVAPI32(00000000), ref: 0059480D
GetTokenInformation.KERNELBASE(FFFFFFFF,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 00594832
GetLastError.KERNEL32 ref: 00594838
CloseHandle.KERNEL32(FFFFFFFF), ref: 00594850
GetTokenInformation.KERNELBASE(FFFFFFFF,00000001(TokenIntegrityLevel),?,00000000,00000000), ref: 0059487A
CloseHandle.KERNELBASE(FFFFFFFF), ref: 0059488D
IsWellKnownSid.ADVAPI32(?,00000016,?,00000000,00000000), ref: 00594898

Memory Dump Source

Source File: 00000000.00000002.747359303.0000000000126000.00000020.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.747294089.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747309017.0000000000121000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747345083.0000000000125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748598921.0000000000D58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748611635.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748670498.0000000000DCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748679438.0000000000DD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.751019727.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_livechat.jbxd

Similarity

API ID: Token$CloseHandleInformationProcess$CurrentErrorKnownLastOpenWell
String ID:
API String ID: 4246584975-0
Opcode ID: 7a4edefdfe7ad2176c99ec348d62bb15a688a9ee46823cd834bacadd5f27173d
Instruction ID: 4580f8e50877212e04c5eedf4cfbd26d7da97497c5e5fac5e097205715641669
Opcode Fuzzy Hash: 7a4edefdfe7ad2176c99ec348d62bb15a688a9ee46823cd834bacadd5f27173d
Instruction Fuzzy Hash: 17216271A00609BBDF20DBA9DC89FAE7B7CFB44721F200255F918E71D0E6349E468A65

Uniqueness

Uniqueness Score: -1.00%

Function 006F10F2 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 208COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 006F110C

Part of subcall function 006F2E11: __FF_MSGBANNER.LIBCMT ref: 006F2E2A
Part of subcall function 006F2E11: __NMSG_WRITE.LIBCMT ref: 006F2E31
Part of subcall function 006F2E11: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 006F2E56

std::exception::exception.LIBCMT ref: 006F1141
std::exception::exception.LIBCMT ref: 006F115B
__CxxThrowException@8.LIBCMT ref: 006F116C

Strings

$, xrefs: 006F11AD

Memory Dump Source

Source File: 00000000.00000002.747359303.0000000000126000.00000020.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.747294089.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747309017.0000000000121000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747345083.0000000000125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748598921.0000000000D58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748611635.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748670498.0000000000DCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748679438.0000000000DD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.751019727.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_livechat.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID: $
API String ID: 615853336-3993045852
Opcode ID: 5e2de90cbeb47123b4250da7b3311c36136825cb70c8b2585d981e8a17524376
Instruction ID: f2be14150a0ab8df7611f2f25ca427c58bfe2a9baf2f6e7f343f8d443c6250fa
Opcode Fuzzy Hash: 5e2de90cbeb47123b4250da7b3311c36136825cb70c8b2585d981e8a17524376
Instruction Fuzzy Hash: F061B27190024DDBDF24DF98D8467FE77A7AF133A4F20022AEA15EA280D7B08F91D655

Uniqueness

Uniqueness Score: -1.00%

Function 005FE340 Relevance: 7.5, APIs: 5, Instructions: 44comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 005FE359
SetEvent.KERNEL32(?,?,?,?,0075D058,000000FF,005FE32B), ref: 005FE371
OleUninitialize.OLE32 ref: 005FE397
TlsGetValue.KERNEL32(?,?,?,?,0075D058,000000FF,005FE32B), ref: 005FE3A7
TlsSetValue.KERNEL32(?,00000000), ref: 005FE3BF

Memory Dump Source

Source File: 00000000.00000002.747359303.0000000000126000.00000020.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.747294089.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747309017.0000000000121000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747345083.0000000000125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748598921.0000000000D58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748611635.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748670498.0000000000DCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748679438.0000000000DD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.751019727.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_livechat.jbxd

Similarity

API ID: Value$EventInitializeUninitialize
String ID:
API String ID: 566941487-0
Opcode ID: 14b792b8bdb8fd44d2a23fd6b4498c0cb924b2a943d591a03a0156dad15c402d
Instruction ID: 80197a3e5ca8088d9264c155a667f37eeff108df91fe6a31f07cb168d1cd2779
Opcode Fuzzy Hash: 14b792b8bdb8fd44d2a23fd6b4498c0cb924b2a943d591a03a0156dad15c402d
Instruction Fuzzy Hash: D0015EB5600740ABD710EF64DC0EB2B7AA9FB80B15F40891EF906C36A0EB3DE4018A56

Uniqueness

Uniqueness Score: -1.00%

Function 001219FE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 71memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,00000028,00000004,00000000,00121CCE,?), ref: 00121A84
VirtualProtect.KERNELBASE(?,00000028,00000000,00000000), ref: 00121A9B

Strings

.itext, xrefs: 00121A54
.text, xrefs: 00121A22

Memory Dump Source

Source File: 00000000.00000002.747309017.0000000000121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.747294089.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747345083.0000000000125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747359303.0000000000126000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748598921.0000000000D58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748611635.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748670498.0000000000DCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748679438.0000000000DD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.751019727.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_livechat.jbxd

Similarity

API ID: ProtectVirtual
String ID: .itext$.text
API String ID: 544645111-3616233406
Opcode ID: 3654394267933e0a7caa09bde84a1d7efa039bc5d0bbf7e99ee3f3ae3f1754cb
Instruction ID: d7c6e865c9fa9e9168a511c845aa5be927d90acb2fb49e4bbc349257130ca6d0
Opcode Fuzzy Hash: 3654394267933e0a7caa09bde84a1d7efa039bc5d0bbf7e99ee3f3ae3f1754cb
Instruction Fuzzy Hash: 7F11E17AA41365BAC720CF90AD81BFAB3F9EB24740F104529F942E7141E370E9A9D760

Uniqueness

Uniqueness Score: -1.00%

Function 00600D10 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(advapi32.dll), ref: 00600D29
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00600D49
_free.LIBCMT ref: 00600D74

Part of subcall function 006F1DCE: HeapFree.KERNEL32(00000000,00000000), ref: 006F1DE4

Strings

advapi32.dll, xrefs: 00600D28, 00600D50

Memory Dump Source

Source File: 00000000.00000002.747359303.0000000000126000.00000020.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.747294089.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747309017.0000000000121000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747345083.0000000000125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748598921.0000000000D58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748611635.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748670498.0000000000DCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748679438.0000000000DD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.751019727.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_livechat.jbxd

Similarity

API ID: ErrorFreeHeapLastLibraryLoad_free
String ID: advapi32.dll
API String ID: 1383136612-4050573280
Opcode ID: 08e2a2910ec142cd0d1bb4e5e6d2e9a2e1819a0be137046ab4701389622f3001
Instruction ID: ec4fa73b8d0a9fd95bec49c6fc4fa136cc949a0722a9a03b7afef386d064a4ca
Opcode Fuzzy Hash: 08e2a2910ec142cd0d1bb4e5e6d2e9a2e1819a0be137046ab4701389622f3001
Instruction Fuzzy Hash: 41016DB0544B41EFEB11EB68C80975BBBE8BF44704F04892EF49982391E738D4048766

Uniqueness

Uniqueness Score: -1.00%

Function 00600D90 Relevance: 4.5, APIs: 3, Instructions: 38COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(C4AA70B8,000000FF,005951A0,?), ref: 00600DB3
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00600DD1
_free.LIBCMT ref: 00600DFB

Part of subcall function 006F1DCE: HeapFree.KERNEL32(00000000,00000000), ref: 006F1DE4

Memory Dump Source

Source File: 00000000.00000002.747359303.0000000000126000.00000020.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.747294089.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747309017.0000000000121000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747345083.0000000000125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748598921.0000000000D58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748611635.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748670498.0000000000DCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748679438.0000000000DD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.751019727.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_livechat.jbxd

Similarity

API ID: Free$ErrorHeapLastLibrary_free
String ID:
API String ID: 1013596455-0
Opcode ID: 0420d3098c70b9d934eb0f93686669a9a0891236ad85cef4686dfe0d946361f4
Instruction ID: b2e70a457be038211cd13fe6f58cc24a97b75d82fa94061bfcef0d8b67b5aab0
Opcode Fuzzy Hash: 0420d3098c70b9d934eb0f93686669a9a0891236ad85cef4686dfe0d946361f4
Instruction Fuzzy Hash: 29014BB1548741EBE714DB38C949B5BBBE8BB44700F048D2EF84593391EB38D648CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00121000 Relevance: 1.6, APIs: 1, Instructions: 107memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,00121B87,?,?,?,00C9AE00,00124000,00CAAE00,?), ref: 00121045

Memory Dump Source

Source File: 00000000.00000002.747309017.0000000000121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.747294089.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747345083.0000000000125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747359303.0000000000126000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748598921.0000000000D58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748611635.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748670498.0000000000DCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748679438.0000000000DD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.751019727.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_livechat.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8ad0bd426fc4e14450ebb4a25b13beb1236773bfd8cb879707df8a141987a14b
Instruction ID: 19b517d942d19ddd78c20a1fc627f88e90ced58d24c9a3b8eb27c78a2e2f67ca
Opcode Fuzzy Hash: 8ad0bd426fc4e14450ebb4a25b13beb1236773bfd8cb879707df8a141987a14b
Instruction Fuzzy Hash: B64182B1600711DFC324CF25D880A66B7F5FF68300B25892EE99A87B51E375F8A5CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00700E3A Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 00700E7D

Part of subcall function 006F7E11: __getptd_noexit.LIBCMT ref: 006F7E11

Memory Dump Source

Source File: 00000000.00000002.747359303.0000000000126000.00000020.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.747294089.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747309017.0000000000121000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747345083.0000000000125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748598921.0000000000D58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748611635.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748670498.0000000000DCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748679438.0000000000DD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.751019727.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_livechat.jbxd

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: f174a10778199a479e6562b116726ab3d8d70a439946b04f380232414fc5a033
Instruction ID: bb11ac63fe80bb529d12af5b30cbaf7d6d6578b7dc67526fa11f2b8ce2bc61dd
Opcode Fuzzy Hash: f174a10778199a479e6562b116726ab3d8d70a439946b04f380232414fc5a033
Instruction Fuzzy Hash: 62019E35301215DEEB29AF25EC04B6B37D8AB817B0F144F2AE815EA1E1D778D80087D0

Uniqueness

Uniqueness Score: -1.00%

Function 006F187A Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

Part of subcall function 006F88A1: __lock.LIBCMT ref: 006F88A3

__onexit_nolock.LIBCMT ref: 006F1892

Part of subcall function 006F1793: RtlDecodePointer.NTDLL(00D4E280), ref: 006F17A8
Part of subcall function 006F1793: RtlDecodePointer.NTDLL ref: 006F17B5
Part of subcall function 006F1793: __realloc_crt.LIBCMT ref: 006F17F2
Part of subcall function 006F1793: __realloc_crt.LIBCMT ref: 006F1808
Part of subcall function 006F1793: RtlEncodePointer.NTDLL(00000000), ref: 006F181A
Part of subcall function 006F1793: RtlEncodePointer.NTDLL(88735C9C), ref: 006F182E
Part of subcall function 006F1793: RtlEncodePointer.NTDLL(-00000004), ref: 006F1836

Memory Dump Source

Source File: 00000000.00000002.747359303.0000000000126000.00000020.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.747294089.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747309017.0000000000121000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747345083.0000000000125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748598921.0000000000D58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748611635.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748670498.0000000000DCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748679438.0000000000DD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.751019727.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_livechat.jbxd

Similarity

API ID: Pointer$Encode$Decode__realloc_crt$__lock__onexit_nolock
String ID:
API String ID: 3536590627-0
Opcode ID: 1c60242edd718886b59d7a793497cbcd5baaef891c2d138f2ac97eaca1fc2ba1
Instruction ID: 7441ba2bd7a94ad36007b6bfbe6ebab71db707692e96baaeb06b526946622935
Opcode Fuzzy Hash: 1c60242edd718886b59d7a793497cbcd5baaef891c2d138f2ac97eaca1fc2ba1
Instruction Fuzzy Hash: F7D05E31C0070CEADB90FFB4C9427BD7BB26F003A0F60826CF2346A1E2CB744A019A49

Uniqueness

Uniqueness Score: -1.00%

Function 00121E30 Relevance: 1.5, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,?,00121CD9,?,?), ref: 00121E44

Memory Dump Source

Source File: 00000000.00000002.747309017.0000000000121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.747294089.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747345083.0000000000125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747359303.0000000000126000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748598921.0000000000D58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748611635.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748670498.0000000000DCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748679438.0000000000DD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.751019727.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_livechat.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fcb2ab42565846cd0755b84c485fb0dd8ed3536351509fb9e1afcc4644f1d2b4
Instruction ID: 995493327cdfd824f02b84bf0dcb59c8ffe3687a0f0bdb3f8085dc90d91dc514
Opcode Fuzzy Hash: fcb2ab42565846cd0755b84c485fb0dd8ed3536351509fb9e1afcc4644f1d2b4
Instruction Fuzzy Hash: 3CC04835215111EFCB95DB98D84CF097BE4BB88B16F0888A4F229CB264C63098409B51

Uniqueness

Uniqueness Score: -1.00%

Function 006FBA5E Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 006FBA60

Memory Dump Source

Source File: 00000000.00000002.747359303.0000000000126000.00000020.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.747294089.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747309017.0000000000121000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747345083.0000000000125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748598921.0000000000D58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748611635.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748670498.0000000000DCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748679438.0000000000DD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.751019727.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_livechat.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: c6a1aa2cc284fcc8bc2d32751f565f1be14babd1ff55118002d6aa9bc4ad3a30
Instruction ID: b21845688ef3cb106682f16e98c637677b8fefd40f5d8d19ea050d486fec8e16
Opcode Fuzzy Hash: c6a1aa2cc284fcc8bc2d32751f565f1be14babd1ff55118002d6aa9bc4ad3a30
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00121E47 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00121E5A

Memory Dump Source

Source File: 00000000.00000002.747309017.0000000000121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.747294089.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747345083.0000000000125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747359303.0000000000126000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748598921.0000000000D58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748611635.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748670498.0000000000DCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748679438.0000000000DD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.751019727.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_livechat.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 63ef09d4eb12fe895dc2e40099ebed39cd54f4b2909d9f0c261dec3c0009aaf4
Instruction ID: 975bc3667eec2d9777e24aa664facd907824723eb2b089de37003194e32718c8
Opcode Fuzzy Hash: 63ef09d4eb12fe895dc2e40099ebed39cd54f4b2909d9f0c261dec3c0009aaf4
Instruction Fuzzy Hash: 95C04C36505122EFCB509F94E80CEC6BFA4FF48765F068844F25997075C7309885CB91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 007038F9 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0070CA3A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0070CA4F
UnhandledExceptionFilter.KERNEL32(007A7B44), ref: 0070CA5A
GetCurrentProcess.KERNEL32(C0000409), ref: 0070CA76
TerminateProcess.KERNEL32(00000000), ref: 0070CA7D

Memory Dump Source

Source File: 00000000.00000002.747359303.0000000000126000.00000020.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.747294089.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747309017.0000000000121000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747345083.0000000000125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748598921.0000000000D58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748611635.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748670498.0000000000DCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748679438.0000000000DD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.751019727.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_livechat.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 63cbf962d72cc598f8b75a4ece5728e219fb2232fce15845bb938e0773276325
Instruction ID: 4b98a35ff5584c995c5a5bf2f7cd3c4dd1b8f0408df0eba39d047f39a5ac4f1c
Opcode Fuzzy Hash: 63cbf962d72cc598f8b75a4ece5728e219fb2232fce15845bb938e0773276325
Instruction Fuzzy Hash: F321C0BC910314EFD700DF28EC89A547BB4BB0A314F14556AF409C73B0E7B859818F6A

Uniqueness

Uniqueness Score: -1.00%

Function 003642D0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00600D10: LoadLibraryW.KERNEL32(advapi32.dll), ref: 00600D29
Part of subcall function 00600D10: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00600D49
Part of subcall function 00600D10: _free.LIBCMT ref: 00600D74

GetProcAddress.KERNEL32(00000000,ConvertStringSecurityDescriptorToSecurityDescriptorW,00D4F0D0,?,0059512D), ref: 003642F6
GetProcAddress.KERNEL32(00366560,OpenEventLogA,00D4F0D0,?,0059512D), ref: 00364310
GetProcAddress.KERNEL32(0036ED80,CloseEventLog,00D4F0D0,?,0059512D), ref: 0036432A
GetProcAddress.KERNEL32(0058F960,ReportEventA,00D4F0D0,?,0059512D), ref: 00364344
GetProcAddress.KERNEL32(00366570,CreateProcessWithTokenW,00D4F0D0,?,0059512D), ref: 0036435E

Strings

ReportEventA, xrefs: 0036433E
OpenEventLogA, xrefs: 0036430A
ConvertStringSecurityDescriptorToSecurityDescriptorW, xrefs: 003642F0
CloseEventLog, xrefs: 00364324
advapi32.dll, xrefs: 003642D4
CreateProcessWithTokenW, xrefs: 00364358

Memory Dump Source

Source File: 00000000.00000002.747359303.0000000000126000.00000020.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.747294089.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747309017.0000000000121000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747345083.0000000000125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748598921.0000000000D58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748611635.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748670498.0000000000DCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748679438.0000000000DD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.751019727.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_livechat.jbxd

Similarity

API ID: AddressProc$ErrorLastLibraryLoad_free
String ID: CloseEventLog$ConvertStringSecurityDescriptorToSecurityDescriptorW$CreateProcessWithTokenW$OpenEventLogA$ReportEventA$advapi32.dll
API String ID: 1327587910-3518705215
Opcode ID: 582b1576ab455740ced1dd0a421e69356c260dde76d6034ae20427801c151e29
Instruction ID: 00755e6d4625689fc0ac4b900186d2cd89a820eb57c5c551bc8022df6006b550
Opcode Fuzzy Hash: 582b1576ab455740ced1dd0a421e69356c260dde76d6034ae20427801c151e29
Instruction Fuzzy Hash: F5110C74F01313ABDB51EE7A9D01B166EE8AF50B807258436A804E7388E720EC318BE0

Uniqueness

Uniqueness Score: -1.00%

Function 006FB264 Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 006FB270

Part of subcall function 006FBC4B: __getptd_noexit.LIBCMT ref: 006FBC4E
Part of subcall function 006FBC4B: __amsg_exit.LIBCMT ref: 006FBC5B

__amsg_exit.LIBCMT ref: 006FB290
__lock.LIBCMT ref: 006FB2A0
InterlockedDecrement.KERNEL32(?), ref: 006FB2BD
_free.LIBCMT ref: 006FB2D0
InterlockedIncrement.KERNEL32(030717A8), ref: 006FB2E8

Memory Dump Source

Source File: 00000000.00000002.747359303.0000000000126000.00000020.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.747294089.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747309017.0000000000121000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747345083.0000000000125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748598921.0000000000D58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748611635.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748670498.0000000000DCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748679438.0000000000DD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.751019727.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_livechat.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 1cb65aefb28df7239709040d952debd273e0bab7d4e5027d506c3d894fe48ab1
Instruction ID: 21385dda4fac852c5512bb2590baf662ac84739340420459fb0b1ddce1445aaf
Opcode Fuzzy Hash: 1cb65aefb28df7239709040d952debd273e0bab7d4e5027d506c3d894fe48ab1
Instruction Fuzzy Hash: AF01D631D01729DBCB61BF64D8467BD77A2BF05764F041009EA14A7390CB385E41DBD5

Uniqueness

Uniqueness Score: -1.00%

Function 006F3449 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 006F3457

Part of subcall function 006F2E11: __FF_MSGBANNER.LIBCMT ref: 006F2E2A
Part of subcall function 006F2E11: __NMSG_WRITE.LIBCMT ref: 006F2E31
Part of subcall function 006F2E11: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 006F2E56

_free.LIBCMT ref: 006F346A

Memory Dump Source

Source File: 00000000.00000002.747359303.0000000000126000.00000020.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.747294089.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747309017.0000000000121000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747345083.0000000000125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748598921.0000000000D58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748611635.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748670498.0000000000DCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748679438.0000000000DD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.751019727.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_livechat.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 2e056f2fa1e4e32cc44c08649b6e1b3b440532dc4d01dc85f016e427efafc492
Instruction ID: 4ec15641906bf72902a49a934134b809009a179a1934d5f820e0392ea7f27da4
Opcode Fuzzy Hash: 2e056f2fa1e4e32cc44c08649b6e1b3b440532dc4d01dc85f016e427efafc492
Instruction Fuzzy Hash: 4D11A73250462DBBCB626F74AC056BD3BD7AF443A0B24452AFB489B391DA34CD528698

Uniqueness

Uniqueness Score: -1.00%

Function 0070AEDF Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0070AF13
__isleadbyte_l.LIBCMT ref: 0070AF46
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?,?,?), ref: 0070AF77
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?,?,?), ref: 0070AFE5

Memory Dump Source

Source File: 00000000.00000002.747359303.0000000000126000.00000020.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.747294089.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747309017.0000000000121000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.747345083.0000000000125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748010078.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748490674.0000000000CA6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748568448.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748598921.0000000000D58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748611635.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748670498.0000000000DCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.748679438.0000000000DD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.751019727.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_livechat.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 6e1e018f49f504f2e9a9690d9afdcf7164c7a4259c2af21e803ce948152fb4d5
Instruction ID: 81c517ea8a33f491b28b75e6bf9a7a457e418ab6c2197916f3a1cb6e467890c9
Opcode Fuzzy Hash: 6e1e018f49f504f2e9a9690d9afdcf7164c7a4259c2af21e803ce948152fb4d5
Instruction Fuzzy Hash: EB3157B1A00346FFDB20DFA4C884DAA7BE5AF01311F188AA9F461DB1D1E734E950DB52

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report livechat.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\AnyDesk\ad.trace

C:\Users\user\AppData\Roaming\AnyDesk\service.conf

C:\Users\user\AppData\Roaming\AnyDesk\system.conf

C:\Users\user\AppData\Roaming\AnyDesk\user.conf

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7PE6VXJP6DLBIUEF42WE.temp

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
livechat.exe

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre