Edit tour

Windows Analysis Report
_AnyDesk.exe_

Overview

General Information

Sample name:	_AnyDesk.exe_
Analysis ID:	1514437
MD5:	ecae8b9c820ce255108f6050c26c37a1
SHA1:	42333349841ddcec2b5c073abc0cae651bb03e5f
SHA256:	1a70f4eef11fbecb721b9bab1c9ff43a8c4cd7b2cafef08c033c77070c6fe069
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	48
Range:	0 - 100

Signatures

Detected unpacking (changes PE section rights)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read device registry values (via SetupAPI)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE file does not import any functions

Potential key logger detected (key state polling based)

Queries device information via Setup API

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

System is w10x64_ra

_AnyDesk.exe (PID: 5772 cmdline: "C:\Users\user\Desktop\_AnyDesk.exe" MD5: ECAE8B9C820CE255108F6050C26C37A1)

_AnyDesk.exe (PID: 6424 cmdline: "C:\Users\user\Desktop\_AnyDesk.exe" --local-service MD5: ECAE8B9C820CE255108F6050C26C37A1)

_AnyDesk.exe (PID: 6736 cmdline: "C:\Users\user\Desktop\_AnyDesk.exe" --local-control MD5: ECAE8B9C820CE255108F6050C26C37A1)

cleanup

HTTP traffic detected: POST /httpapi HTTP/1.1Host: api.playanext.comUser-Agent: AnyDesk/8.1.0Accept: */*Content-Length: 352Content-Type: application/x-www-form-urlencodedapi_key=c1426bd258099fa69f62933b466d4b77&event=[{"event_type":"check_offer","user_id":"464bbffb9f7c03157be5e17ab1b9672a","session_id":1726829248386429,"ip":"$remote","event_properties":{"method_used":"Google Chrome Criteria Checker","offer_product":"Google Chrome","distributor":"AnyDesk","distributor_product":"AnyDesk","user_country":"Switzerland"}}Data Raw: Data Ascii:

Source: _AnyDesk.exe_	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: _AnyDesk.exe_	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: _AnyDesk.exe_	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: _AnyDesk.exe_	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: _AnyDesk.exe_	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: _AnyDesk.exe_	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: _AnyDesk.exe_	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: _AnyDesk.exe_	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: _AnyDesk.exe_	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: _AnyDesk.exe_	String found in binary or memory: http://ocsp.digicert.com0
Source: _AnyDesk.exe_	String found in binary or memory: http://ocsp.digicert.com0A
Source: _AnyDesk.exe_	String found in binary or memory: http://ocsp.digicert.com0C
Source: _AnyDesk.exe_	String found in binary or memory: http://ocsp.digicert.com0X
Source: _AnyDesk.exe_	String found in binary or memory: http://www.digicert.com/CPS0
Source: _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000002.00000002.1813021660.0000000001A5A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.opengl.org/registry/
Source: _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/
Source: _AnyDesk.exe, 00000003.00000003.1195116537.000000000449D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/compan
Source: _AnyDesk.exe, 00000000.00000003.1184530534.00000000047B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/company#im
Source: _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/company#imprint
Source: _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/contact/sales
Source: _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1183910270.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/en/changelog/windows
Source: _AnyDesk.exe, 00000000.00000002.1851377575.00000000047EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/en/changelog/windows$
Source: _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/order
Source: _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000002.1846933654.0000000002672000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000002.1851377575.0000000004737000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/pricing/teams
Source: _AnyDesk.exe, 00000000.00000002.1851377575.0000000004737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/pricing/teams)
Source: _AnyDesk.exe, 00000000.00000002.1851377575.0000000004737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/pricing/teams7
Source: _AnyDesk.exe, 00000000.00000002.1851377575.0000000004737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/pricing/teamsI
Source: _AnyDesk.exe, 00000000.00000002.1851377575.0000000004737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/pricing/teamsO
Source: _AnyDesk.exe, 00000000.00000002.1851377575.0000000004737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/pricing/teamse
Source: _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1195116537.000000000449D000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/privacy
Source: _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047B9000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1195116537.000000000449D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/terms
Source: _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047B9000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1195116537.000000000449D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/update
Source: _AnyDesk.exe, 00000000.00000003.1176452291.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000002.1813026102.0000000001708000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://boot.net.anydesk.comabcdefABCDEFtruefalsetfInvalid
Source: _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000002.1813021415.0000000001A59000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1524/
Source: _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000002.1813021415.0000000001A59000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1526/
Source: _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000002.1813021415.0000000001A59000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1914/
Source: _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com
Source: _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000002.00000002.1813021660.0000000001BA5000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/
Source: _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/$
Source: _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000002.00000002.1813021660.0000000001BA5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/HelpLinkInstallLocationAnyDesk
Source: _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.com
Source: _AnyDesk.exe, 00000003.00000002.1852610719.00000000049E0000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.com/auth/realms/myanydesk/login-actions/reset-credentials?client_id=myanydesk-fro
Source: _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1183910270.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1318456925.000000000451E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.com/auth/realms/myanydesk/protocol/openid-connect/registrations?client_id=myanyde
Source: _AnyDesk.exe, 00000000.00000002.1813026102.0000000001B2E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://my.anydesk.com/password-generator.
Source: _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.com/v2
Source: _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://order.anydesk.com/trial
Source: _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000002.1850839744.0000000004507000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194888231.000000000450B000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/privacy?hl=$
Source: _AnyDesk.exe, 00000003.00000002.1813021415.0000000001B5F000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.anydesk.com
Source: _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047B9000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1195116537.000000000449D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/
Source: _AnyDesk.exe, 00000000.00000002.1855670783.0000000004BE0000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1183910270.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/account-migration
Source: _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1183910270.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/anydesk-account
Source: _AnyDesk.exe, 00000000.00000002.1855670783.0000000004BE0000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000002.1852610719.00000000049E0000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/anydesk-for-android-chromeos#troubleshooting
Source: _AnyDesk.exe, 00000000.00000002.1851377575.00000000047EA000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000002.1846933654.00000000025F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/anydesk-id-and-alias
Source: _AnyDesk.exe, 00000003.00000002.1852610719.00000000049E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/anydesk-id-and-aliasK
Source: _AnyDesk.exe, 00000000.00000002.1851377575.00000000047EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/anydesk-id-and-aliasZ
Source: _AnyDesk.exe, 00000000.00000002.1846933654.00000000025F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/anydesk-id-and-aliase
Source: _AnyDesk.exe, 00000000.00000002.1851377575.00000000047EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/anydesk-id-and-aliasj
Source: _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1183910270.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/how-do-i-delete-my-anydesk-account
Source: _AnyDesk.exe, 00000003.00000002.1852610719.00000000049E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/how-do-i-delete-my-anydesk-account.
Source: _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1183910270.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000002.1850839744.0000000004507000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194888231.000000000450B000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/license-expired-error
Source: _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1183910270.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/my-anydesk-ii#user-management
Source: _AnyDesk.exe, 00000000.00000002.1851377575.00000000047EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/my-anydesk-ii#user-management6
Source: _AnyDesk.exe, 00000000.00000002.1851377575.00000000047EA000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000002.1846933654.0000000002672000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/quick-start-guide
Source: _AnyDesk.exe, 00000000.00000002.1855670783.0000000004BE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/quick-start-guide8
Source: _AnyDesk.exe, 00000000.00000002.1855670783.0000000004BE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/quick-start-guide9
Source: _AnyDesk.exe, 00000003.00000002.1852610719.00000000049E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/quick-start-guide=
Source: _AnyDesk.exe, 00000000.00000002.1851377575.00000000047EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/quick-start-guideY
Source: _AnyDesk.exe, 00000000.00000002.1851377575.00000000047EA000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000002.1852610719.00000000049E0000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/security-permissions-on-macos
Source: _AnyDesk.exe, 00000000.00000002.1855670783.0000000004BE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/security-permissions-on-macos?IH
Source: _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1183910270.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/status-anynet_overload
Source: _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1183910270.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000002.1851377575.0000000004737000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/status-desk_rt_auto_disconnect
Source: _AnyDesk.exe, 00000003.00000002.1852610719.00000000049E0000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194783064.00000000044E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/status-desk_rt_auto_disconnect.
Source: _AnyDesk.exe, 00000000.00000002.1851377575.0000000004737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/status-desk_rt_auto_disconnectd
Source: _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1183910270.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/status-desk_rt_ipc_error
Source: _AnyDesk.exe, 00000003.00000002.1850839744.0000000004507000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194888231.000000000450B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/status-desk_rt_ipc_error.y?
Source: _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1183910270.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/the-session-has-ended-unexpectedly
Source: _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1183910270.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000002.1851377575.0000000004737000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194783064.00000000044E6000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/users
Source: _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1183910270.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000002.1852610719.00000000049E0000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194783064.00000000044E6000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/waiting-for-image-black-screen
Source: _AnyDesk.exe, 00000000.00000002.1855670783.0000000004BE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/waiting-for-image-black-screen%
Source: _AnyDesk.exe, 00000000.00000002.1851377575.0000000004737000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194783064.00000000044E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/waiting-for-image-black-screen.
Source: _AnyDesk.exe, 00000000.00000002.1851377575.0000000004737000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000002.1852610719.00000000049E0000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/what-is-full-client-management
Source: _AnyDesk.exe	String found in binary or memory: https://support.google.com/chrome/contact/chromeuninstall3?hl=$1
Source: _AnyDesk.exe, 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmp, _AnyDesk.exe, 00000002.00000003.1327827209.0000000004DE1000.00000004.00000020.00020000.00000000.sdmp, gcapi.dll.2.dr, gcapi.dll0.2.dr	String found in binary or memory: https://support.google.com/chrome/contact/chromeuninstall3?hl=$1microsoft-edge:openFailed
Source: _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/
Source: _AnyDesk.exe, 00000000.00000002.1855670783.0000000004BE0000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000002.1852610719.00000000049E0000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/$
Source: _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000002.00000002.1813021660.0000000001A5A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.nayuki.io/page/qr-code-generator-library

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 57.128.101.75:443 -> 192.168.2.16:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.188.124.23:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.209.178.72:443 -> 192.168.2.16:49710 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Creates a DirectInput object (often for capturing keystrokes)

Source: _AnyDesk.exe, 00000000.00000003.1176452291.00000000026F8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: DirectDrawCreateEx

memstr_7aaa69fb-b

Installs a raw input device (often for capturing keystrokes)

Source: _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_efadb0a8-3

Potential key logger detected (key state polling based)

Source: C:\Users\user\Desktop\_AnyDesk.exe

Code function: 3_2_013AABF0 GetCurrentThreadId,MsgWaitForMultipleObjectsEx,PeekMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,TranslateMessage,DispatchMessageW,PeekMessageW,MsgWaitForMultipleObjectsEx,

3_2_013AABF0

System Summary

Contains functionality to communicate with device drivers

Source: C:\Users\user\Desktop\_AnyDesk.exe

Code function: 3_2_011E1880: DeviceIoControl,

3_2_011E1880

Contains functionality to launch a process as a different user

Source: C:\Users\user\Desktop\_AnyDesk.exe

Code function: 2_2_6C37B6C0 new,SetHandleInformation,CreateEnvironmentBlock,CreateProcessAsUserW,DestroyEnvironmentBlock,CreateProcessW,AssignProcessToJobObject,GetCurrentProcess,GetCurrentProcess,TerminateProcess,GetCurrentProcess,WaitForSingleObject,ResumeThread,WaitForSingleObject,

2_2_6C37B6C0

Detected potential crypto function

Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_6C375D10	2_2_6C375D10
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_6C38AE20	2_2_6C38AE20
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_6C383EA0	2_2_6C383EA0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_6C381ED0	2_2_6C381ED0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_6C387F4E	2_2_6C387F4E
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_6C3839A4	2_2_6C3839A4
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_6C384B22	2_2_6C384B22
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_6C398517	2_2_6C398517
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_6C374580	2_2_6C374580
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_6C3846ED	2_2_6C3846ED
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_6C3956C9	2_2_6C3956C9
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_6C36A090	2_2_6C36A090
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_6C393093	2_2_6C393093
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_6C38817D	2_2_6C38817D
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_6C3842B8	2_2_6C3842B8
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_6C392301	2_2_6C392301
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_6C3803B7	2_2_6C3803B7
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_015F3288	2_2_015F3288
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_015F8444	2_2_015F8444
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_015F99D2	2_2_015F99D2
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01511140	2_2_01511140
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01515140	2_2_01515140
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01515970	2_2_01515970
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_015101C0	2_2_015101C0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01516070	2_2_01516070
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01514810	2_2_01514810
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01510810	2_2_01510810
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01515350	2_2_01515350
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01514360	2_2_01514360
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01515B00	2_2_01515B00
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_0151A390	2_2_0151A390
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01510BB0	2_2_01510BB0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01514A10	2_2_01514A10
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_0151AAE0	2_2_0151AAE0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01514290	2_2_01514290
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01510530	2_2_01510530
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_015145C0	2_2_015145C0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01514D90	2_2_01514D90
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01511DB0	2_2_01511DB0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01517431	2_2_01517431
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01517430	2_2_01517430
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01512430	2_2_01512430
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_015134C0	2_2_015134C0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_0151B480	2_2_0151B480
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01518CA9	2_2_01518CA9
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01518F60	2_2_01518F60
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01517700	2_2_01517700
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01511730	2_2_01511730
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01519FD0	2_2_01519FD0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_015127D7	2_2_015127D7
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_0151AFC0	2_2_0151AFC0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_0152DFC0	2_2_0152DFC0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_015137E0	2_2_015137E0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_0152D7E0	2_2_0152D7E0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01516FB0	2_2_01516FB0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01514FA0	2_2_01514FA0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01512E40	2_2_01512E40
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01515E61	2_2_01515E61
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01515E60	2_2_01515E60
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01515660	2_2_01515660
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01510660	2_2_01510660
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01518606	2_2_01518606
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_0151AE90	2_2_0151AE90
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_013C7120	2_2_013C7120
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_013B3160	2_2_013B3160
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_013BB140	2_2_013BB140
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_013B55B0	2_2_013B55B0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_013B4DA0	2_2_013B4DA0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_013C2420	2_2_013C2420
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_013B4320	2_2_013B4320
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_013B5380	2_2_013B5380
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_013B6E10	2_2_013B6E10
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_013BE2A0	2_2_013BE2A0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_015E1D70	2_2_015E1D70
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_015DF100	2_2_015DF100
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_015E6DA0	2_2_015E6DA0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_015EC470	2_2_015EC470
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_015E14F0	2_2_015E14F0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_015E6F50	2_2_015E6F50
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_015EC340	2_2_015EC340
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_015DF3C0	2_2_015DF3C0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_015E73E0	2_2_015E73E0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_015DF240	2_2_015DF240
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_015E7279	2_2_015E7279
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_015E0AF0	2_2_015E0AF0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_0142EE40	2_2_0142EE40
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01430367	2_2_01430367
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_0147C540	2_2_0147C540
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_0143077A	2_2_0143077A
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01434600	2_2_01434600
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01434811	2_2_01434811
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01434B01	2_2_01434B01
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01434DD8	2_2_01434DD8
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01430C92	2_2_01430C92
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01478FB0	2_2_01478FB0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_014C9080	2_2_014C9080
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_0149D350	2_2_0149D350
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_0140F5C0	2_2_0140F5C0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_0142F424	2_2_0142F424
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_0142F430	2_2_0142F430
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_0142F678	2_2_0142F678
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_0144B6C0	2_2_0144B6C0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_0142F91A	2_2_0142F91A
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01409A50	2_2_01409A50
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_013FBA90	2_2_013FBA90
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_0142FC06	2_2_0142FC06
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_0142FF5A	2_2_0142FF5A
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01493E40	2_2_01493E40
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_014C1E30	2_2_014C1E30
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01493ED0	2_2_01493ED0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_012B5970	3_2_012B5970
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_012C6220	3_2_012C6220
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_012D8270	3_2_012D8270
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_012F5DB0	3_2_012F5DB0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_012D6420	3_2_012D6420
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_012C6E50	3_2_012C6E50
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_0125A000	3_2_0125A000
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_011EF0D0	3_2_011EF0D0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_012523C0	3_2_012523C0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_01253200	3_2_01253200
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_012182C0	3_2_012182C0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_011DE2E0	3_2_011DE2E0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_011F7580	3_2_011F7580
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_012244A0	3_2_012244A0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_011EB4D0	3_2_011EB4D0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_012274C0	3_2_012274C0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_0123E4C0	3_2_0123E4C0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_0124D7A0	3_2_0124D7A0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_011C47C0	3_2_011C47C0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_01219600	3_2_01219600
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_0123A610	3_2_0123A610
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_011EEB20	3_2_011EEB20
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_01204A20	3_2_01204A20
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_01233A80	3_2_01233A80
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_01233D20	3_2_01233D20
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_01250D70	3_2_01250D70
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_011E0D60	3_2_011E0D60
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_01218C60	3_2_01218C60
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_01253CB0	3_2_01253CB0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_01224C90	3_2_01224C90
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_0122ECE0	3_2_0122ECE0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_01293310	3_2_01293310
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_012903F0	3_2_012903F0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_0127CA20	3_2_0127CA20
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_0128A290	3_2_0128A290
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_012A2D90	3_2_012A2D90
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_012A27D0	3_2_012A27D0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_01292E70	3_2_01292E70
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_01362EC0	3_2_01362EC0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_013583A0	3_2_013583A0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_01360AF0	3_2_01360AF0

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: String function: 6C362EA0 appears 47 times
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: String function: 6C362340 appears 31 times
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: String function: 6C366EC0 appears 51 times
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: String function: 6C37FC11 appears 50 times
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: String function: 6C381630 appears 48 times

PE file does not import any functions

Source: _AnyDesk.exe_

Static PE information: No import functions for PE file found

Uses 32bit PE files

Source: _AnyDesk.exe_

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: _AnyDesk.exe_

Binary or memory string: K.sLn}

Source: classification engine

Classification label: mal68.evad.winEXE_@5/9@4/4

Source: C:\Users\user\Desktop\_AnyDesk.exe

Code function: 2_2_6C3629A0 FormatMessageA,GetLastError,

2_2_6C3629A0

Source: C:\Users\user\Desktop\_AnyDesk.exe

Code function: 3_2_01386360 LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,GetLastError,

3_2_01386360

Source: C:\Users\user\Desktop\_AnyDesk.exe

Code function: 2_2_6C39FFEC LaunchGoogleChrome,CoInitializeEx,CoInitializeSecurity,GetCurrentProcessId,GetShellWindow,GetWindowThreadProcessId,LocalFree,OpenProcess,OpenProcessToken,DuplicateTokenEx,ImpersonateLoggedOnUser,CloseHandle,CloseHandle,CloseHandle,LocalFree,LocalFree,CoCreateInstance,RevertToSelf,CoUninitialize,

2_2_6C39FFEC

Source: C:\Users\user\Desktop\_AnyDesk.exe

Code function: 2_2_6C3A2CE9 LoadResource,LockResource,SizeofResource,

2_2_6C3A2CE9

Source: C:\Users\user\Desktop\_AnyDesk.exe

File created: C:\Users\user\AppData\Roaming\AnyDesk

Jump to behavior

Source: C:\Users\user\Desktop\_AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcstobjmtx
Source: C:\Users\user\Desktop\_AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_5772_1932119840_1_mtx
Source: C:\Users\user\Desktop\_AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_810_lsystem_mtx
Source: C:\Users\user\Desktop\_AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_6424_6912_13
Source: C:\Users\user\Desktop\_AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_6736_1948717042_0_mtx
Source: C:\Users\user\Desktop\_AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_6424_6912_14
Source: C:\Users\user\Desktop\_AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_6424_6912_20
Source: C:\Users\user\Desktop\_AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_6424_6912_21
Source: C:\Users\user\Desktop\_AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_6736_1948717042_1_mtx
Source: C:\Users\user\Desktop\_AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_6424_6912_12
Source: C:\Users\user\Desktop\_AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_6424_6912_6
Source: C:\Users\user\Desktop\_AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_6424_6912_7
Source: C:\Users\user\Desktop\_AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_5772_1932119840_0_mtx
Source: C:\Users\user\Desktop\_AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_6424_6912_3
Source: C:\Users\user\Desktop\_AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_6424_6912_4
Source: C:\Users\user\Desktop\_AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_6424_6912_5
Source: C:\Users\user\Desktop\_AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Session\1\ad_connect_queue_6424_1948009239_mtx
Source: C:\Users\user\Desktop\_AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_6736_6916_0
Source: C:\Users\user\Desktop\_AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_trace_mtx
Source: C:\Users\user\Desktop\_AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_6736_6924_0

Source: C:\Users\user\Desktop\_AnyDesk.exe

File created: C:\Users\user\AppData\Local\Temp\gcapi.dll

Jump to behavior

Source: _AnyDesk.exe_

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\_AnyDesk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM Win32_Processor
Source: C:\Users\user\Desktop\_AnyDesk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM Win32_Processor

Source: C:\Users\user\Desktop\_AnyDesk.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\_AnyDesk.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: _AnyDesk.exe

String found in binary or memory: Removed multi-install failure key; switching to channel:

Source: unknown	Process created: C:\Users\user\Desktop\_AnyDesk.exe "C:\Users\user\Desktop\_AnyDesk.exe"
Source: C:\Users\user\Desktop\_AnyDesk.exe	Process created: C:\Users\user\Desktop\_AnyDesk.exe "C:\Users\user\Desktop\_AnyDesk.exe" --local-service
Source: C:\Users\user\Desktop\_AnyDesk.exe	Process created: C:\Users\user\Desktop\_AnyDesk.exe "C:\Users\user\Desktop\_AnyDesk.exe" --local-control
Source: C:\Users\user\Desktop\_AnyDesk.exe	Process created: C:\Users\user\Desktop\_AnyDesk.exe "C:\Users\user\Desktop\_AnyDesk.exe" --local-service	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Process created: C:\Users\user\Desktop\_AnyDesk.exe "C:\Users\user\Desktop\_AnyDesk.exe" --local-control	Jump to behavior

Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: windows.system.profile.systemid.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: cryptowinrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Section loaded: dwmapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\_AnyDesk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2155fee3-2419-4373-b102-6843707eb41f}\InProcServer32

Jump to behavior

Executable creates window controls seldom found in malware

Source: C:\Users\user\Desktop\_AnyDesk.exe

Window found: window name: SysTabControl32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

PE / OLE file has a valid certificate

Source: _AnyDesk.exe_

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: _AnyDesk.exe_

Static file information: File size 4993864 > 1048576

PE file has a big raw section

Source: _AnyDesk.exe_

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x4b6200

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: _AnyDesk.exe_

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: _AnyDesk.exe_

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: C:\b\build\slave\win\build\src\out\Release\gcapi_dll.dll.pdbGCTL source: _AnyDesk.exe, 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmp, _AnyDesk.exe, 00000002.00000002.1852397723.00000000067C6000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000002.00000003.1327827209.0000000004DE1000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000002.00000002.1851815991.0000000006143000.00000004.00000001.00020000.00000000.sdmp, _AnyDesk.exe, 00000002.00000003.1328461235.0000000005E47000.00000004.00000001.00020000.00000000.sdmp, _AnyDesk.exe, 00000002.00000002.1852397723.00000000067E2000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000002.1857599328.0000000005217000.00000004.00000010.00020000.00000000.sdmp, gcapi.dll.2.dr, gcapi.dll0.2.dr
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-32\privacy_feature\privacy_feature.pdb source: _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000002.1830046657.0000000001D41000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_loader\AnyDesk.pdb source: _AnyDesk.exe, 00000000.00000000.1170705664.0000000001E21000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe_
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-64\win_dwm\win_dwm.pdb source: _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000002.00000002.1830046694.0000000001CC9000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-32\win_dwm\win_dwm.pdb source: _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000002.1830052675.0000000001C93000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Users\ashakhmut\Projects\anydesk\deps\win_system_id\build\win_system_id_dll.pdb source: _AnyDesk.exe, 00000000.00000002.1830052675.0000000001C63000.00000004.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_app\win_app.pdb source: _AnyDesk.exe, 00000000.00000002.1813026102.0000000001BD6000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-64\privacy_feature\privacy_feature.pdb source: _AnyDesk.exe, 00000000.00000002.1830052675.0000000001D54000.00000004.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.000000000360A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\b\build\slave\win\build\src\out\Release\gcapi_dll.dll.pdb source: _AnyDesk.exe, 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmp, _AnyDesk.exe, 00000002.00000002.1852397723.00000000067C6000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000002.00000003.1327827209.0000000004DE1000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000002.00000002.1851815991.0000000006143000.00000004.00000001.00020000.00000000.sdmp, _AnyDesk.exe, 00000002.00000003.1328461235.0000000005E47000.00000004.00000001.00020000.00000000.sdmp, _AnyDesk.exe, 00000002.00000002.1852397723.00000000067E2000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000002.1857599328.0000000005217000.00000004.00000010.00020000.00000000.sdmp, gcapi.dll.2.dr, gcapi.dll0.2.dr
Source:	Binary string: SAS.pdbR source: _AnyDesk.exe, 00000000.00000002.1830052675.0000000001C63000.00000004.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: SAS.pdb source: _AnyDesk.exe, 00000000.00000002.1830052675.0000000001C63000.00000004.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\_AnyDesk.exe

Unpacked PE file: 0.2._AnyDesk.exe.e30000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 0_3_04716DFD push eax; retf	0_3_04716E39
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 0_3_04716DFD push eax; retf	0_3_04716E39
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_6C36FCD0 push ecx; mov dword ptr [esp], 00000000h	2_2_6C36FCD7
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_6C381676 push ecx; ret	2_2_6C381689
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_6C3811DF push ecx; ret	2_2_6C3811F2
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_015F7395 push ecx; ret	2_2_015F73A8
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01506934 push ss; retn 000Eh	2_2_01506937
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01506869 push cs; ret	2_2_0150686A
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01402FF8 pushad ; ret	2_2_01402FF9
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01403022 push eax; ret	2_2_01403023
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_0140302A push esp; ret	2_2_0140302B
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_01435B0F pushad ; iretd	2_2_01435B10
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_01298010 push ecx; mov dword ptr [esp], 00000000h	3_2_01298011

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\Desktop\_AnyDesk.exe	File created: C:\Users\user\AppData\Local\Temp\gcapi.dll			Jump to dropped file
Source: C:\Users\user\Desktop\_AnyDesk.exe	File created: C:\Users\user\Desktop\gcapi.dll			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\_AnyDesk.exe

File opened: C:\Users\user\Desktop\_AnyDesk.exe:Zone.Identifier read attributes | delete

Jump to behavior

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\Desktop\_AnyDesk.exe

Code function: 2_2_6C3803B7 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_6C3803B7

Source: C:\Users\user\Desktop\_AnyDesk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Users\user\Desktop\_AnyDesk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_PhysicalMemory
Source: C:\Users\user\Desktop\_AnyDesk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_PhysicalMemory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\_AnyDesk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive
Source: C:\Users\user\Desktop\_AnyDesk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\_AnyDesk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter = TRUE
Source: C:\Users\user\Desktop\_AnyDesk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter = TRUE

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Users\user\Desktop\_AnyDesk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_PhysicalMemory
Source: C:\Users\user\Desktop\_AnyDesk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_PhysicalMemory

Contains functionality to read device registry values (via SetupAPI)

Source: C:\Users\user\Desktop\_AnyDesk.exe

Code function: 3_2_0136A5A0 SetupDiGetClassDevsW,GetLastError,SetupDiEnumDeviceInfo,SetupDiGetDeviceRegistryPropertyW,SetupDiGetDeviceInstallParamsW,SetupDiSetDeviceInstallParamsW,GetLastError,SetupDiBuildDriverInfoList,SetupDiEnumDriverInfoW,SetupDiDestroyDeviceInfoList,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,

3_2_0136A5A0

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\_AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\_AnyDesk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\gcapi.dll			Jump to dropped file
Source: C:\Users\user\Desktop\_AnyDesk.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\gcapi.dll			Jump to dropped file

Found evasive API chain (date check)

Source: C:\Users\user\Desktop\_AnyDesk.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_3-89866

Found evasive API chain checking for process token information

Source: C:\Users\user\Desktop\_AnyDesk.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_3-89871

Found large amount of non-executed APIs

Source: C:\Users\user\Desktop\_AnyDesk.exe	API coverage: 5.2 %
Source: C:\Users\user\Desktop\_AnyDesk.exe	API coverage: 9.2 %

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\_AnyDesk.exe TID: 1576	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe TID: 432	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe TID: 6428	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe TID: 1576	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe TID: 6928	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe TID: 6932	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe TID: 7080	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe TID: 6928	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe TID: 6936	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\_AnyDesk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_BaseBoard
Source: C:\Users\user\Desktop\_AnyDesk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_BaseBoard

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Users\user\Desktop\_AnyDesk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM Win32_Processor
Source: C:\Users\user\Desktop\_AnyDesk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM Win32_Processor

Uses the system / local time for branch decision (may execute only at specific dates)

Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_6C39F147 GetLocalTime followed by cmp: cmp dx, 000ch and CTI: jbe 6C39F183h	2_2_6C39F147
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_011D3800 GetLocalTime followed by cmp: cmp cx, 000ch and CTI: jbe 011D3829h	3_2_011D3800
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_011D3850 GetLocalTime followed by cmp: cmp ax, 000ch and CTI: jbe 011D38C2h	3_2_011D3850

Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_6C396C6E FindFirstFileExA,	2_2_6C396C6E
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_0121F320 FindFirstFileW,FindNextFileW,FindClose,GetLastError,	3_2_0121F320
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_01234D90 FindClose,FindFirstFileW,	3_2_01234D90

Source: C:\Users\user\Desktop\_AnyDesk.exe

Code function: 2_2_6C37F1AA VirtualQuery,GetSystemInfo,

2_2_6C37F1AA

Source: C:\Users\user\Desktop\_AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: _AnyDesk.exe, 00000000.00000002.1846933654.00000000025F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\1e
Source: _AnyDesk.exe, 00000002.00000002.1794840601.0000000000C98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllz
Source: _AnyDesk.exe, 00000000.00000002.1846933654.00000000025F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}keY
Source: _AnyDesk.exe, 00000003.00000002.1846022806.00000000023A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\_AnyDesk.exe

Code function: 2_2_0142EE40 LoadLibraryA,LdrGetProcedureAddress,VirtualProtect,

2_2_0142EE40

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\_AnyDesk.exe

Code function: 2_2_6C385F8C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_6C385F8C

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\_AnyDesk.exe

Code function: 2_2_6C389E6A mov eax, dword ptr fs:[00000030h]

2_2_6C389E6A

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\_AnyDesk.exe

Code function: 2_2_6C38B428 GetProcessHeap,

2_2_6C38B428

Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_6C385F8C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6C385F8C
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_6C380FC3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6C380FC3
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 2_2_6C3814B2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6C3814B2

Source: C:\Users\user\Desktop\_AnyDesk.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\_AnyDesk.exe

Code function: 2_2_6C39F711 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

2_2_6C39F711

Language, Device and Operating System Detection

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\_AnyDesk.exe

Code function: 2_2_6C38168B cpuid

2_2_6C38168B

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: EnumSystemLocalesW,	2_2_6C38EC36
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: IsValidCodePage,GetLocaleInfoW,	2_2_6C39AD29
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: GetLocaleInfoW,	2_2_6C39AEBD
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: EnumSystemLocalesW,	2_2_6C39AF66
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: EnumSystemLocalesW,	2_2_6C39AFB1
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_6C39B452
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: GetLocaleInfoW,	2_2_6C39B559
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_6C39B626
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: EnumSystemLocalesW,	2_2_6C39B04C
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_6C39B0D9
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: GetLocaleInfoW,	2_2_6C38F15E
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,GetLocaleInfoW,	2_2_6C37D200
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: GetLocaleInfoW,	2_2_6C39B329
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: GetLocaleInfoW,	2_2_01601481

Queries device information via Setup API

Source: C:\Users\user\Desktop\_AnyDesk.exe

3_2_0136A5A0

Queries information about the installed CPU (vendor, model number etc)

Source: C:\Users\user\Desktop\_AnyDesk.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\_AnyDesk.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\_AnyDesk.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\_AnyDesk.exe

Code function: 2_2_6C372D20 GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

2_2_6C372D20

Source: C:\Users\user\Desktop\_AnyDesk.exe

Code function: 3_2_0137E060 GetUserNameW,

3_2_0137E060

Source: C:\Users\user\Desktop\_AnyDesk.exe

Code function: 2_2_6C39057E _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

2_2_6C39057E

Source: C:\Users\user\Desktop\_AnyDesk.exe

Code function: 2_2_6C372A20 GetCurrentProcess,GetModuleHandleW,GetProcAddress,GetVersionExW,GetNativeSystemInfo,GetModuleHandleW,GetProcAddress,

2_2_6C372A20

Source: C:\Users\user\Desktop\_AnyDesk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

OS version to string mapping found (often used in BOTs)

Source: _AnyDesk.exe, 00000003.00000002.1793736803.0000000000CFF000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: 91337f7c79cf9e0e9335079141cbee71f8672b84release/win_8.1.0a4e3c0a02145015976e3309142b548b2p
Source: _AnyDesk.exe_	Binary or memory string: .itext.text.customa4e3c0a02145015976e3309142b548b2release/win_8.1.091337f7c79cf9e0e9335079141cbee71f8672b84
Source: ad.trace.3.dr	Binary or memory string: info 2024-09-20 10:47:14.857 lctrl 6736 6760 main - * Version 8.1.0 (release/win_8.1.0 91337f7c79cf9e0e9335079141cbee71f8672b84)
Source: _AnyDesk.exe, 00000002.00000002.1794249325.0000000000AFF000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: 91337f7c79cf9e0e9335079141cbee71f8672b84release/win_8.1.0a4e3c0a02145015976e3309142b548b2
Source: _AnyDesk.exe_	Binary or memory string: release/win_8.1.0
Source: ad.trace.3.dr	Binary or memory string: info 2024-09-20 10:47:13.709 front 5772 6308 main - * Version 8.1.0 (release/win_8.1.0 91337f7c79cf9e0e9335079141cbee71f8672b84)
Source: ad.trace.3.dr	Binary or memory string: info 2024-09-20 10:47:14.777 lsvc 6424 6420 main - * Version 8.1.0 (release/win_8.1.0 91337f7c79cf9e0e9335079141cbee71f8672b84)

Remote Access Functionality

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_012C8990 bind,WSAGetLastError,	3_2_012C8990
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_012CA080 WSASocketW,WSAGetLastError,listen,WSAGetLastError,	3_2_012CA080
Source: C:\Users\user\Desktop\_AnyDesk.exe	Code function: 3_2_012CAD60 htons,bind,WSAGetLastError,htons,	3_2_012CAD60

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	421 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	31 Input Capture	12 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	31 Input Capture	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	11 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Process Injection	1 Software Packing	NTDS	166 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	431 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Valid Accounts	DCSync	331 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	331 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Access Token Manipulation	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Hidden Files and Directories	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
_AnyDesk.exe_	0%	ReversingLabs
_AnyDesk.exe_	0%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\gcapi.dll	0%	ReversingLabs
C:\Users\user\Desktop\gcapi.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://anydesk.com/compan	0%	Avira URL Cloud	safe
https://support.google.com/chrome/contact/chromeuninstall3?hl=$1	0%	Avira URL Cloud	safe
https://anydesk.com/update	0%	Avira URL Cloud	safe
https://order.anydesk.com/trial	0%	Avira URL Cloud	safe
https://anydesk.com/company#im	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/users	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/how-do-i-delete-my-anydesk-account	0%	Avira URL Cloud	safe
https://www.google.com/intl/$	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/my-anydesk-ii#user-management6	0%	Avira URL Cloud	safe
https://my.anydesk.com/auth/realms/myanydesk/protocol/openid-connect/registrations?client_id=myanyde	0%	Avira URL Cloud	safe
https://my.anydesk.com	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/anydesk-id-and-aliasj	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/security-permissions-on-macos?IH	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/my-anydesk-ii#user-management	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/status-desk_rt_ipc_error.y?	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/status-desk_rt_auto_disconnectd	0%	Avira URL Cloud	safe
https://anydesk.com/	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/status-desk_rt_auto_disconnect	0%	Avira URL Cloud	safe
https://anydesk.com/privacy	0%	Avira URL Cloud	safe
https://datatracker.ietf.org/ipr/1526/	0%	Avira URL Cloud	safe
https://www.nayuki.io/page/qr-code-generator-library	0%	Avira URL Cloud	safe
https://anydesk.com/en/changelog/windows$	0%	Avira URL Cloud	safe
https://anydesk.com/pricing/teams	0%	Avira URL Cloud	safe
https://datatracker.ietf.org/ipr/1914/	0%	Avira URL Cloud	safe
https://help.anydesk.com	0%	Avira URL Cloud	safe
https://policies.google.com/privacy?hl=$	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/anydesk-id-and-aliase	0%	Avira URL Cloud	safe
https://anydesk.com/terms	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/anydesk-id-and-aliasZ	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/what-is-full-client-management	0%	Avira URL Cloud	safe
https://anydesk.com/en/changelog/windows	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/account-migration	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/anydesk-id-and-aliasK	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/quick-start-guide9	0%	Avira URL Cloud	safe
https://my.anydesk.com/password-generator.	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/	0%	Avira URL Cloud	safe
https://anydesk.com/order	0%	Avira URL Cloud	safe
https://anydesk.com/contact/sales	0%	Avira URL Cloud	safe
https://support.anydesk.com	0%	Avira URL Cloud	safe
https://help.anydesk.com/	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/quick-start-guide=	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/quick-start-guide8	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/status-anynet_overload	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/anydesk-for-android-chromeos#troubleshooting	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/how-do-i-delete-my-anydesk-account.	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/waiting-for-image-black-screen	0%	Avira URL Cloud	safe
https://anydesk.com/pricing/teamse	0%	Avira URL Cloud	safe
https://help.anydesk.com/$	0%	Avira URL Cloud	safe
http://www.opengl.org/registry/	0%	Avira URL Cloud	safe
https://www.apache.org/licenses/	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/quick-start-guide	0%	Avira URL Cloud	safe
https://my.anydesk.com/auth/realms/myanydesk/login-actions/reset-credentials?client_id=myanydesk-fro	0%	Avira URL Cloud	safe
https://anydesk.com/pricing/teamsI	0%	Avira URL Cloud	safe
https://anydesk.com/pricing/teamsO	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/security-permissions-on-macos	0%	Avira URL Cloud	safe
https://anydesk.com/pricing/teams7	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/waiting-for-image-black-screen.	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/status-desk_rt_auto_disconnect.	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/waiting-for-image-black-screen%	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/quick-start-guideY	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/status-desk_rt_ipc_error	0%	Avira URL Cloud	safe
https://support.google.com/chrome/contact/chromeuninstall3?hl=$1microsoft-edge:openFailed	0%	Avira URL Cloud	safe
https://help.anydesk.com/HelpLinkInstallLocationAnyDesk	0%	Avira URL Cloud	safe
https://anydesk.com/company#imprint	0%	Avira URL Cloud	safe
https://boot.net.anydesk.comabcdefABCDEFtruefalsetfInvalid	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/anydesk-account	0%	Avira URL Cloud	safe
https://datatracker.ietf.org/ipr/1524/	0%	Avira URL Cloud	safe
https://my.anydesk.com/v2	0%	Avira URL Cloud	safe
https://anydesk.com/pricing/teams)	0%	Avira URL Cloud	safe
https://support.anydesk.com/knowledge/anydesk-id-and-alias	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
d1atxff5avezsq.cloudfront.net	18.66.102.45	true	false	unknown
boot.net.anydesk.com	57.128.101.75	true	false	unknown
relay-75ef99c7.net.anydesk.com	185.209.178.72	true	false	unknown
relay-b8f8a0be.net.anydesk.com	5.188.124.23	true	false	unknown
api.playanext.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://api.playanext.comUser-Agent: AnyDesk/8.1.0Accept: /Content-Length: 352Content-Type: application/x-www-form-urlencodedapi_key=c1426bd258099fa69f62933b466d4b77&event=[{"event_type":"check_offer","user_id":"464bbffb9f7c03157be5e17ab1b9672a","session_id":1726829248386429,"ip":"$remote","event_properties":{"method_used":"Google Chrome Criteria Checker","offer_product":"Google Chrome","distributor":"AnyDesk","distributor_product":"AnyDesk","user_country":"Switzerland"}}/httpapi	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://support.anydesk.com/knowledge/users	_AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1183910270.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000002.1851377575.0000000004737000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194783064.00000000044E6000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anydesk.com/compan	_AnyDesk.exe, 00000003.00000003.1195116537.000000000449D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://order.anydesk.com/trial	_AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/how-do-i-delete-my-anydesk-account	_AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1183910270.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.google.com/chrome/contact/chromeuninstall3?hl=$1	_AnyDesk.exe	false	Avira URL Cloud: safe	unknown
https://anydesk.com/update	_AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047B9000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1195116537.000000000449D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/intl/$	_AnyDesk.exe, 00000000.00000002.1855670783.0000000004BE0000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000002.1852610719.00000000049E0000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anydesk.com/company#im	_AnyDesk.exe, 00000000.00000003.1184530534.00000000047B9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/my-anydesk-ii#user-management6	_AnyDesk.exe, 00000000.00000002.1851377575.00000000047EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://my.anydesk.com	_AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/anydesk-id-and-aliasj	_AnyDesk.exe, 00000000.00000002.1851377575.00000000047EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/status-desk_rt_auto_disconnectd	_AnyDesk.exe, 00000000.00000002.1851377575.0000000004737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://my.anydesk.com/auth/realms/myanydesk/protocol/openid-connect/registrations?client_id=myanyde	_AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1183910270.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1318456925.000000000451E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/my-anydesk-ii#user-management	_AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1183910270.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/security-permissions-on-macos?IH	_AnyDesk.exe, 00000000.00000002.1855670783.0000000004BE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/status-desk_rt_ipc_error.y?	_AnyDesk.exe, 00000003.00000002.1850839744.0000000004507000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194888231.000000000450B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anydesk.com/	_AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/status-desk_rt_auto_disconnect	_AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1183910270.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000002.1851377575.0000000004737000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anydesk.com/privacy	_AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1195116537.000000000449D000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://datatracker.ietf.org/ipr/1526/	_AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000002.1813021415.0000000001A59000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://www.nayuki.io/page/qr-code-generator-library	_AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000002.00000002.1813021660.0000000001A5A000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://policies.google.com/privacy?hl=$	_AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000002.1850839744.0000000004507000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194888231.000000000450B000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://help.anydesk.com	_AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/anydesk-id-and-aliasZ	_AnyDesk.exe, 00000000.00000002.1851377575.00000000047EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anydesk.com/pricing/teams	_AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000002.1846933654.0000000002672000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000002.1851377575.0000000004737000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anydesk.com/en/changelog/windows$	_AnyDesk.exe, 00000000.00000002.1851377575.00000000047EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://datatracker.ietf.org/ipr/1914/	_AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000002.1813021415.0000000001A59000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/anydesk-id-and-aliase	_AnyDesk.exe, 00000000.00000002.1846933654.00000000025F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anydesk.com/terms	_AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047B9000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1195116537.000000000449D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/what-is-full-client-management	_AnyDesk.exe, 00000000.00000002.1851377575.0000000004737000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000002.1852610719.00000000049E0000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anydesk.com/en/changelog/windows	_AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1183910270.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/account-migration	_AnyDesk.exe, 00000000.00000002.1855670783.0000000004BE0000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1183910270.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/anydesk-id-and-aliasK	_AnyDesk.exe, 00000003.00000002.1852610719.00000000049E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/	_AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047B9000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1195116537.000000000449D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anydesk.com/order	_AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anydesk.com/contact/sales	_AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/quick-start-guide9	_AnyDesk.exe, 00000000.00000002.1855670783.0000000004BE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://my.anydesk.com/password-generator.	_AnyDesk.exe, 00000000.00000002.1813026102.0000000001B2E000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com	_AnyDesk.exe, 00000003.00000002.1813021415.0000000001B5F000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://help.anydesk.com/	_AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000002.00000002.1813021660.0000000001BA5000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/quick-start-guide8	_AnyDesk.exe, 00000000.00000002.1855670783.0000000004BE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/quick-start-guide=	_AnyDesk.exe, 00000003.00000002.1852610719.00000000049E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/waiting-for-image-black-screen	_AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1183910270.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000002.1852610719.00000000049E0000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194783064.00000000044E6000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/status-anynet_overload	_AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1183910270.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/anydesk-for-android-chromeos#troubleshooting	_AnyDesk.exe, 00000000.00000002.1855670783.0000000004BE0000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000002.1852610719.00000000049E0000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.opengl.org/registry/	_AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000002.00000002.1813021660.0000000001A5A000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://anydesk.com/pricing/teamse	_AnyDesk.exe, 00000000.00000002.1851377575.0000000004737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/how-do-i-delete-my-anydesk-account.	_AnyDesk.exe, 00000003.00000002.1852610719.00000000049E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://help.anydesk.com/$	_AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.apache.org/licenses/	_AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/quick-start-guide	_AnyDesk.exe, 00000000.00000002.1851377575.00000000047EA000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000002.1846933654.0000000002672000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://my.anydesk.com/auth/realms/myanydesk/login-actions/reset-credentials?client_id=myanydesk-fro	_AnyDesk.exe, 00000003.00000002.1852610719.00000000049E0000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/security-permissions-on-macos	_AnyDesk.exe, 00000000.00000002.1851377575.00000000047EA000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000002.1852610719.00000000049E0000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anydesk.com/pricing/teamsI	_AnyDesk.exe, 00000000.00000002.1851377575.0000000004737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/waiting-for-image-black-screen.	_AnyDesk.exe, 00000000.00000002.1851377575.0000000004737000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194783064.00000000044E6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anydesk.com/pricing/teamsO	_AnyDesk.exe, 00000000.00000002.1851377575.0000000004737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/quick-start-guideY	_AnyDesk.exe, 00000000.00000002.1851377575.00000000047EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/status-desk_rt_auto_disconnect.	_AnyDesk.exe, 00000003.00000002.1852610719.00000000049E0000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194783064.00000000044E6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/waiting-for-image-black-screen%	_AnyDesk.exe, 00000000.00000002.1855670783.0000000004BE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anydesk.com/pricing/teams7	_AnyDesk.exe, 00000000.00000002.1851377575.0000000004737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/status-desk_rt_ipc_error	_AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1183910270.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.google.com/chrome/contact/chromeuninstall3?hl=$1microsoft-edge:openFailed	_AnyDesk.exe, 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmp, _AnyDesk.exe, 00000002.00000003.1327827209.0000000004DE1000.00000004.00000020.00020000.00000000.sdmp, gcapi.dll.2.dr, gcapi.dll0.2.dr	false	Avira URL Cloud: safe	unknown
https://help.anydesk.com/HelpLinkInstallLocationAnyDesk	_AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000002.00000002.1813021660.0000000001BA5000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://datatracker.ietf.org/ipr/1524/	_AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000002.1813021415.0000000001A59000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://my.anydesk.com/v2	_AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anydesk.com/company#imprint	_AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anydesk.com/pricing/teams)	_AnyDesk.exe, 00000000.00000002.1851377575.0000000004737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://boot.net.anydesk.comabcdefABCDEFtruefalsetfInvalid	_AnyDesk.exe, 00000000.00000003.1176452291.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000002.1813026102.0000000001708000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/anydesk-account	_AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1183910270.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1184530534.00000000047BB000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/anydesk-id-and-alias	_AnyDesk.exe, 00000000.00000002.1851377575.00000000047EA000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000002.1813026102.0000000001A49000.00000002.00000001.01000000.00000003.sdmp, _AnyDesk.exe, 00000000.00000003.1176452291.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000002.1846933654.00000000025F8000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000000.00000003.1182840002.000000000472C000.00000004.00000020.00020000.00000000.sdmp, _AnyDesk.exe, 00000003.00000003.1194924108.00000000044DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
18.66.102.21	unknown	United States	3	MIT-GATEWAYSUS	false
185.209.178.72	relay-75ef99c7.net.anydesk.com	United States	396356	MAXIHOSTUS	false
57.128.101.75	boot.net.anydesk.com	Belgium	2686	ATGS-MMD-ASUS	false
5.188.124.23	relay-b8f8a0be.net.anydesk.com	United States	202422	GHOSTRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1514437
Start date and time:	2024-09-20 12:46:43 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	_AnyDesk.exe_
Detection:	MAL
Classification:	mal68.evad.winEXE_@5/9@4/4
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 63% Number of executed functions: 76 Number of non-executed functions: 279

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, SgrmBroker.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target _AnyDesk.exe, PID 5772 because there are no executed function
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:47:16	API Interceptor	3x Sleep call for process: _AnyDesk.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
18.66.102.21	http://shop.tiktokwins.xyz/	Get hash	malicious	Unknown	Browse
	http://rebrand.ly	Get hash	malicious	Unknown	Browse
	https://3pviwkdm.r.ap-northeast-1.awstrack.me/L0/https:%2F%2Fnew.paperlogic.jp%2Fdocuments%2Fdetail%2F1082854/1/0106018deeee3014-c2d10558-f6be-49da-9a17-ffb71f8d4a78-000000/uzu1d7NIaLiu0Ia28zbMDidxKco=148	Get hash	malicious	Unknown	Browse
	https://rebrand.ly/rzllfcg	Get hash	malicious	Unknown	Browse
185.209.178.72	AnyDesk.exe	Get hash	malicious	Unknown	Browse
57.128.101.75	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Unknown	Browse
	anydesk.exe	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Unknown	Browse
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
d1atxff5avezsq.cloudfront.net	Lisect_AVT_24003_G1B_127.exe	Get hash	malicious	PureLog Stealer	Browse	18.245.86.84
	https://download.filezilla-project.org/client/FileZilla_3.67.0_win64_sponsored2-setup.exe	Get hash	malicious	Unknown	Browse	18.65.39.23
	f_0002b5.exe	Get hash	malicious	Unknown	Browse	18.245.86.84
	f_0002b5.exe	Get hash	malicious	Unknown	Browse	13.225.10.64
	https://download.filezilla-project.org/client/FileZilla_3.67.0_win64_sponsored2-setup.exe	Get hash	malicious	Unknown	Browse	3.161.136.51
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse	18.173.219.116
	Filezillawin_94199_patched.exe	Get hash	malicious	Unknown	Browse	13.35.116.32
	Filezillawin_94199_patched.exe	Get hash	malicious	Unknown	Browse	13.35.116.110
	SysrI6zSkJ.exe	Get hash	malicious	RedLine	Browse	18.173.219.85
	SysrI6zSkJ.exe	Get hash	malicious	RedLine	Browse	18.173.219.36
boot.net.anydesk.com	f_0002b5.exe	Get hash	malicious	Unknown	Browse	57.128.101.74
	f_0002b5.exe	Get hash	malicious	Unknown	Browse	195.181.174.167
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.39
	http://116.0.56.101:9191/images/Distribution.exe	Get hash	malicious	Unknown	Browse	49.12.130.235
	SysrI6zSkJ.exe	Get hash	malicious	RedLine	Browse	37.59.29.33
	SysrI6zSkJ.exe	Get hash	malicious	RedLine	Browse	185.229.191.44
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	141.95.145.210
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	92.223.88.232
	http://sub.nabprotect-livechat.com/	Get hash	malicious	Unknown	Browse	185.229.191.39
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse	141.95.145.210
relay-75ef99c7.net.anydesk.com	AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.209.178.72

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MAXIHOSTUS	https://download.metatrader.com/cdn/web/gvd.markets.capital/mt5/gvdmarkets5setup.exe	Get hash	malicious	LummaC Stealer	Browse	66.203.112.227
	AnyDesk_new_Soft.exe	Get hash	malicious	EICAR	Browse	207.188.6.17
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.209.179.55
	https://bnz-portal.com/anydesk.exe	Get hash	malicious	Unknown	Browse	185.209.179.55
	https://bnz-portal.com/	Get hash	malicious	Unknown	Browse	185.209.179.55
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.209.178.72
	mt4setup.exe	Get hash	malicious	Unknown	Browse	66.203.112.227
	mt4setup.exe	Get hash	malicious	Unknown	Browse	66.203.112.227
MIT-GATEWAYSUS	https://linkin.bio/hdd-team	Get hash	malicious	Unknown	Browse	18.66.112.38
	WOT0089836_Electrical_Single_Line_diagram%2C_lighting__RR_docx_3461849704.pdf	Get hash	malicious	Unknown	Browse	18.173.205.119
	http://www.revsharboomerang.com	Get hash	malicious	Unknown	Browse	18.66.102.67
	https://yaqoot-alsama.com/o/?(:3Y9s2NV8xX32vaWINlJnJhmQUm5KTk5lQTOdIkPVVTRVIxNzASMjAyNFUZNTASMTcQ==	Get hash	malicious	Unknown	Browse	18.66.102.106
	SecuriteInfo.com.Linux.Mirai.8587.19636.7995.elf	Get hash	malicious	Mirai	Browse	19.167.48.103
	SecuriteInfo.com.Linux.Siggen.9999.8861.1379.elf	Get hash	malicious	Mirai	Browse	18.113.234.180
	SecuriteInfo.com.Linux.Siggen.9999.3716.19012.elf	Get hash	malicious	Mirai	Browse	18.125.180.187
	http://www.amazon.pl/a/c/r/58Taq1bLcVvmOOVrbiwneNbdW/	Get hash	malicious	Unknown	Browse	18.173.205.127
	http://www.amazon.pl/a/c/r/58Taq1bLcVvmOOVrbiwneNbdW%20%20Amazon:%20Zaloguj%20si%C3%84%C2%99%20z%2012	Get hash	malicious	Unknown	Browse	18.173.205.86
	http://telstra-100234.weeblysite.com/	Get hash	malicious	Unknown	Browse	18.172.103.101
GHOSTRU	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse	5.188.124.20
	https://bendigo-desk.com/	Get hash	malicious	Unknown	Browse	92.38.148.19
	https://bendigo-desk.com/	Get hash	malicious	Unknown	Browse	92.38.148.17
	Project.lnk	Get hash	malicious	Unknown	Browse	92.38.148.17
	LiveChat.exe	Get hash	malicious	Unknown	Browse	5.188.124.20
	anydesk.exe	Get hash	malicious	Unknown	Browse	5.188.124.20
	skid.x86.elf	Get hash	malicious	Moobot	Browse	5.188.111.145
	z7TJSPPROCESSO_.msi	Get hash	malicious	Unknown	Browse	92.38.149.87
	https://mrsltc.pythagorasremarketableremittance.online	Get hash	malicious	HTMLPhisher	Browse	92.38.171.163
	N2yyiafum9z.msi	Get hash	malicious	Unknown	Browse	92.38.149.87
ATGS-MMD-ASUS	WOT0089836_Electrical_Single_Line_diagram%2C_lighting__RR_docx_3461849704.pdf	Get hash	malicious	Unknown	Browse	51.44.35.189
	SecuriteInfo.com.Linux.Mirai.8587.19636.7995.elf	Get hash	malicious	Mirai	Browse	48.27.158.183
	SecuriteInfo.com.Linux.Siggen.9999.8861.1379.elf	Get hash	malicious	Mirai	Browse	57.135.132.125
	SecuriteInfo.com.Linux.Siggen.9999.6095.9527.elf	Get hash	malicious	Mirai	Browse	48.239.22.74
	SecuriteInfo.com.Linux.Siggen.9999.3716.19012.elf	Get hash	malicious	Mirai	Browse	51.58.121.94
	SecuriteInfo.com.Linux.Siggen.9999.8163.26295.elf	Get hash	malicious	Mirai	Browse	32.238.30.171
	http://attnationameritechiewide.weebly.com/	Get hash	malicious	Unknown	Browse	34.134.85.232
	http://newdocumentpropse.wordpress.com	Get hash	malicious	Unknown	Browse	34.160.236.64
	http://hhomelogginbt.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	34.49.241.189
	openconference.msi	Get hash	malicious	Unknown	Browse	34.128.163.126

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\gcapi.dll	AnyDesk_new_Soft.exe	Get hash	malicious	Unknown	Browse
	AnyDesk_new_Soft.exe	Get hash	malicious	EICAR	Browse
	f_0002b5.exe	Get hash	malicious	Unknown	Browse
	f_0002b5.exe	Get hash	malicious	Unknown	Browse
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse
	SysrI6zSkJ.exe	Get hash	malicious	RedLine	Browse
	SysrI6zSkJ.exe	Get hash	malicious	RedLine	Browse
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse
	https://nab-support.com/LiveChat.exe	Get hash	malicious	Unknown	Browse
	Project.lnk	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\gcapi.dll	AnyDesk_new_Soft.exe	Get hash	malicious	Unknown	Browse
	AnyDesk_new_Soft.exe	Get hash	malicious	EICAR	Browse
	f_0002b5.exe	Get hash	malicious	Unknown	Browse
	f_0002b5.exe	Get hash	malicious	Unknown	Browse
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse
	SysrI6zSkJ.exe	Get hash	malicious	RedLine	Browse
	SysrI6zSkJ.exe	Get hash	malicious	RedLine	Browse
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse
	https://nab-support.com/LiveChat.exe	Get hash	malicious	Unknown	Browse
	Project.lnk	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\gcapi.dll

Download File

Process:	C:\Users\user\Desktop\_AnyDesk.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	394240
Entropy (8bit):	6.700175464943679
Encrypted:	false
SSDEEP:	6144:Tv/ioKdMF+LZD/ZRj1vwWrrUFMNoz4pFGxjEB1NYAOrabN2GZvFcD7:Td+LZrNwWrrwMNoz4vG1OYZabtK7
MD5:	1CE7D5A1566C8C449D0F6772A8C27900
SHA1:	60854185F6338E1BFC7497FD41AA44C5C00D8F85
SHA-256:	73170761D6776C0DEBACFBBC61B6988CB8270A20174BF5C049768A264BB8FFAF
SHA-512:	7E3411BE8614170AE91DB1626C452997DC6DB663D79130872A124AF982EE1D457CEFBA00ABD7F5269ADCE3052403BE31238AECC3934C7379D224CB792D519753
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: AnyDesk_new_Soft.exe, Detection: malicious, Browse Filename: AnyDesk_new_Soft.exe, Detection: malicious, Browse Filename: f_0002b5.exe, Detection: malicious, Browse Filename: f_0002b5.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: SysrI6zSkJ.exe, Detection: malicious, Browse Filename: SysrI6zSkJ.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: Project.lnk, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........q.hB..;B..;B..;.I.:@..;...;W..;...;...;...;b..;.#;@..;!M.:U..;!M.:c..;!M.:u..;...;@..;,M.:...;...;Y..;B..;~..;,M.:e..;,M.:C..;,M.;C..;B.s;C..;,M.:C..;RichB..;........................PE..L......W.........."!................:.....................................................@.........................p................0.......................@..h2......8...........................p...@.......................@....................text...y........................... ..`.rdata...-..........................@..@.data...H5..........................@....gfids..(...........................@..@.tls......... ......................@....rsrc........0......................@..@.reloc..h2...@...4..................@..B................................................................................................................................................................

C:\Users\user\AppData\Roaming\AnyDesk\ad.trace

Download File

Process:	C:\Users\user\Desktop\_AnyDesk.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	36240
Entropy (8bit):	4.407790393494557
Encrypted:	false
SSDEEP:	384:jRY2L+RfRrj+kHssaN1d+Z43Ns2r8Q1pW5BX+NIdWbABkgbjdB+2dbd:tz4prC0ZIfDIX+NIQb0fdT
MD5:	FB68FA75470E8807C0F32C05A7CFC8E3
SHA1:	D5795C08BBC13EDB7CC6FA33B8587685D42F185A
SHA-256:	C8694032DE3F52C23236F2DCB24B5A15CE677D3D1B9732B9403B3324552DECC1
SHA-512:	FB134B67F30F9C28A62A0C93375A56CC6358E80E0CA0E5768962D6FD54F224891DDA2CD50A83E35B67049DADEFBE3DFE12C0474932BEB548EBB5CE6F89350FA3
Malicious:	false
Reputation:	low
Preview:	* * * * * * * * * * * * * * * * * .. info 2024-09-20 10:47:13.709 front 5772 6308 main - AnyDesk Windows Startup .. info 2024-09-20 10:47:13.709 front 5772 6308 main - Version 8.1.0 (release/win_8.1.0 91337f7c79cf9e0e9335079141cbee71f8672b84).. info 2024-09-20 10:47:13.709 front 5772 6308 main - * Checksum a4e3c0a02145015976e3309142b548b2.. info 2024-09-20 10:47:13.725 front 5772 6308 main - * Build 20240912163351.. info 2024-09-20 10:47:13.725 front 5772 6308 main - * Copyright (C) 2024 AnyDesk Software GmbH *.. info 2024-09-20 10:47:13.725 front 5772 6308 main - .. info 2024-09-20 10:47:13.725 front 5772 6308 main - Command Line params: "C:\Users\user\Desktop\_AnyDesk.exe"..

C:\Users\user\AppData\Roaming\AnyDesk\global_cache\device-id.cache

Download File

Process:	C:\Users\user\Desktop\_AnyDesk.exe
File Type:	data
Category:	dropped
Size (bytes):	312
Entropy (8bit):	7.215601299435307
Encrypted:	false
SSDEEP:	6:brqRAhP9qjuMowV57wPvoc90yYjVXhVyqSLsiarHfT4Z6FHN5hsVAbkeB:brhQjuLwV50Xo+LYhXh79T4AUekeB
MD5:	16A1B203A4B98A3A69A25D57B2BFAD30
SHA1:	8AB98DA87726668B1D77F1461AB820A1929B70D9
SHA-256:	40FBACF048B86380C1B3AE66AA92CF26D0146787827E5E8AE18468127F3C2C32
SHA-512:	2F7F5937E6AB2813FF7EDA1A9DC96E3E4F3C69455C260E06A856B69DD908CF2E92329283FA969AF4879ABB0D4DF3E37C299083D353BAE15FAB227F93ADCBD84D
Malicious:	false
Reputation:	low
Preview:	.......+DID-V1-0190fd86-60c0-7354-baed-48b4878d6c61....fF....{..+...z.6..X..x..-.../...D.....A.....#..Xt....t..,.PB.....K...G..o.$f,.&.,N1{..[8.....A.F..Nr\|.......S/...$HCC.PU.R.%.O.-P.....H.z...~...,.\|..?'.R...%(.....t}B*...\.....?..T.q, ..RMK...S..z+..E.70.W3/D..)t.......)p...\|F./'.TI.J.<

C:\Users\user\AppData\Roaming\AnyDesk\service.conf

Download File

Process:	C:\Users\user\Desktop\_AnyDesk.exe
File Type:	ASCII text, with very long lines (1751)
Category:	dropped
Size (bytes):	2970
Entropy (8bit):	6.03924214627846
Encrypted:	false
SSDEEP:	48:uISTssbIis9sLOtPgqJVL6Lj6GBUNs1OZ+YLEgCkroHovkl8YHvxhbFWF8GUNjFj:uIST9Iis9sLEPgKVCeggEYoHovg3bFoG
MD5:	8DEFA31E9E3FC1EE4534679D59F085A6
SHA1:	9F416065A127212BEB3CCD67042256B133631E91
SHA-256:	564A391CF9133C532AA0A59D97C098F6FAB52ACAEBBEDE3165E1C3FF83F27282
SHA-512:	CAE4444AA19802E2471E0CC7F364592C2DD351FD54E99DB8A43CC0BB7EEF32F12A1F9D6D7419B247C16A1FAA3AAFD720D2EE7E72F7756B33CE79702918738295
Malicious:	false
Reputation:	low
Preview:	ad.anynet.cert=-----BEGIN CERTIFICATE-----\nMIICqDCCAZACAQEwDQYJKoZIhvcNAQELBQAwGTEXMBUGA1UEAwwOQW55RGVzayBD\nbGllbnQwIBcNMjQwOTIwMTA0NzE2WhgPMjA3NDA5MDgxMDQ3MTZaMBkxFzAVBgNV\nBAMMDkFueURlc2sgQ2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEAqT2s7zHJFdoDi4rc1NXbY3+LTe2yDwAF+Fu4xA6mXMOIvbX0T9RjZtCefZpZ\nibkkJVHN1FhwWvA7ygBHO1r8HbxiI41ccEKX1+zlXmnTxLbtDYOI4mVUU0munM0v\ntVzZTeI04SNiqNdO5W91h7si3bkkycWK9fa7iM07DtUsrfmi8p/S6xUcxik9COYW\n/MFSt7C5KYKhdEqk7+s38QfIbnTkT6dczgwLF//EnI41MUyuOnr2Rbi7FO2odOzp\nYvNECnFWjhzGk7oCHebROwkUENYDN61fdh2xTROzSsaFw6OAezXVzmCQBu4T+RHr\nuDf23D+kxepkcmGUUvcgbJcdjwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQARAqrm\nA+VnpXA39NRsXhDOVoKLVTETL1tSeyiT6q54EJRGD8WbpUdU+q64qwPzSC54DKyI\nymEqbpwiEqDygOp3kyRMrp+qlPHj2Rt9oFpTdaqAmAdHQyaJP3ouMdmH21Wre61l\n4Llc0yyE6LIzbVk/rWfdqQIfIsCzFRMuFrcRfk7XoxCsU36UW92ZjpnvdIhmlPkV\nnEQrupn/c/5O+GAMcMIISoa+UI0hE3hzNkfxN3EF3qoYGFEWSF2V6USm0Jz9AyT2\n8iqYtbx5MomNQzgk6O+S4DrAxFclhyzJQ2saQgxXJkoY8ZgYL9Jgbj+kndDS34FV\nTnR+DIoDlox0tj8h\n-----END CERTI

C:\Users\user\AppData\Roaming\AnyDesk\system.conf

Download File

Process:	C:\Users\user\Desktop\_AnyDesk.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	774
Entropy (8bit):	4.784067155125961
Encrypted:	false
SSDEEP:	12:oFU7XWsvD0+P65sD08iBs7lNqQHvWhabkVp4LroBGgFBGt:fb17a8iBs5sAwagVp4LtBt
MD5:	E61E42906B932B0FC701EFAA6D2B4102
SHA1:	A480CA096D3A6B707D44A66A94D33C53FD3D21E3
SHA-256:	46D574E025D5A5BBCF8C24E10EE6E3DFA379968B15E8F0746E078E67E2717BAE
SHA-512:	52AE8D560687D9C5A11BDB184DB055ED54B2D08747B42A342F8BC0E1660BE98955FA04F9FB298CB8D14CFF3BEC08FE87230E9928D02E005808AE4A55E299ADF4
Malicious:	false
Reputation:	low
Preview:	ad.anynet.alias=.ad.anynet.client_stats_hash=ec0cfc18be0b62770634777cd7447009494d623d.ad.anynet.cur_version=34359738380.ad.anynet.did.hash=2694448009.ad.anynet.fpr=c9704e6b6405bdd07cd123385a4d0793e22bc0a6.ad.anynet.id=699299886.ad.anynet.last_relay=relay-75ef99c7.net.anydesk.com:80:443:6568.ad.anynet.network_id=main.ad.anynet.relay.fatal_result=1.0.ad.anynet.relay.state=2.ad.inst.id=b7fa7604a2cd7ece322cb303c2d237bc.ad.license.expiry=0.ad.license.name=free-1.ad.security.frontend_clipboard=1.ad.security.frontend_clipboard_files=1.ad.security.frontend_clipboard_version=1.ad.security.permission_profiles._default.permissions.sas=1.ad.security.permission_profiles._unattended_access.permissions.sas=1.ad.security.permission_profiles.version=1.ad.security.update_version=1.

C:\Users\user\AppData\Roaming\AnyDesk\user.conf

Download File

Process:	C:\Users\user\Desktop\_AnyDesk.exe
File Type:	ASCII text, with very long lines (3453)
Category:	dropped
Size (bytes):	7315
Entropy (8bit):	4.413087378878271
Encrypted:	false
SSDEEP:	192:NMkHB1hOY9tND8UewJn3Tj1dLPKujAWrBNm4dnt:dOY1D8DwJn/LdkqBVdnt
MD5:	8A372E751EB9BF6CADE10EFFBAF4ADC4
SHA1:	ADA1FA5EE74F745F2A11B8EE8FB0B82878FA57FF
SHA-256:	3FCCBEB52CAC6AB3F527206AA5A84CCEDF45AC80F2D9049493B8697D3C21641D
SHA-512:	76B24FD0F6583A3F0F0A1F468F7658A02356CBB6FD0A9CCCB55EF7690CCBBD52682E9F60342B97288921CA658BDCD314C6B0123CFFB301933C9AB401F25BF5BD
Malicious:	false
Reputation:	low
Preview:	ad.account.auth_methods=6fa74c609a01f31f1f670668df954f4642a4aae8018a18dae508394ea6988efd8c7646d54bd48cb50ff648310f1fa2df0b53d2e90e4e008262013ecaea920a6cd219d7c9b3dae56a1ba60f2fdd0cab75ccdb5fd4d8c9c7319d9766d32a3fc27374ab0862b47b212f41cf5778b89c5838d58e5cfd0ec3fbde61aff3b9db9fabee233c8c3753e464a8ca30871548335470f0d9cd46241325b146471a1e3ceb5130304c806804e9cec6e71eb81e47bb6ebf480bb0ffb9cae98c3ffa973093b59f70bfba332d7cea697039bfe1d4c0d91418be755e11d15f4efcbf6f1491e460028539a974c7c815.ad.account.info=6fa74c609a01f31f1f670668df954f4642a4aae8018a18dae508394ea6988efd8c7646d54bd48cb50ff648310f1fa2df0b53d2e90e4e008262013ecaea9283b648351596465846d9195ce65c6305669d552753dff4fd0abd9a596b90f28fc27374ab0862b47b212f41cf5778b89c0ee8235d0b7782eafa59fe540b79641a9f961eed28b72eac6b4f5e64ce583f766470f0d95c722515975bdaa02f7102acbab3dd5ae148c0547911a4e1be0313ba56f416a311cc97f090d4a4388d62c664f6c8a6fbf1f6c3b636f77f4e14e32c0d62a9f113c24a365877a0cf42836d81ddcf05129d77d7a7975587a864fec545a67dc1d6cabeb85829.ad.acc

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms (copy)

Download File

Process:	C:\Users\user\Desktop\_AnyDesk.exe
File Type:	data
Category:	dropped
Size (bytes):	3210
Entropy (8bit):	3.2498781610109657
Encrypted:	false
SSDEEP:	24:+nwlBA5HmSOeyWoymRnwlBA5unGOeyjDym+:mwlS5HzzoyYwlS50Gey1
MD5:	94FB60DECDF5D1EC57BAA784AA179EA2
SHA1:	0133C3B6713BDECFD274BA6A456B022F8C610DE1
SHA-256:	DAFBB82A7D60146004410592605532C20800885F5D7164243389D6C2978735B8
SHA-512:	6649028D58F796702CD1C3CB128835B19DC3D732BC1591380DEE51EE561FB263359A03B52F5B35837D20E87FF4C6A672EB01D5BC67CD6085B969060E304DA2F6
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.@.. ......iJ...!3jsJ...TA.rJ...H3L..........................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4......iJ......tJ.....f.2.H3L.4Y.U ._AnyDesk.exe..J......4Y.U4Y.U.....S........................_.A.n.y.D.e.s.k...e.x.e.......Q...............-.......P...........w.%{.....C:\Users\user\Desktop\_AnyDesk.exe....O.p.e.n. .a. .n.e.w. .A.n.y.D.e.s.k. .w.i.n.d.o.w...".C.:.\.U.s.e.r.s.\.c.a.l.i.\.D.e.s.k.t.o.p.\._.A.n.y.D.e.s.k...e.x.e.........%USERPROFILE%\Desktop\_AnyDesk.exe..................................................................................................................................................................................................................................%.U.S.E.R.P.R.O.F.I.L.E.%.\.D.e.s.k.t.o.p.\._.A.n.y.D.e.s.k...e.x.e....................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZQTLWF9V88R56MVSE0K1.temp

Download File

Process:	C:\Users\user\Desktop\_AnyDesk.exe
File Type:	data
Category:	dropped
Size (bytes):	3210
Entropy (8bit):	3.2498781610109657
Encrypted:	false
SSDEEP:	24:+nwlBA5HmSOeyWoymRnwlBA5unGOeyjDym+:mwlS5HzzoyYwlS50Gey1
MD5:	94FB60DECDF5D1EC57BAA784AA179EA2
SHA1:	0133C3B6713BDECFD274BA6A456B022F8C610DE1
SHA-256:	DAFBB82A7D60146004410592605532C20800885F5D7164243389D6C2978735B8
SHA-512:	6649028D58F796702CD1C3CB128835B19DC3D732BC1591380DEE51EE561FB263359A03B52F5B35837D20E87FF4C6A672EB01D5BC67CD6085B969060E304DA2F6
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.@.. ......iJ...!3jsJ...TA.rJ...H3L..........................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4......iJ......tJ.....f.2.H3L.4Y.U ._AnyDesk.exe..J......4Y.U4Y.U.....S........................_.A.n.y.D.e.s.k...e.x.e.......Q...............-.......P...........w.%{.....C:\Users\user\Desktop\_AnyDesk.exe....O.p.e.n. .a. .n.e.w. .A.n.y.D.e.s.k. .w.i.n.d.o.w...".C.:.\.U.s.e.r.s.\.c.a.l.i.\.D.e.s.k.t.o.p.\._.A.n.y.D.e.s.k...e.x.e.........%USERPROFILE%\Desktop\_AnyDesk.exe..................................................................................................................................................................................................................................%.U.S.E.R.P.R.O.F.I.L.E.%.\.D.e.s.k.t.o.p.\._.A.n.y.D.e.s.k...e.x.e....................................................................................................................................................................

C:\Users\user\Desktop\gcapi.dll

Download File

Process:	C:\Users\user\Desktop\_AnyDesk.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	394240
Entropy (8bit):	6.700175464943679
Encrypted:	false
SSDEEP:	6144:Tv/ioKdMF+LZD/ZRj1vwWrrUFMNoz4pFGxjEB1NYAOrabN2GZvFcD7:Td+LZrNwWrrwMNoz4vG1OYZabtK7
MD5:	1CE7D5A1566C8C449D0F6772A8C27900
SHA1:	60854185F6338E1BFC7497FD41AA44C5C00D8F85
SHA-256:	73170761D6776C0DEBACFBBC61B6988CB8270A20174BF5C049768A264BB8FFAF
SHA-512:	7E3411BE8614170AE91DB1626C452997DC6DB663D79130872A124AF982EE1D457CEFBA00ABD7F5269ADCE3052403BE31238AECC3934C7379D224CB792D519753
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: AnyDesk_new_Soft.exe, Detection: malicious, Browse Filename: AnyDesk_new_Soft.exe, Detection: malicious, Browse Filename: f_0002b5.exe, Detection: malicious, Browse Filename: f_0002b5.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: SysrI6zSkJ.exe, Detection: malicious, Browse Filename: SysrI6zSkJ.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: Project.lnk, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........q.hB..;B..;B..;.I.:@..;...;W..;...;...;...;b..;.#;@..;!M.:U..;!M.:c..;!M.:u..;...;@..;,M.:...;...;Y..;B..;~..;,M.:e..;,M.:C..;,M.;C..;B.s;C..;,M.:C..;RichB..;........................PE..L......W.........."!................:.....................................................@.........................p................0.......................@..h2......8...........................p...@.......................@....................text...y........................... ..`.rdata...-..........................@..@.data...H5..........................@....gfids..(...........................@..@.tls......... ......................@....rsrc........0......................@..@.reloc..h2...@...4..................@..B................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.999385068938963
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	_AnyDesk.exe_
File size:	4'993'864 bytes
MD5:	ecae8b9c820ce255108f6050c26c37a1
SHA1:	42333349841ddcec2b5c073abc0cae651bb03e5f
SHA256:	1a70f4eef11fbecb721b9bab1c9ff43a8c4cd7b2cafef08c033c77070c6fe069
SHA512:	9dc317682d4a89351e876b47f57e7fd26176f054b7322433c2c02dd074aabf8bfb19e6d1137a4b3ee6cd3463eaf8c0de124385928c561bdfe38440f336035ed4
SSDEEP:	49152:meqV5ZTNR7GCogeeQO+f2roC8b9vIT2jDKW4q8TrdzRplNOBLE7Rm1ebw4Tf/Eex:cX1T7bL0KrCqKDV4Jnd1ZOQ7R3rr/f6K
TLSH:	0A3633816787DBBAC8331131E6A1C1EC95F24F8E213A62CDB6209E479FD7327994D81D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........h.}.;.}.;.}.;..";.}.;..#;.}.;...;.}.;...;.}.;Rich.}.;........................PE..L......f.........."......*....K............

File Icon


Icon Hash:	499669d8d82916a8

Static PE Info

General

Entrypoint:	0x401ce5
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66E2FBD2 [Thu Sep 12 14:33:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	12/02/2024 01:00:00 13/02/2025 00:59:59
Subject Chain	CN=AnyDesk Software GmbH, O=AnyDesk Software GmbH, L=Stuttgart, S=Baden-W\xfcrttemberg, C=DE
Version:	3
Thumbprint MD5:	E4E34304F4315A15A0BC0E413363721E
Thumbprint SHA-1:	CA38CF219C8E9782A8CBBD76643D24E4F2D74B03
Thumbprint SHA-256:	AF74DC88EF91477F8A93E5DA98B3C80ECD6CB6A10271DC6DC768EC3F34239BC0
Serial:	030E330A8ED28347BDA3BB478E410D7C

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 64h
push esi
lea ecx, dword ptr [ebp-64h]
call 00007F03B867E1C3h
lea eax, dword ptr [ebp-64h]
mov ecx, eax
mov dword ptr [018A8058h], eax
call 00007F03B867E081h
test al, al
jne 00007F03B867E7E4h
mov esi, 000003E8h
lea ecx, dword ptr [ebp-64h]
call 00007F03B867E06Fh
mov eax, esi
pop esi
leave
ret
lea eax, dword ptr [ebp-64h]
push eax
lea ecx, dword ptr [ebp-30h]
call 00007F03B867DEA3h
lea eax, dword ptr [ebp-30h]
mov ecx, eax
mov dword ptr [018A805Ch], eax
call 00007F03B867DE3Bh
test al, al
jne 00007F03B867E7E1h
lea ecx, dword ptr [ebp-30h]
call 00007F03B867DE20h
mov esi, 000003E9h
jmp 00007F03B867E797h
cmp dword ptr [ebp-10h], 00000000h
je 00007F03B867E7DAh
push 00000800h
call dword ptr [ebp-10h]
cmp dword ptr [ebp-0Ch], 00000000h
je 00007F03B867E7DAh
push 00008001h
call dword ptr [ebp-0Ch]
lea eax, dword ptr [ebp-64h]
push eax
lea esi, dword ptr [ebp-30h]
call 00007F03B867E725h
pop ecx
mov esi, eax
push esi
call dword ptr [ebp-20h]
lea ecx, dword ptr [ebp-30h]
call 00007F03B867DDE2h
jmp 00007F03B867E75Eh
mov edx, dword ptr [esp+04h]
push ebx
mov ebx, dword ptr [esp+10h]
push esi
xor esi, esi
test ebx, ebx
je 00007F03B867E801h
push edi
mov edi, dword ptr [esp+14h]
sub edi, 018A8060h
imul edx, edx, 0019660Dh
add edx, 3C6EF35Fh
mov eax, edx
shr eax, 0Ch

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ C ] VS2010 build 30319
[RES] VS2010 SP1 build 40219
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14a9000	0x4850	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x4be200	0x5148	.itext
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x14ae000	0x8c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xff1000	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2877	0x2a00	9331303edc1ee829b16143a6f76f4c61	False	0.5997023809523809	data	6.5480559369675175	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x4000	0xfece00	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xff1000	0x2fa	0x400	59971ad78ea90c8a67b60c39a6f127d2	False	0.7265625	Matlab v4 mat-file (little endian) \234\022\377, numeric, rows 1726151634, columns 0, imaginary	5.6465688726772685	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xff2000	0x4b6464	0x4b6200	6fee06e3f827ab4af178bcf2bf4cd524	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x14a9000	0x4850	0x4a00	93dec90c44f8820e0638ad47a1281038	False	0.5120882601351351	data	6.017976566767105	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x14ae000	0x300	0x400	dff545c0291c6bb280bbfb0224bbecb4	False	0.15234375	data	1.2203722656529061	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x14a9280	0x1b8e	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9167848029486816
RT_ICON	0x14aae10	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 0	English	United States	0.299390243902439
RT_ICON	0x14ab478	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	United States	0.478494623655914
RT_ICON	0x14ab760	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 0	English	United States	0.48155737704918034
RT_ICON	0x14ab948	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	United States	0.597972972972973
RT_ICON	0x14abac0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.09404315196998124
RT_ICON	0x14acb68	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.2047872340425532
RT_GROUP_ICON	0x14aba70	0x4c	data	English	United States	0.8026315789473685
RT_GROUP_ICON	0x14acfd0	0x22	data	English	United States	1.0588235294117647
RT_VERSION	0x14acff8	0x24c	data	English	United States	0.47959183673469385
RT_MANIFEST	0x14ad248	0x605	XML 1.0 document, ASCII text	English	United States	0.4516547696301103

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 20, 2024 12:47:16.956243038 CEST	49700	443	192.168.2.16	57.128.101.75
Sep 20, 2024 12:47:16.956330061 CEST	443	49700	57.128.101.75	192.168.2.16
Sep 20, 2024 12:47:16.956671000 CEST	49700	443	192.168.2.16	57.128.101.75
Sep 20, 2024 12:47:16.981081009 CEST	49700	443	192.168.2.16	57.128.101.75
Sep 20, 2024 12:47:16.981112003 CEST	443	49700	57.128.101.75	192.168.2.16
Sep 20, 2024 12:47:17.654040098 CEST	443	49700	57.128.101.75	192.168.2.16
Sep 20, 2024 12:47:17.654148102 CEST	49700	443	192.168.2.16	57.128.101.75
Sep 20, 2024 12:47:17.654922009 CEST	49700	443	192.168.2.16	57.128.101.75
Sep 20, 2024 12:47:17.654942989 CEST	443	49700	57.128.101.75	192.168.2.16
Sep 20, 2024 12:47:17.655358076 CEST	443	49700	57.128.101.75	192.168.2.16
Sep 20, 2024 12:47:17.655433893 CEST	49700	443	192.168.2.16	57.128.101.75
Sep 20, 2024 12:47:17.686630964 CEST	49700	443	192.168.2.16	57.128.101.75
Sep 20, 2024 12:47:17.698012114 CEST	49702	80	192.168.2.16	57.128.101.75
Sep 20, 2024 12:47:17.704606056 CEST	80	49702	57.128.101.75	192.168.2.16
Sep 20, 2024 12:47:17.704778910 CEST	49702	80	192.168.2.16	57.128.101.75
Sep 20, 2024 12:47:17.711293936 CEST	49702	80	192.168.2.16	57.128.101.75
Sep 20, 2024 12:47:17.716567039 CEST	80	49702	57.128.101.75	192.168.2.16
Sep 20, 2024 12:47:22.722907066 CEST	49702	80	192.168.2.16	57.128.101.75
Sep 20, 2024 12:47:22.735471010 CEST	49706	6568	192.168.2.16	57.128.101.75
Sep 20, 2024 12:47:22.740371943 CEST	6568	49706	57.128.101.75	192.168.2.16
Sep 20, 2024 12:47:22.740565062 CEST	49706	6568	192.168.2.16	57.128.101.75
Sep 20, 2024 12:47:22.749538898 CEST	49706	6568	192.168.2.16	57.128.101.75
Sep 20, 2024 12:47:22.754734039 CEST	6568	49706	57.128.101.75	192.168.2.16
Sep 20, 2024 12:47:22.769964933 CEST	80	49702	57.128.101.75	192.168.2.16
Sep 20, 2024 12:47:23.401437998 CEST	6568	49706	57.128.101.75	192.168.2.16
Sep 20, 2024 12:47:23.409935951 CEST	49706	6568	192.168.2.16	57.128.101.75
Sep 20, 2024 12:47:23.418930054 CEST	6568	49706	57.128.101.75	192.168.2.16
Sep 20, 2024 12:47:23.597848892 CEST	6568	49706	57.128.101.75	192.168.2.16
Sep 20, 2024 12:47:23.638854027 CEST	49706	6568	192.168.2.16	57.128.101.75
Sep 20, 2024 12:47:23.693005085 CEST	6568	49706	57.128.101.75	192.168.2.16
Sep 20, 2024 12:47:23.693319082 CEST	49706	6568	192.168.2.16	57.128.101.75
Sep 20, 2024 12:47:23.931269884 CEST	6568	49706	57.128.101.75	192.168.2.16
Sep 20, 2024 12:47:23.931355000 CEST	49706	6568	192.168.2.16	57.128.101.75
Sep 20, 2024 12:47:23.932303905 CEST	6568	49706	57.128.101.75	192.168.2.16
Sep 20, 2024 12:47:24.154150963 CEST	6568	49706	57.128.101.75	192.168.2.16
Sep 20, 2024 12:47:24.186901093 CEST	49706	6568	192.168.2.16	57.128.101.75
Sep 20, 2024 12:47:24.192073107 CEST	6568	49706	57.128.101.75	192.168.2.16
Sep 20, 2024 12:47:24.192140102 CEST	49706	6568	192.168.2.16	57.128.101.75
Sep 20, 2024 12:47:24.211065054 CEST	49707	443	192.168.2.16	5.188.124.23
Sep 20, 2024 12:47:24.211112022 CEST	443	49707	5.188.124.23	192.168.2.16
Sep 20, 2024 12:47:24.211211920 CEST	49707	443	192.168.2.16	5.188.124.23
Sep 20, 2024 12:47:24.220590115 CEST	49707	443	192.168.2.16	5.188.124.23
Sep 20, 2024 12:47:24.220613956 CEST	443	49707	5.188.124.23	192.168.2.16
Sep 20, 2024 12:47:24.690722942 CEST	443	49707	5.188.124.23	192.168.2.16
Sep 20, 2024 12:47:24.690812111 CEST	49707	443	192.168.2.16	5.188.124.23
Sep 20, 2024 12:47:24.691589117 CEST	49707	443	192.168.2.16	5.188.124.23
Sep 20, 2024 12:47:24.691602945 CEST	443	49707	5.188.124.23	192.168.2.16
Sep 20, 2024 12:47:24.691920996 CEST	443	49707	5.188.124.23	192.168.2.16
Sep 20, 2024 12:47:24.691975117 CEST	49707	443	192.168.2.16	5.188.124.23
Sep 20, 2024 12:47:24.716231108 CEST	49707	443	192.168.2.16	5.188.124.23
Sep 20, 2024 12:47:24.726131916 CEST	49708	80	192.168.2.16	5.188.124.23
Sep 20, 2024 12:47:24.731044054 CEST	80	49708	5.188.124.23	192.168.2.16
Sep 20, 2024 12:47:24.731126070 CEST	49708	80	192.168.2.16	5.188.124.23
Sep 20, 2024 12:47:24.736448050 CEST	49708	80	192.168.2.16	5.188.124.23
Sep 20, 2024 12:47:24.741343021 CEST	80	49708	5.188.124.23	192.168.2.16
Sep 20, 2024 12:47:25.211954117 CEST	80	49708	5.188.124.23	192.168.2.16
Sep 20, 2024 12:47:25.220315933 CEST	49708	80	192.168.2.16	5.188.124.23
Sep 20, 2024 12:47:25.225275993 CEST	80	49708	5.188.124.23	192.168.2.16
Sep 20, 2024 12:47:25.326224089 CEST	80	49708	5.188.124.23	192.168.2.16
Sep 20, 2024 12:47:25.333245993 CEST	49708	80	192.168.2.16	5.188.124.23
Sep 20, 2024 12:47:25.338144064 CEST	80	49708	5.188.124.23	192.168.2.16
Sep 20, 2024 12:47:25.551259041 CEST	80	49708	5.188.124.23	192.168.2.16
Sep 20, 2024 12:47:25.600861073 CEST	49708	80	192.168.2.16	5.188.124.23
Sep 20, 2024 12:47:25.625165939 CEST	49708	80	192.168.2.16	5.188.124.23
Sep 20, 2024 12:47:25.630371094 CEST	80	49708	5.188.124.23	192.168.2.16
Sep 20, 2024 12:47:25.630611897 CEST	49708	80	192.168.2.16	5.188.124.23
Sep 20, 2024 12:47:25.698088884 CEST	49710	443	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:25.698177099 CEST	443	49710	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:25.698652983 CEST	49710	443	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:25.714875937 CEST	49710	443	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:25.714910984 CEST	443	49710	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:26.193788052 CEST	443	49710	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:26.193906069 CEST	49710	443	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:26.194792032 CEST	49710	443	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:26.194823980 CEST	443	49710	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:26.194967031 CEST	443	49710	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:26.195050001 CEST	49710	443	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:26.255537987 CEST	49710	443	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:26.273830891 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:26.282917023 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:26.283077002 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:26.290359974 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:26.295370102 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:26.747596025 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:26.755188942 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:26.760123968 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:26.855415106 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:26.904807091 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:26.989691019 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:26.990021944 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:26.994800091 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:27.173715115 CEST	80	49702	57.128.101.75	192.168.2.16
Sep 20, 2024 12:47:27.173785925 CEST	49702	80	192.168.2.16	57.128.101.75
Sep 20, 2024 12:47:27.259187937 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:27.303828955 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:27.309706926 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:27.309830904 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:27.314337969 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:27.314713001 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:27.314815998 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:27.314827919 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:27.319195986 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:27.319458008 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:27.540740013 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:27.541043043 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:27.545886040 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:27.628268957 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:27.629338026 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:27.634236097 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:27.726387978 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:27.766823053 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:27.845431089 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:27.845534086 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:27.845742941 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:27.845910072 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:27.850760937 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:27.945632935 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:27.950207949 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:27.955064058 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:27.957943916 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:27.960381031 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:27.962858915 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:27.965168953 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.049344063 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.049592018 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.054436922 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.148669958 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.148891926 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.153667927 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.241528034 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.248434067 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.248508930 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.248538017 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.248550892 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.248591900 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.248822927 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.248924017 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.249141932 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.249141932 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.249154091 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.249166012 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.249196053 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.249757051 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.249836922 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.249867916 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.249881029 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.249941111 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.250169039 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.250600100 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.250705004 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.250706911 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.250720978 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.250758886 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.336075068 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.336229086 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.336240053 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.336288929 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.336431026 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.336471081 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.336623907 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.336636066 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.336679935 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.336977005 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.336990118 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.337028980 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.337287903 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.337443113 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.337455034 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.337513924 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.337757111 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.337816000 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.338233948 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.338443041 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.338454962 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.338501930 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.338640928 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.338656902 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.338907003 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.339112997 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.339124918 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.339184999 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.339261055 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.339272976 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.339314938 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.339965105 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.340058088 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.340069056 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.340082884 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.340122938 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.340375900 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.340431929 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.340883970 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.340945959 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.340991020 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.341003895 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.341047049 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.341063976 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.341275930 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.341325998 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.341711044 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.342165947 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.345717907 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.423644066 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.423672915 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.423686028 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.423751116 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.423980951 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.424043894 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.424098015 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.424293041 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.424304008 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.424314976 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.424343109 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.424367905 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.424772978 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.424783945 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.424823046 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.425153971 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.425168037 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.425178051 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.425224066 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.425479889 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.425599098 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.425611019 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.425620079 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.425652027 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.425676107 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.426170111 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.426182032 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.426191092 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.426201105 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.426225901 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.426253080 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.426732063 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.426743031 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.426798105 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.427028894 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.427045107 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.427054882 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.427098036 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.427548885 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.427560091 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.427568913 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.427599907 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.427619934 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.428077936 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.428088903 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.428097963 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.428109884 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.428129911 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.428147078 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.428698063 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.428709030 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.428749084 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.429023981 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.429038048 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.429049969 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.429068089 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.429119110 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.429536104 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.429548025 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.429557085 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.429585934 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.429605961 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.429708958 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.430022001 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.430032969 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.430042028 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.430053949 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.430077076 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.430107117 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.430666924 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.430676937 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.430727959 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.430985928 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.430998087 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.431008101 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.431034088 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.431057930 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.431372881 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.431389093 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.431400061 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.431418896 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.431443930 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.432910919 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.433523893 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.433536053 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.433582067 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.477981091 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.511245012 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.511276007 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.511287928 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.511339903 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.511620045 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.511634111 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.511643887 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.511656046 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.511667013 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.511668921 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.511693001 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.511709929 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.512223005 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.512239933 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.512248993 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.512259007 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.512269020 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.512275934 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.512298107 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.512867928 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.512880087 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.512890100 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.512901068 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.512929916 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.513537884 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.513550997 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.513560057 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.513570070 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.513578892 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.513582945 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.513590097 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.513601065 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.513631105 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.514431953 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.514444113 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.514451981 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.514461994 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.514472008 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.514482021 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.514492035 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.514493942 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.514503002 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.514517069 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.514529943 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.515444994 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.515456915 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.515465021 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.515474081 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.515484095 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.515494108 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.515503883 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.515503883 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.515530109 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.515544891 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.516388893 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.516402006 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.516411066 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.516421080 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.516429901 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.516439915 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.516444921 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.516450882 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.516470909 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.517333031 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.517344952 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.517354012 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.517364025 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.517374992 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.517385006 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.517391920 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.517419100 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.518354893 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.518369913 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.518378973 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.518388033 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.518398046 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.518409014 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.518410921 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.518419981 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.518430948 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.518436909 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.518441916 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.518455029 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.518479109 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.519267082 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.519278049 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.519287109 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.519296885 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.519306898 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.519316912 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.519325972 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.519326925 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.519365072 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.520176888 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.520189047 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.520198107 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.520207882 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.520216942 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.520220995 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.520227909 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.520237923 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.520246029 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.520247936 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.520257950 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.520278931 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.520296097 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.521114111 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.521125078 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.521133900 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.521143913 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.521153927 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.521162987 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.521173000 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.521173954 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.521258116 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.521975040 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.521987915 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.522001028 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.522011042 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.522021055 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.522032022 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.522032022 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.522039890 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.522058010 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.522069931 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.522516012 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.522525072 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.522567034 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.522658110 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.522667885 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.522706032 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.522789001 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.522799015 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.522835970 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.598928928 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.598946095 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.598957062 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.599006891 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.599006891 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.599019051 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.599030018 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.599044085 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.599066973 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.599090099 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.599529028 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.599545002 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.599555969 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.599565029 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.599566936 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.599592924 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.599920988 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.599931955 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.599941969 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.599951982 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.599972963 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.600012064 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.600457907 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.600470066 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.600478888 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.600488901 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.600500107 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.600508928 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.600514889 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.600528002 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.601310015 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.601321936 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.601330042 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.601339102 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.601350069 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.601353884 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.601361036 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.601372957 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.601382017 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.601397991 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.601421118 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.602166891 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.602179050 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.602189064 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.602199078 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.602206945 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.602216959 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.602221966 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.602227926 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.602241993 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.602267981 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.603024960 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.603038073 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.603046894 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.603056908 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.603065968 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.603075981 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.603085995 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.603095055 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.603116035 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.603889942 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.603903055 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.603912115 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.603921890 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.603931904 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.603941917 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.603945971 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.603951931 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.603977919 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.604016066 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.604701996 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.604715109 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.604724884 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.604733944 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.604743958 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.604754925 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.604760885 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.604801893 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.605559111 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.605571985 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.605581045 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.605591059 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.605601072 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.605611086 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.605617046 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.605621099 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.605648994 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.605648994 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.606276035 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.606288910 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.606297970 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.606307983 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.606317997 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.606327057 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.606331110 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.606342077 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.606352091 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.606360912 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.606363058 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.606384039 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.606400013 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.607222080 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.607233047 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.607243061 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.607254028 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.607263088 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.607273102 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.607278109 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.607283115 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.607294083 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.607304096 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.607310057 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.607317924 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.607342958 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.608091116 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.608103037 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.608112097 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.608122110 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.608131886 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.608138084 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.608143091 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.608151913 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.608155966 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.608167887 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.608176947 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.608196020 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.608215094 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.609021902 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.609034061 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.609042883 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.609052896 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.609062910 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.609072924 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.609081984 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.609091997 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.609101057 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.609103918 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.609132051 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.609756947 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.609812021 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.609865904 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.609879017 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.609888077 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.609898090 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.609906912 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.609916925 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.609918118 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.609926939 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.609937906 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.609937906 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.609947920 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.609992981 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.686464071 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.686527967 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.686542988 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.686614037 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.686647892 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.686662912 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.686676979 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.686691999 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.686695099 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.686719894 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.686980009 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.687028885 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.687099934 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.687114954 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.687128067 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.687141895 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.687156916 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.687158108 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.687170982 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.687182903 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.687220097 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.687639952 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.687654972 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.687669039 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.687705040 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.687917948 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.687943935 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.687958956 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.687973022 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.687973976 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.687987089 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.687999010 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.688003063 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.688018084 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.688026905 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.688033104 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.688069105 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.688903093 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.688918114 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.688930988 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.688945055 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.688957930 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.688971996 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.688972950 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.688985109 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.688987970 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.689002991 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.689007998 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.689018011 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.689035892 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.689064026 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.689707041 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.689721107 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.689790964 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.708131075 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.712973118 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.807416916 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:28.851834059 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:28.896666050 CEST	49712	80	192.168.2.16	18.66.102.21
Sep 20, 2024 12:47:28.901468992 CEST	80	49712	18.66.102.21	192.168.2.16
Sep 20, 2024 12:47:28.901536942 CEST	49712	80	192.168.2.16	18.66.102.21
Sep 20, 2024 12:47:28.901665926 CEST	49712	80	192.168.2.16	18.66.102.21
Sep 20, 2024 12:47:28.906768084 CEST	80	49712	18.66.102.21	192.168.2.16
Sep 20, 2024 12:47:29.851965904 CEST	80	49712	18.66.102.21	192.168.2.16
Sep 20, 2024 12:47:29.901854038 CEST	49712	80	192.168.2.16	18.66.102.21
Sep 20, 2024 12:47:29.916923046 CEST	49712	80	192.168.2.16	18.66.102.21
Sep 20, 2024 12:47:29.922251940 CEST	80	49712	18.66.102.21	192.168.2.16
Sep 20, 2024 12:47:29.922324896 CEST	49712	80	192.168.2.16	18.66.102.21
Sep 20, 2024 12:47:38.821865082 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:38.826649904 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:48.828898907 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:48.834124088 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:47:58.842952013 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:47:58.848352909 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:48:08.851924896 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:48:08.889090061 CEST	80	49711	185.209.178.72	192.168.2.16
Sep 20, 2024 12:48:18.900922060 CEST	49711	80	192.168.2.16	185.209.178.72
Sep 20, 2024 12:48:18.912781000 CEST	80	49711	185.209.178.72	192.168.2.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 20, 2024 12:47:16.911966085 CEST	61807	53	192.168.2.16	1.1.1.1
Sep 20, 2024 12:47:16.918828011 CEST	53	61807	1.1.1.1	192.168.2.16
Sep 20, 2024 12:47:24.188813925 CEST	63458	53	192.168.2.16	1.1.1.1
Sep 20, 2024 12:47:24.198766947 CEST	53	63458	1.1.1.1	192.168.2.16
Sep 20, 2024 12:47:25.626771927 CEST	59361	53	192.168.2.16	1.1.1.1
Sep 20, 2024 12:47:25.638403893 CEST	53	59361	1.1.1.1	192.168.2.16
Sep 20, 2024 12:47:28.887687922 CEST	56441	53	192.168.2.16	1.1.1.1
Sep 20, 2024 12:47:28.895226002 CEST	53	56441	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 20, 2024 12:47:16.911966085 CEST	192.168.2.16	1.1.1.1	0xdb9b	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Sep 20, 2024 12:47:24.188813925 CEST	192.168.2.16	1.1.1.1	0xc8a0	Standard query (0)	relay-b8f8a0be.net.anydesk.com	A (IP address)	IN (0x0001)	false
Sep 20, 2024 12:47:25.626771927 CEST	192.168.2.16	1.1.1.1	0x9a8c	Standard query (0)	relay-75ef99c7.net.anydesk.com	A (IP address)	IN (0x0001)	false
Sep 20, 2024 12:47:28.887687922 CEST	192.168.2.16	1.1.1.1	0xc733	Standard query (0)	api.playanext.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 20, 2024 12:47:16.918828011 CEST	1.1.1.1	192.168.2.16	0xdb9b	No error (0)	boot.net.anydesk.com		57.128.101.75	A (IP address)	IN (0x0001)	false
Sep 20, 2024 12:47:24.198766947 CEST	1.1.1.1	192.168.2.16	0xc8a0	No error (0)	relay-b8f8a0be.net.anydesk.com		5.188.124.23	A (IP address)	IN (0x0001)	false
Sep 20, 2024 12:47:25.638403893 CEST	1.1.1.1	192.168.2.16	0x9a8c	No error (0)	relay-75ef99c7.net.anydesk.com		185.209.178.72	A (IP address)	IN (0x0001)	false
Sep 20, 2024 12:47:28.895226002 CEST	1.1.1.1	192.168.2.16	0xc733	No error (0)	api.playanext.com	d1atxff5avezsq.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 20, 2024 12:47:28.895226002 CEST	1.1.1.1	192.168.2.16	0xc733	No error (0)	d1atxff5avezsq.cloudfront.net		18.66.102.45	A (IP address)	IN (0x0001)	false
Sep 20, 2024 12:47:28.895226002 CEST	1.1.1.1	192.168.2.16	0xc733	No error (0)	d1atxff5avezsq.cloudfront.net		18.66.102.96	A (IP address)	IN (0x0001)	false
Sep 20, 2024 12:47:28.895226002 CEST	1.1.1.1	192.168.2.16	0xc733	No error (0)	d1atxff5avezsq.cloudfront.net		18.66.102.65	A (IP address)	IN (0x0001)	false
Sep 20, 2024 12:47:28.895226002 CEST	1.1.1.1	192.168.2.16	0xc733	No error (0)	d1atxff5avezsq.cloudfront.net		18.66.102.21	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.playanext.comuser-agent: anydesk

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49702	57.128.101.75	80	6424	C:\Users\user\Desktop\_AnyDesk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 20, 2024 12:47:17.711293936 CEST	216	OUT	Data Raw: 16 03 01 00 d3 01 00 00 cf 03 03 bc 84 54 63 5d 32 d0 06 76 18 9c 40 f0 04 71 b2 b6 4e 78 bb 58 d1 97 ec f2 12 16 36 4c 1d 10 0c 00 00 38 c0 2c c0 30 00 9f cc a9 cc a8 cc aa c0 2b c0 2f 00 9e c0 24 c0 28 00 6b c0 23 c0 27 00 67 c0 0a c0 14 00 39 Data Ascii: Tc]2v@qNxX6L8,0+/$(k#'g93=<5/n#anydesk/8.1.0/windows*(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49708	5.188.124.23	80	6424	C:\Users\user\Desktop\_AnyDesk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 20, 2024 12:47:24.736448050 CEST	216	OUT	Data Raw: 16 03 01 00 d3 01 00 00 cf 03 03 a9 1a b9 12 3f 7a 29 d1 9d b7 7a d8 96 34 24 ce e6 98 4c b5 b6 2a b3 09 8d df 38 c0 2d fd 38 bf 00 00 38 c0 2c c0 30 00 9f cc a9 cc a8 cc aa c0 2b c0 2f 00 9e c0 24 c0 28 00 6b c0 23 c0 27 00 67 c0 0a c0 14 00 39 Data Ascii: ?z)z4$L8-88,0+/$(k#'g93=<5/n#anydesk/8.1.0/windows(
Sep 20, 2024 12:47:25.211954117 CEST	1236	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 53 56 51 34 01 25 e1 0d 05 e5 c2 66 20 9a 84 b2 65 e9 b9 10 8f 77 10 ce 44 4f 57 4e 47 52 44 01 20 2e 58 5d 9c b3 95 cb 0c 20 5f 2d 22 f4 d5 6f 00 23 ec f8 ff 95 d7 dc 82 15 d0 23 d2 57 16 3e 77 c0 2c 00 00 0b ff Data Ascii: WSSVQ4%f ewDOWNGRD .X] _-"o##W>w,OKHE0A0)yA0*H0J10UAnyNet Root CA 21 0Uphilandro Software GmbH10UDE0190227210728Z2902242
Sep 20, 2024 12:47:25.220315933 CEST	1094	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 34 30 39 32 30 31 30 34 37 Data Ascii: 000H010UAnyDesk Client0 240920104716Z20740908104716Z010UAnyDesk Client0"0H0=1cM[\Ocf}Y$%QXpZ;G;Zb#\pB^i
Sep 20, 2024 12:47:25.326224089 CEST	91	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 68 80 d3 de df b4 86 18 11 2c 47 72 a4 fe bc 0f 03 d7 25 c9 c1 09 a6 9b 8b 35 ec 52 fb 6f 5f bd c8 f9 a0 b9 d5 89 b6 8d 17 03 03 00 23 68 80 d3 de df b4 86 19 c5 ea 8e 2b 1e ce 1a 27 88 1e 50 7b e0 87 07 3f 48 02 Data Ascii: (h,Gr%5Ro_#h+'P{?H4P3hf
Sep 20, 2024 12:47:25.333245993 CEST	92	OUT	Data Raw: 17 03 03 00 57 69 76 29 ee 30 d9 88 13 ee 4c 62 20 77 3e 8a 93 68 34 71 20 4c 57 4b ed f4 8d 56 99 4b 60 d2 06 84 ae 78 c2 b6 97 a9 e8 fb 87 39 92 f4 6b a8 55 02 85 41 12 ca c9 31 c1 cf 32 60 20 b3 8d a9 2b 4e 5f 17 b6 74 9c 86 f1 29 db 48 5c 86 Data Ascii: Wiv)0Lb w>h4q LWKVK`x9kUA12` +N_t)H\ypfz
Sep 20, 2024 12:47:25.551259041 CEST	423	IN	Data Raw: 17 03 03 01 a2 68 80 d3 de df b4 86 1a af 84 29 a7 47 1e 2f 31 ea b1 af a2 6c ed 00 33 96 15 cf e4 2a 3f 08 31 bd 9e 89 26 67 94 31 48 1b c1 b7 18 ae 2d 53 9c f4 8d 71 39 40 d2 7c d9 26 39 1c 5a 61 e5 f4 ec 85 13 e3 ee 3b 4b e8 27 21 a9 63 ef 69 Data Ascii: h)G/1l3?1&g1H-Sq9@\|&9Za;K'!cie,Q<\|X3anSXun,\|lRa>KJUrTb&fINS5(2@zgD7@g5ZP\}%R[[m3VIPIqv%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49711	185.209.178.72	80	6424	C:\Users\user\Desktop\_AnyDesk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 20, 2024 12:47:26.290359974 CEST	216	OUT	Data Raw: 16 03 01 00 d3 01 00 00 cf 03 03 3a 5c dc 54 0c 41 1d f0 c1 fd 07 05 ff d3 9b 0d 69 02 34 de 3d da 13 8d b0 28 14 11 91 3e 55 92 00 00 38 c0 2c c0 30 00 9f cc a9 cc a8 cc aa c0 2b c0 2f 00 9e c0 24 c0 28 00 6b c0 23 c0 27 00 67 c0 0a c0 14 00 39 Data Ascii: :\TAi4=(>U8,0+/$(k#'g93=<5/n#anydesk/8.1.0/windows*(
Sep 20, 2024 12:47:26.747596025 CEST	1234	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 09 05 e8 ac b5 99 1c 5d f3 a8 cc ed 60 6e 64 2b 91 31 dc f4 c2 3b 46 60 44 4f 57 4e 47 52 44 01 20 05 aa d5 ee 94 ca 9c 13 ca d4 a7 bf 6d 5b 1a a8 84 7a e4 4d 21 82 fa fc 3d a2 71 43 56 53 e9 88 c0 2c 00 00 0b ff Data Ascii: WS]`nd+1;F`DOWNGRD m[zM!=qCVS,OKHE0A0)yA0*H0J10UAnyNet Root CA 21 0Uphilandro Software GmbH10UDE0190227210728Z2902242
Sep 20, 2024 12:47:26.755188942 CEST	1094	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 34 30 39 32 30 31 30 34 37 Data Ascii: 000H010UAnyDesk Client0 240920104716Z20740908104716Z010UAnyDesk Client0"0H0=1cM[\Ocf}Y$%QXpZ;G;Zb#\pB^i
Sep 20, 2024 12:47:26.855415106 CEST	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 c4 ff 43 31 a4 d8 96 38 36 ad 7d fb 58 49 f1 4b 7e 24 78 d2 38 49 e2 e5 bb f9 21 3d f7 8c c4 f0 ed 82 3d 46 2e 44 5c f5 Data Ascii: (C186}XIK~$x8I!==F.D\
Sep 20, 2024 12:47:26.989691019 CEST	40	IN	Data Raw: 17 03 03 00 23 c4 ff 43 31 a4 d8 96 39 d8 7c 79 05 a6 d2 0f ad 3d 1b 2b 59 5e 57 32 8c cc c0 80 f7 95 cd d1 37 f0 0d 8f Data Ascii: #C19\|y=+Y^W27
Sep 20, 2024 12:47:26.990021944 CEST	92	OUT	Data Raw: 17 03 03 00 57 76 76 24 ca e2 07 be a0 83 be 58 bb 8c 1d 78 5a b9 fd 55 56 cd d6 4f 90 43 df 8c 9f 36 c5 22 d7 fe a4 6f 64 9a 9f ef 58 02 00 90 80 fb 1f 81 c3 a2 85 9b 11 3b 15 51 c6 34 5f 59 27 12 b3 f2 bb f7 b5 64 39 18 87 60 f2 58 b2 8d 66 1b Data Ascii: Wvv$XxZUVOC6"odX;Q4_Y'd9`Xf}*ula/
Sep 20, 2024 12:47:27.259187937 CEST	146	IN	Data Raw: 17 03 03 00 8d c4 ff 43 31 a4 d8 96 3a 28 0e 55 4a 8b 82 2c e4 bb 9d a6 11 90 46 6b 09 a2 67 de b4 7e f5 7e 1d 74 38 37 0f 0f 27 77 f5 5f 97 3f 2a fc 0b 3a 93 0d 62 49 bf 19 a2 28 95 a6 30 d2 69 71 5d 96 4a 9f b8 ed b9 7a 57 aa f7 1a 23 57 af 84 Data Ascii: C1:(UJ,Fkg~~t87'w_?*:bI(0iq]JzW#W4V+D&62N4s]AjG6tfm)\,T-A/p
Sep 20, 2024 12:47:27.309706926 CEST	456	OUT	Data Raw: 17 03 03 01 c3 76 76 24 ca e2 07 be a1 ec 12 db 27 a8 dc b7 bc d3 b6 43 2c 4c 62 f9 8a 11 92 2b 36 4e ca a9 e1 02 f5 d6 4d e5 d5 53 dd 91 d9 69 2e 93 7f d3 d3 28 9c 91 2e 8b e5 32 26 26 76 27 5b cb 60 84 44 ed 3a c2 b1 4e dc f5 6a e2 a1 68 70 c2 Data Ascii: vv$'C,Lb+6NMSi.(.2&&v'[`D:Njhplu.?~zLEJ}_Cz~_XH,jYTM])D&="sJ7LqU3)L=j,Yq$3#z>%r4<N$\|~Q%}xXm]V&7}]>5#
Sep 20, 2024 12:47:27.309830904 CEST	61	OUT	Data Raw: 17 03 03 00 38 76 76 24 ca e2 07 be a2 f0 f6 51 90 99 38 ba b7 c1 bb 65 c1 52 b3 54 fd f9 97 c0 ab 9a 2d d9 60 b1 26 99 a0 b1 b1 9e 8d 09 53 28 04 20 44 eb fb f9 c1 d7 24 d7 88 aa 5e Data Ascii: 8vv$Q8eRT-`&S( D$^
Sep 20, 2024 12:47:27.314337969 CEST	286	OUT	Data Raw: 17 03 03 01 19 76 76 24 ca e2 07 be a3 1a e9 6b e9 d2 50 68 ca 02 b3 c5 9d b0 a2 14 5b 0f 49 72 22 ab 92 e1 05 6e 46 c6 8f a0 e6 0f 7f 09 bd 98 5a 29 c0 ce 73 c2 f4 9f 1a 8d 05 41 18 19 e5 9b 46 fd 8d b7 6c d7 18 e0 d4 f6 b7 00 51 2a d1 0a 61 c5 Data Ascii: vv$kPh[Ir"nFZ)sAFlQ*at][a/!pf#mVS ~/G&cdJ6?O?~r+5d#EgL%+{vpS);k^kaB+{2)z7!:[g,a-{j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49712	18.66.102.21	80	6424	C:\Users\user\Desktop\_AnyDesk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 20, 2024 12:47:28.901665926 CEST	506	OUT	POST /httpapi HTTP/1.1Host: api.playanext.comUser-Agent: AnyDesk/8.1.0Accept: /Content-Length: 352Content-Type: application/x-www-form-urlencodedapi_key=c1426bd258099fa69f62933b466d4b77&event=[{"event_type":"check_offer","user_id":"464bbffb9f7c03157be5e17ab1b9672a","session_id":1726829248386429,"ip":"$remote","event_properties":{"method_used":"Google Chrome Criteria Checker","offer_product":"Google Chrome","distributor":"AnyDesk","distributor_product":"AnyDesk","user_country":"Switzerland"}} Data Raw: Data Ascii:
Sep 20, 2024 12:47:29.851965904 CEST	622	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 0 Connection: keep-alive Date: Fri, 20 Sep 2024 10:47:29 GMT X-Amzn-Trace-Id: Root=1-66ed52c1-753e2d323bae5228722db12a;Parent=08b4cd3c4f9e43eb;Sampled=0;Lineage=1:d7502c8f:0 x-amzn-RequestId: 09794cdc-4f6a-41da-b2e4-d8e602941aaa x-amz-apigw-id: eZneTEBZoAMEkqQ= X-Amz-Cf-Pop: FRA56-P3 Via: 1.1 7abd55cee48606340f570b45718202b6.cloudfront.net (CloudFront), 1.1 21c2c1b3872c539a34b64bcf45f4054c.cloudfront.net (CloudFront) X-Cache: Miss from cloudfront X-Amz-Cf-Pop: FRA56-P2 X-Amz-Cf-Id: 4THu1e6Z8_yslwAAlYnt2OnvMEf5aPXUCGW_r4_od1IDfPVM17XFNA==

Target ID:	0
Start time:	06:47:12
Start date:	20/09/2024
Path:	C:\Users\user\Desktop\_AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\_AnyDesk.exe"
Imagebase:	0xe30000
File size:	4'993'864 bytes
MD5 hash:	ECAE8B9C820CE255108F6050C26C37A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	06:47:14
Start date:	20/09/2024
Path:	C:\Users\user\Desktop\_AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\_AnyDesk.exe" --local-service
Imagebase:	0xe30000
File size:	4'993'864 bytes
MD5 hash:	ECAE8B9C820CE255108F6050C26C37A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	06:47:14
Start date:	20/09/2024
Path:	C:\Users\user\Desktop\_AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\_AnyDesk.exe" --local-control
Imagebase:	0xe30000
File size:	4'993'864 bytes
MD5 hash:	ECAE8B9C820CE255108F6050C26C37A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	26.4%
Signature Coverage:	5.9%
Total number of Nodes:	303
Total number of Limit Nodes:	28

Executed Functions

Function 0142EE40 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 487
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

kernel32.dll, xrefs: 0142EF2C

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID:
String ID: kernel32.dll
API String ID: 0-1793498882
Opcode ID: 01c24dce5f4a42cd0cd7cbedd935d93c93901f9909544a8b644c388b8ec62c03
Instruction ID: e3a43cdd0ce1cf87674caa92321c274582dddb2761b07f43f7e0788f50ebbbb4
Opcode Fuzzy Hash: 01c24dce5f4a42cd0cd7cbedd935d93c93901f9909544a8b644c388b8ec62c03
Instruction Fuzzy Hash: 191276716043118FD724CF18C880B6BB7F1FB89314F94856EE9998B352E731E889CB91

Function 01601481 Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 016014E9

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001601000.00000020.00000001.01000000.00000003.sdmp, Offset: 01601000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1601000__AnyDesk.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 23621a98c46fd09a29565ea85817f235a31cf06355310baa753e5ab0ef4c4774
Instruction ID: 2cc2d9029cd2ce90fdeb167f08f2c14b165828f240b44209b7edc7d1689571ad
Opcode Fuzzy Hash: 23621a98c46fd09a29565ea85817f235a31cf06355310baa753e5ab0ef4c4774
Instruction Fuzzy Hash: D601243020220BBAFB279A69EC15F5B7BB8BF02718F258418E601E51D0EB60D641C744

Function 6C39F787 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 68
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNEL32(80000002,Software\Google\GCAPITemp,00000000,00000000,00000000,0002021F,00000000,?,?,?,00000000,00000000), ref: 6C39F7CB
lstrlenW.KERNEL32(?,?,00000000,00000000), ref: 6C39F7D9
RegSetValueExW.KERNEL32(?,?,00000000,00000001,?,00000000,?,00000000,00000000), ref: 6C39F7EB
RegDeleteValueW.KERNEL32(?,?,?,00000000,00000000), ref: 6C39F7FE
RegCloseKey.ADVAPI32(?,?,00000000,00000000), ref: 6C39F807
RegDeleteKeyW.ADVAPI32(80000002,Software\Google\GCAPITemp), ref: 6C39F815

Strings

test, xrefs: 6C39F79A
Software\Google\GCAPITemp, xrefs: 6C39F7BF, 6C39F7C9, 6C39F813

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: DeleteValue$CloseCreatelstrlen
String ID: Software\Google\GCAPITemp$test
API String ID: 495649648-3707622476
Opcode ID: 5e25e56db1d950704158b3a84d351a2052fb3f9d61cd8f585c99e7fbed97de81
Instruction ID: 9b19a90a719ea6417c8e0b9091a810dd579b34f1baa340e9d3f77b99d65dc077
Opcode Fuzzy Hash: 5e25e56db1d950704158b3a84d351a2052fb3f9d61cd8f585c99e7fbed97de81
Instruction Fuzzy Hash: 05113476A01219AFDB00DF969C89DFFBBBDFB0A345B54002AF500A2100D6324E088BB0

Function 6C380AF4 Relevance: 9.1, APIs: 6, Instructions: 93
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6C380B31
dllmain_crt_dispatch.LIBCMT ref: 6C380B48
dllmain_crt_dispatch.LIBCMT ref: 6C380B8D
dllmain_raw.LIBCMT ref: 6C380B97
dllmain_crt_dispatch.LIBCMT ref: 6C380BBE
dllmain_raw.LIBCMT ref: 6C380BD1

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: dllmain_crt_dispatchdllmain_raw
String ID:
API String ID: 1382799047-0
Opcode ID: cbc9ef201b73b2cd54209117a3a0612d5300197975d05a2014d979fb70227422
Instruction ID: 7f6ccc0d5360a2317fc6f388e3ff0f833614ff2d8e2124e5a46ea8142d5456f8
Opcode Fuzzy Hash: cbc9ef201b73b2cd54209117a3a0612d5300197975d05a2014d979fb70227422
Instruction Fuzzy Hash: B821CE32D03795ABDB22AE658D409AF3A39AB45B1CB150A08F8652BA10C736C5108FE1

Function 6C385598 Relevance: 4.6, APIs: 3, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23c8e736f7ed008922f6cafa4d3229f2c97062328f452cf22268ec4a9ad2c3c0
Instruction ID: ca79690dc9822255922db60d47e104be22e71c4cac2a0bd6bdaf9545577a0a2d
Opcode Fuzzy Hash: 23c8e736f7ed008922f6cafa4d3229f2c97062328f452cf22268ec4a9ad2c3c0
Instruction Fuzzy Hash: 8011D670F873039AFE0016645C05BC6356C9F2176CF541525FA529DEC0EBA5890C8F97

Function 01637F2C Relevance: 3.1, APIs: 2, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___TypeMatch.LIBCMT ref: 01637F39
IsInExceptionSpec.LIBCMT ref: 01637FDD

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001637000.00000020.00000001.01000000.00000003.sdmp, Offset: 01637000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1637000__AnyDesk.jbxd

Similarity

API ID: ExceptionMatchSpecType
String ID:
API String ID: 4234207746-0
Opcode ID: 1425275a6719bfaa05b94ff7a6e1b03c3015c8e6d99aa0c85529b95c3870a56f
Instruction ID: 7974ec57b1c0cf8715e346b7d731c4f718113bababc374d638ff43a5854efe57
Opcode Fuzzy Hash: 1425275a6719bfaa05b94ff7a6e1b03c3015c8e6d99aa0c85529b95c3870a56f
Instruction Fuzzy Hash: 2F31F7B680064AAFDF11DF98C880AAEBBB5FF98314F144159E920B7311D331AA55CFA5

Function 6C368A90 Relevance: 3.0, APIs: 2, Instructions: 46
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

new.LIBCMT ref: 6C368AC0
GetCommandLineW.KERNEL32(00000000,?,?,?,?,?,6C37EF5E,00000000,00000000,00000000), ref: 6C368AD6

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: CommandLine
String ID:
API String ID: 3253501508-0
Opcode ID: f2c768916f235bc9918aa5099fcb606157ade24e885b6bf3c4fad7059473aa08
Instruction ID: dcdfc27906a23b09f794062508c60a8a8d83049f253f68e7fdd3284ed6e8c78d
Opcode Fuzzy Hash: f2c768916f235bc9918aa5099fcb606157ade24e885b6bf3c4fad7059473aa08
Instruction Fuzzy Hash: 3801B175A043019BCA00EF75C845BAB77B8AB9A204F004519E8AA87B90DF309818CFD7

Function 01637B92 Relevance: 3.0, APIs: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___BuildCatchObject.LIBCMT ref: 01637BAE

Part of subcall function 01637B09: ___BuildCatchObjectHelper.LIBCMT ref: 01637B3F

___FrameUnwindToState.LIBCMT ref: 01637BD3

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001637000.00000020.00000001.01000000.00000003.sdmp, Offset: 01637000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1637000__AnyDesk.jbxd

Similarity

API ID: BuildCatchObject$FrameHelperStateUnwind
String ID:
API String ID: 447491975-0
Opcode ID: 637ca4be3a068003d4b9e82dab8ad509b5359c1087b32336b4d929cb59bffcf1
Instruction ID: 85ca57dd1ab117cb0191a62fedeff92780db2ee48df27b0d7eb85a20166c05fd
Opcode Fuzzy Hash: 637ca4be3a068003d4b9e82dab8ad509b5359c1087b32336b4d929cb59bffcf1
Instruction Fuzzy Hash: 240146B140010ABBDF16AF55CC44EEA7F6AEF98350F108018FE1919260DB72D9B2DBA5

Function 01637B9B Relevance: 3.0, APIs: 2, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___BuildCatchObject.LIBCMT ref: 01637BAE

Part of subcall function 01637B09: ___BuildCatchObjectHelper.LIBCMT ref: 01637B3F

___FrameUnwindToState.LIBCMT ref: 01637BD3

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001637000.00000020.00000001.01000000.00000003.sdmp, Offset: 01637000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1637000__AnyDesk.jbxd

Similarity

API ID: BuildCatchObject$FrameHelperStateUnwind
String ID:
API String ID: 447491975-0
Opcode ID: 49b0479126507bf512c958381cfe1e2a5c13a09915cae28b875b13ef6b0f9fab
Instruction ID: 147f66f50218924779ccabbdd83b65c3db47c564295c91ac89885feefe9637c7
Opcode Fuzzy Hash: 49b0479126507bf512c958381cfe1e2a5c13a09915cae28b875b13ef6b0f9fab
Instruction Fuzzy Hash: 290142B140010ABBDF16AF51CC44EEA3F6AEF98390F108018FE1915220DB72D9B2DBA4

Function 6C3740D0 Relevance: 3.0, APIs: 2, Instructions: 39
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(00020219,?,00000000,?,?), ref: 6C3740FD
RegCloseKey.ADVAPI32 ref: 6C374110

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: 3d2dd1a6849f763dc75799a7ae192a81b9e3a75c783c4f26e3754ffde925d8dc
Instruction ID: 52ca2d7658d5917ff3a586c7733e9df9e63314f8830550ae49e30d03319a2daf
Opcode Fuzzy Hash: 3d2dd1a6849f763dc75799a7ae192a81b9e3a75c783c4f26e3754ffde925d8dc
Instruction Fuzzy Hash: CEF08C72205305AFD7208F4AC844B5BFBE8FB98321F10852EF9A8C3240D771A814CFA4

Function 013A6E40 Relevance: 1.6, APIs: 1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessId.KERNEL32(00000000,?), ref: 013A6F4E

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013A6000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13a6000__AnyDesk.jbxd

Similarity

API ID: Process
String ID:
API String ID: 1235230986-0
Opcode ID: b534e85f8707b891db63e48109b23ecd5e48487dd7d97d4aa0f5dc549f97ff53
Instruction ID: b71aa24a435009af14bec6ed95737526ae0753c5069d2b983e4ec3d789742f77
Opcode Fuzzy Hash: b534e85f8707b891db63e48109b23ecd5e48487dd7d97d4aa0f5dc549f97ff53
Instruction Fuzzy Hash: C4512AB14083429FC710EF69C884A6BBBF8FF98704F445A2DF99593251E775E508CBA2

Function 01422200 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetExitCodeProcess.KERNEL32(00000000,?), ref: 0142231F

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: 79b83ec2e00965e11e1a23bdebfbb6f93ff476d9c9caec60b4c2e28cbfddc642
Instruction ID: 138698e78f2a3777842d9128411602b7c5ad0ed6080a23bbead39fce2ee34313
Opcode Fuzzy Hash: 79b83ec2e00965e11e1a23bdebfbb6f93ff476d9c9caec60b4c2e28cbfddc642
Instruction Fuzzy Hash: 6341D2712083019BD760DF29DC44F9B7BD8FB95768F440B1EF894922A0E7B8D5488B62

Function 013C1CE0 Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessId.KERNEL32(00000000,?), ref: 013C1D12

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013AC000.00000020.00000001.01000000.00000003.sdmp, Offset: 013AC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13ac000__AnyDesk.jbxd

Similarity

API ID: Process
String ID:
API String ID: 1235230986-0
Opcode ID: 4d7da6063a0598a1928c78d6fb32e289a9bd39bce0172d7dfa7e3d432c6b1beb
Instruction ID: f329632883eb29438a2acd397840d07565df7a7596306a1af2e35ffd8f732f96
Opcode Fuzzy Hash: 4d7da6063a0598a1928c78d6fb32e289a9bd39bce0172d7dfa7e3d432c6b1beb
Instruction Fuzzy Hash: 9D317C71604702CFC714DF6CD985A2ABBE4BF88614F448A6DE16AC7391CB30ED04CB92

Function 015EF649 Relevance: 1.6, APIs: 1, Instructions: 68
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000015EF000.00000020.00000001.01000000.00000003.sdmp, Offset: 015EF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15ef000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32c77d6f8a5e0397854b743918d229db7178a6a35010af309c6fc4aefccf6958
Instruction ID: 015d08957102657b9fcaa21e3e3062784c8102ed5e32ed7a11f4eaec41cb8d7f
Opcode Fuzzy Hash: 32c77d6f8a5e0397854b743918d229db7178a6a35010af309c6fc4aefccf6958
Instruction Fuzzy Hash: EE115472C04517ABCB296F78EC0C65D3BE5BB952A0F24452BE998DE1B0EF31C4508F65

Function 6C37EF28 Relevance: 1.5, APIs: 1, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

new.LIBCMT ref: 6C37EF37

Part of subcall function 6C367AB0: new.LIBCMT ref: 6C367AF2

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8bf8d0206eb7ba5af4f46071801a65ade334105028541a10532631db3a272d9
Instruction ID: 02bea29dcfc2a186fff5faff0af95b7aabaebb05f0cab5babfb8ce71e5badf13
Opcode Fuzzy Hash: b8bf8d0206eb7ba5af4f46071801a65ade334105028541a10532631db3a272d9
Instruction Fuzzy Hash: FC01A7329193149EDB209A7294187DE377CAB1272DF01451AD86097F88DF3995088FFB

Function 6C38B8F3 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00000000,00000000,?,6C38FCCF,00000001,00000364,?,?,6C386175,00000000,00000000,00000000,00000000,00000000,0000010C), ref: 6C38B934

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 97d9dd6a2fd30bf871231c57cb089255e532a78649057782d00a91eaa03cfa15
Instruction ID: 881ec5d4804f1a3092d99566be44c56d2bedb29bbe8c4768dcfc7ceb8d7f1ad0
Opcode Fuzzy Hash: 97d9dd6a2fd30bf871231c57cb089255e532a78649057782d00a91eaa03cfa15
Instruction Fuzzy Hash: EAF0E93164362B67EB125E678C01B9B3B5C9F4177CB114151E864EFD90CB21D9008EF1

Function 6C374140 Relevance: 1.5, APIs: 1, Instructions: 14registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(80000002,00020219,00000000,00000000,00000000,00000000,?,6C39F4D8,6C3B63E8,?,Software\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96},00020219,7FFFFFFF,80000002), ref: 6C374150

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: dd78c5f398a4a27fd6032fca6ba1b1c0a7dc2c2bdebf0962a8dca3631818589f
Instruction ID: b60f2c103f504aac0f3043bcc5e89c5868d9dd7ef314e16d4075ccf39c39ac2b
Opcode Fuzzy Hash: dd78c5f398a4a27fd6032fca6ba1b1c0a7dc2c2bdebf0962a8dca3631818589f
Instruction Fuzzy Hash: 1DC08C323D43087BEA205AB1DC03F543A6CE722F01F300020B306AC0E0C1A370209A4C

Function 015F13E7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

__aligned_offset_malloc.LIBCMT ref: 015F13F4

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000015EF000.00000020.00000001.01000000.00000003.sdmp, Offset: 015EF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15ef000__AnyDesk.jbxd

Similarity

API ID: __aligned_offset_malloc
String ID:
API String ID: 1921993648-0
Opcode ID: 835a7a903867007c7053a53e93d0ff0f0a961907bcdf9ad5a93014ec2faf4c88
Instruction ID: bfc9e1981fb1bd50cfcbdd1506c6471720b8153f77d6567d3eca6346ab18888d
Opcode Fuzzy Hash: 835a7a903867007c7053a53e93d0ff0f0a961907bcdf9ad5a93014ec2faf4c88
Instruction Fuzzy Hash: 84C09B3244010D77DF111985DC01F453F19D7D0660F144010FA1C0D5A09573A5619985

Function 015EF7B2 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 015EF7BF

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000015EF000.00000020.00000001.01000000.00000003.sdmp, Offset: 015EF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15ef000__AnyDesk.jbxd

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction ID: e26ade09a969273d55df41151ac18eff613eaf8bb5cba363ffcf9c9fa6cc3297
Opcode Fuzzy Hash: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction Fuzzy Hash: 08C09B7344010D77CF111D52DC05E463F5997D0760F144011FB1C1D1709973D5619585

Function 013AD8F0 Relevance: 1.3, APIs: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00000021,00003000,00000040,?,?,0163B418,000000FF,013AD549,?,?,Function_00001760), ref: 013AD93F

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013AC000.00000020.00000001.01000000.00000003.sdmp, Offset: 013AC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13ac000__AnyDesk.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c872bef0cd28e85af5531fcd9203ac39e1f21c9472ff7a801e95981542926ed9
Instruction ID: 62986902eaa9197f441f3e4158c2ede0982dbf6a4acabd5997f808e7282e531a
Opcode Fuzzy Hash: c872bef0cd28e85af5531fcd9203ac39e1f21c9472ff7a801e95981542926ed9
Instruction Fuzzy Hash: 741157B5A44701EFD320DF48DC49F16BBE8EB54B18F00891DF8A697781E7B8A8548B91

Function 01525D90 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b02ea62cb42c1324ef121da225109f80a248af837b05794af9d53c1da94ccfa
Instruction ID: 249cac011c482e775d8f43ca8d3e93aaff0a5a5687c32037ee9dc46a6f608b1c
Opcode Fuzzy Hash: 2b02ea62cb42c1324ef121da225109f80a248af837b05794af9d53c1da94ccfa
Instruction Fuzzy Hash: 1641B772A1011A9FDB10DF99DC56BFEB7B5FF95310F04406AEA05EF280EA30A905C7A1

Function 01504750 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbdeab533010f57f114e26f6068c2813822387a812ed266e2948199bc01b2d75
Instruction ID: 8262289b2f3769e8c6487286c55d46872be20cd07c66505a5536a858b5b89cf1
Opcode Fuzzy Hash: cbdeab533010f57f114e26f6068c2813822387a812ed266e2948199bc01b2d75
Instruction Fuzzy Hash: 0C2105722102062BE7226AE99C84F7F366CFFD2651F48081CF7049A180EB65E912CBB5

Function 015ECCDA Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000015DD000.00000020.00000001.01000000.00000003.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15dd000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 668c055715006ec0ff995fa41e5412b8cf1b3394c6dce6161b5de91237aabd77
Instruction ID: 56ac6506e8e93a41dbb1c590073e377de56e7a747c0d53c2240e92fa6c665d85
Opcode Fuzzy Hash: 668c055715006ec0ff995fa41e5412b8cf1b3394c6dce6161b5de91237aabd77
Instruction Fuzzy Hash: 26012B75D0064FABCB28EA95ED099AD7FE9BB84350F00041DD5459E190EFB2C5418790

Non-executed Functions

Function 6C39FFEC Relevance: 25.7, APIs: 17, Instructions: 233comthreadCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 6C3A0024
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000002,00000000,00000040,00000000), ref: 6C3A0039
CoUninitialize.OLE32 ref: 6C3A02D1

Part of subcall function 6C39F4F1: GetCurrentProcess.KERNEL32(00000008,?), ref: 6C39F50F
Part of subcall function 6C39F4F1: OpenProcessToken.ADVAPI32(00000000), ref: 6C39F516
Part of subcall function 6C39F4F1: GetTokenInformation.ADVAPI32(?,00000012(TokenIntegrityLevel),?,00000004,00000000), ref: 6C39F53A
Part of subcall function 6C39F4F1: CloseHandle.KERNEL32(?), ref: 6C39F547

GetCurrentProcessId.KERNEL32(?), ref: 6C3A0064

Part of subcall function 6C39F383: OpenProcess.KERNEL32(00000400,00000001,?,00000000,00000000), ref: 6C39F396

GetShellWindow.USER32 ref: 6C3A0087
GetWindowThreadProcessId.USER32(00000000), ref: 6C3A008E
LocalFree.KERNEL32(?), ref: 6C3A00A2
OpenProcess.KERNEL32(00000440,00000001,?), ref: 6C3A00EA
OpenProcessToken.ADVAPI32(?,0000000A,?,00000000), ref: 6C3A0131
DuplicateTokenEx.ADVAPI32(?,0000000F,00000000,00000002,00000001,?), ref: 6C3A014E
ImpersonateLoggedOnUser.ADVAPI32(?), ref: 6C3A015E
CloseHandle.KERNEL32(?), ref: 6C3A018C
CloseHandle.KERNEL32(?), ref: 6C3A019C
LocalFree.KERNEL32(?), ref: 6C3A01AF
LocalFree.KERNEL32(?), ref: 6C3A01BB
CoCreateInstance.OLE32(6C3B65CC,00000000,00000004,6C3B65BC,?,?), ref: 6C3A01F0
RevertToSelf.ADVAPI32(00000001,00000000), ref: 6C3A02A7

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Process$OpenToken$CloseFreeHandleLocal$CurrentInitializeWindow$CreateDuplicateImpersonateInformationInstanceLoggedRevertSecuritySelfShellThreadUninitializeUser
String ID:
API String ID: 1086148846-0
Opcode ID: 059802f87ad94bfa74e56e778567b3dbbdd71f8687e08a889dcb6eda28b0da44
Instruction ID: 5b236be0a505fb0cf14292fcc340d0f431069da49e9a0aec274eb50267c59bc1
Opcode Fuzzy Hash: 059802f87ad94bfa74e56e778567b3dbbdd71f8687e08a889dcb6eda28b0da44
Instruction Fuzzy Hash: E7815E71A01219AFEF20DFA1DC84FEEB779FF05208F1040A9E55AA6681DF359959CF20

Function 6C37B6C0 Relevance: 25.0, APIs: 13, Strings: 1, Instructions: 504COMMON

Download Yara Rule

APIs

Part of subcall function 6C37D530: new.LIBCMT ref: 6C37D54D

new.LIBCMT ref: 6C37B811
SetHandleInformation.KERNEL32(00000000,00000001,00000001), ref: 6C37B8AA

Part of subcall function 6C37B5D0: GetCurrentProcess.KERNEL32(00000001,?,00000001), ref: 6C37B5F4

Part of subcall function 6C37FC31: std::invalid_argument::invalid_argument.LIBCONCRT ref: 6C37FC3D
Part of subcall function 6C37FC31: __CxxThrowException@8.LIBVCRUNTIME ref: 6C37FC4B

Strings

invalid vector<T> subscript, xrefs: 6C37BE32

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: CurrentException@8HandleInformationProcessThrowstd::invalid_argument::invalid_argument
String ID: invalid vector<T> subscript
API String ID: 2615769013-3016609489
Opcode ID: 62c8e3a09680569007f0bdb75b31ce7a41bd0a185af35160a6cb0d12b3538f6e
Instruction ID: 5da2d3ff24043440c34b902e095ba3b373093970aa97163ff6fdc74f9ca634e6
Opcode Fuzzy Hash: 62c8e3a09680569007f0bdb75b31ce7a41bd0a185af35160a6cb0d12b3538f6e
Instruction Fuzzy Hash: AB1227716083809FD720DF25C854B9BB7F4BF85318F14491CE4A99BA90DB39E908CFA6

Function 6C372A20 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 172libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000), ref: 6C372A4E
GetModuleHandleW.KERNEL32(kernel32.dll,IsWow64Process), ref: 6C372A64
GetProcAddress.KERNEL32(00000000), ref: 6C372A6B
GetVersionExW.KERNEL32(0000011C), ref: 6C372AE0
GetNativeSystemInfo.KERNEL32(?), ref: 6C372B3C

Strings

kernel32.dll, xrefs: 6C372A59, 6C372C1C
GetProductInfo, xrefs: 6C372C17
IsWow64Process, xrefs: 6C372A54

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: AddressCurrentHandleInfoModuleNativeProcProcessSystemVersion
String ID: GetProductInfo$IsWow64Process$kernel32.dll
API String ID: 1167739923-1263506661
Opcode ID: 618c303d19228d34f4d41bd7dcf6f6d7d4e316e0c02fc6e31a63dd62cbc47c1f
Instruction ID: 70277c564769b660b657de76671737686f5c7515d0207ab2166d43c0c815367e
Opcode Fuzzy Hash: 618c303d19228d34f4d41bd7dcf6f6d7d4e316e0c02fc6e31a63dd62cbc47c1f
Instruction Fuzzy Hash: 4B61B071A00619CBCB30DFA5C9487EAB7F4EF19304F10059EE48AD7A40DB7A9A94CF95

Function 013B6E10 Relevance: 15.7, Strings: 12, Instructions: 736COMMON

Download Yara Rule

Strings

Content-Type: text/plain, xrefs: 013B6FCB
Host: %s, xrefs: 013B6E60
-Version: %S, xrefs: 013B70C9
Content-Length: %u, xrefs: 013B7016
-Timestamp: %llu, xrefs: 013B72CE
POST /report HTTP/1.1, xrefs: 013B6E6B
/%S, xrefs: 013B6FB8
-Commit: %s, xrefs: 013B7149
-Checksum: %s, xrefs: 013B7249
-Branch: %s, xrefs: 013B71C9
-ReportID: %08x, xrefs: 013B7359
User-Agent: , xrefs: 013B6F1E

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013AC000.00000020.00000001.01000000.00000003.sdmp, Offset: 013AC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13ac000__AnyDesk.jbxd

Similarity

API ID:
String ID: -Branch: %s$-Checksum: %s$-Commit: %s$-ReportID: %08x$-Timestamp: %llu$-Version: %S$/%S$Content-Length: %u$Content-Type: text/plain$Host: %s$POST /report HTTP/1.1$User-Agent:
API String ID: 0-916006669
Opcode ID: c6767c1332fdc0204c79d22bfed61114cb7c6a16dabe88cdf2d0ff75e77c73ae
Instruction ID: 12c78a72e8d50a209844a07f30e28490f602a8fee7f8dabdb885ba464c60a090
Opcode Fuzzy Hash: c6767c1332fdc0204c79d22bfed61114cb7c6a16dabe88cdf2d0ff75e77c73ae
Instruction Fuzzy Hash: DC428D706086858FC739DF2894A4BEBBBE7EBC9300F44896DE5CACB251E7715849C781

Function 6C392301 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 461COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 6C392820
_free.LIBCMT ref: 6C392891
_free.LIBCMT ref: 6C3928AA
_free.LIBCMT ref: 6C3928DC
_free.LIBCMT ref: 6C3928E5
_free.LIBCMT ref: 6C3928F1

Strings

C, xrefs: 6C3926DE

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: _free$_memcmp
String ID: C
API String ID: 789029625-1037565863
Opcode ID: 0aa4e6a420b2751be31c890c69cd38aebb286f0a20d317117d35263554c8c26c
Instruction ID: f81e0a4a4fed71a7e6cada5daf34d22347ec12cd5e05d85a62d22574447e5994
Opcode Fuzzy Hash: 0aa4e6a420b2751be31c890c69cd38aebb286f0a20d317117d35263554c8c26c
Instruction Fuzzy Hash: B9029F75A05A199BDB24DF18CD98BD9B3B4FF09308F1441AAD849A7B50F732AE84CF41

Function 6C398517 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6C39865D

Strings

1#SNAN, xrefs: 6C39985C
1#QNAN, xrefs: 6C399863
1#IND, xrefs: 6C399855
1#INF, xrefs: 6C39986A

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: c00a268994de59194811deecaa7035dcd1cb6658a2e54d41e0cd1b8c0598e2e3
Instruction ID: 2eb519dfd1a2c1a0df75d9e660b4e7b4785335fc012627e792a52f8d69138388
Opcode Fuzzy Hash: c00a268994de59194811deecaa7035dcd1cb6658a2e54d41e0cd1b8c0598e2e3
Instruction Fuzzy Hash: 77C28E72E096288FDB25CE28DD407DAB3B9FB85308F1441EAD45DE7640E779AE818F41

Function 6C375D10 Relevance: 10.0, APIs: 4, Strings: 1, Instructions: 1234COMMON

Download Yara Rule

Strings

inity, xrefs: 6C3760FA

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID: inity
API String ID: 0-2893408212
Opcode ID: 043001b046d20a73a50a817f0805114c5cba27553fda5a871ddcf391c7ed45cf
Instruction ID: f4980d1c7f0eac5df0d166afe3469b14fcc71931491562b58b6425b7747ff503
Opcode Fuzzy Hash: 043001b046d20a73a50a817f0805114c5cba27553fda5a871ddcf391c7ed45cf
Instruction Fuzzy Hash: B5C29971A08B428BC325CF28C4A035BB7F5BFCA358F148A1EE49997A50DB39D445CF96

Function 6C39B452 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 6C39B4EB
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 6C39B514
GetACP.KERNEL32 ref: 6C39B529

Strings

ACP, xrefs: 6C39B470
OCP, xrefs: 6C39B4A6

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 3f2e53945c8b42e14892c8d9a9a408024a5359f2588e5381401227bb5f38bd4b
Instruction ID: 1dcbcdbf216113099a074298ad8e53eb3e91d0b54985e3d826a96c3d75afff90
Opcode Fuzzy Hash: 3f2e53945c8b42e14892c8d9a9a408024a5359f2588e5381401227bb5f38bd4b
Instruction Fuzzy Hash: 7221D032649104AAE7308F59D901B9773BAEB44F6CB5A8564E90ADFA00F733DD40DF90

Function 6C39B626 Relevance: 7.7, APIs: 5, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 6C38FBB0: GetLastError.KERNEL32(00000008,6C361DE7,6C38EBE2,6C385DC7), ref: 6C38FBB4
Part of subcall function 6C38FBB0: _free.LIBCMT ref: 6C38FBE7
Part of subcall function 6C38FBB0: SetLastError.KERNEL32(00000000,00000008,6C361DE7), ref: 6C38FC28
Part of subcall function 6C38FBB0: _abort.LIBCMT ref: 6C38FC2E

Part of subcall function 6C38FBB0: _free.LIBCMT ref: 6C38FC0F
Part of subcall function 6C38FBB0: SetLastError.KERNEL32(00000000,00000008,6C361DE7), ref: 6C38FC1C

GetUserDefaultLCID.KERNEL32 ref: 6C39B732
IsValidCodePage.KERNEL32(00000000), ref: 6C39B78D
IsValidLocale.KERNEL32(?,00000001), ref: 6C39B79C
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 6C39B7E4
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 6C39B803

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID:
API String ID: 745075371-0
Opcode ID: 783971262cfc2d40b0e91a27742ada23c911ed652b27c55ab5ba32fbd3834721
Instruction ID: 1c3bd91e8d388b8f1431974321fd30898baa65a5735e7e6902b4b56a829f03a7
Opcode Fuzzy Hash: 783971262cfc2d40b0e91a27742ada23c911ed652b27c55ab5ba32fbd3834721
Instruction Fuzzy Hash: 80515072A01205ABEF20DFA5CC84AFE73B9AF05708F104569E954EB640F771D9448F61

Function 6C39057E Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,6C3AF9F4), ref: 6C3905E8
WideCharToMultiByte.KERNEL32(00000000,00000000,6C3BEC4C,000000FF,00000000,0000003F,00000000,?,?), ref: 6C390660
WideCharToMultiByte.KERNEL32(00000000,00000000,6C3BECA0,000000FF,?,0000003F,00000000,?), ref: 6C39068D
_free.LIBCMT ref: 6C3905D6

Part of subcall function 6C38CBA5: HeapFree.KERNEL32(00000000,00000000,?,6C39A020,00000000,00000000,00000000,00000000,?,6C39A2C4,00000000,00000007,00000000,?,6C398081,00000000), ref: 6C38CBBB
Part of subcall function 6C38CBA5: GetLastError.KERNEL32(00000000,?,6C39A020,00000000,00000000,00000000,00000000,?,6C39A2C4,00000000,00000007,00000000,?,6C398081,00000000,00000000), ref: 6C38CBCD

_free.LIBCMT ref: 6C3907A2

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: ab62d62600ae25f7769400fa6991409ee8ba0e6ef03e18eb46bb2bdc89decc4c
Instruction ID: 21005a20249d656a1560f7fc82a10c787156f6c7000af14b735899fdc46bfae7
Opcode Fuzzy Hash: ab62d62600ae25f7769400fa6991409ee8ba0e6ef03e18eb46bb2bdc89decc4c
Instruction Fuzzy Hash: C051EC72901249EFDB00EF6DCC409AE7BBCEF89318B10426AE594E7640FB319945CF95

Function 6C3629A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 132windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00001200,00000000,?,00000000,?,00000100,00000000,?,?), ref: 6C3629D1
GetLastError.KERNEL32(?,?,00000000,?,00000100,00000000,?,?), ref: 6C362B45

Strings

Error (0x%X) while retrieving error. (0x%X), xrefs: 6C362B4C
(0x%X), xrefs: 6C362A48

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID: (0x%X)$Error (0x%X) while retrieving error. (0x%X)
API String ID: 3479602957-3758316108
Opcode ID: 7bcbea100c79d7c1fcb130c8aec2235a11a07ba86c4b27c9f4cf12c77dddaf21
Instruction ID: 35cc2188ec8117b2ba83f98b4c4b771fc17389271c162ac69a3d70363988d6bd
Opcode Fuzzy Hash: 7bcbea100c79d7c1fcb130c8aec2235a11a07ba86c4b27c9f4cf12c77dddaf21
Instruction Fuzzy Hash: DA41E731A001189FDB25CF55CC44FEE7779EB49308F1002D9E499A6A85CFB15E88CF91

Function 6C39B0D9 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 6C38FBB0: GetLastError.KERNEL32(00000008,6C361DE7,6C38EBE2,6C385DC7), ref: 6C38FBB4
Part of subcall function 6C38FBB0: _free.LIBCMT ref: 6C38FBE7
Part of subcall function 6C38FBB0: SetLastError.KERNEL32(00000000,00000008,6C361DE7), ref: 6C38FC28
Part of subcall function 6C38FBB0: _abort.LIBCMT ref: 6C38FC2E

Part of subcall function 6C38FBB0: _free.LIBCMT ref: 6C38FC0F
Part of subcall function 6C38FBB0: SetLastError.KERNEL32(00000000,00000008,6C361DE7), ref: 6C38FC1C

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6C39B12D
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6C39B17E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6C39B23E

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorInfoLastLocale$_free$_abort
String ID:
API String ID: 2829624132-0
Opcode ID: 6d67313208c24cfbe6112f6e4b37aa97dbafbe7b372ea5dde91c5f80e6f3dbd8
Instruction ID: 917084f0f30637d34be66bd48b3956897d0429ff80b60b36072d196850380303
Opcode Fuzzy Hash: 6d67313208c24cfbe6112f6e4b37aa97dbafbe7b372ea5dde91c5f80e6f3dbd8
Instruction Fuzzy Hash: B461BF715442079FEB288F29CC81BAA77B8EF0430CF1041A9ED55CAA84FB76E955CF91

Function 6C385F8C Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 6C386084
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 6C38608E
UnhandledExceptionFilter.KERNEL32(-00000328,?,?,?,?,?,00000000), ref: 6C38609B

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 6bbb820dc321ae1c4b166494f224dc8bec528b8da4f403d9721def3019cda9fb
Instruction ID: a877ab758d7e2ea8c88f6e4ce99dddc2cc993a709506b4906d27ccc4aba9efaf
Opcode Fuzzy Hash: 6bbb820dc321ae1c4b166494f224dc8bec528b8da4f403d9721def3019cda9fb
Instruction Fuzzy Hash: DD31D6B594221CDBCB21DF65D988BCCBBB8BF08314F5042DAE81CA7250E7319B858F45

Function 6C37D200 Relevance: 4.6, APIs: 3, Instructions: 78COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32 ref: 6C37D21F
GetLocaleInfoW.KERNEL32(?,00000059,?,00000009), ref: 6C37D23D
GetLocaleInfoW.KERNEL32(?,0000005A,?,00000009,?,-00000001,?,00000059,?,00000009), ref: 6C37D284

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: InfoLocale$DefaultLanguageUser
String ID:
API String ID: 1606347679-0
Opcode ID: 78f5e7f5a8139f34a5d6ec64ecf234d04d1fc3c0a73355f9709630ee143d679c
Instruction ID: 9c86e1213b6214752eff30ccc0d3109706639fd79c2678331834ce39f518dafd
Opcode Fuzzy Hash: 78f5e7f5a8139f34a5d6ec64ecf234d04d1fc3c0a73355f9709630ee143d679c
Instruction Fuzzy Hash: 8E21C331B012089FDB20EFA5D845BEFB7BCEB45305F40012AE506D7680C735D80A8FA5

Function 6C39F711 Relevance: 4.5, APIs: 3, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 6C39F744
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 6C39F759
FreeSid.ADVAPI32(?), ref: 6C39F769

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 499162108acebb06daeb552c00522dd03b2f80725a11b1dc7a9a88bdaf585099
Instruction ID: 7dcdf9de6ff546cd3f82efdedabc2ee2f196548d1085d2fd104d4325fd9b4f27
Opcode Fuzzy Hash: 499162108acebb06daeb552c00522dd03b2f80725a11b1dc7a9a88bdaf585099
Instruction Fuzzy Hash: EC012871A1020EAFDF00DFE0CD89ABEB7BCFB08205F504569A911E6180E7359A048B61

Function 6C3A2CE9 Relevance: 4.5, APIs: 3, Instructions: 40COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(?,?,?,6C3A2BE3,?,00000000,?,?,6C3A2C6F,?,?,?), ref: 6C3A2CF2
LockResource.KERNEL32(00000000,00000A2F,?,6C3A2BE3,?,00000000,?,?,6C3A2C6F,?,?,?), ref: 6C3A2D00
SizeofResource.KERNEL32(?,?,?,6C3A2BE3,?,00000000,?,?,6C3A2C6F,?,?,?), ref: 6C3A2D12

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: 3b095fcf3106ebec471c52c677320ab57375b39aca0eb9cd99f440abfd414bc9
Instruction ID: 676fea17ed40b4d819c4090946342bf08304174e063d44771b9b6d2abd4f454d
Opcode Fuzzy Hash: 3b095fcf3106ebec471c52c677320ab57375b39aca0eb9cd99f440abfd414bc9
Instruction Fuzzy Hash: 93F0C836A01225ABCF211FEADA0849A7BB9EB053557004D26FC6DD7414D733D8729FD0

Function 6C389E6A Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(6C361DE7,?,6C389E40,6C361DE7,6C3BB670,0000000C,6C389F88,6C361DE7,00000002,00000000,?,6C385DF9,00000003,?,6C37FA3A,6C37FA7E), ref: 6C389E8B
TerminateProcess.KERNEL32(00000000,?,6C389E40,6C361DE7,6C3BB670,0000000C,6C389F88,6C361DE7,00000002,00000000,?,6C385DF9,00000003,?,6C37FA3A,6C37FA7E), ref: 6C389E92
ExitProcess.KERNEL32 ref: 6C389EA4

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 8dd392e4d53280d8bac8cbaa2e8e84d6e9abf292fea34f1896425bc2173f83ea
Instruction ID: f8c74f61eb5192763ae774dcf4093e8c9cb6c6a98edc71db3ebe9416182e395a
Opcode Fuzzy Hash: 8dd392e4d53280d8bac8cbaa2e8e84d6e9abf292fea34f1896425bc2173f83ea
Instruction Fuzzy Hash: EBE0EC32102648AFCF01AFA5D908ADD3F7DEF45689F044414FC499B521CB3AE956DF90

Function 014C1E30 Relevance: 4.4, Strings: 3, Instructions: 609COMMON

Download Yara Rule

Strings

, xrefs: 014C1EC8
gfff, xrefs: 014C21D0
0, xrefs: 014C225C

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID:
String ID: $0$gfff
API String ID: 0-3930087101
Opcode ID: 55c0cd220a0f26c11070c35f255b02f329222b1cba60f7db92ad6896f81eba33
Instruction ID: e37f605c7ef86f7bdb7f741ff2d7835aed8031c88d58d2ca4b184d272ff15994
Opcode Fuzzy Hash: 55c0cd220a0f26c11070c35f255b02f329222b1cba60f7db92ad6896f81eba33
Instruction Fuzzy Hash: 962227B9A083029BD795DF29C540B5BBBE0BFD4F40F14492EE98593362E7B0D805CB92

Function 6C36A090 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 252COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6C36A345

Strings

vector<T> too long, xrefs: 6C36A340

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 909987262-3788999226
Opcode ID: 344ef34a4ad9a7686f2044515cfc9fd4e62e233dee4f047365bba83a404eeff0
Instruction ID: 3970e070ca30a5f193423bbaf4f7f5c3c63f267e3d86c8effac1a0eda4cc666e
Opcode Fuzzy Hash: 344ef34a4ad9a7686f2044515cfc9fd4e62e233dee4f047365bba83a404eeff0
Instruction Fuzzy Hash: 7B81C472A001189FCB08CF69C990ADEBBF6EF88304B14C159E8469F799DB31E915CF90

Function 6C38168B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A,?), ref: 6C3816A4

Strings

, xrefs: 6C381808

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-3916222277
Opcode ID: 81a90def6cf2a411a68a78b9248765c488a3a1bca14138cb650f06d6bbd3a536
Instruction ID: 7ef1ffdaf4b48405c5db468c9880db067cd84a00fb75c016dc99ebe74a012748
Opcode Fuzzy Hash: 81a90def6cf2a411a68a78b9248765c488a3a1bca14138cb650f06d6bbd3a536
Instruction Fuzzy Hash: 95513BB1A022098FEF04CF69C58279ABBF8FB49314F20856AE425E7684E375D440CF90

Function 6C396C6E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 6C396E01

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: a709cee0db1cf6fcc0ce4969df58a0739f1f1d062524db5958a7916b70852a2a
Instruction ID: 4c87b2569f8c72603beebd66bc542b361bf05f82451d46550d1dec51d8b056bf
Opcode Fuzzy Hash: a709cee0db1cf6fcc0ce4969df58a0739f1f1d062524db5958a7916b70852a2a
Instruction Fuzzy Hash: 973158B1901249AFCB148E79CC84EEB7BBDDF86308F1402A8F828D7650F6319D448FA0

Function 6C38AE20 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ddc88b868330ce88cbc43b3a6ab2eeea43af64c70ef626071db1f136410f2e4
Instruction ID: 554cbd16ac42478d4d3b5a6d1258c2da82d92674922c8159b5d2aca97b6f4c86
Opcode Fuzzy Hash: 6ddc88b868330ce88cbc43b3a6ab2eeea43af64c70ef626071db1f136410f2e4
Instruction Fuzzy Hash: 1D023D71E0121A9FDB14CFA9C89069EB7F5FF88318F254269D819EB780D731AA418F90

Function 6C39AD29 Relevance: 3.2, APIs: 2, Instructions: 192COMMON

Download Yara Rule

APIs

IsValidCodePage.KERNEL32(00000000), ref: 6C39ADD0

Part of subcall function 6C386183: IsProcessorFeaturePresent.KERNEL32(00000017,6C386155,0000010C,00000000,00000000,00000000,00000000,00000000,?,?,6C386175,00000000,00000000,00000000,00000000,00000000), ref: 6C386185
Part of subcall function 6C386183: GetCurrentProcess.KERNEL32(C0000417,00000000,0000010C,6C3722CA), ref: 6C3861A7
Part of subcall function 6C386183: TerminateProcess.KERNEL32(00000000), ref: 6C3861AE

Part of subcall function 6C38FBB0: GetLastError.KERNEL32(00000008,6C361DE7,6C38EBE2,6C385DC7), ref: 6C38FBB4
Part of subcall function 6C38FBB0: _free.LIBCMT ref: 6C38FBE7
Part of subcall function 6C38FBB0: SetLastError.KERNEL32(00000000,00000008,6C361DE7), ref: 6C38FC28
Part of subcall function 6C38FBB0: _abort.LIBCMT ref: 6C38FC2E

Part of subcall function 6C38FBB0: _free.LIBCMT ref: 6C38FC0F
Part of subcall function 6C38FBB0: SetLastError.KERNEL32(00000000,00000008,6C361DE7), ref: 6C38FC1C

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6C39AF11

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorLast$Process_free$CodeCurrentFeatureInfoLocalePagePresentProcessorTerminateValid_abort
String ID:
API String ID: 3156739809-0
Opcode ID: 04762afd77171fdd0611238a42cda4671136020cd3afbe43d0bf52203766a9bc
Instruction ID: 9378696b7ab0233634aa23638b14a6e5886b5e496b2b71cde046e5e13eb62144
Opcode Fuzzy Hash: 04762afd77171fdd0611238a42cda4671136020cd3afbe43d0bf52203766a9bc
Instruction Fuzzy Hash: 93510632E01205AAE714AA75CC51FF773ACEF09719F100629E955DBA80FB35E8048FA6

Function 6C372D20 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 6C372D80
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C372D92

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1518329722-0
Opcode ID: 10bdc686f56a659de770a5b5b31533259500ed4deb5a91230470469eb4aba062
Instruction ID: 66ac81a7429d45534546fa4a28ba908e7fe06185d2816bc2007bdcd00ac61312
Opcode Fuzzy Hash: 10bdc686f56a659de770a5b5b31533259500ed4deb5a91230470469eb4aba062
Instruction Fuzzy Hash: B401F2756043409FDB109F28C941B967BFCAB06324F208B18F9B48A2E0E73691208F87

Function 0152D7E0 Relevance: 1.8, Strings: 1, Instructions: 567COMMON

Download Yara Rule

Strings

!, xrefs: 0152DB98

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: b36dee44d3b7f4bf8a0b12692baaaa8e282191ead6047c6b179cc26c764012ca
Instruction ID: 87ed4d9967db6dc86ba1759f23f8e642a23b7c71c8e77b2c8f1a2e4f7da87335
Opcode Fuzzy Hash: b36dee44d3b7f4bf8a0b12692baaaa8e282191ead6047c6b179cc26c764012ca
Instruction Fuzzy Hash: 5F0225B260020A6BD700EF65DC80FAF77ADBBE5604F08452CF945DF385EA74E90587A2

Function 6C393093 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6C39308E,?,?,00000008,?,?,6C39CFB4,00000000), ref: 6C3932C0

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 50c8def82df5b5f2e4567d4d71d3e3e51bc4b9c82667a99be64fce44de52dd90
Instruction ID: 6e98905405a427752b0cbfabddbb0be18ec3257f59c4876c1c22491073b5179b
Opcode Fuzzy Hash: 50c8def82df5b5f2e4567d4d71d3e3e51bc4b9c82667a99be64fce44de52dd90
Instruction Fuzzy Hash: 0BB158B26106089FD745CF28C486B957BE0FF45368F258658E8E9CF6A1D736E982CF40

Function 0152DFC0 Relevance: 1.8, Strings: 1, Instructions: 512COMMON

Download Yara Rule

Strings

$, xrefs: 0152E351

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 0b215e3a6e0080ba039b2d490fb90d1421f742471e592e2fe2a62e57fc78c446
Instruction ID: e1be03977b53489e535eb91f952ebc3da54b320d2a900f04cdb312a81415a46e
Opcode Fuzzy Hash: 0b215e3a6e0080ba039b2d490fb90d1421f742471e592e2fe2a62e57fc78c446
Instruction Fuzzy Hash: 4102B1B6A083419BD724DB65DC82BAFB7E5FBD5304F04492DF9898B381E670E901CB52

Function 013B3160 Relevance: 1.7, Strings: 1, Instructions: 432COMMON

Download Yara Rule

Strings

yxxx, xrefs: 013B3213

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013AC000.00000020.00000001.01000000.00000003.sdmp, Offset: 013AC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13ac000__AnyDesk.jbxd

Similarity

API ID:
String ID: yxxx
API String ID: 0-3567846162
Opcode ID: 1b650839e5ec7de57ad79b589962ad7cb6efb8c47bcdb470d786b702fa73e45e
Instruction ID: b90d1895ec794349c53c42927c4335e6b668bd3daddab886084ae8ff9f676186
Opcode Fuzzy Hash: 1b650839e5ec7de57ad79b589962ad7cb6efb8c47bcdb470d786b702fa73e45e
Instruction Fuzzy Hash: C1D10A727082454BC308CE2CDCD169EB7D6FBD9218F08462DE59ACBB82E678E909C741

Function 6C39B329 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 6C38FBB0: GetLastError.KERNEL32(00000008,6C361DE7,6C38EBE2,6C385DC7), ref: 6C38FBB4
Part of subcall function 6C38FBB0: _free.LIBCMT ref: 6C38FBE7
Part of subcall function 6C38FBB0: SetLastError.KERNEL32(00000000,00000008,6C361DE7), ref: 6C38FC28
Part of subcall function 6C38FBB0: _abort.LIBCMT ref: 6C38FC2E

Part of subcall function 6C38FBB0: _free.LIBCMT ref: 6C38FC0F
Part of subcall function 6C38FBB0: SetLastError.KERNEL32(00000000,00000008,6C361DE7), ref: 6C38FC1C

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6C39B37D

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: 5fe5bb95a3d4690a4c2bbd10c048163379e38cb2947a0045e3a525d41f5a9550
Instruction ID: 9ad8945385891d1c927dada513e5f607f452c33baa4f681da68671b21ccd3747
Opcode Fuzzy Hash: 5fe5bb95a3d4690a4c2bbd10c048163379e38cb2947a0045e3a525d41f5a9550
Instruction Fuzzy Hash: D1218032515206ABDB24DE29DC81BAA73BCEF0531CF10016BED04DAA40FB75E949CF91

Function 015E14F0 Relevance: 1.6, Strings: 1, Instructions: 321COMMON

Download Yara Rule

Strings

(, xrefs: 015E1569

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000015DD000.00000020.00000001.01000000.00000003.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15dd000__AnyDesk.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 02d95ac0709b894e85ec1c47ee4022a60faa924566bc73b389cd65469d7b15cc
Instruction ID: 6123818fa46b0bdd427d7b492fb36f9b34f2bfd78a05c466569599e2e6959aeb
Opcode Fuzzy Hash: 02d95ac0709b894e85ec1c47ee4022a60faa924566bc73b389cd65469d7b15cc
Instruction Fuzzy Hash: 5AB115B1A083029BD314DF65CC84E5FBBE4BFA4704F48891DF5849B292E771E905C7A2

Function 6C39AEBD Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 6C38FBB0: GetLastError.KERNEL32(00000008,6C361DE7,6C38EBE2,6C385DC7), ref: 6C38FBB4
Part of subcall function 6C38FBB0: _free.LIBCMT ref: 6C38FBE7
Part of subcall function 6C38FBB0: SetLastError.KERNEL32(00000000,00000008,6C361DE7), ref: 6C38FC28
Part of subcall function 6C38FBB0: _abort.LIBCMT ref: 6C38FC2E

Part of subcall function 6C38FBB0: _free.LIBCMT ref: 6C38FC0F
Part of subcall function 6C38FBB0: SetLastError.KERNEL32(00000000,00000008,6C361DE7), ref: 6C38FC1C

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6C39AF11

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: 43e4742c08ea1b919c4cdb0677367c59356c78dd638d13244ab6e70360726a09
Instruction ID: 1d97c18fc609ad65e76ac67becbaf2e5761718dad6e73f442357d7a6f3ea0c60
Opcode Fuzzy Hash: 43e4742c08ea1b919c4cdb0677367c59356c78dd638d13244ab6e70360726a09
Instruction Fuzzy Hash: F0112973A05106ABDB149F28DC55AFA73FCEF05318B1042BAE906D7640FB35E9058FA0

Function 6C39AFB1 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 6C38FBB0: GetLastError.KERNEL32(00000008,6C361DE7,6C38EBE2,6C385DC7), ref: 6C38FBB4
Part of subcall function 6C38FBB0: _free.LIBCMT ref: 6C38FBE7
Part of subcall function 6C38FBB0: SetLastError.KERNEL32(00000000,00000008,6C361DE7), ref: 6C38FC28
Part of subcall function 6C38FBB0: _abort.LIBCMT ref: 6C38FC2E

EnumSystemLocalesW.KERNEL32(6C39B0D9,00000001), ref: 6C39B023

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: ea38f369e85d46b1589e8f55995641296dc40b37880b7069eef3ce58646f5023
Instruction ID: 034e4dffc7655d531d95dd03e817af800eff1a178b867f916e3a903c6a45548c
Opcode Fuzzy Hash: ea38f369e85d46b1589e8f55995641296dc40b37880b7069eef3ce58646f5023
Instruction Fuzzy Hash: DE11063B2043019FDB189F39C8A46AAB7A2FB8435CB18452DD5878BB40E3366442CB40

Function 6C39B559 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 6C38FBB0: GetLastError.KERNEL32(00000008,6C361DE7,6C38EBE2,6C385DC7), ref: 6C38FBB4
Part of subcall function 6C38FBB0: _free.LIBCMT ref: 6C38FBE7
Part of subcall function 6C38FBB0: SetLastError.KERNEL32(00000000,00000008,6C361DE7), ref: 6C38FC28
Part of subcall function 6C38FBB0: _abort.LIBCMT ref: 6C38FC2E

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,6C39B2F7,00000000,00000000,?), ref: 6C39B585

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorLast$InfoLocale_abort_free
String ID:
API String ID: 2692324296-0
Opcode ID: 8b714d6bd896e081a0c1e63077a1192963aff53bfc3f84237d03598d61e24b31
Instruction ID: e0117fa3d90bff33a7d802ec672bf588bfe4f302bccdbaf7979e25fd7ef4d9f8
Opcode Fuzzy Hash: 8b714d6bd896e081a0c1e63077a1192963aff53bfc3f84237d03598d61e24b31
Instruction Fuzzy Hash: 12F0F432A00219AFEB244A65C805BFB77A8EF4075CF144969EC55A7A80FA31FE05CED0

Function 6C39B04C Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 6C38FBB0: GetLastError.KERNEL32(00000008,6C361DE7,6C38EBE2,6C385DC7), ref: 6C38FBB4
Part of subcall function 6C38FBB0: _free.LIBCMT ref: 6C38FBE7
Part of subcall function 6C38FBB0: SetLastError.KERNEL32(00000000,00000008,6C361DE7), ref: 6C38FC28
Part of subcall function 6C38FBB0: _abort.LIBCMT ref: 6C38FC2E

EnumSystemLocalesW.KERNEL32(6C39B329,00000001), ref: 6C39B098

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 7d934412760325cc2968315583410d984aba316cafe86d7be484a682d208d5ba
Instruction ID: 4ee8cb2ec5d3df32d83258fd8e3a64803e6818180919b9c46a5ff6bda8718dcf
Opcode Fuzzy Hash: 7d934412760325cc2968315583410d984aba316cafe86d7be484a682d208d5ba
Instruction Fuzzy Hash: 0CF046323003059FD7245F3AD894AAA7BA5EF8036CF08462DE9818FB40E7729802CF40

Function 6C38EC36 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 6C38B688: EnterCriticalSection.KERNEL32(?,?,6C38B4E9,00000000,6C3BB718,0000000C,6C37F041,?,6C380906,?,?,6C371BDD,0000012C), ref: 6C38B697

EnumSystemLocalesW.KERNEL32(6C38EBF0,00000001,6C3BB8B8,0000000C), ref: 6C38EC6E

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 66c99777d5fcb25f59e611ab450388a55beeaa0e801fbe094d277ef565d8492c
Instruction ID: 5878ed34015d828456de7bfdfe6d4a2f5740eae7a3c4500659f83664edd95a3e
Opcode Fuzzy Hash: 66c99777d5fcb25f59e611ab450388a55beeaa0e801fbe094d277ef565d8492c
Instruction Fuzzy Hash: 92F0493AA11300EFDB14DFA8C844B9D3BB4AB16324F108556F850DB694CB3889458F8A

Function 6C39F147 Relevance: 1.5, APIs: 1, Instructions: 33timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 6C39F15F

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 051ca359bd3b5a92ca8369d42167e67ad5fa09905bf84d12954e486bb7a13c3b
Instruction ID: 7473f30fae93b41d9785f642a2fb721bce4530a6dcc3346d91d59b04a0d66333
Opcode Fuzzy Hash: 051ca359bd3b5a92ca8369d42167e67ad5fa09905bf84d12954e486bb7a13c3b
Instruction Fuzzy Hash: 35F09625D0010AD7CF04EF94C5117FDB7B89F19705F804079A846EAA40E7398945C7E5

Function 6C38F15E Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,?,?,?,6C391EFE,?,20001004,?,00000002,?), ref: 6C38F19D

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: ae44b6ac4908e8cdd0533848fd56d7c154e6006b2b5601fa515239d16709c399
Instruction ID: f3cbe96aa37817b4718f1f12e528d882120bea37daff043f47612bb2b9e7c23e
Opcode Fuzzy Hash: ae44b6ac4908e8cdd0533848fd56d7c154e6006b2b5601fa515239d16709c399
Instruction Fuzzy Hash: 22F08C35602218BFCF12AF60DC00AAE7BB9EF09710F508118FC0566610CB329E249EE5

Function 6C39AF66 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 6C38FBB0: GetLastError.KERNEL32(00000008,6C361DE7,6C38EBE2,6C385DC7), ref: 6C38FBB4
Part of subcall function 6C38FBB0: _free.LIBCMT ref: 6C38FBE7
Part of subcall function 6C38FBB0: SetLastError.KERNEL32(00000000,00000008,6C361DE7), ref: 6C38FC28
Part of subcall function 6C38FBB0: _abort.LIBCMT ref: 6C38FC2E

EnumSystemLocalesW.KERNEL32(Function_0003AEBD,00000001), ref: 6C39AF9D

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 6a16a13a304988c7a70f5bd8eaaa0addc5f5cf127e35ac8e70e70b3c1b2ed2f7
Instruction ID: dfbea7e712746b703f3da0fafba0ec11e477e7ea6ea7a21728d6c541e16e2891
Opcode Fuzzy Hash: 6a16a13a304988c7a70f5bd8eaaa0addc5f5cf127e35ac8e70e70b3c1b2ed2f7
Instruction Fuzzy Hash: 4FF0E536B0020557DB049F3AD854BAA7FA4EFC5758B0A4159EA078BA40D7369842CBA0

Function 6C374580 Relevance: 1.5, Strings: 1, Instructions: 269COMMON

Download Yara Rule

Strings

, xrefs: 6C374781

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 47a23ac52ad25d5c1dff85ac5b20252a878257e3651bfc726e5b7bc0acd51f27
Instruction ID: b5850a8a2bd6532d7bc44ef26b2005b732e9c72781c956dd4b39e0f4bf170349
Opcode Fuzzy Hash: 47a23ac52ad25d5c1dff85ac5b20252a878257e3651bfc726e5b7bc0acd51f27
Instruction Fuzzy Hash: FCA1AD71E056459FDB28CF68C880298FBB5FF19314F18866EE809DB742D738A945CFA4

Function 6C387F4E Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 6C3880BE

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 8539593f3be978389ef38bfebd006fa0c853f7248c9af714f81ab8b3c7156af0
Instruction ID: 0ae4f2a8d7fdbec349b84b07d4c8d3f93d50ef69a6fe0d27a1442362dadba378
Opcode Fuzzy Hash: 8539593f3be978389ef38bfebd006fa0c853f7248c9af714f81ab8b3c7156af0
Instruction Fuzzy Hash: 245166A17476446BDB20896988407EF739A9F0330CF24091BE491CBF81CB17D64ACFA3

Function 6C38B428 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 6C38B428

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 82116c4666ca6d509ac2d09d16f6646d2edf47a0b21e177928ee6d8609d8de65
Instruction ID: 0608502458c1c735c8703f80a6e042e50d684f98e7baf2da03728c573db32010
Opcode Fuzzy Hash: 82116c4666ca6d509ac2d09d16f6646d2edf47a0b21e177928ee6d8609d8de65
Instruction Fuzzy Hash: A1A011303022028F8B208E38830830C3ABCAA2228030000AAA008C02A0EA288A208A82

Function 013BB140 Relevance: .8, Instructions: 752COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013AC000.00000020.00000001.01000000.00000003.sdmp, Offset: 013AC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13ac000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f578b18ac17166e6b2182e564e9e064d12fd966c0324bed2416b4ab6c7660540
Instruction ID: 887a41670119cf59e433f7cc06ffd820c83c81332475460c8dad39fa62de0f31
Opcode Fuzzy Hash: f578b18ac17166e6b2182e564e9e064d12fd966c0324bed2416b4ab6c7660540
Instruction Fuzzy Hash: F05284716083429FD328DF28C985B9BFBE8BF94708F04491DF69997254EB71E805CB92

Function 013BE2A0 Relevance: .7, Instructions: 718COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013AC000.00000020.00000001.01000000.00000003.sdmp, Offset: 013AC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13ac000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f1e5ce6f07d261f731decbe2232e00bd8000bd0c38af0fd90d42f1de4bfa6f4
Instruction ID: 762b749e32c6f5a2f9e54c4e6c46a2739311093e3c84493579808d078f97440c
Opcode Fuzzy Hash: 2f1e5ce6f07d261f731decbe2232e00bd8000bd0c38af0fd90d42f1de4bfa6f4
Instruction Fuzzy Hash: 925261716087429FD358DF28C885BABFBE4BF98704F04892DE699D7251E770E904CB92

Function 6C3956C9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73f704890b048c42f69cf7347967ff30630da54d5ebb38f8a9a9e839a822e9db
Instruction ID: 5344e18dc9f3126518e4cba99fd5e090289e4670276e8d698c3cc0abfb377ceb
Opcode Fuzzy Hash: 73f704890b048c42f69cf7347967ff30630da54d5ebb38f8a9a9e839a822e9db
Instruction Fuzzy Hash: FC322372E29F414DDB239534C962325A26CAFB73C9F15C727F82AB5D95EB2AC4C34600

Function 0140F5C0 Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c4ef369079bafbc7b05fce5a43a41b3ed217f5384212aa7b891d5cea085545f
Instruction ID: ccb9e29bc21c31466a286bfc6468a879316ea2af30801aa041a3950c595efb15
Opcode Fuzzy Hash: 2c4ef369079bafbc7b05fce5a43a41b3ed217f5384212aa7b891d5cea085545f
Instruction Fuzzy Hash: 10426071A00259CFDB26CF69C880A9E7BF5BF88304F14817AE9099B3A5D731E945CF90

Function 013C7120 Relevance: .6, Instructions: 581COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013AC000.00000020.00000001.01000000.00000003.sdmp, Offset: 013AC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13ac000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a941b35973b0070ce2a3774397eac339f9d8c0aaa3adc77851659d02703f935
Instruction ID: b6f4ffdff6f1bca5d4aad674a51a644f7870a1c05b564f925377233eb8c52c5e
Opcode Fuzzy Hash: 4a941b35973b0070ce2a3774397eac339f9d8c0aaa3adc77851659d02703f935
Instruction Fuzzy Hash: 012246756087418FC318DF1DD840A5AFBE1FBD9624F108A6EF999973A0E731A905CF82

Function 013B4320 Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013AC000.00000020.00000001.01000000.00000003.sdmp, Offset: 013AC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13ac000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7335b6a64ff62e3c10c746cf60fc9f860b2daf94af6301c82937d4f165d86de4
Instruction ID: 0e9c64957cc253d6149818c3758d2f7d45d71cba8e7c3ddb3ae400cda89ad41c
Opcode Fuzzy Hash: 7335b6a64ff62e3c10c746cf60fc9f860b2daf94af6301c82937d4f165d86de4
Instruction Fuzzy Hash: 29124B33A9E6DA07D31BC62888711F4BF824BA3219F0E46ADCD861B7D7D59A350CD780

Function 01409A50 Relevance: .6, Instructions: 569COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2fc7250d722d2fe625343e1586b793389f401dfe6e649f66819e77743c9efcb
Instruction ID: 8b893927d18980463bd85ba58f61f1d2847531d28a3dfbaca20092febdf6684c
Opcode Fuzzy Hash: f2fc7250d722d2fe625343e1586b793389f401dfe6e649f66819e77743c9efcb
Instruction Fuzzy Hash: 38325371A00249CFDB16DF69C490A9EBBF1BF98314F14816EE9199B3A2D731ED45CB80

Function 013FBA90 Relevance: .6, Instructions: 564COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38ce5583c7f328f4948198fd9219e591d11f862ac948bad6bd9417859b39a86b
Instruction ID: c87ad73f2fb8ba867ef2db45087721b05c7266d3a8578cdc2fc46e5d83f1f946
Opcode Fuzzy Hash: 38ce5583c7f328f4948198fd9219e591d11f862ac948bad6bd9417859b39a86b
Instruction Fuzzy Hash: 11227EB0604745CFD725CF18C480B6AFBE1BF99708F148A6DEA898B355DB71E845CB82

Function 01518606 Relevance: .5, Instructions: 511COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c012176b7e6b48779bb7abbd4962e1f62933d80c1bf8be37bee73958aa826dd
Instruction ID: b81a75cbd750ee57ab880ca5fe21bd57bc42e1a8247022c00949e33d8fba034e
Opcode Fuzzy Hash: 7c012176b7e6b48779bb7abbd4962e1f62933d80c1bf8be37bee73958aa826dd
Instruction Fuzzy Hash: 3B22D1B6904B128FD725CF19D08055AFBE1FF88324F158A6EE9A967B14C330FA55CB81

Function 0147C540 Relevance: .5, Instructions: 506COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 714a170bd0f1359492265617069859cb8a32ba8ad0bbdd4c19f6460788e3306e
Instruction ID: 46a52452eec2cf5ca6303f0f9ab4aa3b4cb770d4a53c718245276ecd58d6e82a
Opcode Fuzzy Hash: 714a170bd0f1359492265617069859cb8a32ba8ad0bbdd4c19f6460788e3306e
Instruction Fuzzy Hash: 21F13A716443426AE710EF25DCC2FEBB3D4AFA4705F44481EFA459A291E7B5F900CB62

Function 013B4DA0 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013AC000.00000020.00000001.01000000.00000003.sdmp, Offset: 013AC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13ac000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6abd96074e30f7639621ea52a47d804199d95326e6f71f4b2034da9bf567e73e
Instruction ID: 744b56b4e4841d66634011454d49bf4861996a79d916756278108a49caa0b585
Opcode Fuzzy Hash: 6abd96074e30f7639621ea52a47d804199d95326e6f71f4b2034da9bf567e73e
Instruction Fuzzy Hash: A9F16F319083568FD714CF28C4D07EAB7E1ABD9308F04492EF6899B652F376D649CB86

Function 01478FB0 Relevance: .4, Instructions: 434COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07e5d84407709f450582cc19b4fb2db08cab8c768b46350746aa97cb17600232
Instruction ID: 348f77d77ee4e6cf47574701ce3ef7de0d3994de04c01360f082b23d360e432a
Opcode Fuzzy Hash: 07e5d84407709f450582cc19b4fb2db08cab8c768b46350746aa97cb17600232
Instruction Fuzzy Hash: E8E12575644702ABD310EF29CC82F9FB3D4BFA8314F84491EF65A96391D7B1A900CB52

Function 015E73E0 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000015DD000.00000020.00000001.01000000.00000003.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15dd000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 065d9e70d041b9ab58755f6eabdc306cc387714d8d7d006baebdcc59c0e24f80
Instruction ID: 9c8999921e011f9cbc031833a038c29dafd95f425ab6e0b30d5243294099cb53
Opcode Fuzzy Hash: 065d9e70d041b9ab58755f6eabdc306cc387714d8d7d006baebdcc59c0e24f80
Instruction Fuzzy Hash: 5CF15075A0D3058FD358DFAAC48064BFBE2BFC8200F45CA6DE5949B315D6B0D905DB92

Function 015E6F50 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000015DD000.00000020.00000001.01000000.00000003.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15dd000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8427271788e4471304ab997abc8253679e48f3611d026c7d1d777a1d9318c7bb
Instruction ID: f2f06a18da7ed8442331f7866dd0ac92f766bf4c82aa6b368bce04cbb192e137
Opcode Fuzzy Hash: 8427271788e4471304ab997abc8253679e48f3611d026c7d1d777a1d9318c7bb
Instruction Fuzzy Hash: 7CE15175A083048FD748DF69C89462FFBE2BFC8300F44896EE5A587351EAB4D909CB95

Function 01511DB0 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b419dfdd04a6a937029fe41010b60186c06f52cc0e95eed1717328733c2d35
Instruction ID: e1276028a7b1a8aaa9c3457be4fc34e2af8e32c1c7dd989f2f5ff4dbd7ed7d0d
Opcode Fuzzy Hash: 71b419dfdd04a6a937029fe41010b60186c06f52cc0e95eed1717328733c2d35
Instruction Fuzzy Hash: EC026325C18FDA86E7129B3DC442977B7A0BFEA248F10DB1EFDD476511EB30A684E241

Function 01511730 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ff4be15c2f80043a3a3874cdd73c1f2d3d53d22ba90f1b2c37d9e7b8a8b640d
Instruction ID: b6a781629bb928500aebf629892cbea9c355c20372acd511b5ea83e167e1d80a
Opcode Fuzzy Hash: 7ff4be15c2f80043a3a3874cdd73c1f2d3d53d22ba90f1b2c37d9e7b8a8b640d
Instruction Fuzzy Hash: B6027435C18FDA82E7129B3DC442977B7A0BFEA248F10DB1EFDD536511EB21A644E241

Function 01511140 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c33fb274095a188932260f0ea2736bc6a8e3ca316cc910230737caadc8204e01
Instruction ID: 2ebe893d888999753afb1d26b3bca0271f9524ae4939b53c8bad6f40d49bb695
Opcode Fuzzy Hash: c33fb274095a188932260f0ea2736bc6a8e3ca316cc910230737caadc8204e01
Instruction Fuzzy Hash: 6BF18321C1DFDA87E6139B3E8542166F3A0BFFA284F14DB0AFDD435452EB61B2D59240

Function 01516FB0 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01b1297a424d3e39430ecae581cbbc167fce1ddec024d9f867a3e2aac9254bbd
Instruction ID: 710cd41da4f6e342ae8409c66ae1ae6178ef323e45a41310fc9ccc11cd751796
Opcode Fuzzy Hash: 01b1297a424d3e39430ecae581cbbc167fce1ddec024d9f867a3e2aac9254bbd
Instruction Fuzzy Hash: 21C12A73E24B7906D7649E7F8C400A9B6E3AFC4120F9F47BDDD98A7342C930690A86D0

Function 013C2420 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013AC000.00000020.00000001.01000000.00000003.sdmp, Offset: 013AC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13ac000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4af67cbeaa972255a6364efe3e99be4d160408153d600e736a1f3f0edebc0aa1
Instruction ID: 30f9bcc022eae47eac3f153bce4a70b99ab9b857934a7701c9438b2c18e31f28
Opcode Fuzzy Hash: 4af67cbeaa972255a6364efe3e99be4d160408153d600e736a1f3f0edebc0aa1
Instruction Fuzzy Hash: FEE12DB15083829FC338DF64C885BAFB7E9BFD8704F00892DE68A87255D775A905CB52

Function 6C3846ED Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: ad4dbc5562df239a8ca3ecaf868529121956af527bd9877e5341b3018b02a533
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 4FC1923220F19349EB1E467A943413FBAE95E927B532A075DE4B2DBDD4FE21C124CE60

Function 6C384B22 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 2e8b80254e4672cda36c2fa0e56b3b619cbb46276d608dbc987f95dd74584c97
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 7CC1B73220B4934AEB0E463AD43413FFAF95A927B931A076DD4B2DBDD5FE11D124CA60

Function 014C9080 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 393a43b8d4c0eb7be08b06df616bea86d132b469f9596e61bb15700249fd6bbb
Instruction ID: b9f276782cb53df727b1f632f5ac05b6b3c3f77796d66ac792dd0cd627ccdcf2
Opcode Fuzzy Hash: 393a43b8d4c0eb7be08b06df616bea86d132b469f9596e61bb15700249fd6bbb
Instruction Fuzzy Hash: 31A129767002056BE314EB29DC81F7BB799FFD5B14F49082EEA0587250EB36E80586A2

Function 01510BB0 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01eef35076e03c2ca61ca294521eaf8e3a6a0edeb0c2c68d9f1c504fd829c17a
Instruction ID: 5e9142bd653f95e136de3893ee1a1bf864b9894fee25e592a81f3f395f91be15
Opcode Fuzzy Hash: 01eef35076e03c2ca61ca294521eaf8e3a6a0edeb0c2c68d9f1c504fd829c17a
Instruction Fuzzy Hash: 39E18125C1DFCA87D6139B3A8542166F3A0BFFB288F14DB1AFDD435422EB61B2D49240

Function 6C3842B8 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: aa786224a8d20c22b130656c1dae0f23ded395983c3b4547d322a8410bc9d867
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: 87C1863220F5934AEB0E467AD43403FFAE95A927B931A076DD4B2DBDD4FE11C124DA60

Function 6C383EA0 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: edda22724352531c015e8d31f8189f3ea6a658e0789083afccb7166a5afdb7c4
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: EEC1823220F55349EB4E467A943403FFAF55A927B931A076DD4B2DBEC4FE21C124DAA0

Function 01430C92 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03f19bd14fc39aadf2404c78d91e2ebaa6ff0761b6a5e2c6623a2eb9527f3e78
Instruction ID: 93ee35c2204ada9647a544ec28b3288f504acd2522cc5d0aae560b3d70ed9c9d
Opcode Fuzzy Hash: 03f19bd14fc39aadf2404c78d91e2ebaa6ff0761b6a5e2c6623a2eb9527f3e78
Instruction Fuzzy Hash: 95D18C29D39F8741E7235A7D9412162FB606FFB280F02EB0FFDD431916AB22A3658344

Function 0143077A Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a83e0d244e729b0c5f0f4ed35345615ff07efabb447afdcb0fc7428ed0fc4b4c
Instruction ID: 5c0cd820e4e3ff208c02225f5e7fc417fad8f510a69cf52e116e81bd8b24e29c
Opcode Fuzzy Hash: a83e0d244e729b0c5f0f4ed35345615ff07efabb447afdcb0fc7428ed0fc4b4c
Instruction Fuzzy Hash: F8D17D29D39F8741E223567D5412162FB606FFB280F42EB0FFDD431D56AB22A3A59344

Function 0151AAE0 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee9de8cedcf4a0d5b7f7b82656dc2ac43d788865c97bbd8271ed834288025cd5
Instruction ID: b2119cfd33997fa4c7a4b1eabc284289fdfdb525fc75547c5a1aad14b1c971c2
Opcode Fuzzy Hash: ee9de8cedcf4a0d5b7f7b82656dc2ac43d788865c97bbd8271ed834288025cd5
Instruction Fuzzy Hash: C7D1D075A093419FC348CF29C48091BFBE1BFC9310F958A2EF59A87265E731E945CB82

Function 0149D350 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85f01c4bf931d7745d41832c39f2cd3e7f7a86bd813eac662f5cd87afff2d1c9
Instruction ID: aa38c24c75846d80064f3551b94351c5110ba81fcb83941e66d42ccb1b11f432
Opcode Fuzzy Hash: 85f01c4bf931d7745d41832c39f2cd3e7f7a86bd813eac662f5cd87afff2d1c9
Instruction Fuzzy Hash: 488129B2F50623179F64A6FEBD53BAB39425BA0694F08043FE5C6C6376F930E4198271

Function 01434DD8 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8024c089fdfb3a573542c1ffb85ef95958d172e4f51b09de379eed29773a6a5f
Instruction ID: 5c56f4601f9742544138ab41d6dca33c0af7a03c756e7cf8b6c73b237f031894
Opcode Fuzzy Hash: 8024c089fdfb3a573542c1ffb85ef95958d172e4f51b09de379eed29773a6a5f
Instruction Fuzzy Hash: 85C19460634F3781CBD3EEB0A210841F7B0BF8721AB4A1A0A9915D5525EB3FD79ED350

Function 01493ED0 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3231874b4b31010a25934312ad9989e8007f986dff2d636b187980df77160695
Instruction ID: 6771c8637189a775d9053dff926e0a0ce4a978aaeb8222fdfc00344e19f194e0
Opcode Fuzzy Hash: 3231874b4b31010a25934312ad9989e8007f986dff2d636b187980df77160695
Instruction Fuzzy Hash: 28716673B64A164B970CCD2DCC8225E62D3ABD820478ECB7DED56DF385E938D91186C0

Function 01515B00 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b32b9f09d68a8ba3adc6463fbd9cf88116f9db414d22f8215cfaa78ec6d93ad
Instruction ID: 6f11827480e59e8e1b79be61eb69857010848982b78c4a8dc916c0614b27ef10
Opcode Fuzzy Hash: 0b32b9f09d68a8ba3adc6463fbd9cf88116f9db414d22f8215cfaa78ec6d93ad
Instruction Fuzzy Hash: 0A91E573918BBE06D7605EAF88041B9F6E3AFC8210F9B0776DD9477242C970AE4697D0

Function 015134C0 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f63f56a63d2c6405d7ccd1426b6c5b482d6a0ea83d6f6e59f6eb06f60437d5c0
Instruction ID: 1ed3b6fb89644e6b850db1c5f277362feae46a596866a13ff7755a4b5227202f
Opcode Fuzzy Hash: f63f56a63d2c6405d7ccd1426b6c5b482d6a0ea83d6f6e59f6eb06f60437d5c0
Instruction Fuzzy Hash: F4A111B15087008FD369CF29C8949ABBBF5FF88314F448A1EE59A8B645D731E605CB92

Function 0151B480 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c68cb41f7e17e5a392b7fabcbbb92e6c77303ccfc31c9a40a991973174689bec
Instruction ID: 0f844351ea253da13d9c6e1cfa77b688bc38bc01a3518ba62389196e50282e70
Opcode Fuzzy Hash: c68cb41f7e17e5a392b7fabcbbb92e6c77303ccfc31c9a40a991973174689bec
Instruction Fuzzy Hash: 0DA14574558A92ABC717DF1CC4801F9FBA2FF87316B988B29959043358C73A753ACB90

Function 015137E0 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 826e42605ee126863780f9eb3f4782779f66d25537c2391683b0f09919911524
Instruction ID: 1f0e5c22e587cb98f00efd1f75fc793942f9e76526df83444eb80f03f81f8078
Opcode Fuzzy Hash: 826e42605ee126863780f9eb3f4782779f66d25537c2391683b0f09919911524
Instruction Fuzzy Hash: E6A143B15087009FD365CF29C884AABFBF5FF88314F448A1EE59A8B655D731E505CB82

Function 01515660 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48f772e764e96c8212e236196d32a0df716073b9467db21747c4a59b50ceb64b
Instruction ID: 3f7ae1dbec1256e9f6f248993aff54e9aafd5c6dcd0379d871c3f8185551f2b6
Opcode Fuzzy Hash: 48f772e764e96c8212e236196d32a0df716073b9467db21747c4a59b50ceb64b
Instruction Fuzzy Hash: 11A10471A187019FD359CF29C481A5BFBE1FFC8244F548A2EE59ACB214E730E905CB52

Function 01515350 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45ffc9e665e15232cf344cdbe0676b5d1f2bfa8aaa6ee5c71fc997130b71a973
Instruction ID: 31fc1648b2d772aabd3f5385c7d4a82b9e4b34aef9b1346c9d7044b2ef961ede
Opcode Fuzzy Hash: 45ffc9e665e15232cf344cdbe0676b5d1f2bfa8aaa6ee5c71fc997130b71a973
Instruction Fuzzy Hash: 2FA1E3716187019FD359CF29C481A6BFBE1FFC8304F548A2EE59ACB614E730E9458B52

Function 01512E40 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e80e51f96a1072a29dceebca06e072e48cff87002f092a77ba4e7505ccb73cce
Instruction ID: 76a467faf4480157fe87d9c4242dcff4afc32a21da1df3394f32c0cf3525caca
Opcode Fuzzy Hash: e80e51f96a1072a29dceebca06e072e48cff87002f092a77ba4e7505ccb73cce
Instruction Fuzzy Hash: 3CC1D4B19083188FD344DF5AC184A56BBE1BF8C710F4685FEEA589B322DB70A840CF95

Function 01430367 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33377212acdf3a1f49ecd29046806f27112c063ae4376f3ee03c5c72e5db24a2
Instruction ID: 79f5e46af9b85c9f2d167f41261b5fbd682ba45528be5d519e6580b2ffb80127
Opcode Fuzzy Hash: 33377212acdf3a1f49ecd29046806f27112c063ae4376f3ee03c5c72e5db24a2
Instruction Fuzzy Hash: 48B15D29D39F9742E6136A3E9403462FB606EF7280B42D70FFDA531966A722B3658344

Function 0142FF5A Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e39e6095b2a51030ec4a8094dcfee1b6ada8ac54362acdc4aa825af8506bfde
Instruction ID: 7dbf1c6fce68dbedaf9d03a993b0c15ae0e09146bd8613cb5285edf77200ec8a
Opcode Fuzzy Hash: 7e39e6095b2a51030ec4a8094dcfee1b6ada8ac54362acdc4aa825af8506bfde
Instruction Fuzzy Hash: 49B16E29D39F8742E613663E9403462FB606EF7280B42D70FFDA431966A723B3A58344

Function 015127D7 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 833f5d6d57c85dace192e2b59db7cd1af1f9583e9cad9fb5410db99f3049a67f
Instruction ID: 9e04aef57c18c3655255a87c43deba0732a00903d4d1df80b25665c9edfedab9
Opcode Fuzzy Hash: 833f5d6d57c85dace192e2b59db7cd1af1f9583e9cad9fb5410db99f3049a67f
Instruction Fuzzy Hash: 2BA1AF21C09F8746F70B7B754456264A330BFF3188F60CB06FDA17D96AEBA1B6C85161

Function 6C38817D Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a624920225fb5600030301188e471cea0ac27020de311048007ade9af58b8656
Instruction ID: 8961640d0c5c775006c772f0fefa80a4969073f631f3cbe4736844541e44ff64
Opcode Fuzzy Hash: a624920225fb5600030301188e471cea0ac27020de311048007ade9af58b8656
Instruction Fuzzy Hash: 4C617B75743B0856DA2449684850BEF3399DF4370CF20091BD992DBE82DB63DA46CF67

Function 01512430 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dd4c44225567eee2d7751b73d10631589946bc71cb5d53a591a32a9ba35f940
Instruction ID: 476557cf0e254261e1f46d96d7b27990bb8de535034de14c24b511e32f443f17
Opcode Fuzzy Hash: 2dd4c44225567eee2d7751b73d10631589946bc71cb5d53a591a32a9ba35f940
Instruction Fuzzy Hash: 8E918810D18F9943F6139F3D85411A7B3A1BFBE208F15EF0AEDD53A856EB20B6D59280

Function 01518F60 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90f9ae9119390146c4de1b735a445bf63a3ebd5eba14a46d36f239d947fc874a
Instruction ID: 3968f34fddb5d7f7acc9b11c180c9702693ad281cf77e4e25c5e2b4d969242f9
Opcode Fuzzy Hash: 90f9ae9119390146c4de1b735a445bf63a3ebd5eba14a46d36f239d947fc874a
Instruction Fuzzy Hash: 5571D5B3E20F294F8314DE798D84156B2F1EB84520F5A867ECF5193B45E7707A5E86C0

Function 01519FD0 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2107d06bb6b3beb192b9ff0d555eda9a2cfb2dd6ec8480c8914a07ee73a0fc8
Instruction ID: 09cb5fbff5c243bfde8b4fc0506f9998b4dd83acd77ac240435c779ae41c2645
Opcode Fuzzy Hash: a2107d06bb6b3beb192b9ff0d555eda9a2cfb2dd6ec8480c8914a07ee73a0fc8
Instruction Fuzzy Hash: 1D917C756093818FD316CF28C08095AFBE1FFD9214F58896DE8D98B35AD235E909CB52

Function 01434811 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 214580da4c52336f87777016291bce7a1f7c901488048e3b7d458f71011c9eb6
Instruction ID: 9a2c864dfa3869496d731ef871dfb0de96b15b54b913c3409db7d25677fb6d6b
Opcode Fuzzy Hash: 214580da4c52336f87777016291bce7a1f7c901488048e3b7d458f71011c9eb6
Instruction Fuzzy Hash: 3A81B320534F3785CBD3EE709214852FBB1BF8721AB490E0A9915D6525EB3FE6AEC350

Function 01510810 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fcc43b6dec1d2a5d4b93e07f1dccf19a7351a6efeb9f8f549763149ed7a8214
Instruction ID: ae706abdb179f87b645cc07c41bf6b1c2ea54298a88e0a0fe88f47c7f1b1e925
Opcode Fuzzy Hash: 1fcc43b6dec1d2a5d4b93e07f1dccf19a7351a6efeb9f8f549763149ed7a8214
Instruction Fuzzy Hash: BDA18420C1DF8A87E3138F398542166F361BFBA248F15EB0EFDD935452EB61B2D49240

Function 015E1D70 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000015DD000.00000020.00000001.01000000.00000003.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15dd000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b093ab98a4d5114a4853ba0fec75c293dd2be11bbce91bf57854c319a06deff
Instruction ID: 6ad304c857db8828953adbb5479aac94378969ffc3d0621e846355ce926c4de0
Opcode Fuzzy Hash: 2b093ab98a4d5114a4853ba0fec75c293dd2be11bbce91bf57854c319a06deff
Instruction Fuzzy Hash: 4F5127A4F4070275EA6C62376DEBF7F55CD5B70A4AF08482DFA12A9081FFB1B51181B2

Function 01514360 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 135a2f4fd57d2a0c5553eb17a872198c91ab6e186f2da9d12fe8d4f3dfba4dd8
Instruction ID: c5be1069a3b5d470a7eca9bb53eafd36713951bd1d0423a72e1f799e726e1dd9
Opcode Fuzzy Hash: 135a2f4fd57d2a0c5553eb17a872198c91ab6e186f2da9d12fe8d4f3dfba4dd8
Instruction Fuzzy Hash: 9B81AD715083419FD319CF28C480A6BBBE4FFC9314F448A2DE9DA8B655D730EA48CB92

Function 0151A390 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71c080744b33fe28efdd22d9ba3f5637dc13fe43c3433e2e1a757dd4a0f23182
Instruction ID: f9c31c9cc1f13153ace538e78f3d8c271c75f983563690eb87d7b2d0a0d26639
Opcode Fuzzy Hash: 71c080744b33fe28efdd22d9ba3f5637dc13fe43c3433e2e1a757dd4a0f23182
Instruction Fuzzy Hash: 6571AF715093818FE716DF28D48456BBBE0FFCA618F050A6DE9C59B34AD370DA05CBA2

Function 01517431 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7264c70299fa56e359571c6f703c96d6d5a10104b9f91aba4f0598870021b61
Instruction ID: 849a2652a1c571fa51cb8a07ce2d3b544c2228477cd3c5e3620e405ea61f3e4d
Opcode Fuzzy Hash: d7264c70299fa56e359571c6f703c96d6d5a10104b9f91aba4f0598870021b61
Instruction Fuzzy Hash: C271E826639F7A06DBC3DA3D881046BF7D1BE8910AB45095ADC90F3281D73EDA4E7660

Function 01517430 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f6a2591c6a1714bf7261bac80aec65f1a127fd8b4b380c508f0496f22d439f2
Instruction ID: 0b7ff545bc09f5cb45206e0fc0200a039461be9699e09fc9b2e1c9a51d882348
Opcode Fuzzy Hash: 3f6a2591c6a1714bf7261bac80aec65f1a127fd8b4b380c508f0496f22d439f2
Instruction Fuzzy Hash: 8A71D826639F7A06DBC3DA3D881046FF7D1BE8910AB45095ADC90F3281D73EDA4E7660

Function 0142FC06 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0db747e3a21f9b07f5a7d99dea06301f23bdd19cf5dfb0a6be5ff1e58db43495
Instruction ID: 298dd32380d41dff26ab423adb4b90dfa14e0fd258da535973a5fb26ea3e8b68
Opcode Fuzzy Hash: 0db747e3a21f9b07f5a7d99dea06301f23bdd19cf5dfb0a6be5ff1e58db43495
Instruction Fuzzy Hash: 77914229C39F9741F7235A399512162FF607FFB284B41E70FFDA432825EB2272659244

Function 01434B01 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b01d61fce4056f3b7af9f2867f595921b6c6edd233688dc8ef038da9c660b26
Instruction ID: 56e03ed0a23be8146ce49b47cd4affcf68210d38530fd51fd2f9ca077068cc0e
Opcode Fuzzy Hash: 6b01d61fce4056f3b7af9f2867f595921b6c6edd233688dc8ef038da9c660b26
Instruction Fuzzy Hash: 6B715021035F3691CBD3AE70A624812FBB5FF5A26F748190AC915D6124EB3FE16EE314

Function 015101C0 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a46fd9a0c7651f21d0a439fba3ad5ffb515a0e8e1e41b4cee262b977e9b59456
Instruction ID: 2d0036fbf6a2ac230d073020fe4acde3cd32f7ac39314fffd9b9b0657883e45a
Opcode Fuzzy Hash: a46fd9a0c7651f21d0a439fba3ad5ffb515a0e8e1e41b4cee262b977e9b59456
Instruction Fuzzy Hash: D4A11311D18FD793F3165F3986405B6B760BEB9208F06FB08EDD929956DB34B6E4C280

Function 013B5380 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013AC000.00000020.00000001.01000000.00000003.sdmp, Offset: 013AC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13ac000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb2e3bdb494c02d80f27478900ef98ba42d0ec31c99de567ce3a3b5d6e868a36
Instruction ID: 791eec01cdc52c530cfac0a067064f8688c129b9c8c5f9fc0d2a3aeb6449ffd0
Opcode Fuzzy Hash: bb2e3bdb494c02d80f27478900ef98ba42d0ec31c99de567ce3a3b5d6e868a36
Instruction Fuzzy Hash: C161E161A087094BC718DE7DE8D469AFBD3EBC5111F44CA7CC99A43F45E678E90D8B80

Function 01518CA9 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c55ec42e37731b7a14bb140ff7fe4e7a6f44855d55ca4aaab8372080e5fa6381
Instruction ID: 22e7d709fda8e4eaf352df4d7786e3abe78a222fa99a92a3d6f41a23d52c2ab1
Opcode Fuzzy Hash: c55ec42e37731b7a14bb140ff7fe4e7a6f44855d55ca4aaab8372080e5fa6381
Instruction Fuzzy Hash: BA812975A10B669BD764CF2ED8C045AFBF1FB08210B918A2ADDA583B40D334F565CF94

Function 01514810 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 304aea128017510030fb4b2dd7ec456fd9cf499941f63fee13b880ca14d22c1f
Instruction ID: c092fbf9891d92a0e4b2ef750592ec7795f902dbe7210ca7b9b4e5f2b497cf7d
Opcode Fuzzy Hash: 304aea128017510030fb4b2dd7ec456fd9cf499941f63fee13b880ca14d22c1f
Instruction Fuzzy Hash: 9F61B2711087419FE315CF28C891A6BBBE6BFC9310F584E1EE5DA8B245D730E945CB92

Function 015E0AF0 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000015DD000.00000020.00000001.01000000.00000003.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15dd000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baee5229649e401ea305ef148804accdc8fb0cfe9125c11320dffa2d6762d732
Instruction ID: f1f56183c60a76c6c4c6fd1a8c639a92045455cd1fbacf669cf3233ec30251fc
Opcode Fuzzy Hash: baee5229649e401ea305ef148804accdc8fb0cfe9125c11320dffa2d6762d732
Instruction Fuzzy Hash: F8515A71B043428BD705DF28DC84A5FBBD4BFE1214F48456DF848AF292E6B5E509C7A2

Function 0142F91A Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 303774cf16026807fd9ad1079921e14d32cf6e2744c0d5817eb5f016bb73ed8f
Instruction ID: d012de82f71be164386ba9a79ebcfc69f1d48f75e3077d195b55a71955ca5adb
Opcode Fuzzy Hash: 303774cf16026807fd9ad1079921e14d32cf6e2744c0d5817eb5f016bb73ed8f
Instruction Fuzzy Hash: 4A714F29C39F9741F6231A3EA513122AF606FF7184B41E70FFDE535C25EB226325A248

Function 015145C0 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fda400917465c8049516f131d4d4b750af77061c9d6780c6a6fe43bdd176a3ec
Instruction ID: 3f3cd510931d70cfb5219fce6b9340b7fdb5cdb0c0a24ab2cb24f799186e6eb4
Opcode Fuzzy Hash: fda400917465c8049516f131d4d4b750af77061c9d6780c6a6fe43bdd176a3ec
Instruction Fuzzy Hash: D56179716083419FD319CF28C480A6BBBE5BF99304F448E2DF5DA8B255D730EA49CB92

Function 01515140 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 247a9015ead9b47189546f598a4d1d17fe7fb473ad58da355a6347165fd037c4
Instruction ID: cf786902a476e4ba5ff063d2db9dcc3acaf822547dd770334734d0a27d1c463c
Opcode Fuzzy Hash: 247a9015ead9b47189546f598a4d1d17fe7fb473ad58da355a6347165fd037c4
Instruction Fuzzy Hash: 7F61D1716187009FD358DF2AC481A1BFBE1FFCC614F95892EE59A87724E631E941CB42

Function 0142F678 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 283059473b5f504bd6e2790f0060d0dab31377bbfd52c1d036e6fc39e5e6e109
Instruction ID: 0b7c6ab8832b4bac30c20cf8315355e3789910792ec430be1c59bc205b0073e7
Opcode Fuzzy Hash: 283059473b5f504bd6e2790f0060d0dab31377bbfd52c1d036e6fc39e5e6e109
Instruction Fuzzy Hash: 37717629C3AF9741F7235A399502162EB607FFB244B41E70FFDB532825DB22B2669244

Function 01514A10 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 880dbf13d9d85aeb984338b1ec6de3dbc99e5c5c892af9bc88d7fd014d2db5c8
Instruction ID: 7abefcc1a285ee787e43f4566f64ec4f79c16115f4c1b812ae154bdb9340b5ac
Opcode Fuzzy Hash: 880dbf13d9d85aeb984338b1ec6de3dbc99e5c5c892af9bc88d7fd014d2db5c8
Instruction Fuzzy Hash: 57516B716083419FD315CF28C49096FBBE5BFC9214F044A2EF5DA87245D774EA09CB96

Function 01517700 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40a998b215707fbddb308fd1f2a4123efc998ac43f72f41c2de7b8f5ed9dde9e
Instruction ID: bb9c7e85b03edbdbeac7fad3b1039728caf01e63060780ed1bbf7894804bf037
Opcode Fuzzy Hash: 40a998b215707fbddb308fd1f2a4123efc998ac43f72f41c2de7b8f5ed9dde9e
Instruction Fuzzy Hash: 6461A33390467B5BDB649E6DD8401A9F7A3BFC4360F5B8A75DC9823642C234EA11DBD0

Function 01434600 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1600fee178202e74a0e3854272e86c5d03762d8c57e0d0afaba0c9f43ab63143
Instruction ID: 160426379d33f9cb5d798aafb2cadb4dbe40604f9e1d884464c63899f7173d35
Opcode Fuzzy Hash: 1600fee178202e74a0e3854272e86c5d03762d8c57e0d0afaba0c9f43ab63143
Instruction Fuzzy Hash: 6C517121036F3685CBD3ED30A618852FBB5BF8925F748190AC915D6124EB3FE26ED314

Function 0144B6C0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a754b6d348463551ed3a8a51b14f809fc350282f2e779ec76d4b87ee2fac81f
Instruction ID: d411a619b196ffe3ab65443d4888f9af4fecca52b74e2274371aa7b2041f3f3d
Opcode Fuzzy Hash: 6a754b6d348463551ed3a8a51b14f809fc350282f2e779ec76d4b87ee2fac81f
Instruction Fuzzy Hash: C9515171025F658ACBC7EE24C100847F7A0FF9425AB014A96DD14DB901DB3FEA8FA260

Function 013B55B0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013AC000.00000020.00000001.01000000.00000003.sdmp, Offset: 013AC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13ac000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93e8b882fe4f13e8af0c8e54399b88a076f6f72d4135d7c6c4f75e001706996c
Instruction ID: d3afed8dacd2ce9bf799a11a0e6e126878cd749190a4cdf73398e775a58bcda3
Opcode Fuzzy Hash: 93e8b882fe4f13e8af0c8e54399b88a076f6f72d4135d7c6c4f75e001706996c
Instruction Fuzzy Hash: A351D262B047094FC714DEBDD885BAAFBD0EB85224F04C53DD99AC7B42F668E9098B40

Function 0142F424 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b61378bab18afc6a13eadf80e40a60b8ce3642dd523c5b9c454fc2b83fc2532
Instruction ID: edb2bb50f7bfa11b3232a728c3617c0c6d58c03cc93739f0d95c00f94e2a14ab
Opcode Fuzzy Hash: 6b61378bab18afc6a13eadf80e40a60b8ce3642dd523c5b9c454fc2b83fc2532
Instruction Fuzzy Hash: 9D514029C39F9741F6235A3EA503522EB206FF7180B41E70FFEF535825EB2263259248

Function 01515E61 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fb40114186b8bd38015c621e979a7392c83a08e63974a8c4c5d01ece18a9f7f
Instruction ID: 60fd1d765f02fcb2a976aa9e4688b1d572eac1bb7d4b1230358260f2d41c94e0
Opcode Fuzzy Hash: 3fb40114186b8bd38015c621e979a7392c83a08e63974a8c4c5d01ece18a9f7f
Instruction Fuzzy Hash: 7F51EC266257BA46DBC3CA2DC45047EB7E1BE89106B45055BDCD0B3281D73EDA09B7A0

Function 01516070 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99376b587692ce240fa4f6e5ff9e9d674aa83cf96403c63a4b33a8538c00fd75
Instruction ID: 07dd5ae059c3e471b78f31e51d9e2693d2b31b22fbb5d0b08e918051ea00797a
Opcode Fuzzy Hash: 99376b587692ce240fa4f6e5ff9e9d674aa83cf96403c63a4b33a8538c00fd75
Instruction Fuzzy Hash: B1617C3791262B9BD761DF59D84537AB3A2EFC4360F6B8A358C0427642C734F9119AC4

Function 01515E60 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42d113fb11f5d67af7d42cc83fe2ed468dff338936dc1334fd8bb1f7698a49c1
Instruction ID: f596beb0799896668d325aee8c79abb024e702851dcaec8fab2584063ea8ec71
Opcode Fuzzy Hash: 42d113fb11f5d67af7d42cc83fe2ed468dff338936dc1334fd8bb1f7698a49c1
Instruction Fuzzy Hash: 80510C266257BA46DBC3CA2DC45047EBBE1BE89106B45055BDCD0B3381D73EDA09B7A0

Function 015E6DA0 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000015DD000.00000020.00000001.01000000.00000003.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15dd000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4774b97d26911314886fd226fd9cf99473cf4b69df2164468e95a7c2718f84d
Instruction ID: 8b76a3e304cea6ac4cca360dd0db58786d5d471454b08f895516a5889d7e0f5a
Opcode Fuzzy Hash: e4774b97d26911314886fd226fd9cf99473cf4b69df2164468e95a7c2718f84d
Instruction Fuzzy Hash: 0851FDB2D083640DE3589E65C494325BED2BBC4301F1AC1BDE9F88B2D2D9B9C506DBD4

Function 0142F430 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5794309a7c7b4b83753110184b8a048f64b01b5d83985d1d5dc3265ab65be5b5
Instruction ID: 9194b0ea81f94fc862f46e4787260f2570bcaf0b0f12bb988cbc1aa10f17987b
Opcode Fuzzy Hash: 5794309a7c7b4b83753110184b8a048f64b01b5d83985d1d5dc3265ab65be5b5
Instruction Fuzzy Hash: 2B514129C39F9741F6235A3EA503522EB206FF7180B41E70FFEF535825EB2263259248

Function 01514FA0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b381c4e486b840f53379e6f5f3b16083f57ee351ebe5ee8cb4560d0f0172778
Instruction ID: 13c2c6f9ef7cde7f57e6a8f141fe5bf2f74ba8134327b3090ad966f43dd74b38
Opcode Fuzzy Hash: 6b381c4e486b840f53379e6f5f3b16083f57ee351ebe5ee8cb4560d0f0172778
Instruction Fuzzy Hash: A251657624D3809FC301CB28D49099FFBF5ABEA210F985C1EF6C48B352C262E548CB12

Function 015DF240 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000015DD000.00000020.00000001.01000000.00000003.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15dd000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81b587baca19dc962f531650aa723c09539903be57c9dd9f926d6b27632698ed
Instruction ID: f0ef39fb87bbcbabf7c087ccc32622f448b38fccad3fa450d398332d7bff4148
Opcode Fuzzy Hash: 81b587baca19dc962f531650aa723c09539903be57c9dd9f926d6b27632698ed
Instruction Fuzzy Hash: C4417C72E1872E47E34CFE169C9421AB39397C0250F4A8B3CCE5A973C1DA35B926C6C1

Function 01514D90 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03d2617f2e6450c73128e7713fa84ccb1b993ecf8f2e047b2220d1ac443cb30a
Instruction ID: 0e86f2555416314ce3972f72b02eb9b8d653c21c224d4f4385b228ab5050a999
Opcode Fuzzy Hash: 03d2617f2e6450c73128e7713fa84ccb1b993ecf8f2e047b2220d1ac443cb30a
Instruction Fuzzy Hash: 0F410D71781742EFD3109B78D841FC6BBE4BFA6704F094A8DE1985B692C3B2B115CB98

Function 015EC470 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000015DD000.00000020.00000001.01000000.00000003.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15dd000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f11c02d740d861b546250a6b08f4eddfd8c96f86f1ab6003e022a8c2eece4559
Instruction ID: ea79d0abd5243e42de7341975a14704a25cb80041df521f14ec87292869a17a9
Opcode Fuzzy Hash: f11c02d740d861b546250a6b08f4eddfd8c96f86f1ab6003e022a8c2eece4559
Instruction Fuzzy Hash: 88412BB1A043029FD348DF69D880A6BB7E8FFD8610F44492EF99997250D730E9458B92

Function 015E7279 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000015DD000.00000020.00000001.01000000.00000003.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15dd000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d481a4f207b7f74c5812b247d7d033099df4872058ff6401ca39112874e3023
Instruction ID: b3082cd8af82071a83f4f7cc439025271f279b4d0754c8aa2255e66af9202fa4
Opcode Fuzzy Hash: 9d481a4f207b7f74c5812b247d7d033099df4872058ff6401ca39112874e3023
Instruction Fuzzy Hash: 42413B71A083048FD34CDF69C88051BFBE2BFC8354F458A2EE99997351DA74D9058B86

Function 01510660 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7ad43ef9492b0eabf3af094ecf28adf8b082ba3035ed07e572c91c519b4f747
Instruction ID: ba2e2efae2480ce4a0a91beee38708bc7e4a708e8769769581eafedb0f3733a5
Opcode Fuzzy Hash: d7ad43ef9492b0eabf3af094ecf28adf8b082ba3035ed07e572c91c519b4f747
Instruction Fuzzy Hash: BC418F34D0CB5A87D7029F3DC541566F7A0BFAA258F04CB1EFD9436162E731B6C89A81

Function 0151AFC0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3676694d50fd6b3236d8fc156716b40af4f2d9e9394455ca0dd6f1277e61c393
Instruction ID: 3f54f9656805f7eff8448bdaae59dd51cc565ce59ac1d9aa4cbd06db4a70fd17
Opcode Fuzzy Hash: 3676694d50fd6b3236d8fc156716b40af4f2d9e9394455ca0dd6f1277e61c393
Instruction Fuzzy Hash: 95314470A093029FC304CF29C48095BFBE0FFC8214F908A6DF8999B315D635E909CB92

Function 0151AE90 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25a75610f76cbb05e132641d20439d048d8487028208f32efb633bd6e32ee19c
Instruction ID: 198543b23a1ccd3af2a2143c00fe7cd6bd6d53ba5031b9d5c014b50731b48059
Opcode Fuzzy Hash: 25a75610f76cbb05e132641d20439d048d8487028208f32efb633bd6e32ee19c
Instruction Fuzzy Hash: B53120B56093829BD305CF19C880A6BFBE5FFC8214F508A2DF8999B255D730E905CB92

Function 015EC340 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000015DD000.00000020.00000001.01000000.00000003.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15dd000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 476ab853d53f43d4c33d856b1f9bf321ce587f80cebe62eb81e8a4edb31c8b31
Instruction ID: eac639fe80ff9c8d37fc0531f5f49729469ee1a2357ea35fb2439e7ebdc4ad1a
Opcode Fuzzy Hash: 476ab853d53f43d4c33d856b1f9bf321ce587f80cebe62eb81e8a4edb31c8b31
Instruction Fuzzy Hash: C22146B3F64B180B9310D9A68C40351B582EFD5613F5FC4349E28C7117DEBAC9167190

Function 015DF100 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000015DD000.00000020.00000001.01000000.00000003.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15dd000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a4046c303b2977ceb943f5ef4c5c5b17fabf2a8c8781c494021933672a5b347
Instruction ID: 0490d86b4bce045c3c4fd50df124024f9d30e3e971c92668636fd4ef92e6cccb
Opcode Fuzzy Hash: 5a4046c303b2977ceb943f5ef4c5c5b17fabf2a8c8781c494021933672a5b347
Instruction Fuzzy Hash: 40315E7682976A4FC3D3FE61894010AF291FFC5118F4D4B6CCD505B690D73EAA4A9A82

Function 015DF3C0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000015DD000.00000020.00000001.01000000.00000003.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15dd000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92293155279e3b78e5313fff4ca827ca998ba6d119ad35366abdabaf4cacb6e4
Instruction ID: 26fabb481758038c65147c37fd07f15c61f8278cfa5eb8c9b610e4269bbf68bd
Opcode Fuzzy Hash: 92293155279e3b78e5313fff4ca827ca998ba6d119ad35366abdabaf4cacb6e4
Instruction Fuzzy Hash: 8C3127706183429FD351EF29C88094BFBE4FFD9254F05C91AF9899B221D730E985CB62

Function 015F3288 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000015EF000.00000020.00000001.01000000.00000003.sdmp, Offset: 015EF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15ef000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 510fefe929476b4ad1b819700367c5733ba1393bdcdf18db65bb656df78b8659
Instruction ID: ef5fe245c877b3af02073f743f4124a2a354aa6b0abddaca64faa482ae532b2b
Opcode Fuzzy Hash: 510fefe929476b4ad1b819700367c5733ba1393bdcdf18db65bb656df78b8659
Instruction Fuzzy Hash: 4411087F24409143F684CA6DC8B56BEAB95FBC5220B6C836ED3414FB98D623E145D600

Function 01510530 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60a23c78da3b6716c584f250082441a8c334e7b2b212062c327525d921f6641d
Instruction ID: e20dff78d5d84a56d0f5324a8300c8f3afdd640ba6d3cde6ff2ac6fc7cf11feb
Opcode Fuzzy Hash: 60a23c78da3b6716c584f250082441a8c334e7b2b212062c327525d921f6641d
Instruction Fuzzy Hash: CC318C3480CB9A97D7029F39C441166F7A0BFAA258F00CB1EFD9437261D771BA84AB52

Function 01515970 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b704e791cf868b1a81724527ce4058ef44244604f7d98ac77dee455ac60772f
Instruction ID: 900ac890a87352c8de097067a0c70f97775cce1280b60468625df83dd0f260f6
Opcode Fuzzy Hash: 2b704e791cf868b1a81724527ce4058ef44244604f7d98ac77dee455ac60772f
Instruction Fuzzy Hash: FD3112B5504B018FD318DF25C491A6BB7E5BFDC300F81891DE59A8B650DA30F9088B92

Function 01514290 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b7beae770b9ffa159e9e9a099aa66c1e602952cd02999caaadff5ae71bab6db
Instruction ID: f960b8c8ae12e8bbc022b0bab4eecf251bcd217079d94149fff49864bc09b750
Opcode Fuzzy Hash: 2b7beae770b9ffa159e9e9a099aa66c1e602952cd02999caaadff5ae71bab6db
Instruction Fuzzy Hash: BE21F7321047814BD322CE3CC88066BBBE5FF46224F590B6DD9D64BA47C320E50DC791

Function 6C381ED0 Relevance: .1, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: c22733cd489ae54c0db62c70550bb198d7ddb390b655063b3c38db4f4636f43d
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 79113AB724708243D600893DD8B46A7F3A5EBC632DB38437AE1728BE58D323E1459E00

Function 01493E40 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000013E2000.00000020.00000001.01000000.00000003.sdmp, Offset: 013E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13e2000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc281d633757abb1e25df9bd32246cd0c115047ba5503716c0a59fd9e2aa907a
Instruction ID: 22e5c61ec793be3b84c407c6eab48209d7987e519b5809fbb6a4910005246b59
Opcode Fuzzy Hash: dc281d633757abb1e25df9bd32246cd0c115047ba5503716c0a59fd9e2aa907a
Instruction Fuzzy Hash: FF01E773B7182A035B1CC42E9C021AA418757C952439FCB7DED6BEF286F828DC1292D0

Function 6C382FC6 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6C3830CA
_GetRangeOfTrysToCheck.LIBVCRUNTIME ref: 6C383145
___TypeMatch.LIBVCRUNTIME ref: 6C3831B9
___DestructExceptionObject.LIBVCRUNTIME ref: 6C38323E
IsInExceptionSpec.LIBVCRUNTIME ref: 6C383279
FindHandlerForForeignException.LIBVCRUNTIME ref: 6C3832C8
___DestructExceptionObject.LIBVCRUNTIME ref: 6C3832EA
__CxxThrowException@8.LIBVCRUNTIME ref: 6C383302
_UnwindNestedFrames.LIBCMT ref: 6C38330A
___FrameUnwindToState.LIBVCRUNTIME ref: 6C383316
CallUnexpected.LIBVCRUNTIME ref: 6C383321

Strings

csm, xrefs: 6C383074
csm, xrefs: 6C383007
csm, xrefs: 6C3830F9

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Exception$DestructObjectSpecUnwind$CallCheckException@8FindForeignFrameFramesHandlerMatchNestedRangeStateThrowTrysTypeUnexpected
String ID: csm$csm$csm
API String ID: 410073093-393685449
Opcode ID: 93cfc5b0379c0dd86d20842f2a67b316759647f4094a56b87c0881e3fce1ce14
Instruction ID: 361424e15a3a1ef789031f4ea82464e68ae3711a05d0ad71cd29351ad17777c5
Opcode Fuzzy Hash: 93cfc5b0379c0dd86d20842f2a67b316759647f4094a56b87c0881e3fce1ce14
Instruction Fuzzy Hash: 08B1BC708062099FDF50DFA5D840ADEBBB4BF09318F148259E85267B51C336EA49CFA2

Function 6C38BA4E Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6C38BABE
_free.LIBCMT ref: 6C38BAD4
_free.LIBCMT ref: 6C38BAE5
_free.LIBCMT ref: 6C38BAF6
_free.LIBCMT ref: 6C38BB0D
GetCPInfo.KERNEL32(?,?), ref: 6C38BB55

Part of subcall function 6C394A36: _free.LIBCMT ref: 6C394AA1

_free.LIBCMT ref: 6C38BD01
_free.LIBCMT ref: 6C38BD14
_free.LIBCMT ref: 6C38BD22
_free.LIBCMT ref: 6C38BD2D
_free.LIBCMT ref: 6C38BD6F
_free.LIBCMT ref: 6C38BD77
_free.LIBCMT ref: 6C38BD7F
_free.LIBCMT ref: 6C38BD87
_free.LIBCMT ref: 6C38BD95

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 4c33f501aa84616b99d7538ace91a10e5b92ba27f18771de99330ae387a6cdcc
Instruction ID: d600e1eed7861607e7af9e1edc9802434660ba29f8bc6b3f83e58fc081037a00
Opcode Fuzzy Hash: 4c33f501aa84616b99d7538ace91a10e5b92ba27f18771de99330ae387a6cdcc
Instruction Fuzzy Hash: ACB1D271902606AFDB11DF64CC80BEEBBF5FF09308F144169E495AB751DB32994A8F60

Function 6C397EE9 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 6C397F2D

Part of subcall function 6C3998B3: _free.LIBCMT ref: 6C3998D0
Part of subcall function 6C3998B3: _free.LIBCMT ref: 6C3998E2
Part of subcall function 6C3998B3: _free.LIBCMT ref: 6C3998F4
Part of subcall function 6C3998B3: _free.LIBCMT ref: 6C399906
Part of subcall function 6C3998B3: _free.LIBCMT ref: 6C399918
Part of subcall function 6C3998B3: _free.LIBCMT ref: 6C39992A
Part of subcall function 6C3998B3: _free.LIBCMT ref: 6C39993C
Part of subcall function 6C3998B3: _free.LIBCMT ref: 6C39994E
Part of subcall function 6C3998B3: _free.LIBCMT ref: 6C399960
Part of subcall function 6C3998B3: _free.LIBCMT ref: 6C399972
Part of subcall function 6C3998B3: _free.LIBCMT ref: 6C399984
Part of subcall function 6C3998B3: _free.LIBCMT ref: 6C399996
Part of subcall function 6C3998B3: _free.LIBCMT ref: 6C3999A8

_free.LIBCMT ref: 6C397F22

Part of subcall function 6C38CBA5: HeapFree.KERNEL32(00000000,00000000,?,6C39A020,00000000,00000000,00000000,00000000,?,6C39A2C4,00000000,00000007,00000000,?,6C398081,00000000), ref: 6C38CBBB
Part of subcall function 6C38CBA5: GetLastError.KERNEL32(00000000,?,6C39A020,00000000,00000000,00000000,00000000,?,6C39A2C4,00000000,00000007,00000000,?,6C398081,00000000,00000000), ref: 6C38CBCD

_free.LIBCMT ref: 6C397F44
_free.LIBCMT ref: 6C397F59
_free.LIBCMT ref: 6C397F64
_free.LIBCMT ref: 6C397F86
_free.LIBCMT ref: 6C397F99
_free.LIBCMT ref: 6C397FA7
_free.LIBCMT ref: 6C397FB2
_free.LIBCMT ref: 6C397FEA
_free.LIBCMT ref: 6C397FF1
_free.LIBCMT ref: 6C39800E
_free.LIBCMT ref: 6C398026

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: ac2e8e038d539c56935ad87ecdf6173c9a9f2e94f289e804c131b2cdc8f4d53a
Instruction ID: c6cf08953020937b26d1aa2015f811f81245ea5d7728e2776659c615ee29c200
Opcode Fuzzy Hash: ac2e8e038d539c56935ad87ecdf6173c9a9f2e94f289e804c131b2cdc8f4d53a
Instruction Fuzzy Hash: 2D319531606F019FFB226A35D844B9677E5EF41718F304529E49AE7A90FF31A948CF21

Function 6C3625F0 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 300threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?), ref: 6C362686
GetCurrentThreadId.KERNEL32 ref: 6C3626A8
_Smanip.LIBCPMT ref: 6C362716
_Smanip.LIBCPMT ref: 6C36273C
_Smanip.LIBCPMT ref: 6C362788
_Smanip.LIBCPMT ref: 6C3627DF
_Smanip.LIBCPMT ref: 6C36282B
GetTickCount.KERNEL32 ref: 6C362892

Strings

VERBOSE, xrefs: 6C3628E3
)] , xrefs: 6C362913
UNKNOWN, xrefs: 6C3628CF, 6C3628D4

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Smanip$Current$CountProcessThreadTick
String ID: )] $UNKNOWN$VERBOSE
API String ID: 1623629380-3915483136
Opcode ID: 4bcb224f3a0572fbfd76802bb3f26e1b3c1f24ac09bd4499968c5ea8402fa18d
Instruction ID: 7afe6ec320fb3fed762815a590c95fefe299e777636d4815338fc0644f67dca9
Opcode Fuzzy Hash: 4bcb224f3a0572fbfd76802bb3f26e1b3c1f24ac09bd4499968c5ea8402fa18d
Instruction Fuzzy Hash: AEA1D0B0A043019FC710DF66CC45F9AB7E9AF95348F048929F588C7B95EB3295188FA7

Function 6C371CB0 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 265threadCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 6C371CCF
TlsSetValue.KERNEL32(?,?), ref: 6C371CFD
CloseHandle.KERNEL32(?), ref: 6C371D4A
TlsSetValue.KERNEL32(?,00000000), ref: 6C371D72
GetCurrentThreadId.KERNEL32 ref: 6C371E06
AcquireSRWLockExclusive.KERNEL32(?,?,?), ref: 6C371E19
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?), ref: 6C371EDE
AcquireSRWLockExclusive.KERNEL32(?,?,?), ref: 6C371F31
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?), ref: 6C371FBF

Strings

Failed to TlsSetValue()., xrefs: 6C371D28, 6C371D9D
c:\b\build\slave\win\build\src\base\threading\thread_local_win.cc, xrefs: 6C371D14, 6C371D89

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ExclusiveLock$AcquireCloseHandleReleaseValue$CurrentThread
String ID: Failed to TlsSetValue().$c:\b\build\slave\win\build\src\base\threading\thread_local_win.cc
API String ID: 3870014289-1575462531
Opcode ID: 1afa81c6a66abc8c7eec58927c56b942d19661a3e129d5ec706360a48f54a8a7
Instruction ID: 2f007d91c4f2622d6786f01c04028a611d314a6383a5b586a165bd740e37a409
Opcode Fuzzy Hash: 1afa81c6a66abc8c7eec58927c56b942d19661a3e129d5ec706360a48f54a8a7
Instruction Fuzzy Hash: 0C8146769043059BCB20DF61DC44BCA77A8FB55308F040929FD9897A81D77AA54CCFA6

Function 6C3999B1 Relevance: 18.4, APIs: 12, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6C3999F9
_free.LIBCMT ref: 6C399A1D
_free.LIBCMT ref: 6C399A2A
_free.LIBCMT ref: 6C399A4F
_free.LIBCMT ref: 6C399A5C
_free.LIBCMT ref: 6C399A65
_free.LIBCMT ref: 6C399D43
_free.LIBCMT ref: 6C399D4B

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 42b37f9df824651f39ce38dd6cad105397420ae33fd2f46fa4cc054b53401f63
Instruction ID: b886586fec649bae8669b860ed8b92117074da3b3ae823983003923a5ebdcb00
Opcode Fuzzy Hash: 42b37f9df824651f39ce38dd6cad105397420ae33fd2f46fa4cc054b53401f63
Instruction Fuzzy Hash: B2C144B2E40204AFEB20DBA8CC42FDEB7F8AB45744F140165FA54FB681F6709A458F65

Function 6C3A526F Relevance: 17.8, APIs: 2, Strings: 8, Instructions: 305fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C3A6AB6: SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 6C3A6AEE
Part of subcall function 6C3A6AB6: GetLastError.KERNEL32 ref: 6C3A6B07

SetEndOfFile.KERNEL32(?,?,?,?,00000000), ref: 6C3A52F7
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 6C3A5310

Part of subcall function 6C362340: GetLastError.KERNEL32(?,00000000), ref: 6C3623D6

Part of subcall function 6C3A6663: GetLastError.KERNEL32(?,000000FF,0000001C,00000001), ref: 6C3A66A2

Strings

expected to start with , xrefs: 6C3A5546
failed to truncate, xrefs: 6C3A532F
failed to rewind to write, xrefs: 6C3A52CF
failed to write records, xrefs: 6C3A54E2
failed to write header, xrefs: 6C3A53BC
failed to write string table, xrefs: 6C3A55DB
DAPC, xrefs: 6C3A5376
c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc, xrefs: 6C3A52BB, 6C3A531C, 6C3A53A9, 6C3A54CF, 6C3A551B, 6C3A55C8

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorLast$File$Pointer
String ID: expected to start with $DAPC$c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc$failed to rewind to write$failed to truncate$failed to write header$failed to write records$failed to write string table
API String ID: 4162258135-419746783
Opcode ID: 3333c48199f047aa239a703b359ff6e963927efa0fb699bdcf097e442777a153
Instruction ID: f3bb8da745adb1c01fea4f801d9579ce8475e848208a690594acdc2643f2d720
Opcode Fuzzy Hash: 3333c48199f047aa239a703b359ff6e963927efa0fb699bdcf097e442777a153
Instruction Fuzzy Hash: 34A13772A40204AAEB14DBA4DC45FEDB379EF11308F104089E589B7ED1DF366959CF21

Function 6C366AE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

new.LIBCMT ref: 6C366B06

Strings

SVWj, xrefs: 6C366B56

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID: SVWj
API String ID: 0-3360714375
Opcode ID: 682262d66ba932ee0f28f1c2cee2a640181a03fc11cc0861f8c8ef878ed1f807
Instruction ID: 4b30102e1a8127b8e9371cb5a287291a6f320f29d6d4bf580a401822de3a85c4
Opcode Fuzzy Hash: 682262d66ba932ee0f28f1c2cee2a640181a03fc11cc0861f8c8ef878ed1f807
Instruction Fuzzy Hash: 57312636A052009BD710DB6BC48099D73B8EB543ACB1402A9D845DBF15DB32EA45CFD6

Function 6C3A77EB Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 112COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,6C3A763E,000000FF,?,?), ref: 6C3A7814

Part of subcall function 6C3A7928: OutputDebugStringW.KERNEL32(6C3BEDD8,?,6C3A7900,Failed to create directory %ls, last error is %d,?,000000B7), ref: 6C3A7949

Strings

Failed to create one of the parent directories, xrefs: 6C3A78BF
%hs( %ls directory conflicts with an existing file. ), xrefs: 6C3A7839
install_static::`anonymous-namespace'::RecursiveDirectoryCreate, xrefs: 6C3A781C
Failed to create directory %ls, last error is %d, xrefs: 6C3A78F6
%hs( %ls directory exists ), xrefs: 6C3A7825

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: AttributesDebugFileOutputString
String ID: %hs( %ls directory conflicts with an existing file. )$%hs( %ls directory exists )$Failed to create directory %ls, last error is %d$Failed to create one of the parent directories$install_static::`anonymous-namespace'::RecursiveDirectoryCreate
API String ID: 708965821-2569357656
Opcode ID: b94b2295a15e39d056063237d9e8c1dd4ec80f9ae3a3a132ab7224d613143b57
Instruction ID: 7066f9d7474783e364d20d3488d14b76ff10c0a45f0020e0ffb64f2e2aee8efd
Opcode Fuzzy Hash: b94b2295a15e39d056063237d9e8c1dd4ec80f9ae3a3a132ab7224d613143b57
Instruction Fuzzy Hash: 4931C731A11105AADF049AE5DC85FEE777CDF13328F10051AE464A2EC4DB35592BCEA7

Function 6C37D530 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

new.LIBCMT ref: 6C37D54D

Part of subcall function 6C372A20: GetCurrentProcess.KERNEL32(00000000), ref: 6C372A4E
Part of subcall function 6C372A20: GetModuleHandleW.KERNEL32(kernel32.dll,IsWow64Process), ref: 6C372A64
Part of subcall function 6C372A20: GetProcAddress.KERNEL32(00000000), ref: 6C372A6B
Part of subcall function 6C372A20: GetVersionExW.KERNEL32(0000011C), ref: 6C372AE0
Part of subcall function 6C372A20: GetNativeSystemInfo.KERNEL32(?), ref: 6C372B3C

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6C37D5B7
GetProcAddress.KERNEL32(00000000,InitializeProcThreadAttributeList), ref: 6C37D5CB
GetProcAddress.KERNEL32(00000000,UpdateProcThreadAttribute), ref: 6C37D5D8
GetProcAddress.KERNEL32(00000000,DeleteProcThreadAttributeList), ref: 6C37D5E5

Strings

kernel32.dll, xrefs: 6C37D5B2
InitializeProcThreadAttributeList, xrefs: 6C37D5C5
DeleteProcThreadAttributeList, xrefs: 6C37D5DA
UpdateProcThreadAttribute, xrefs: 6C37D5CD

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: AddressProc$HandleModule$CurrentInfoNativeProcessSystemVersion
String ID: DeleteProcThreadAttributeList$InitializeProcThreadAttributeList$UpdateProcThreadAttribute$kernel32.dll
API String ID: 4189602493-1491343547
Opcode ID: 58c6c2c0321a53d1250457a06c0a3501517e1cc69f4383e8b0b7f2d337979ccf
Instruction ID: 560686af53291cbe1cf78e7c1b9601f7f3a2486a5aafc1a8012f0f63fffef9dd
Opcode Fuzzy Hash: 58c6c2c0321a53d1250457a06c0a3501517e1cc69f4383e8b0b7f2d337979ccf
Instruction Fuzzy Hash: A01104F1B053809BEF208B658C4475B3AB8EB9633DF10043EE50197A40DB7D5844CF6A

Function 6C38FA90 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6C38FAA4

Part of subcall function 6C38CBA5: HeapFree.KERNEL32(00000000,00000000,?,6C39A020,00000000,00000000,00000000,00000000,?,6C39A2C4,00000000,00000007,00000000,?,6C398081,00000000), ref: 6C38CBBB
Part of subcall function 6C38CBA5: GetLastError.KERNEL32(00000000,?,6C39A020,00000000,00000000,00000000,00000000,?,6C39A2C4,00000000,00000007,00000000,?,6C398081,00000000,00000000), ref: 6C38CBCD

_free.LIBCMT ref: 6C38FAB0
_free.LIBCMT ref: 6C38FABB
_free.LIBCMT ref: 6C38FAC6
_free.LIBCMT ref: 6C38FAD1
_free.LIBCMT ref: 6C38FADC
_free.LIBCMT ref: 6C38FAE7
_free.LIBCMT ref: 6C38FAF2
_free.LIBCMT ref: 6C38FAFD
_free.LIBCMT ref: 6C38FB0B

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3a66db7868b29ab46d9be5706cfb0f6196260c4ab0a3226f5cc42d1425d44105
Instruction ID: bc00e413ad60a2a8f30872d2805853d6e0a43b88f05f99ad7fffecdfb0481781
Opcode Fuzzy Hash: 3a66db7868b29ab46d9be5706cfb0f6196260c4ab0a3226f5cc42d1425d44105
Instruction Fuzzy Hash: 8C11BCB5212908BFDB02EF54D881CD93F66EF48654B2142A1BA884F621DB31DB589F42

Function 6C361E30 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 190fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,?), ref: 6C361E54

Part of subcall function 6C37FC31: std::invalid_argument::invalid_argument.LIBCONCRT ref: 6C37FC3D
Part of subcall function 6C37FC31: __CxxThrowException@8.LIBVCRUNTIME ref: 6C37FC4B

new.LIBCMT ref: 6C361F48
CreateFileW.KERNEL32(?,00000004,00000003,00000000,00000004,00000080,00000000), ref: 6C361F81
CreateFileW.KERNEL32(?,00000004,00000003,00000000,00000004,00000080,00000000,?,debug.log), ref: 6C362032

Strings

\, xrefs: 6C361EAB
@1su, xrefs: 6C361F81, 6C362032
invalid string position, xrefs: 6C361EFC
debug.log, xrefs: 6C361EDF, 6C361FC2

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: File$Create$Exception@8ModuleNameThrowstd::invalid_argument::invalid_argument
String ID: @1su$\$debug.log$invalid string position
API String ID: 3749634790-3473598416
Opcode ID: 05c2ed80526d33d57c4e0d6cb1e64e241954b4edc3e5c8b47812d19fef9f7ba4
Instruction ID: 48b7532057f75f1752f175277fa9ac6dc5dee0ffeb5a20692549dfea4cee3e7b
Opcode Fuzzy Hash: 05c2ed80526d33d57c4e0d6cb1e64e241954b4edc3e5c8b47812d19fef9f7ba4
Instruction Fuzzy Hash: E3510474A013049BDB10DF75C848BAD77B8AF05308F200619E962ABED4EB719908CF95

Function 015FC0E2 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

___initmbctable.LIBCMT ref: 015FC0EA

Part of subcall function 015F668B: __setmbcp.LIBCMT ref: 015F6696

__calloc_crt.LIBCMT ref: 015FC11F
__invoke_watson.LIBCMT ref: 015FC1B7

Part of subcall function 015F5B46: __call_reportfault.LIBCMT ref: 015F5B53

Strings

, xrefs: 015FC23F

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000015EF000.00000020.00000001.01000000.00000003.sdmp, Offset: 015EF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15ef000__AnyDesk.jbxd

Similarity

API ID: ___initmbctable__call_reportfault__calloc_crt__invoke_watson__setmbcp
String ID:
API String ID: 1808350796-3916222277
Opcode ID: 6f0470ed17b3074adbd87ccd86fe7d8338fce07dfa1a1f68afd6b063435464dc
Instruction ID: eb9213b660dc8e5a10506806af64b0b3d5711319b421c1d26a2d304bc4748fe6
Opcode Fuzzy Hash: 6f0470ed17b3074adbd87ccd86fe7d8338fce07dfa1a1f68afd6b063435464dc
Instruction Fuzzy Hash: 4C41167280834E9FEB319E7C9804FAE7BE5BF59320F24056DDB848F185E6708550C760

Function 6C39C926 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3377520aa48fa864ebbc7ff4beb0db75bb4f73f353b36e197b43651429f740cd
Instruction ID: a8d627cfaedf1dcf0766adfde3a88d8af2be9b7cebe5c2a89b751e436bc32f03
Opcode Fuzzy Hash: 3377520aa48fa864ebbc7ff4beb0db75bb4f73f353b36e197b43651429f740cd
Instruction Fuzzy Hash: 93C1D270E05249AFDB01EFACE840BEDBBB5BF0A318F144189E450A7781E7359946CFA1

Function 6C39BE3D Relevance: 13.8, APIs: 9, Instructions: 272COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6C39BB7C: CreateFileW.KERNEL32(00000000,00000000,?,6C39BEE6,?,?,00000000,?,6C39BEE6,00000000,0000000C), ref: 6C39BB99

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C39BF51
__dosmaperr.LIBCMT ref: 6C39BF58
GetFileType.KERNEL32(00000000), ref: 6C39BF64
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C39BF6E
__dosmaperr.LIBCMT ref: 6C39BF77
CloseHandle.KERNEL32(00000000), ref: 6C39BF97
CloseHandle.KERNEL32(?), ref: 6C39C0E1
GetLastError.KERNEL32 ref: 6C39C113
__dosmaperr.LIBCMT ref: 6C39C11A

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: 52990b0baca609f375849df0383686cfb3697271e8c3eb65a2bde17bf5302627
Instruction ID: 89e8e2f20f2b10b2458d364b8410e8c12cfb31b4dddcc0da8fb91ccc74414967
Opcode Fuzzy Hash: 52990b0baca609f375849df0383686cfb3697271e8c3eb65a2bde17bf5302627
Instruction Fuzzy Hash: 57A14532A141488FDF199F6CD850BAD7BB9AB07328F140149E811AF3D1E7359816CFA2

Function 6C3977D1 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 6C3977F8
_free.LIBCMT ref: 6C397863
_free.LIBCMT ref: 6C397889
_free.LIBCMT ref: 6C3978B2
_free.LIBCMT ref: 6C3978EA
_free.LIBCMT ref: 6C39791B
_free.LIBCMT ref: 6C39795C
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 6C3979DD
_free.LIBCMT ref: 6C3979F6

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 40a6dbabdd48450a17c6c98c0aeaa9e527fd1e0c45fb7ba489a5e728c4dab335
Instruction ID: 35129977f239efd98dcc187e5b7be423304e8c7e4cac4bd43725d433f536d850
Opcode Fuzzy Hash: 40a6dbabdd48450a17c6c98c0aeaa9e527fd1e0c45fb7ba489a5e728c4dab335
Instruction Fuzzy Hash: C9613C71B0A7056FEB119F6988416A97BB8DF03318F1402ADE894977C0F7368608CF92

Function 6C38018B Relevance: 13.7, APIs: 9, Instructions: 200COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?), ref: 6C3801D4
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?), ref: 6C380268
___crtCompareStringEx.LIBCPMT ref: 6C380282
___crtCompareStringEx.LIBCPMT ref: 6C3802BE
___crtCompareStringEx.LIBCPMT ref: 6C380337
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 6C380352
__freea.LIBCMT ref: 6C38035F

Part of subcall function 6C38C844: HeapAlloc.KERNEL32(00000000,0000010C,00000004,?,6C38C8A7,?,00000000,?,6C397B70,0000010C,00000004,?,0000010C,?,?,6C38DB9D), ref: 6C38C876

__freea.LIBCMT ref: 6C380372
__freea.LIBCMT ref: 6C38037D

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ByteCharCompareMultiStringWide___crt__freea$AllocHeap
String ID:
API String ID: 2499053095-0
Opcode ID: fb8e660066e9932664fbd228eca17cf1174d2a30fdea73d78dbe716abf4b6284
Instruction ID: 92622a60956fd76bc299f14398a56c8ab4b9810dac80b046b789983ceb202162
Opcode Fuzzy Hash: fb8e660066e9932664fbd228eca17cf1174d2a30fdea73d78dbe716abf4b6284
Instruction Fuzzy Hash: 6C510372A0328AAFEF118FA4CCC0DDE7BB9EF41758B104229EA14D6550DBB5C994CF90

Function 6C39F383 Relevance: 13.6, APIs: 9, Instructions: 77COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000400,00000001,?,00000000,00000000), ref: 6C39F396
OpenProcessToken.ADVAPI32(00000000,00000008,?,00000000), ref: 6C39F3B3
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 6C39F3CF
GetLastError.KERNEL32 ref: 6C39F3D5
GetLastError.KERNEL32 ref: 6C39F3E0
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,?,?), ref: 6C39F406
ConvertSidToStringSidW.ADVAPI32(?,?), ref: 6C39F420
CloseHandle.KERNEL32(?), ref: 6C39F43C
CloseHandle.KERNEL32(00000000), ref: 6C39F443

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Token$CloseErrorHandleInformationLastOpenProcess$ConvertString
String ID:
API String ID: 1608810797-0
Opcode ID: fd339e5ec3783e3be3a6a43e57a864239d24f25f9bce8a9e0b5f3f2d3d764e8b
Instruction ID: c08f8a3672185e82a62d0f46a064d2b1126cdc70364017ca9a0d9b166dd500c4
Opcode Fuzzy Hash: fd339e5ec3783e3be3a6a43e57a864239d24f25f9bce8a9e0b5f3f2d3d764e8b
Instruction Fuzzy Hash: DC217C32A41108BFEF019FA5DC84AEE7BBDEF0A308F104155F911E6150E7728E659F60

Function 6C37E6F0 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 349COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 6C37E754
GetWindowsDirectoryW.KERNEL32(?,00000104,00000000,?), ref: 6C37E798
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 6C37E7DB

Strings

ProgramW6432, xrefs: 6C37E84B
Quick Launch, xrefs: 6C37EAF5
Microsoft, xrefs: 6C37EB1D
Internet Explorer, xrefs: 6C37EB09

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Directory$FileModuleNameSystemWindows
String ID: Internet Explorer$Microsoft$ProgramW6432$Quick Launch
API String ID: 592745672-224070340
Opcode ID: 4a8fae4661b0819c685d68c4cc81de711d2201e425b660cfc9c6cd96225c6c9e
Instruction ID: 03f8d0593ef1dd4fca78f960f315b7aba9111a43f1c912aa9096104c8056130b
Opcode Fuzzy Hash: 4a8fae4661b0819c685d68c4cc81de711d2201e425b660cfc9c6cd96225c6c9e
Instruction Fuzzy Hash: 7DC16D30248340ABE624DB65CC55FEE77ECAF41748F50092DF29196AD0EB66A508CEB7

Function 6C39EEFE Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 6C39EF1F
RegCreateKeyExW.ADVAPI32(80000002,SOFTWARE\Google\No Chrome Offer Until,00000000,00000000,00000000,0002001F,00000000,?,?,00000000), ref: 6C39EF81
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?,?,00000000), ref: 6C39EFD4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 6C39F03D

Strings

SOFTWARE\Google\No Chrome Offer Until, xrefs: 6C39EF6F

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: CloseCreateFileModuleNameQueryValue
String ID: SOFTWARE\Google\No Chrome Offer Until
API String ID: 2815806617-1538224596
Opcode ID: 523e29f534505d2bd5ee7c83b5666748b912061adf7b575b8be049ef08bb389d
Instruction ID: f4e0052e207c6579b60ac620899ce5482de3efbfd84aa1964ee1bd71090f9866
Opcode Fuzzy Hash: 523e29f534505d2bd5ee7c83b5666748b912061adf7b575b8be049ef08bb389d
Instruction Fuzzy Hash: E43123F1A41218ABDB20CB51DC49FEAB7BCFB49304F4041EAF609A6141E7715A89CFA4

Function 6C3A411C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 98fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000004,00000080,00000000,?), ref: 6C3A4149
LockFileEx.KERNEL32(00000000,00000002,00000000,000000FF,000000FF,?), ref: 6C3A417F
GetLastError.KERNEL32 ref: 6C3A4198
new.LIBCMT ref: 6C3A41D9

Strings

@1su, xrefs: 6C3A4149
LockFileEx, xrefs: 6C3A41B8
c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc, xrefs: 6C3A41A5

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: File$CreateErrorLastLock
String ID: @1su$LockFileEx$c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc
API String ID: 3875127904-1313365825
Opcode ID: e34577e6802ec8273f212b4f9317ecf1e3255f0fcea32a0c4b18adfcd6deba28
Instruction ID: 82ae64c642dd5fff092c728784e458662452c9e91e92dc7cf7c9018131358232
Opcode Fuzzy Hash: e34577e6802ec8273f212b4f9317ecf1e3255f0fcea32a0c4b18adfcd6deba28
Instruction Fuzzy Hash: 9D31D171600314BFD7208FF9CC45B9AB7A8EB05728F100629E664ABAC0DA71E9158FA1

Function 6C3A6B55 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 78fileCOMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(6C3A6322,6C3A6322,0000001C,?,00000000,00000001), ref: 6C3A6B7A
GetLastError.KERNEL32 ref: 6C3A6B93
SetEndOfFile.KERNEL32(6C3A6322), ref: 6C3A6BE1
GetLastError.KERNEL32 ref: 6C3A6BFA

Strings

c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc, xrefs: 6C3A6BA0, 6C3A6C07
SetEndOfFile, xrefs: 6C3A6C1A
SetFilePointerEx, xrefs: 6C3A6BB3

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorFileLast$Pointer
String ID: SetEndOfFile$SetFilePointerEx$c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc
API String ID: 1697706070-3222943609
Opcode ID: b3e049919b3388440e54e197a67dbf7e81e6428170d3004c862dc330658b791c
Instruction ID: 3bfb396cabc763a7abfc2c877305eeb4c6386dab6d4abed8015857146cc40972
Opcode Fuzzy Hash: b3e049919b3388440e54e197a67dbf7e81e6428170d3004c862dc330658b791c
Instruction Fuzzy Hash: 3521F371940209BAEB009FEACD46FED7778EF0135CF104945E544B6DC2DB3356AA4E26

Function 015EF544 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 015EF54A
___fls_getvalue@4.LIBCMT ref: 015EF555
___fls_setvalue@8.LIBCMT ref: 015EF568
__freefls@4.LIBCMT ref: 015EF59E
___set_flsgetvalue.LIBCMT ref: 015EF5CE
__calloc_crt.LIBCMT ref: 015EF5DA
__getptd.LIBCMT ref: 015EF5E7
__dosmaperr.LIBCMT ref: 015EF63C

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000015EF000.00000020.00000001.01000000.00000003.sdmp, Offset: 015EF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15ef000__AnyDesk.jbxd

Similarity

API ID: ___set_flsgetvalue$___fls_getvalue@4___fls_setvalue@8__calloc_crt__dosmaperr__freefls@4__getptd
String ID:
API String ID: 1998086043-0
Opcode ID: 312d020c226b9ffae59afb814256b8f7719b623d56735e151eb7609d753073f6
Instruction ID: 82b6f62e75f88dd5f322b67c60d9b1916d83a37d1973bcf028a15b67de6c86c4
Opcode Fuzzy Hash: 312d020c226b9ffae59afb814256b8f7719b623d56735e151eb7609d753073f6
Instruction Fuzzy Hash: CC31AE72904747AFDB19BFB5DD0885E3BE9FFA4224720842AFA558F151DF70D8118BA0

Function 6C3903A9 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6C39042B
_free.LIBCMT ref: 6C39044F
_free.LIBCMT ref: 6C3905D6
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,6C3AF9F4), ref: 6C3905E8
WideCharToMultiByte.KERNEL32(00000000,00000000,6C3BEC4C,000000FF,00000000,0000003F,00000000,?,?), ref: 6C390660
WideCharToMultiByte.KERNEL32(00000000,00000000,6C3BECA0,000000FF,?,0000003F,00000000,?), ref: 6C39068D
_free.LIBCMT ref: 6C3907A2

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: a9311131a17fd9f4e01c4298d77590e4a09efd0c673c2abb682030c018e1a277
Instruction ID: d927c90d5face74de6bd9e6cda611b7acee2c02726bd7b9c1bcc3fe479129cfc
Opcode Fuzzy Hash: a9311131a17fd9f4e01c4298d77590e4a09efd0c673c2abb682030c018e1a277
Instruction Fuzzy Hash: DEC13872A05284AFDB009F6DC840AEE7BBCEF8A318F24419AD5D0D7A41F7319A45CF95

Function 6C3759B0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 291COMMON

Download Yara Rule

APIs

Part of subcall function 6C374CA0: AcquireSRWLockExclusive.KERNEL32(00000000,00000001,0000000F), ref: 6C374CBC
Part of subcall function 6C374CA0: ReleaseSRWLockExclusive.KERNEL32(00000000), ref: 6C374D21

Part of subcall function 6C374E80: AcquireSRWLockExclusive.KERNEL32(00000000,00000000,00000000,00000000), ref: 6C374EDB
Part of subcall function 6C374E80: ReleaseSRWLockExclusive.KERNEL32(00000000), ref: 6C374F0A
Part of subcall function 6C374E80: AcquireSRWLockExclusive.KERNEL32(00000000,00000000,00000000,00000000), ref: 6C374FCD
Part of subcall function 6C374E80: ReleaseSRWLockExclusive.KERNEL32(00000000), ref: 6C37500A

AcquireSRWLockExclusive.KERNEL32(00000000), ref: 6C375BFA
ReleaseSRWLockExclusive.KERNEL32(00000000), ref: 6C375C1E
AcquireSRWLockExclusive.KERNEL32(00000000), ref: 6C375C47
ReleaseSRWLockExclusive.KERNEL32(00000000), ref: 6C375C6B

Strings

Gp7l, xrefs: 6C375A25, 6C375A41, 6C375C24, 6C375B99, 6C375B4C, 6C375A2A, 6C375C31
Gp7l, xrefs: 6C3759B9, 6C375B65, 6C375BAF

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: Gp7l$Gp7l
API String ID: 17069307-1344844634
Opcode ID: d83bdc0507e374689d74a07b0235d16df00d14274ba7a9e0c6fb7d708ae81b31
Instruction ID: 3cbdc1654d0cb6c445d5ede06453b885ce40b925c5050fe11b7a708a93b5f644
Opcode Fuzzy Hash: d83bdc0507e374689d74a07b0235d16df00d14274ba7a9e0c6fb7d708ae81b31
Instruction Fuzzy Hash: FEB19271F00609DBCF59CF68D4907AEB7B5BF85308F14822AD405ABB40DB399945CFAA

Function 6C39DDCB Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00CB6B00,00CB6B00,?,7FFFFFFF,?,?,6C39E0A4,00CB6B00,00CB6B00,?,00CB6B00,?,?,?,?,00CB6B00), ref: 6C39DE77
MultiByteToWideChar.KERNEL32(00CB6B00,00000009,00CB6B00,00CB6B00,00000000,00000000,?,6C39E0A4,00CB6B00,00CB6B00,?,00CB6B00,?,?,?,?), ref: 6C39DEFA
MultiByteToWideChar.KERNEL32(00CB6B00,00000001,00CB6B00,00CB6B00,00000000,6C39E0A4,?,6C39E0A4,00CB6B00,00CB6B00,?,00CB6B00,?,?,?,?), ref: 6C39DF8D
MultiByteToWideChar.KERNEL32(00CB6B00,00000009,00CB6B00,00CB6B00,00000000,00000000,?,6C39E0A4,00CB6B00,00CB6B00,?,00CB6B00,?,?,?,?), ref: 6C39DFA4

Part of subcall function 6C38C844: HeapAlloc.KERNEL32(00000000,0000010C,00000004,?,6C38C8A7,?,00000000,?,6C397B70,0000010C,00000004,?,0000010C,?,?,6C38DB9D), ref: 6C38C876

MultiByteToWideChar.KERNEL32(00CB6B00,00000001,00CB6B00,00CB6B00,00000000,00CB6B00,?,6C39E0A4,00CB6B00,00CB6B00,?,00CB6B00,?,?,?,?), ref: 6C39E020
__freea.LIBCMT ref: 6C39E04B
__freea.LIBCMT ref: 6C39E057

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocHeapInfo
String ID:
API String ID: 2171645-0
Opcode ID: e717bd499e8cdc41e4677792434a1fa0d05988805b875e46d746e735ba5fd36b
Instruction ID: 734f823c846412901131859056bda12b972a01af7c8a6eb2b346795efc0deb9a
Opcode Fuzzy Hash: e717bd499e8cdc41e4677792434a1fa0d05988805b875e46d746e735ba5fd36b
Instruction Fuzzy Hash: 22911772E013069FDF108EA5C842EEE7BB9AF19758F144619E910E7680FB36C844CFA0

Function 6C399DD6 Relevance: 10.7, APIs: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6C399E45
_free.LIBCMT ref: 6C399E53
_free.LIBCMT ref: 6C399F81
_free.LIBCMT ref: 6C399F8C

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 01b8b9dfd98981869a0ff76901396e38369db73f493a1b94f1a37af247ac0258
Instruction ID: 291e39357ac5daa43d94856a3b853e1e65f4af41f03b58e036a749154f3a0a75
Opcode Fuzzy Hash: 01b8b9dfd98981869a0ff76901396e38369db73f493a1b94f1a37af247ac0258
Instruction Fuzzy Hash: 2B61D071E05305AFEB20CF68C841B9EFBF9AF45714F140169E89AEB640F73199418F90

Function 6C389040 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,6C3897B5,?,?,?,?,?,?), ref: 6C389082
__fassign.LIBCMT ref: 6C3890FD
__fassign.LIBCMT ref: 6C389118
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,00000005,00000000,00000000), ref: 6C38913E
WriteFile.KERNEL32(?,?,00000000,6C3897B5,00000000,?,?,?,?,?,?,?,?,?,6C3897B5,?), ref: 6C38915D
WriteFile.KERNEL32(?,?,00000001,6C3897B5,00000000,?,?,?,?,?,?,?,?,?,6C3897B5,?), ref: 6C389196

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 6be3975c426ac4b817e94c4aa3a816aa9c06358890ae1ac1ac63dc7d3da4e1bd
Instruction ID: 9b24a7c6f8decb416ca1c2c0746afb05ac94fd3fa035a8a582ab74f2076e8b4e
Opcode Fuzzy Hash: 6be3975c426ac4b817e94c4aa3a816aa9c06358890ae1ac1ac63dc7d3da4e1bd
Instruction Fuzzy Hash: 8551C271A05309AFDF00CFA8C885AEEBBF8EF0A300F14415AE955E7281D731A941CFA1

Function 6C37B420 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 146COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 6C37B4AA
new.LIBCMT ref: 6C37B508
new.LIBCMT ref: 6C37B575

Strings

null, xrefs: 6C37B4B8
false, xrefs: 6C37B52D
true, xrefs: 6C37B45C

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID: false$null$true
API String ID: 0-2913297407
Opcode ID: 7b608706f956fd433b32c1dcbb34feffdece2d6b9952f48c290348052851981c
Instruction ID: cb15c97413748a2b533af981a24af925a273562af85220243d647e28da31579a
Opcode Fuzzy Hash: 7b608706f956fd433b32c1dcbb34feffdece2d6b9952f48c290348052851981c
Instruction Fuzzy Hash: 695103769043099FD720CF68C440BDAF7F4EF45318F04866AC8959BA01E736A649CF65

Function 6C3A02FF Relevance: 10.6, APIs: 7, Instructions: 141sleepCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?), ref: 6C3A0349
CoUninitialize.OLE32(00000001,00000000,?,00000000), ref: 6C3A038E
LaunchGoogleChrome.GCAPI(00000001,00000000,?,00000000), ref: 6C3A0381

Part of subcall function 6C39FFEC: CoInitializeEx.OLE32(00000000,00000002), ref: 6C3A0024
Part of subcall function 6C39FFEC: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000002,00000000,00000040,00000000), ref: 6C3A0039
Part of subcall function 6C39FFEC: GetCurrentProcessId.KERNEL32(?), ref: 6C3A0064
Part of subcall function 6C39FFEC: GetShellWindow.USER32 ref: 6C3A0087
Part of subcall function 6C39FFEC: GetWindowThreadProcessId.USER32(00000000), ref: 6C3A008E
Part of subcall function 6C39FFEC: LocalFree.KERNEL32(?), ref: 6C3A00A2
Part of subcall function 6C39FFEC: CoUninitialize.OLE32 ref: 6C3A02D1

CoUninitialize.OLE32(00000001,00000000,?,00000000), ref: 6C3A03AF
LaunchGoogleChrome.GCAPI ref: 6C3A03C9
EnumWindows.USER32(6C39F056,?), ref: 6C3A044C
Sleep.KERNEL32(0000000A), ref: 6C3A046A

Part of subcall function 6C3688E0: new.LIBCMT ref: 6C368900
Part of subcall function 6C3688E0: new.LIBCMT ref: 6C36893C
Part of subcall function 6C3688E0: new.LIBCMT ref: 6C368979

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: InitializeUninitialize$ChromeGoogleLaunchProcessWindow$CurrentEnumFreeLocalSecurityShellSleepThreadWindows
String ID:
API String ID: 1477501081-0
Opcode ID: af1eaf7a8c5faf3592bd7e8f5e8cfee49b466b15cbffe7cea85ac41163a4a463
Instruction ID: e1fcc265b07eb29e00f9eb8aeda289c4998ccf5bf710a2e3b43c0be38a898d91
Opcode Fuzzy Hash: af1eaf7a8c5faf3592bd7e8f5e8cfee49b466b15cbffe7cea85ac41163a4a463
Instruction Fuzzy Hash: 5A519171D052889FCF00DFE5E890ADDBBB8EF05318F14012AE962A7AC1DB75591ACF51

Function 6C3A767F Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(%LOCALAPPDATA%,00000000,00000000,00000000,?,?,?,?,?,?,?,6C3A7616,?,6C3AFB90,000000FF,6C3B8A68), ref: 6C3A769E
ExpandEnvironmentStringsW.KERNEL32(%LOCALAPPDATA%,00000000,00000000,?,?,?,?,?,6C3A7616,?,6C3AFB90,000000FF,6C3B8A68,00000000,Software\Google\Update\ClientState), ref: 6C3A76C8
GetTempPathW.KERNEL32(00000000,00000000,?,?,?,?,?,6C3A7616,?,6C3AFB90,000000FF,6C3B8A68,00000000,Software\Google\Update\ClientState), ref: 6C3A76E9
GetTempPathW.KERNEL32(00000001,00000000,?,?,?,?,?,6C3A7616,?,6C3AFB90,000000FF,6C3B8A68,00000000,Software\Google\Update\ClientState), ref: 6C3A7718

Strings

User Data, xrefs: 6C3A778C, 6C3A7791, 6C3A7799
%LOCALAPPDATA%, xrefs: 6C3A7699, 6C3A76C3

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: EnvironmentExpandPathStringsTemp
String ID: %LOCALAPPDATA%$User Data
API String ID: 442586119-612141592
Opcode ID: 4ba2a60b5e10a998daf876fbbb5d3b23f4c8715dafc048e0a1f5039ad78bf77c
Instruction ID: 765d16026da5c0e621484d4d24571be009cad703633e96df7bcec761fbaf2f20
Opcode Fuzzy Hash: 4ba2a60b5e10a998daf876fbbb5d3b23f4c8715dafc048e0a1f5039ad78bf77c
Instruction Fuzzy Hash: EE3127317021006EDB149AB99C99EFF77BCDF42658B10012EE812DBA88DF36CC158DB1

Function 6C39F1A9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?,?,00000000,00000000,?,6C39EF48,?,?,00000208), ref: 6C39F1D9
GetFileVersionInfoW.VERSION(?,?,00002000,?,?,?,00000208), ref: 6C39F217
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,00002000,?,?,?,00000208), ref: 6C39F24A
VerQueryValueW.VERSION(?,?,?,?,\VarFileInfo\Translation,?,?,?,?,00002000,?,?,?,00000208), ref: 6C39F2C1

Strings

\StringFileInfo\%02X%02X%02X%02X\CompanyName, xrefs: 6C39F286
\VarFileInfo\Translation, xrefs: 6C39F23E

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: FileInfoQueryValueVersion$Size
String ID: \StringFileInfo\%02X%02X%02X%02X\CompanyName$\VarFileInfo\Translation
API String ID: 2099394744-937506062
Opcode ID: d1a6e67e5de13136975f2f8e4e21da924357b3a6e6212316d32fa49b5e64a264
Instruction ID: 710169712c08b69e928881b9358acc92038adbf23f1ee2f9eac7765cd50f1648
Opcode Fuzzy Hash: d1a6e67e5de13136975f2f8e4e21da924357b3a6e6212316d32fa49b5e64a264
Instruction Fuzzy Hash: B831A5F9A01218ABDB20DE55CC44EDB73FCAB48204F9005D6FA64E3A41EA35DA45CF66

Function 6C367950 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

__Getcvt.LIBCPMT ref: 6C367968
__Getcvt.LIBCPMT ref: 6C36799A

Strings

false, xrefs: 6C3679B6
true, xrefs: 6C3679E9

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Getcvt
String ID: false$true
API String ID: 1921796781-2658103896
Opcode ID: 39072ebe73fbe7e3258b3008fdfce8fc0d2f345f25f38f259a36948538743012
Instruction ID: 387ceec80c1ffa1db45a9f6c78e43a9653b1195d50731596a755d6ab32a60a75
Opcode Fuzzy Hash: 39072ebe73fbe7e3258b3008fdfce8fc0d2f345f25f38f259a36948538743012
Instruction Fuzzy Hash: 4B3138359042445FDB10CFA9C4407AABFE5AF47318F18809ED9945FF4AD6B7D9088FA2

Function 6C3674E0 Relevance: 10.6, APIs: 7, Instructions: 87COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6C3674EE
std::_Lockit::_Lockit.LIBCPMT ref: 6C36750A
std::_Lockit::~_Lockit.LIBCPMT ref: 6C36752A
std::_Lockit::~_Lockit.LIBCPMT ref: 6C367571
std::_Facet_Register.LIBCPMT ref: 6C3675AD
std::_Lockit::~_Lockit.LIBCPMT ref: 6C3675B8
_abort.LIBCMT ref: 6C3675C6

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Register_abort
String ID:
API String ID: 954195503-0
Opcode ID: e62d6a0fa5610bed79dd7d49c07a2c441d9454c82541c7f9602a0ecb5367b42a
Instruction ID: d9b9ad26617a736d1f5788118c16fd27da4101e62ca31190ebbdf010e52cfe88
Opcode Fuzzy Hash: e62d6a0fa5610bed79dd7d49c07a2c441d9454c82541c7f9602a0ecb5367b42a
Instruction Fuzzy Hash: E631F275A041149FCB20DF5AC88099DB3B8EF4A328B5401DAD94997F14DB31BE0ACFD6

Function 6C37E580 Relevance: 10.6, APIs: 7, Instructions: 87COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6C37E58E
std::_Lockit::_Lockit.LIBCPMT ref: 6C37E5AA
std::_Lockit::~_Lockit.LIBCPMT ref: 6C37E5CA
std::_Lockit::~_Lockit.LIBCPMT ref: 6C37E611
std::_Facet_Register.LIBCPMT ref: 6C37E64D
std::_Lockit::~_Lockit.LIBCPMT ref: 6C37E658
_abort.LIBCMT ref: 6C37E666

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Register_abort
String ID:
API String ID: 954195503-0
Opcode ID: 4ff84ea00cc400c1d551c5329218b7e618b67143c128cbc6414a1413f01d2109
Instruction ID: a82bb9c934137742a40a63d48cf117a323a69ccdaddefc764f09026b30c2f2e2
Opcode Fuzzy Hash: 4ff84ea00cc400c1d551c5329218b7e618b67143c128cbc6414a1413f01d2109
Instruction Fuzzy Hash: B631C031A052149FCB21DF58D4809DDB7B8EB05328F144199D8459BB10DB36BF06CFEA

Function 6C3673E0 Relevance: 10.6, APIs: 7, Instructions: 87COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6C3673EE
std::_Lockit::_Lockit.LIBCPMT ref: 6C36740A
std::_Lockit::~_Lockit.LIBCPMT ref: 6C36742A
std::_Lockit::~_Lockit.LIBCPMT ref: 6C367471
std::_Facet_Register.LIBCPMT ref: 6C3674AD
std::_Lockit::~_Lockit.LIBCPMT ref: 6C3674B8
_abort.LIBCMT ref: 6C3674C6

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Register_abort
String ID:
API String ID: 954195503-0
Opcode ID: d343c405fc365bf983ec300c122f1c2564ec618b68c0bfd4875bbc4ce6365c48
Instruction ID: 14bbb7b59251906df8165ec7f66d4abaf0c3b382f8d9cdf67ae0145121adac6d
Opcode Fuzzy Hash: d343c405fc365bf983ec300c122f1c2564ec618b68c0bfd4875bbc4ce6365c48
Instruction Fuzzy Hash: 64314535A045149BCB22CF5AC48499DBBB8EF0A328F544299D84897F15DB31BE06CFD6

Function 6C39A2AB Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6C399FF2: _free.LIBCMT ref: 6C39A01B

_free.LIBCMT ref: 6C39A2F9

Part of subcall function 6C38CBA5: HeapFree.KERNEL32(00000000,00000000,?,6C39A020,00000000,00000000,00000000,00000000,?,6C39A2C4,00000000,00000007,00000000,?,6C398081,00000000), ref: 6C38CBBB
Part of subcall function 6C38CBA5: GetLastError.KERNEL32(00000000,?,6C39A020,00000000,00000000,00000000,00000000,?,6C39A2C4,00000000,00000007,00000000,?,6C398081,00000000,00000000), ref: 6C38CBCD

_free.LIBCMT ref: 6C39A304
_free.LIBCMT ref: 6C39A30F
_free.LIBCMT ref: 6C39A363
_free.LIBCMT ref: 6C39A36E
_free.LIBCMT ref: 6C39A379
_free.LIBCMT ref: 6C39A384

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9f76696241dda59e37702b6c7b8591e1945ed59e411e7bea7a02caf6cd15d4c2
Instruction ID: 8879fa425d207d58b45983baf0e0b974cecc56db13a5b35210622f936c9287ef
Opcode Fuzzy Hash: 9f76696241dda59e37702b6c7b8591e1945ed59e411e7bea7a02caf6cd15d4c2
Instruction Fuzzy Hash: D2117231542F14AEE921ABB0CC45FCBFB9D5F00705F804D24B2DF66A50EB25B50D8E52

Function 6C3855A6 Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6C38548D,6C380D47,6C38093D,?,6C380B4D,?,00000001,?,?,00000001,?,6C3BB430,0000000C,6C380C56), ref: 6C3855B4
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6C3855C2
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6C3855DB
SetLastError.KERNEL32(00000000,6C380B4D,?,00000001,?,?,00000001,?,6C3BB430,0000000C,6C380C56,?,00000001,?), ref: 6C38562D

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 2e022fa2efcc42abc700ff93e4dc83678563ee8df7e62650959fa66c69ec1803
Instruction ID: dc198a47295eaa6037265ba729ae4e228a6f266c18c8bc075378b2a99d8d64fc
Opcode Fuzzy Hash: 2e022fa2efcc42abc700ff93e4dc83678563ee8df7e62650959fa66c69ec1803
Instruction Fuzzy Hash: A901473270F3516EFA1015B5AC84A8A3B7DDB1327CB20033AE42644AD8EF6248058F88

Function 6C37F0D2 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

Strings

ReleaseSRWLockExclusive, xrefs: 6C37F111
KERNEL32.DLL, xrefs: 6C37F0EC
AcquireSRWLockExclusive, xrefs: 6C37F101

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: 37390af6b9ee0504f902ad0428a0a070cf2de3a8bcbae0d77b59f93ee7265642
Instruction ID: 4b424a56b09cc69f367b15801f1976cbca5a47171e24a4a78f31cb9702810ad7
Opcode Fuzzy Hash: 37390af6b9ee0504f902ad0428a0a070cf2de3a8bcbae0d77b59f93ee7265642
Instruction Fuzzy Hash: 6C01F97734A2225B9F315DBA88845D627BCB64F31D7200535D510D3A00D72EC006DEF8

Function 015DFC00 Relevance: 10.2, Strings: 8, Instructions: 215COMMON

Download Yara Rule

Strings

DSS1, xrefs: 015DFD2C
DSS2, xrefs: 015DFD65
DSS1, xrefs: 015DFDC2
RSA2, xrefs: 015DFD1C
RSA1, xrefs: 015DFDBB
RSA1, xrefs: 015DFD25
DSS2, xrefs: 015DFE13
RSA2, xrefs: 015DFDB2

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000015DD000.00000020.00000001.01000000.00000003.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15dd000__AnyDesk.jbxd

Similarity

API ID:
String ID: DSS1$DSS1$DSS2$DSS2$RSA1$RSA1$RSA2$RSA2
API String ID: 0-86297711
Opcode ID: fd7451687124c38f781362005dedff9807898d0171133a80a23cfddfa63e5e9e
Instruction ID: f708af2ae20cac1d87d0414d91bd3e4f5ddd9f6700787423c49828e8e96420bc
Opcode Fuzzy Hash: fd7451687124c38f781362005dedff9807898d0171133a80a23cfddfa63e5e9e
Instruction Fuzzy Hash: 485128B17883125AE73167FE9CD2F5CA7D06B50B12F08085BF509EE0E3D2F16592836A

Function 6C3861B6 Relevance: 9.3, APIs: 6, Instructions: 264COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C386343
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C38635F
__allrem.LIBCMT ref: 6C386376
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C386394
__allrem.LIBCMT ref: 6C3863AB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C3863C9

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: f7672b970583daad0a5493cda401f76377b1b79e7d24a194dd0dc409d21125cd
Instruction ID: 926c89c5b5df6809297f5c1512230f138e87f5007195e31fb8d0adde207a0c6d
Opcode Fuzzy Hash: f7672b970583daad0a5493cda401f76377b1b79e7d24a194dd0dc409d21125cd
Instruction Fuzzy Hash: D4811671A127069BE7109E68CC80BDEB3F9AF45328F24462AE551D7F90EBB1D9048F91

Function 6C394D05 Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,6C3887AF,6C3887AF,?,?,?,6C394F56,00000001,00000001,FCE85006), ref: 6C394D5F
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,6C394F56,00000001,00000001,FCE85006,?,?,?), ref: 6C394DE5
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,FCE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 6C394EDF
__freea.LIBCMT ref: 6C394EEC

Part of subcall function 6C38C844: HeapAlloc.KERNEL32(00000000,0000010C,00000004,?,6C38C8A7,?,00000000,?,6C397B70,0000010C,00000004,?,0000010C,?,?,6C38DB9D), ref: 6C38C876

__freea.LIBCMT ref: 6C394EF5
__freea.LIBCMT ref: 6C394F1A

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocHeap
String ID:
API String ID: 3147120248-0
Opcode ID: 41abc70e671cdc4f52eafba8e38e6f61b6235e29060deff186aaea0e2919eeb5
Instruction ID: c1a755f36607173090434e5da201c41a4ca3afd315ef026dc3a1de7545169264
Opcode Fuzzy Hash: 41abc70e671cdc4f52eafba8e38e6f61b6235e29060deff186aaea0e2919eeb5
Instruction Fuzzy Hash: 9151F372A01216AFEF158F64CC80EBB37A9EB45758F118668FD24D6940FB36DC54CEA0

Function 6C37C070 Relevance: 9.2, APIs: 6, Instructions: 178COMMON

Download Yara Rule

APIs

Part of subcall function 6C37C2B0: Sleep.KERNEL32(00000000,?,?,?,6C37C09F,?,00000000,?), ref: 6C37C2F2

AcquireSRWLockExclusive.KERNEL32(00000000,?,00000000,?), ref: 6C37C0C4
ReleaseSRWLockExclusive.KERNEL32(00000000,?,00000000,000000FF,?,?), ref: 6C37C105

Part of subcall function 6C36F000: GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 6C36F02B

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentDirectoryReleaseSleep
String ID:
API String ID: 1427338700-0
Opcode ID: d0766c75fefb436c0578349ccba60d5c4e20e707590e270ffdc4bb6d678cc406
Instruction ID: dc9bbbcec6c37e3b6e07db44d9967f25e6e4bc032415f30ce4b5708d3df7fa7b
Opcode Fuzzy Hash: d0766c75fefb436c0578349ccba60d5c4e20e707590e270ffdc4bb6d678cc406
Instruction Fuzzy Hash: 2F51DA316092419BDB30EF65E854FEEB3E4BF85218F10462DE49997A80DB356404CFF6

Function 6C374E80 Relevance: 9.1, APIs: 6, Instructions: 129COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(00000000,00000000,00000000,00000000), ref: 6C374EDB
ReleaseSRWLockExclusive.KERNEL32(00000000), ref: 6C374F0A
AcquireSRWLockExclusive.KERNEL32(00000000,00000000,00000000,00000000), ref: 6C374F5A
ReleaseSRWLockExclusive.KERNEL32(00000000), ref: 6C374F91
AcquireSRWLockExclusive.KERNEL32(00000000,00000000,00000000,00000000), ref: 6C374FCD
ReleaseSRWLockExclusive.KERNEL32(00000000), ref: 6C37500A

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID:
API String ID: 17069307-0
Opcode ID: 4c8faaedb3ef21cbf6e5a7448107bda03875103002e99a684c0e0c936c5f8ae7
Instruction ID: 1e7b4882e5e79b15ee1893dbb414d9363dabc66092240a5f50c86916c931ab1e
Opcode Fuzzy Hash: 4c8faaedb3ef21cbf6e5a7448107bda03875103002e99a684c0e0c936c5f8ae7
Instruction Fuzzy Hash: 644114B2F01200CBDB21DFA9D44478EB7B8AF45318F150158D894E7B80DB39AE00CFAA

Function 6C3A2974 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,00000001), ref: 6C3A29F9

Strings

microsoft-edge:, xrefs: 6C3A2991
Failed to launch Edge for uninstall survey, xrefs: 6C3A2A16
c:\b\build\slave\win\build\src\chrome\installer\util\google_chrome_distribution.cc, xrefs: 6C3A2A03
Ds;l, xrefs: 6C3A29C3
<, xrefs: 6C3A29A4

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorLast
String ID: <$Ds;l$Failed to launch Edge for uninstall survey$c:\b\build\slave\win\build\src\chrome\installer\util\google_chrome_distribution.cc$microsoft-edge:
API String ID: 1452528299-1846306032
Opcode ID: e37dea4039371ccd5c37e5b8b985a5456e014bb99fd825e2f70c3fb0ba061282
Instruction ID: 1c188f6f06d39b108aed929ed4c25cedd2e05c1f41f5e83365824638c8ee66ed
Opcode Fuzzy Hash: e37dea4039371ccd5c37e5b8b985a5456e014bb99fd825e2f70c3fb0ba061282
Instruction Fuzzy Hash: 4A21B074E4020C9EDB10CFE1CD56BDEB7B8DF16308F000019E958AAA81DB7695498F61

Function 6C38FBB0 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000008,6C361DE7,6C38EBE2,6C385DC7), ref: 6C38FBB4
_free.LIBCMT ref: 6C38FBE7
_free.LIBCMT ref: 6C38FC0F
SetLastError.KERNEL32(00000000,00000008,6C361DE7), ref: 6C38FC1C
SetLastError.KERNEL32(00000000,00000008,6C361DE7), ref: 6C38FC28
_abort.LIBCMT ref: 6C38FC2E

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: cdf430f4dc25bd013f8c88408ca4e6f5ea4ee33ced0126475eae058c176cb62b
Instruction ID: f748049fbeb3ccfc560b14169da728f30f777a124e03c8953bfba4d036f819b3
Opcode Fuzzy Hash: cdf430f4dc25bd013f8c88408ca4e6f5ea4ee33ced0126475eae058c176cb62b
Instruction Fuzzy Hash: 58F0F932347A4127D60232796C08F9E263EDFCA7AEF350124F85496B80EF35C5094D62

Function 6C36F520 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 203COMMON

Download Yara Rule

Strings

vector<T> too long, xrefs: 6C36F764

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID: vector<T> too long
API String ID: 0-3788999226
Opcode ID: 87ca2c222bb1cc3921e23fad8f008b67f74a005859c6a9e0ab83e600b1876d45
Instruction ID: 06a58f3f7b5208de7a0401b2a91e7de99a704db6587b2594087205258565d651
Opcode Fuzzy Hash: 87ca2c222bb1cc3921e23fad8f008b67f74a005859c6a9e0ab83e600b1876d45
Instruction Fuzzy Hash: 11511E726057015BD7109EB98C80F5BB7E9AF88364F100629F9A897B94EB71D9048F53

Function 6C3620B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 164fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

new.LIBCMT ref: 6C36211F
CloseHandle.KERNEL32(?), ref: 6C3621FD
new.LIBCMT ref: 6C362219
DeleteFileW.KERNEL32(?,00000000,-00000002), ref: 6C36227C

Strings

vmodule, xrefs: 6C3620E8, 6C362126

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: CloseDeleteFileHandle
String ID: vmodule
API String ID: 2633145722-2939338212
Opcode ID: 4f3e89d1b51f9288b66545efde5da29e0ddce17fb74ddd0824f6d1f546f395d5
Instruction ID: df650f1b15584c3c60a0e809c331aede5272f0a35a9fd7d3be3cf3c20c467d1c
Opcode Fuzzy Hash: 4f3e89d1b51f9288b66545efde5da29e0ddce17fb74ddd0824f6d1f546f395d5
Instruction Fuzzy Hash: 2251FE756093019FCB04CF26C448B9B77F9BB9A308F004A1EE8958BE94DB76D449CF92

Function 6C3A4485 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 126COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(6C3AFB90,00000000,00000000,00000004), ref: 6C3A44B0
GetLastError.KERNEL32 ref: 6C3A44CE

Strings

: not a directory, xrefs: 6C3A4571
GetFileAttributes , xrefs: 6C3A4507, 6C3A4592
c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc, xrefs: 6C3A44DB, 6C3A4561

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: : not a directory$GetFileAttributes $c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc
API String ID: 1799206407-2199784763
Opcode ID: 449e0c4bdae8b96a0d72b083d3cfe4c83116805183666550a27471a1297194a3
Instruction ID: 7661e70d8ff3ea73a070fd5ec703e33265ca295e5a357c5f064473ea8bd3e9d2
Opcode Fuzzy Hash: 449e0c4bdae8b96a0d72b083d3cfe4c83116805183666550a27471a1297194a3
Instruction Fuzzy Hash: B4312372A003046ADB049BF5EC1AFEA73ACDF12328F10020AF554A7EC1DF3669498E65

Function 6C385300 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6C38532B
__IsNonwritableInCurrentImage.LIBCMT ref: 6C3853A5

Part of subcall function 6C39E550: __FindPESection.LIBCMT ref: 6C39E5A9

_ValidateLocalCookies.LIBCMT ref: 6C385419
_ValidateLocalCookies.LIBCMT ref: 6C385444

Strings

csm, xrefs: 6C38538F

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentFindImageNonwritableSection
String ID: csm
API String ID: 1685366865-1018135373
Opcode ID: fccc2872c62d080ca52fa93e6be180b02e0c187480cc17d747010568a9d11df0
Instruction ID: a2081877569aab4665a895b796519be6e603eed757c5577615dba8f5a8572175
Opcode Fuzzy Hash: fccc2872c62d080ca52fa93e6be180b02e0c187480cc17d747010568a9d11df0
Instruction Fuzzy Hash: B941D734E02218EBDF00CFA9C880ADEBBB5AF4532CF148155E9569BB51D772DA05CF91

Function 6C361F20 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 112fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

new.LIBCMT ref: 6C361F48

Part of subcall function 6C361E30: GetModuleFileNameW.KERNEL32(00000000,?,00000104,?), ref: 6C361E54

CreateFileW.KERNEL32(?,00000004,00000003,00000000,00000004,00000080,00000000), ref: 6C361F81
CreateFileW.KERNEL32(?,00000004,00000003,00000000,00000004,00000080,00000000,?,debug.log), ref: 6C362032

Strings

@1su, xrefs: 6C361F81, 6C362032
debug.log, xrefs: 6C361EDF, 6C361FC2

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: File$Create$ModuleName
String ID: @1su$debug.log
API String ID: 253491666-356108749
Opcode ID: 045e75f7d8258519f35f652276d0fde810b45cbcdad1a9548503367dc3d46646
Instruction ID: 9a0ae409afbc5443d51c3dd0db52434eccde363051b655715db2a0672f541add
Opcode Fuzzy Hash: 045e75f7d8258519f35f652276d0fde810b45cbcdad1a9548503367dc3d46646
Instruction Fuzzy Hash: CF41C674A01204ABDF00DFB1CD85BED77B8AB15308F204219E951EBED4DB769508CF55

Function 6C3A421A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(6C3AFB90,00000000,?,00000000,00000004), ref: 6C3A4247
GetLastError.KERNEL32(?,00000000,00000004), ref: 6C3A4258
GetLastError.KERNEL32(?,00000000,00000004), ref: 6C3A4278

Strings

CreateDirectory , xrefs: 6C3A42B1
c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc, xrefs: 6C3A4285

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorLast$CreateDirectory
String ID: CreateDirectory $c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc
API String ID: 1306683694-1373056967
Opcode ID: 2b31223a5090f22562e3548cb6a3b79f15072c141e9477ddca658e72121606f7
Instruction ID: 09cc515d13870d80d85cf6283ffafe3527839b39b3ce5de0419ba25fe8bcbf7e
Opcode Fuzzy Hash: 2b31223a5090f22562e3548cb6a3b79f15072c141e9477ddca658e72121606f7
Instruction Fuzzy Hash: BF21F531600304AADB009FF5EC5ABFE73ACDB02318F100119E455A7EC0DF76A8698E76

Function 6C3A691E Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

__vwprintf_l.LIBCMT ref: 6C3A6946
GetLastError.KERNEL32(?,0000001C,0000001C,00000000), ref: 6C3A6963

Strings

c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc, xrefs: 6C3A6970
J`:l, xrefs: 6C3A69CF, 6C3A698E, 6C3A6991
CreateFile , xrefs: 6C3A699E

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorLast__vwprintf_l
String ID: CreateFile $J`:l$c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc
API String ID: 3407089876-2432837607
Opcode ID: 9fa415ff710cb9cd0a05f8b7d26eb8f4f348a97f7e3dcf23835442a20ea815dc
Instruction ID: af9f28fe7e9d8bb60b3fb26f458a216fe96973def2921e568832c71bd3b8459f
Opcode Fuzzy Hash: 9fa415ff710cb9cd0a05f8b7d26eb8f4f348a97f7e3dcf23835442a20ea815dc
Instruction Fuzzy Hash: 1A112B71A003086EDB00DFB5DC46FEE73B8DF04318F10051AF950A7AC0DB3259188E66

Function 6C389EEF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,6C389EA0,6C361DE7,?,6C389E40,6C361DE7,6C3BB670,0000000C,6C389F88,6C361DE7,00000002), ref: 6C389F0F
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6C389F22
FreeLibrary.KERNEL32(00000000,?,?,?,6C389EA0,6C361DE7,?,6C389E40,6C361DE7,6C3BB670,0000000C,6C389F88,6C361DE7,00000002,00000000), ref: 6C389F45

Strings

CorExitProcess, xrefs: 6C389F1A
mscoree.dll, xrefs: 6C389F08

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 24de666679f5e078d23254335f3009d7867d550287ae7ef5d4875d08a8f543d1
Instruction ID: 3fdfd4faf1987ad352bc2e316992a2b77ec12c3722b57e582ae23bb9ca174923
Opcode Fuzzy Hash: 24de666679f5e078d23254335f3009d7867d550287ae7ef5d4875d08a8f543d1
Instruction Fuzzy Hash: 9FF04F31A16208FBCF059FD1DC08BEEBFB8EB49716F104064E805A2550DB359A65DF94

Function 6C38DD5F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 6C38DDC4: _free.LIBCMT ref: 6C38DDF9

_free.LIBCMT ref: 6C38DD7A

Part of subcall function 6C38CBA5: HeapFree.KERNEL32(00000000,00000000,?,6C39A020,00000000,00000000,00000000,00000000,?,6C39A2C4,00000000,00000007,00000000,?,6C398081,00000000), ref: 6C38CBBB
Part of subcall function 6C38CBA5: GetLastError.KERNEL32(00000000,?,6C39A020,00000000,00000000,00000000,00000000,?,6C39A2C4,00000000,00000007,00000000,?,6C398081,00000000,00000000), ref: 6C38CBCD

_free.LIBCMT ref: 6C38DD8D
_free.LIBCMT ref: 6C38DD9E
_free.LIBCMT ref: 6C38DDAF

Strings

;l, xrefs: 6C38DD69

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: ;l
API String ID: 776569668-3972728159
Opcode ID: a9546c51364a0e2143a46529222be2b109f88eb76da73206818a2c537df8b44b
Instruction ID: 8b6cfe2cbd777e3d2646424cac82a49ebc151a229c6dae7d73b56f687f7f0a67
Opcode Fuzzy Hash: a9546c51364a0e2143a46529222be2b109f88eb76da73206818a2c537df8b44b
Instruction Fuzzy Hash: BDF01271B13B14AEDA026F58DC04C893B7DE7665047100E9AF84162701DBB516198ECA

Function 6C3945ED Relevance: 7.7, APIs: 5, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b05d13354818b1604794f2fe077c2adb7d773aea3bf7877fe5f3a7f9b2952af
Instruction ID: ca3d127f27ba038c4b1b766bd076e65353a7bc8e12aac64ee93ab690954b0165
Opcode Fuzzy Hash: 1b05d13354818b1604794f2fe077c2adb7d773aea3bf7877fe5f3a7f9b2952af
Instruction Fuzzy Hash: 4071F87190529ADBDB11CF55C884ABFBBB9FF46318F244229E47067A80F7728941CFA1

Function 6C38B731 Relevance: 7.7, APIs: 5, Instructions: 169COMMON

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 6C38B757
_free.LIBCMT ref: 6C38B77D
_free.LIBCMT ref: 6C38B84F
_free.LIBCMT ref: 6C38B882

Part of subcall function 6C38B8F3: RtlAllocateHeap.NTDLL(00000008,00000000,00000000,?,6C38FCCF,00000001,00000364,?,?,6C386175,00000000,00000000,00000000,00000000,00000000,0000010C), ref: 6C38B934

_free.LIBCMT ref: 6C38B8B8

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: _free$AllocateHeap__cftoe
String ID:
API String ID: 3093301996-0
Opcode ID: 04390f35edda4088c3306509b55175e000f73ae98b810c7eccc036072d2ca272
Instruction ID: d606831bcccc21fb7ae9a44fef0e563c3456a5d3d81ccb652acf971b2768ed43
Opcode Fuzzy Hash: 04390f35edda4088c3306509b55175e000f73ae98b810c7eccc036072d2ca272
Instruction Fuzzy Hash: 0C510D329077069BDF018BA98C80F9D77B8AF4932CF644329F524EAB81DB36C5058E65

Function 6C38DB10 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6C38DB82
_free.LIBCMT ref: 6C38DBA2

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: a60fbc9951142c15186021b69d0bc1aa4edeeadd269f82061da964a3e8ffaf5d
Instruction ID: 28d4662c47682ac7c1703e22535f4e3d2a1c6d30b7304a7a512149abaa67a252
Opcode Fuzzy Hash: a60fbc9951142c15186021b69d0bc1aa4edeeadd269f82061da964a3e8ffaf5d
Instruction Fuzzy Hash: 4E410476F022009FCB14DF78C880A9EB7B5EF85718F1581AAE555EB781DB31A905CF81

Function 6C392171 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6C392203
_free.LIBCMT ref: 6C39221A
_free.LIBCMT ref: 6C392239
_free.LIBCMT ref: 6C392254
_free.LIBCMT ref: 6C39226B

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 6217b75c5a72b47b3646f16f1506d5f6d296be433d497a6e2330eed479d69989
Instruction ID: fb610a8b62a4f4f3ffeabb452589b4a582754fb75dc07c2aa0b8110d5c01aab3
Opcode Fuzzy Hash: 6217b75c5a72b47b3646f16f1506d5f6d296be433d497a6e2330eed479d69989
Instruction Fuzzy Hash: 9F41DF31602E009FEB16CF2AD940B55B3F1EF48728B24066DD48AD6AA0F733E646CF41

Function 6C3A6578 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 6C3A6D68: ReadFile.KERNEL32(00000028,00000000,0000001C,0000001C,00000000,0000001C,00000000,00000000,?,?,6C3A60D0,0000001C,00000000,00000028), ref: 6C3A6D8A
Part of subcall function 6C3A6D68: GetLastError.KERNEL32(?,?,6C3A60D0,0000001C,00000000,00000028), ref: 6C3A6D94
Part of subcall function 6C3A6D68: GetLastError.KERNEL32(?,?,6C3A60D0,0000001C,00000000,00000028), ref: 6C3A6D9F

GetLastError.KERNEL32(?,0000001C,00000000,00000000), ref: 6C3A65B7

Strings

read, xrefs: 6C3A65D4
read: expected , xrefs: 6C3A6625
c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io.cc, xrefs: 6C3A65C1, 6C3A660B
, observed , xrefs: 6C3A661C

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorLast$FileRead
String ID: , observed $c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io.cc$read$read: expected
API String ID: 3644057887-3298404683
Opcode ID: 2e8e71619dcf0c81692d718635073ffa6bd337c771343d5daf0b6a9519dfe2dd
Instruction ID: 9f2c7c8fbd78c93aaa6f13dcfce0bd251cfa3a8b51555bb2d02ffb97c8abfa11
Opcode Fuzzy Hash: 2e8e71619dcf0c81692d718635073ffa6bd337c771343d5daf0b6a9519dfe2dd
Instruction Fuzzy Hash: 5421463190030429DB202AA9AD1AFE93378CF1132CF100459F954B6EC6DF3B895A8D6A

Function 6C3A6663 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 6C3A6DDA: WriteFile.KERNEL32(0000001C,000000FF,6C3A6334,00000000,00000000,?,?,6C3A668C,?,0000001C,6C3A6334,6C3A6334,000000FF,0000001C), ref: 6C3A6DF1

GetLastError.KERNEL32(?,000000FF,0000001C,00000001), ref: 6C3A66A2

Strings

write, xrefs: 6C3A66BF
write: expected , xrefs: 6C3A6710
c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io.cc, xrefs: 6C3A66AC, 6C3A66F6
, observed , xrefs: 6C3A6707

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: , observed $c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io.cc$write$write: expected
API String ID: 442123175-2204066763
Opcode ID: b030fa610e2725dc9acf2aaaf31dd0db9fbb80f1515aeb39ddfcbc161f96b7b2
Instruction ID: 2dba516c78b9d70ec73c6a6dafbd86b0912374a292e5f5f0b5b10f44603b1564
Opcode Fuzzy Hash: b030fa610e2725dc9acf2aaaf31dd0db9fbb80f1515aeb39ddfcbc161f96b7b2
Instruction Fuzzy Hash: EB218B71500304BADB202AA9ED0AFE9337CCF1126CF100449F894BAED2EF37895A4C66

Function 6C39774E Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6C397757
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6C39777A

Part of subcall function 6C38C844: HeapAlloc.KERNEL32(00000000,0000010C,00000004,?,6C38C8A7,?,00000000,?,6C397B70,0000010C,00000004,?,0000010C,?,?,6C38DB9D), ref: 6C38C876

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 6C3977A0
_free.LIBCMT ref: 6C3977B3
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6C3977C2

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocFreeHeap_free
String ID:
API String ID: 2278895681-0
Opcode ID: b09b61cbaf76eaa4302b43c03593a16be0dd5e5af8ed425c61b4a5dfac8b33ce
Instruction ID: 8e35dcade9654dd1a060404ce4461bcbac2a9eb3cc0eeb780836d1c47a2bcb23
Opcode Fuzzy Hash: b09b61cbaf76eaa4302b43c03593a16be0dd5e5af8ed425c61b4a5dfac8b33ce
Instruction Fuzzy Hash: C10171726026167B771115BA6C8CCBF2A7DDAC7A693200129BD14C2680FA718C018DB1

Function 6C38FC9E Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,6C3860F1,00000000,?,?,6C386175,00000000,00000000,00000000,00000000,00000000,0000010C,6C3722CA), ref: 6C38FCA3
_free.LIBCMT ref: 6C38FCD8
_free.LIBCMT ref: 6C38FCFF
SetLastError.KERNEL32(00000000,00000000,0000010C,6C3722CA), ref: 6C38FD0C
SetLastError.KERNEL32(00000000,00000000,0000010C,6C3722CA), ref: 6C38FD15

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 99d0024ff3f1b5705c928f11a00294040dd9dcbd069e376a05fe17d00b1b3649
Instruction ID: 459b5032610d920f0d5f2bb02cfbe88dac245511f7d385079333bcea934935ad
Opcode Fuzzy Hash: 99d0024ff3f1b5705c928f11a00294040dd9dcbd069e376a05fe17d00b1b3649
Instruction Fuzzy Hash: D601F932347A0277D2023169AC44E8B163DDBCB7BD7350224F94092B85EF71850D4DB1

Function 6C399D6D Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6C399D85

Part of subcall function 6C38CBA5: HeapFree.KERNEL32(00000000,00000000,?,6C39A020,00000000,00000000,00000000,00000000,?,6C39A2C4,00000000,00000007,00000000,?,6C398081,00000000), ref: 6C38CBBB
Part of subcall function 6C38CBA5: GetLastError.KERNEL32(00000000,?,6C39A020,00000000,00000000,00000000,00000000,?,6C39A2C4,00000000,00000007,00000000,?,6C398081,00000000,00000000), ref: 6C38CBCD

_free.LIBCMT ref: 6C399D97
_free.LIBCMT ref: 6C399DA9
_free.LIBCMT ref: 6C399DBB
_free.LIBCMT ref: 6C399DCD

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: be51b68542b8a73cc3baffd3b7c043fd9b9a64e91351ccea8da93663f00d4a7c
Instruction ID: 89790d74da6b213d6096904fe0364503f25dda889da9f266e7d8ca2157882f1e
Opcode Fuzzy Hash: be51b68542b8a73cc3baffd3b7c043fd9b9a64e91351ccea8da93663f00d4a7c
Instruction Fuzzy Hash: 08F03732607B049FDA42EE58E0C1C4A77FEAB91A193700819F09CE7E14DB31F8848EA4

Function 6C39F4F1 Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 6C39F564: GetVersionExW.KERNEL32(0000011C), ref: 6C39F59E

Part of subcall function 6C39F711: AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 6C39F744
Part of subcall function 6C39F711: CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 6C39F759
Part of subcall function 6C39F711: FreeSid.ADVAPI32(?), ref: 6C39F769

GetCurrentProcess.KERNEL32(00000008,?), ref: 6C39F50F
OpenProcessToken.ADVAPI32(00000000), ref: 6C39F516
GetTokenInformation.ADVAPI32(?,00000012(TokenIntegrityLevel),?,00000004,00000000), ref: 6C39F53A
CloseHandle.KERNEL32(?), ref: 6C39F547
CloseHandle.KERNEL32(?), ref: 6C39F553

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Token$CloseHandleProcess$AllocateCheckCurrentFreeInformationInitializeMembershipOpenVersion
String ID:
API String ID: 3927590866-0
Opcode ID: fb99d8206651b898563129adaf5481e02cd2f90c5d245d6f36e042a4d2570946
Instruction ID: d67a476f9316d8feefb98d1ac586b5c55b416d2f5ed67aeb6557858c7dffd161
Opcode Fuzzy Hash: fb99d8206651b898563129adaf5481e02cd2f90c5d245d6f36e042a4d2570946
Instruction Fuzzy Hash: CFF03C72A00208FBDF00EFE19909BEE7BBCAF0A309F504090B955D6480E772861CEF61

Function 015F6969 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 015F6975

Part of subcall function 015F6BCF: __getptd_noexit.LIBCMT ref: 015F6BD2
Part of subcall function 015F6BCF: __amsg_exit.LIBCMT ref: 015F6BDF

__getptd.LIBCMT ref: 015F698C
__amsg_exit.LIBCMT ref: 015F699A
__lock.LIBCMT ref: 015F69AA
__updatetlocinfoEx_nolock.LIBCMT ref: 015F69BE

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000015EF000.00000020.00000001.01000000.00000003.sdmp, Offset: 015EF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15ef000__AnyDesk.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: c6054eeaa5fc8f294ccc3e9cf1a9dbbf85a93724ecee94b263c113b8f44697dd
Instruction ID: 32521b338614e9212d3a358e6d8fc79f2ea17a1866fc6eb8ec6c4bcd33be47d9
Opcode Fuzzy Hash: c6054eeaa5fc8f294ccc3e9cf1a9dbbf85a93724ecee94b263c113b8f44697dd
Instruction Fuzzy Hash: 8DF09032901717EADB25BB78960279D37E0FF90721F21014DD711AF1D0CB645680DB56

Function 6C36F2B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6C36F453
std::_Xinvalid_argument.LIBCPMT ref: 6C36F45D

Strings

invalid string position, xrefs: 6C36F43A, 6C36F444
string too long, xrefs: 6C36F44E, 6C36F458

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 909987262-4289949731
Opcode ID: f3159f7bc05746b7fa9ea8bc388688864c9a584bca272eb9112e0bd1deb4d832
Instruction ID: 86b47c1141f8a7dcf309c44cffa5fb5207de827db3cb60de33b57281adb7c4da
Opcode Fuzzy Hash: f3159f7bc05746b7fa9ea8bc388688864c9a584bca272eb9112e0bd1deb4d832
Instruction Fuzzy Hash: 3651B37120520A9FCB10CF59D8C0A9E73E9FF98348320492EE855C7E54E731E955CFA5

Function 6C366750 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 172COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6C36684A
std::_Xinvalid_argument.LIBCPMT ref: 6C366854

Strings

invalid string position, xrefs: 6C36683B
string too long, xrefs: 6C366845, 6C36684F

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 909987262-4289949731
Opcode ID: 98ab0b1857acb977fa52df9da6a8c6fb99ad5c8197d0f4252d4f6159aec6498d
Instruction ID: 1423f92090d25f4573e02fb3299b1f2569e6530e4fcf0d1c2b7fd1119f925d5d
Opcode Fuzzy Hash: 98ab0b1857acb977fa52df9da6a8c6fb99ad5c8197d0f4252d4f6159aec6498d
Instruction Fuzzy Hash: 3751D1323052059FDB24CE6EE890A5AF7F9FF943A4710092EE495C7F54D731E8448BA2

Function 6C396ADE Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 6C396B2D
_free.LIBCMT ref: 6C396C4A

Part of subcall function 6C386183: IsProcessorFeaturePresent.KERNEL32(00000017,6C386155,0000010C,00000000,00000000,00000000,00000000,00000000,?,?,6C386175,00000000,00000000,00000000,00000000,00000000), ref: 6C386185
Part of subcall function 6C386183: GetCurrentProcess.KERNEL32(C0000417,00000000,0000010C,6C3722CA), ref: 6C3861A7
Part of subcall function 6C386183: TerminateProcess.KERNEL32(00000000), ref: 6C3861AE

Strings

., xrefs: 6C396E01
*?, xrefs: 6C396B21

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
String ID: *?$.
API String ID: 2812119850-3972193922
Opcode ID: 41fc6043a840425796afd405c4b571990f4f1fc6203f5ab5936051dd2d745751
Instruction ID: da7558c4cd6e80d423ba4636d18c1c607127673321b0d2f21f0b5b32a5160b79
Opcode Fuzzy Hash: 41fc6043a840425796afd405c4b571990f4f1fc6203f5ab5936051dd2d745751
Instruction Fuzzy Hash: C3519275E05109EFDB04DFA9C880AEDBBB5EF49318F24816AE854E7740F7369A058F90

Function 6C3677C0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 159COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6C36793F
std::_Xinvalid_argument.LIBCPMT ref: 6C367949

Strings

invalid string position, xrefs: 6C367926, 6C367930
string too long, xrefs: 6C36793A, 6C367944

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 909987262-4289949731
Opcode ID: cb507f64bfe169f06ea2e4b142b9734c86d6c77d0199557aed1ad0869f458265
Instruction ID: 9dcdb462863378fe3bb7a6e5f17ec88ec5cdb0712f71d0591af472dd83b04eac
Opcode Fuzzy Hash: cb507f64bfe169f06ea2e4b142b9734c86d6c77d0199557aed1ad0869f458265
Instruction Fuzzy Hash: AD51FB327102058FD724CE1DD8C1A5A77E6EF967547A00A2AE4A1CBF85D731DC50CFA2

Function 6C39530A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C395463
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C395478

Strings

R9l, xrefs: 6C395472
R9l, xrefs: 6C395385

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: R9l$R9l
API String ID: 885266447-672721834
Opcode ID: ee8a1c46b47280ad6a7ae0eeacefab8afdc7f21d1e4847fac857220fd3b4429b
Instruction ID: da9906af2880210a07fb3ee89a86019ca2a8d2b924f42769743f03bff4ec67e4
Opcode Fuzzy Hash: ee8a1c46b47280ad6a7ae0eeacefab8afdc7f21d1e4847fac857220fd3b4429b
Instruction Fuzzy Hash: 04519E71A002489FCB44CF99C880E9DBBF6EF8531AF19C259E85897761E771D991CF40

Function 6C375460 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

Part of subcall function 6C373390: Sleep.KERNEL32(00000000), ref: 6C3733D2

AcquireSRWLockExclusive.KERNEL32(00000000,00000001,0000000F), ref: 6C375480
ReleaseSRWLockExclusive.KERNEL32(00000000), ref: 6C3754E5

Strings

Of7l, xrefs: 6C3755D1, 6C3755AB
Of7l, xrefs: 6C375574, 6C375583

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ExclusiveLock$AcquireReleaseSleep
String ID: Of7l$Of7l
API String ID: 190390962-2352733891
Opcode ID: 548145652ea982d143869c76cdd67b88e216e9b07409957267274c671dfaad45
Instruction ID: 159cf78cd690cade3cb444d4ee56a25cc25cc5f2d8c227ca11e6ee01b811f6af
Opcode Fuzzy Hash: 548145652ea982d143869c76cdd67b88e216e9b07409957267274c671dfaad45
Instruction Fuzzy Hash: 814190B1A007058BD724CFAAD48039ABBF9FB88314F10867DD55AD7B80DB79E9048F94

Function 6C38D347 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\_AnyDesk.exe,00000104), ref: 6C38D387
_free.LIBCMT ref: 6C38D452
_free.LIBCMT ref: 6C38D45C

Strings

C:\Users\user\Desktop\_AnyDesk.exe, xrefs: 6C38D37E, 6C38D385, 6C38D3B4, 6C38D3EC

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\_AnyDesk.exe
API String ID: 2506810119-2129544925
Opcode ID: a6e0e0da19ea8204076b2a4e61743c1b8a5fc075ec94dd2bf87ca43c64750090
Instruction ID: 60d07b8d37b0b0795359556e9fb8c2dd6d974392228fe5625b213069ab9726df
Opcode Fuzzy Hash: a6e0e0da19ea8204076b2a4e61743c1b8a5fc075ec94dd2bf87ca43c64750090
Instruction Fuzzy Hash: C431BF71A02609EFDB11DF99D880D9EBBBCEF86714B1040ABE94597B00DBB19A44CF91

Function 6C366910 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6C366A09
std::_Xinvalid_argument.LIBCPMT ref: 6C366A13

Strings

invalid string position, xrefs: 6C3669FA
string too long, xrefs: 6C366A04, 6C366A0E

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 909987262-4289949731
Opcode ID: 344aa0c673f21581578a2edfda072751b657a8dac9f3627842649fb525aaab7d
Instruction ID: a4f21253c4ef6523c59f026c4844243c9f0554ca72016c1c822fb09e21a0eaf8
Opcode Fuzzy Hash: 344aa0c673f21581578a2edfda072751b657a8dac9f3627842649fb525aaab7d
Instruction Fuzzy Hash: 6231D9313002159BD7208E5DD880A5AB7F9EBD16A8B204A2EE591CBF44C771D8448FA1

Function 6C375030 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMON

Download Yara Rule

Strings

Gp7l, xrefs: 6C375038
ZZ7l, xrefs: 6C375091, 6C3750C6

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID: Gp7l$ZZ7l
API String ID: 0-3347185454
Opcode ID: 9d1983011880e2eaaa01318c0a0c12517f47d9d42d2e7e749390b6d3f95f7d10
Instruction ID: b33115273b59dcaf5de311b645fe87a497cc748a3e6c18676ea6488f004eef63
Opcode Fuzzy Hash: 9d1983011880e2eaaa01318c0a0c12517f47d9d42d2e7e749390b6d3f95f7d10
Instruction Fuzzy Hash: A041ABB2A0060A9FCB18CF99D88459EF7B6FF85304B248569C506A7B00DB35BA15CFE5

Function 6C364F30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6C36501A
std::_Xinvalid_argument.LIBCPMT ref: 6C365024

Strings

invalid string position, xrefs: 6C36500B
string too long, xrefs: 6C365015, 6C36501F

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 909987262-4289949731
Opcode ID: f0717b5a5f428e17d5ded530f8a45c4bcef47963c116661f0f09ba9fbb8986de
Instruction ID: ba6674fd435485f246429e54f492473516fa62d96a1f49b8a99cef30f05c0f25
Opcode Fuzzy Hash: f0717b5a5f428e17d5ded530f8a45c4bcef47963c116661f0f09ba9fbb8986de
Instruction Fuzzy Hash: 8D31D7323012018FD725CE5EE890A5AF7A9EF95765B100A3EE591CBF85C371D8408FA2

Function 6C3A4306 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?), ref: 6C3A4364
GetLastError.KERNEL32 ref: 6C3A4386

Strings

DeleteFile , xrefs: 6C3A43C1
c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc, xrefs: 6C3A4392

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID: DeleteFile $c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc
API String ID: 2018770650-2174402464
Opcode ID: 6ee3e498224266ca976d41a70806bdda6c64d58671c38dc44c37b07acd5d4065
Instruction ID: ebe60ab6e4475c67978cd485d93e9a49ba71220e9e37db0ca67a6552c43e487e
Opcode Fuzzy Hash: 6ee3e498224266ca976d41a70806bdda6c64d58671c38dc44c37b07acd5d4065
Instruction Fuzzy Hash: B3317071E00209AACF04DFE5E895EEEB7BCEF04318F104429F551A7A80EF359A5ACE51

Function 6C3A45DD Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C3A674E: CloseHandle.KERNEL32(000000FF,?,00000000), ref: 6C3A6761
Part of subcall function 6C3A674E: GetLastError.KERNEL32(?,00000000), ref: 6C3A677A

DeleteFileW.KERNEL32(?), ref: 6C3A4612
GetLastError.KERNEL32 ref: 6C3A4631

Strings

DeleteFile , xrefs: 6C3A466F
c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc, xrefs: 6C3A463D

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorLast$CloseDeleteFileHandle
String ID: DeleteFile $c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc
API String ID: 1758595503-2174402464
Opcode ID: 145e10cb41784b13508677464070fc1b49e10faa944f3d08093b8ff6f67ca0d8
Instruction ID: a7abb51e1482e71f407e638975e9302b36b4d3925063c0ed4fc9465f8fb7160c
Opcode Fuzzy Hash: 145e10cb41784b13508677464070fc1b49e10faa944f3d08093b8ff6f67ca0d8
Instruction Fuzzy Hash: C821D372A01204ABDB00DFA6DC55FEE73BCEF45318F10046AE441A7A90DF369919CE66

Function 6C3A69EA Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

__vwprintf_l.LIBCMT ref: 6C3A6A12
GetLastError.KERNEL32(?,?,00000000,00000000), ref: 6C3A6A2F

Strings

c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc, xrefs: 6C3A6A3C
CreateFile , xrefs: 6C3A6A6A

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorLast__vwprintf_l
String ID: CreateFile $c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc
API String ID: 3407089876-2132845161
Opcode ID: 219d53908599a9ea4e19bb2f7e4d6558dbb99a3d66ea45f72cf1174bce21194f
Instruction ID: 836feb2d9dfc15876b6f2903c8284b3ae3cb77b5887a3b6f7b26d2a3be345b64
Opcode Fuzzy Hash: 219d53908599a9ea4e19bb2f7e4d6558dbb99a3d66ea45f72cf1174bce21194f
Instruction Fuzzy Hash: F5110571A413086ADB00DFB5DC56FEE73B8EB04328F10051AF955A7AC1EB325A188E66

Function 6C3A3E20 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69fileCOMMON

Download Yara Rule

APIs

UnlockFileEx.KERNEL32(?,00000000,?,?,?), ref: 6C3A3E55
GetLastError.KERNEL32(?,00000000,?,?,?), ref: 6C3A3E6E

Strings

UnlockFileEx, xrefs: 6C3A3E8E
c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc, xrefs: 6C3A3E7B

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorFileLastUnlock
String ID: UnlockFileEx$c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc
API String ID: 3655728120-672186346
Opcode ID: 5a296b8c69e02673d19a8c50050218c2279b6bb9a1d79539f1776a596a75812a
Instruction ID: 7376353bb3e91561ab10c6e3c2b03900854aba8eb4dbc5898a087712e3c105e8
Opcode Fuzzy Hash: 5a296b8c69e02673d19a8c50050218c2279b6bb9a1d79539f1776a596a75812a
Instruction Fuzzy Hash: 171134324002056EE7209FF5CC45FEAB3B8DB41318F10082EE2C0A3E94DB3259198E62

Function 6C3A67C4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 62fileCOMMON

Download Yara Rule

APIs

LockFileEx.KERNEL32(00000000,00000000,00000000,000000FF,000000FF,?,0000001C,0000001C,00000000), ref: 6C3A67FA
GetLastError.KERNEL32 ref: 6C3A6810

Strings

c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc, xrefs: 6C3A681C
LockFileEx, xrefs: 6C3A682F

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorFileLastLock
String ID: LockFileEx$c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc
API String ID: 1811722133-1010764315
Opcode ID: 66969d55d26f265ff6ecb4df86e5484e37c072930a332e60b76e88478c05ba06
Instruction ID: d50867c8c50ec37e38cc4f34cb5f4b7f86610767c706bcac6216581b1beb1cfe
Opcode Fuzzy Hash: 66969d55d26f265ff6ecb4df86e5484e37c072930a332e60b76e88478c05ba06
Instruction Fuzzy Hash: 4401497190020539EB009AB9DC85BEB777CDF06378F10056AF528F6DC0CA3359494DA2

Function 6C3A6AB6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 6C3A6AEE
GetLastError.KERNEL32 ref: 6C3A6B07

Strings

c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc, xrefs: 6C3A6B13
SetFilePointerEx, xrefs: 6C3A6B26

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: SetFilePointerEx$c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc
API String ID: 2976181284-399997206
Opcode ID: 217d3f6ff999ca57c82a5fe0253022f1006b9d6a82837ca7b6186e509568be39
Instruction ID: d99ba7bbd71630b8a363188a4721aab4b397c44b357910bb96eeb97795cc59c6
Opcode Fuzzy Hash: 217d3f6ff999ca57c82a5fe0253022f1006b9d6a82837ca7b6186e509568be39
Instruction Fuzzy Hash: 0E112572640105ABDB008EAECD4AFEE7778EB00358F104219F525D6EC1C6329A258E11

Function 015FEE3B Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

__wcstoi64.LIBCMT ref: 015FEE6B

Strings

d, xrefs: 015FEE9D
*, xrefs: 015FEE3B
*, xrefs: 015FEFA6

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000015EF000.00000020.00000001.01000000.00000003.sdmp, Offset: 015EF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15ef000__AnyDesk.jbxd

Similarity

API ID: __wcstoi64
String ID: *$*$d
API String ID: 398114495-3975053056
Opcode ID: 74efc3f83237348f53431148fb436e571d39ad5c775b596178f4fe1f41b3d97e
Instruction ID: d3942a84634e9d30692aaa0e43260d1c42bd0f2e903adfaeef3c72ed07ea8949
Opcode Fuzzy Hash: 74efc3f83237348f53431148fb436e571d39ad5c775b596178f4fe1f41b3d97e
Instruction Fuzzy Hash: 8D2168729052298FDB26DF18D845BBCB7F0FB45305F1984EED689DA250EB325A84CF81

Function 6C3A0518 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

CanOfferRelaunch.GCAPI(?,?,?,?), ref: 6C3A052C

Part of subcall function 6C373FC0: RegCreateKeyExW.ADVAPI32(00000202,?,00000000,00000000,00000000,?,00000000,?), ref: 6C373FFA
Part of subcall function 6C373FC0: RegCloseKey.ADVAPI32 ref: 6C37400D

Part of subcall function 6C3743A0: RegSetValueExW.ADVAPI32(00000000,?,00000000,00000001,?,?), ref: 6C3743E1

Part of subcall function 6C39F147: GetLocalTime.KERNEL32(?), ref: 6C39F15F

Part of subcall function 6C374370: RegSetValueExW.ADVAPI32(?,00000202,00000000,00000004,00000004), ref: 6C374390

Strings

RelaunchBrandcode, xrefs: 6C3A055E
RelaunchAllowedAfter, xrefs: 6C3A0575
Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}, xrefs: 6C3A0542

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Value$CloseCreateLocalOfferRelaunchTime
String ID: RelaunchAllowedAfter$RelaunchBrandcode$Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
API String ID: 4093175577-67220017
Opcode ID: 3465145b6df811db6a7b5570f97ed3fb99df4cbf632bb77126b4a6f0e9da5012
Instruction ID: cda1ba3a695b2411cdbc19842511d2518cd9bd9b325c0de5965e58be57156054
Opcode Fuzzy Hash: 3465145b6df811db6a7b5570f97ed3fb99df4cbf632bb77126b4a6f0e9da5012
Instruction Fuzzy Hash: 7B1182319042196BDB149EA0ED00ADE7B74DF05258F100115FD96A6D51EB32A935CEE2

Function 6C3A6C33 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54fileCOMMON

Download Yara Rule

APIs

UnlockFileEx.KERNEL32(000000FF,00000000,000000FF,000000FF,?,00000000,00000000), ref: 6C3A6C5B
GetLastError.KERNEL32 ref: 6C3A6C72

Strings

c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc, xrefs: 6C3A6C7F
UnlockFileEx, xrefs: 6C3A6C92

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorFileLastUnlock
String ID: UnlockFileEx$c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc
API String ID: 3655728120-168028389
Opcode ID: 84c6fc3d66d223aabf7c1c4f1fb92986473def6703e2e8c566ecf01d092b44c4
Instruction ID: a3799756dd45e81e404f8316a5eaf1c4c5452b1df8928f55731efbae7407aacf
Opcode Fuzzy Hash: 84c6fc3d66d223aabf7c1c4f1fb92986473def6703e2e8c566ecf01d092b44c4
Instruction Fuzzy Hash: 26012B319042053AEB009FF9DD46BEAB37CEB05368F10066AE524F6ED1DB3369594D62

Function 6C382F01 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_UnwindNestedFrames.LIBCMT ref: 6C382F2F
___FrameUnwindToState.LIBVCRUNTIME ref: 6C382F41
CallCatchBlock.LIBVCRUNTIME ref: 6C382F65

Part of subcall function 6C383549: ___AdjustPointer.LIBCMT ref: 6C383596

Strings

&38l, xrefs: 6C382F24, 6C382F15

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Unwind$AdjustBlockCallCatchFrameFramesNestedPointerState
String ID: &38l
API String ID: 4287930071-3517703615
Opcode ID: fa58f82d3c1954d7f4a288f043c0d815a92d5387328e534f610f396ef617e9ab
Instruction ID: 109178156a1daaf5ea53de3d74e1ff4123b415f65855fd38aa0930002e23d38b
Opcode Fuzzy Hash: fa58f82d3c1954d7f4a288f043c0d815a92d5387328e534f610f396ef617e9ab
Instruction Fuzzy Hash: 6901E532001109BBCF025F65CD08EDA3BBAFF49758F154114FE9866620C772E865EFA1

Function 01523370 Relevance: 6.5, Strings: 5, Instructions: 264COMMON

Download Yara Rule

Strings

Modulus:, xrefs: 01523446, 0152345B
modulus:, xrefs: 01523423
Exponent:, xrefs: 0152344B, 01523474
RSA, xrefs: 015233D6
publicExponent:, xrefs: 01523428

Memory Dump Source

Source File: 00000002.00000002.1798261623.0000000001502000.00000020.00000001.01000000.00000003.sdmp, Offset: 01502000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1502000__AnyDesk.jbxd

Similarity

API ID:
String ID: Exponent:$Modulus:$RSA$modulus:$publicExponent:
API String ID: 0-3763682921
Opcode ID: b37ece1205ddad98e749b1b2d44c1d0c016f85fc7528bd164d7d7850f9a709d2
Instruction ID: 4777b45efe2fd82485ba0163f1770c84f7e0966e92b61db9555a61ffccf30b1a
Opcode Fuzzy Hash: b37ece1205ddad98e749b1b2d44c1d0c016f85fc7528bd164d7d7850f9a709d2
Instruction Fuzzy Hash: B781C2B2B002166BEA51EA1ADC41F2B779CBFE9608F05045CF9049F282F775E905C7A2

Function 6C390D37 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6C390DC2
__alldvrm.LIBCMT ref: 6C390FC3
__alldvrm.LIBCMT ref: 6C390FE5

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 08bbd95e0c94314e88f8ac9cb1697bb445864f1c51da791db5baa43eeec002dc
Instruction ID: 743f705c1028c93954a8d4c0047a2a4dc8074184e8473ff27547feda1c90694b
Opcode Fuzzy Hash: 08bbd95e0c94314e88f8ac9cb1697bb445864f1c51da791db5baa43eeec002dc
Instruction Fuzzy Hash: C7A189329047C69FE711CF28C8907AEBBE5EF0A318F14416DD5869BB81E3358985CF51

Function 6C362400 Relevance: 6.2, APIs: 4, Instructions: 154fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

OutputDebugStringA.KERNEL32(?), ref: 6C362481
WriteFile.KERNEL32(?,?,?,00000000), ref: 6C3624FF
SetLastError.KERNEL32(?,?,00000000), ref: 6C3625AF
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 6C3625C6

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: DebugErrorFileIos_base_dtorLastOutputStringWritestd::ios_base::_
String ID:
API String ID: 3426912829-0
Opcode ID: dd1565e1f1bfbf7438c6040abd69e11460835266ba268d779d6c85ed58c615ee
Instruction ID: fec7900f172c1d1509dbabae8defaba109af5a18b601bf7e1c1e26e5951b6969
Opcode Fuzzy Hash: dd1565e1f1bfbf7438c6040abd69e11460835266ba268d779d6c85ed58c615ee
Instruction Fuzzy Hash: D351BE716043019FDB10CF55C849A9AB7F8FB49308F40082CFA9697A95D772EA58CFA7

Function 6C39DBFC Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6C39DD2B

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: a6f5be0d53e7b9cfce8bbf5d2eed6767de921dbc8ed49e181385260d7a52b7dd
Instruction ID: ce5dac1527ba6dfa1317d0036972562d79065186664a5d3bc19ca70a664ef4c0
Opcode Fuzzy Hash: a6f5be0d53e7b9cfce8bbf5d2eed6767de921dbc8ed49e181385260d7a52b7dd
Instruction Fuzzy Hash: 48415B32A025056BD7116FB98C42BDE3AB9EF42778F140215F498D6FE0F7B548058E63

Function 6C38FE76 Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 568f9c728f9dd380125bec5db702cf89dfec653276680e440ab4b198ae5d3bf7
Instruction ID: 14418b4ab6311abe0be109387d4c95910c8f1b4c534295493257316740649920
Opcode Fuzzy Hash: 568f9c728f9dd380125bec5db702cf89dfec653276680e440ab4b198ae5d3bf7
Instruction Fuzzy Hash: 16412972601744AFD7148F78CC40B9ABBB9EB8D718F104A6AE181DBF81D771A9048F91

Function 6C394BE8 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,08A8C445,00000008,00000000,00000000,6C3700E9,00000000,-00000018,?,00000001,00000008,08A8C445,00000001,6C3700E9,00000001), ref: 6C394C35
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 6C394CBE
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 6C394CD0
__freea.LIBCMT ref: 6C394CD9

Part of subcall function 6C38C844: HeapAlloc.KERNEL32(00000000,0000010C,00000004,?,6C38C8A7,?,00000000,?,6C397B70,0000010C,00000004,?,0000010C,?,?,6C38DB9D), ref: 6C38C876

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ByteCharMultiWide$AllocHeapStringType__freea
String ID:
API String ID: 573072132-0
Opcode ID: a77e21350c0c841a4f3ce63a57e86086be2cefd25e22ab1141640b2e830397ea
Instruction ID: 55e2ee0e16adc5334a89a2cfa377495f67d674e6ea0a454e0147232b6f1ce848
Opcode Fuzzy Hash: a77e21350c0c841a4f3ce63a57e86086be2cefd25e22ab1141640b2e830397ea
Instruction Fuzzy Hash: 0931AD72A0120AAFDF159FA4DC40DEE3BA9EF41318F114228EC24E7640E736C964CFA0

Function 015F6D86 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

__mtterm.LIBCMT ref: 015F6D9A
__init_pointers.LIBCMT ref: 015F6E4C
__calloc_crt.LIBCMT ref: 015F6EBA

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000015EF000.00000020.00000001.01000000.00000003.sdmp, Offset: 015EF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15ef000__AnyDesk.jbxd

Similarity

API ID: __calloc_crt__init_pointers__mtterm
String ID:
API String ID: 2478854527-0
Opcode ID: 33eb11816352dfac1217c6875b122df83e1bfbe8aaf0b8164f4b792112b4c835
Instruction ID: 6ed384c7357b7644b349ea5813a20adbb890c5b1cfe72a3fdec64bf616fa9840
Opcode Fuzzy Hash: 33eb11816352dfac1217c6875b122df83e1bfbe8aaf0b8164f4b792112b4c835
Instruction Fuzzy Hash: BD3141799043129FDB31EF79ED0851A7FA0FB64661B14052EE6029B3ECEB749061DF60

Function 6C372EE0 Relevance: 6.1, APIs: 4, Instructions: 78timeCOMMON

Download Yara Rule

APIs

TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?,00000001,?,?,?,?,?,?,?,6C3A0690), ref: 6C372F5B
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,6C3A0690), ref: 6C372F6F
SystemTimeToFileTime.KERNEL32(?,00000001,00000001,?,?,?,?,?,?,?,6C3A0690), ref: 6C372F83
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C372FBD

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Time$System$File$LocalSpecificUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1393065386-0
Opcode ID: 0d262f6410e97b02d3952f96b5f0c545b2095257ce2e343e063b82072a6dd0b2
Instruction ID: a630ea434da99d50a8ad4c8c2343777a26aa43e02ead23b32e0cbe14314de3ff
Opcode Fuzzy Hash: 0d262f6410e97b02d3952f96b5f0c545b2095257ce2e343e063b82072a6dd0b2
Instruction Fuzzy Hash: 043138752183459BC710CF61C800BABB7E8BF48704F10890EF8D9C7290E739D949DBA6

Function 6C38D7C8 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4c237e74d57e00f3e3b6843ca303e27312616cb1f0e57db4257b0885655f63e
Instruction ID: 0646344ea7afdc69f1e27b6cd750d6537f07b8cd25f5510fb91c8df3ddf5fdbc
Opcode Fuzzy Hash: f4c237e74d57e00f3e3b6843ca303e27312616cb1f0e57db4257b0885655f63e
Instruction Fuzzy Hash: 7A018FB270B6177EFA0119B96CC0F6B262DEB927BDB740736F12461AC4DB618C448D61

Function 6C3813D5 Relevance: 6.1, APIs: 4, Instructions: 53timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000,00000000,00000000), ref: 6C381409
GetCurrentThreadId.KERNEL32 ref: 6C381418
GetCurrentProcessId.KERNEL32 ref: 6C381421
QueryPerformanceCounter.KERNEL32(?), ref: 6C38142E

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 1cb1a1be73c8b7f74e3e28ecc9185849880931e99e2e1dc02c6dd6b124140f4d
Instruction ID: ccfe0a0cd897035d8498b300b1d6c3dcefe9976e81d0de3dd4ef468370fe72bc
Opcode Fuzzy Hash: 1cb1a1be73c8b7f74e3e28ecc9185849880931e99e2e1dc02c6dd6b124140f4d
Instruction Fuzzy Hash: 7C118872E06208EBDF04CFA9D5486EEBBF8EB09309F61046AD413E7244EA318A00CF54

Function 6C38EEBB Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,6C38EE62,00000000,00000000,00000000,00000000,?,6C38F12C,00000006,FlsSetValue), ref: 6C38EEED
GetLastError.KERNEL32(?,6C38EE62,00000000,00000000,00000000,00000000,?,6C38F12C,00000006,FlsSetValue,6C3AF920,6C3AF928,00000000,00000364,?,6C38FCEC), ref: 6C38EEF9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,6C38EE62,00000000,00000000,00000000,00000000,?,6C38F12C,00000006,FlsSetValue,6C3AF920,6C3AF928,00000000), ref: 6C38EF07

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: c0ae85869c082f93dc226fb272f189f1d48a3ae5e2f40ce59930a1dbdec85742
Instruction ID: a772c8c5d424916ae10430adcea50ecfda16c1d07295fdf3cbbba30c9aacf551
Opcode Fuzzy Hash: c0ae85869c082f93dc226fb272f189f1d48a3ae5e2f40ce59930a1dbdec85742
Instruction Fuzzy Hash: 3901D43B757322ABCB114ABD9C44A4A37BCAF467A5B120620F915D3540C721D4118FE0

Function 6C3A6D68 Relevance: 6.0, APIs: 4, Instructions: 48fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000028,00000000,0000001C,0000001C,00000000,0000001C,00000000,00000000,?,?,6C3A60D0,0000001C,00000000,00000028), ref: 6C3A6D8A
GetLastError.KERNEL32(?,?,6C3A60D0,0000001C,00000000,00000028), ref: 6C3A6D94
GetLastError.KERNEL32(?,?,6C3A60D0,0000001C,00000000,00000028), ref: 6C3A6D9F
GetFileType.KERNEL32(00000028,?,?,6C3A60D0,0000001C,00000000,00000028), ref: 6C3A6DBB

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorFileLast$ReadType
String ID:
API String ID: 2855922492-0
Opcode ID: 147d4b8554e3a077d716698a435cf3ff121db0360365a7f0a52fc3f639e0528a
Instruction ID: aef80963b9988a9243e4001f8d893d68f724235919cda7ba25e0f02d904f0e29
Opcode Fuzzy Hash: 147d4b8554e3a077d716698a435cf3ff121db0360365a7f0a52fc3f639e0528a
Instruction Fuzzy Hash: F6018F32301119ABDB009EEEDC45B9E37BDFB023A9F140324F814D6550D73198224EA0

Function 6C3725C0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 6C3725E7

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9497407c361fa0e5cdba83c1c808aa0bd6f632a9449a5baa6c9db17d36afeda
Instruction ID: 81ca917e3b48410c6f218621e38f153526c8b92c8e6e314bab4b3f768af03801
Opcode Fuzzy Hash: e9497407c361fa0e5cdba83c1c808aa0bd6f632a9449a5baa6c9db17d36afeda
Instruction Fuzzy Hash: 98F0E07150610486E63457704715E5E72A84F1036C7100736E966C6F43F7ABE5998DFF

Function 6C370640 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

new.LIBCMT ref: 6C370667

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fae71b4869ae569bafac289f6a09a1d21ff0609c13e63d45931af16e1a68b08f
Instruction ID: 68413c82a615f8f7b65b86824eb44e44db097281c0b8e239cc2d1a86bd3e89b1
Opcode Fuzzy Hash: fae71b4869ae569bafac289f6a09a1d21ff0609c13e63d45931af16e1a68b08f
Instruction Fuzzy Hash: D9F059B251228045E22497704570A9E72B8CF8035CB500239F4AAC6F41EB6BE6988DFF

Function 6C36D3D0 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

new.LIBCMT ref: 6C36D3F7

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19b66c6cea623c4ce6e82e1a1a5c1cb39f330c3bcc8957baa14ce12d8e58302c
Instruction ID: e9050c2863c7f9b0ca94941652757268a189d5c44ad3c42ad0a96434f073fe46
Opcode Fuzzy Hash: 19b66c6cea623c4ce6e82e1a1a5c1cb39f330c3bcc8957baa14ce12d8e58302c
Instruction Fuzzy Hash: 2AF0977241320405E21487B38910E9F72A88F0036C7700339E866C3F8DEFA2F9898EDB

Function 6C370D70 Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

new.LIBCMT ref: 6C370D9A

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3b9674a052d906bc40769fbd11e90ff7402c1ad619f96228d6ceedf274cac0c
Instruction ID: 6f83efa7604ee4583e2df20ffcc6f7c23e259341cdc946c46e0757fad7b1444e
Opcode Fuzzy Hash: a3b9674a052d906bc40769fbd11e90ff7402c1ad619f96228d6ceedf274cac0c
Instruction Fuzzy Hash: 6EF0B47550738449E62487B48650FDF32A84F1035C750023AE826D6E15EB6BF9988EBB

Function 6C36B020 Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

new.LIBCMT ref: 6C36B04A

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15c0b58c902f026745a66fbe5b3f6f91989226b873c08466af165a5806f21b42
Instruction ID: 2b02c894a6c173c451e1a803c0dceeaad53c2348fae0b68f0eed930d8f67183d
Opcode Fuzzy Hash: 15c0b58c902f026745a66fbe5b3f6f91989226b873c08466af165a5806f21b42
Instruction Fuzzy Hash: 1EF024750121089AE61487B28511EEE76E88F1035C7100239F4B6CFE1AEB62EA5CDEDF

Function 6C3A674E Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(000000FF,?,00000000), ref: 6C3A6761
GetLastError.KERNEL32(?,00000000), ref: 6C3A677A

Strings

c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc, xrefs: 6C3A6787
CloseHandle, xrefs: 6C3A679A

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID: CloseHandle$c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc
API String ID: 918212764-2138661059
Opcode ID: 7e252102432f3fa0ca8c558c187134e43a323281f2e3345216f8fa55f74a7d9b
Instruction ID: edd07ad1794a4dfeb8b6f2a093164c8058f19aba009e3053c5f7fd7b13aa5cbe
Opcode Fuzzy Hash: 7e252102432f3fa0ca8c558c187134e43a323281f2e3345216f8fa55f74a7d9b
Instruction Fuzzy Hash: B6F08B7280031176DB216AB9DD0AFDA3328DF002A8F11485AEC84BAEC1DB378C184D82

Function 6C364B40 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 204COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6C364BF6
std::_Xinvalid_argument.LIBCPMT ref: 6C364C00

Strings

string too long, xrefs: 6C364BF1, 6C364BFB

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: string too long
API String ID: 909987262-2556327735
Opcode ID: 9fc342609cd1878fa23a6c4387cba36c642a653a2282d9d37ec671c4d006d0eb
Instruction ID: 36b5029de771b8d0bef182d20f3e7ec61e1977126da1b7ac7aea5f57fe2889b0
Opcode Fuzzy Hash: 9fc342609cd1878fa23a6c4387cba36c642a653a2282d9d37ec671c4d006d0eb
Instruction Fuzzy Hash: A35139337056105BD321D96EE850A5AF7F9EB92768B100A2BE4D1C7F94C372C8448BA2

Function 6C38C99D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 6C38CA2D

Strings

pow, xrefs: 6C38CA05, 6C38CA22

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 576e96e170f0a5db27685e617622916cb2fce0713009c553b8c1d4d05a0f9c93
Instruction ID: 75ec8f5b118a90dbfe95bba1427e58550a899803ed4212733573beb29080ff3a
Opcode Fuzzy Hash: 576e96e170f0a5db27685e617622916cb2fce0713009c553b8c1d4d05a0f9c93
Instruction Fuzzy Hash: 44518E61B0B50196C701BA14DA1039A7BB89B41B9CF208F59E0E5C1ED9FF3E8498DED7

Function 6C39750D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 6C3970A0: GetOEMCP.KERNEL32(00000000,6C397329,?,?,?), ref: 6C3970CB

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,6C397370,?,00000000,?,6C3BED20), ref: 6C397581
GetCPInfo.KERNEL32(00000000,?,?,?,?,6C397370,?,00000000,?,6C3BED20), ref: 6C397594

Strings

;l, xrefs: 6C397521

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: ;l
API String ID: 546120528-3972728159
Opcode ID: c10cec91d7fe25affd69a7c1e4d7fd39b5f518216b326f4b3645ea11ea080a78
Instruction ID: a4f9ef9be728acca06418fc431c798653ddffd31ea788dcdc1d7651eea83bb7c
Opcode Fuzzy Hash: c10cec91d7fe25affd69a7c1e4d7fd39b5f518216b326f4b3645ea11ea080a78
Instruction Fuzzy Hash: F651E171A043469FDB208F6AC4906EBBBB9AF43308F14456ED0958AAD0F7369545CFA1

Function 6C3662E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 158COMMON

Download Yara Rule

Strings

invalid string position, xrefs: 6C36636F
string too long, xrefs: 6C36641C

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID: invalid string position$string too long
API String ID: 0-4289949731
Opcode ID: e47446c682b1af542a0f2614f06501a290a18d39651360128dd09453751873cf
Instruction ID: 487900526fb57cc8bf2629194b3d248a72a5f3da3a57e0287ba5355c9918bd1f
Opcode Fuzzy Hash: e47446c682b1af542a0f2614f06501a290a18d39651360128dd09453751873cf
Instruction Fuzzy Hash: 2941E8323102514BD3219E5EE840A5AFBF9EBA17A5F20093FE591CBF55D772D8048BA1

Function 6C36F170 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132COMMON

Download Yara Rule

Strings

invalid string position, xrefs: 6C36F298
string too long, xrefs: 6C36F2A2

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID: invalid string position$string too long
API String ID: 0-4289949731
Opcode ID: 33115be93e95803d98849e0e590f3545a8c3565f3fa5019c19b808012f3d3cf3
Instruction ID: 4586505b4bf74235f06745c4e4935f567b9ef9ec045eb96be4dc69710b13bcea
Opcode Fuzzy Hash: 33115be93e95803d98849e0e590f3545a8c3565f3fa5019c19b808012f3d3cf3
Instruction Fuzzy Hash: D141D5397012059BC720CF5EDC90E5AB7AAFF89748310092EE551CBE58DB31E8168FE1

Function 6C39FCD5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMON

Download Yara Rule

APIs

GoogleChromeDaysSinceLastRun.GCAPI ref: 6C39FDBB

Strings

RelaunchAllowedAfter, xrefs: 6C39FDF8
Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}, xrefs: 6C39FDDE

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ChromeDaysGoogleLastSince
String ID: RelaunchAllowedAfter$Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
API String ID: 2052684696-26780984
Opcode ID: 711842ca8692cbbc7d3df14e95886902292e3b05343ed0ba4bc4877120d8dd1b
Instruction ID: 8f77e0abc04f559bd2a0d3f8b49e47644b4b582b7901f3c46e414fe674d03f85
Opcode Fuzzy Hash: 711842ca8692cbbc7d3df14e95886902292e3b05343ed0ba4bc4877120d8dd1b
Instruction Fuzzy Hash: 5B41B731D022199ADB10DEA4D844BEEB3B8EF0971CF200519F890A7A95FB76D9458FD1

Function 6C3A4ADC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 6C3A4B03

Strings

dmp, xrefs: 6C3A4B42
reports, xrefs: 6C3A4B7F, 6C3A4B84

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID: dmp$reports
API String ID: 0-1316949204
Opcode ID: d95ede38c74724ed3495d27476254569e841623e9d9bab0b979871087200f6d2
Instruction ID: 7efe28451a37d432df9b81b313e273501a446aacb5e810c37023f4bd1a6b8053
Opcode Fuzzy Hash: d95ede38c74724ed3495d27476254569e841623e9d9bab0b979871087200f6d2
Instruction Fuzzy Hash: 6A41A271E012086BCB14DBA8DC90EEEB7BDEB45308F104129E455E7B80DF319D198FA6

Function 6C364D29 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6C364E2C

Strings

invalid string position, xrefs: 6C364E1D
string too long, xrefs: 6C364E27

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 909987262-4289949731
Opcode ID: bb7b8345793b3945de5f466e654b48e38b0ff6306f86a7a99fe7d6d04840a5ca
Instruction ID: aa8b4b35d1820abe9c44909667ac7af11520af55345ed59a5c34d3cfda4d2d5f
Opcode Fuzzy Hash: bb7b8345793b3945de5f466e654b48e38b0ff6306f86a7a99fe7d6d04840a5ca
Instruction Fuzzy Hash: E031E732B002108BD321DE5DE850B5AF7A5EBE5B65F100A2FD191CBE85D772D8508BE2

Function 6C364970 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 121COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6C364A86

Strings

invalid string position, xrefs: 6C364A6D, 6C364A77
string too long, xrefs: 6C364A81

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 909987262-4289949731
Opcode ID: d9412cd301c595aead50771514f6e869d66bfba0e3b235d043180d3bff47b852
Instruction ID: 82aa0917dc76a4b8dcbe128f63e8e3f295a325db04f8ae8a543b59a8b0927dbd
Opcode Fuzzy Hash: d9412cd301c595aead50771514f6e869d66bfba0e3b235d043180d3bff47b852
Instruction Fuzzy Hash: 3631D2327152009B8320DE5EE89095BF3FAFF947593100A2EE596C7E14DB31D8148FAA

Function 6C370A20 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 121COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6C370B4C

Part of subcall function 6C37FC11: std::invalid_argument::invalid_argument.LIBCONCRT ref: 6C37FC1D
Part of subcall function 6C37FC11: __CxxThrowException@8.LIBVCRUNTIME ref: 6C37FC2B

Strings

,, xrefs: 6C370A52
vector<T> too long, xrefs: 6C370B47

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: ,$vector<T> too long
API String ID: 1419379543-2403322092
Opcode ID: b29e348e297fe710979a9c1e00ca3b2b0c1eae52e5d6a3fc524f15bbce573d80
Instruction ID: 8b1c7c589701772d2f7eb8ec0fc17f089517af7682a888dcf7a61698162083a3
Opcode Fuzzy Hash: b29e348e297fe710979a9c1e00ca3b2b0c1eae52e5d6a3fc524f15bbce573d80
Instruction Fuzzy Hash: CA31E271E111489BDF20DEA8C8C0AEEF7B5EF48318F044529D855A7741C77AA948CFA6

Function 6C36A660 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6C36A70A
std::_Xinvalid_argument.LIBCPMT ref: 6C36A714

Strings

string too long, xrefs: 6C36A705, 6C36A70F

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: string too long
API String ID: 909987262-2556327735
Opcode ID: e9c01a95773ba409297e98f4d615a334cce8e8fdc432719a6c17c5bb064aacd6
Instruction ID: 24cc7df079ed9e944a70ca0f4581cacf51d4d2986b50c9f33165923da3892e71
Opcode Fuzzy Hash: e9c01a95773ba409297e98f4d615a334cce8e8fdc432719a6c17c5bb064aacd6
Instruction Fuzzy Hash: C01106323183214B43206E6EF88085AF3E9FFA47653100A3FE192C7E50DB72E8048FA5

Function 6C39F056 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000104), ref: 6C39F0B2
SetWindowPos.USER32(?,?,?,?,?,?,?), ref: 6C39F105

Strings

Chrome_WidgetWin_, xrefs: 6C39F0C2, 6C39F0C7

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ClassNameWindow
String ID: Chrome_WidgetWin_
API String ID: 697123166-524248775
Opcode ID: 8c18d14430e9fd8e640cae628e86fd58d0612e07fecb6d7b3e2e9e3abd9858e6
Instruction ID: 028bb8508542e0b0ff4e02ec8b7c85f92ea8512d5c6e9bc925f6f9d9283ac7d3
Opcode Fuzzy Hash: 8c18d14430e9fd8e640cae628e86fd58d0612e07fecb6d7b3e2e9e3abd9858e6
Instruction Fuzzy Hash: F72191B1A00209ABDB14CF64DC84FDAB7B8BB28304F104659B555E3940E771A694CFD0

Function 6C3A134D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(6C3B8238,00000000,00000001,6C3B6804,00000000,00000000,?,00000000,00000000), ref: 6C3A136D

Part of subcall function 6C37C8D0: SysAllocString.OLEAUT32(?), ref: 6C37C8D9

Part of subcall function 6C37C8F0: SysFreeString.OLEAUT32(?), ref: 6C37C8F2

CoSetProxyBlanket.OLE32(00000000,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 6C3A13BE

Strings

ROOT\CIMV2, xrefs: 6C3A137E

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: String$AllocBlanketCreateFreeInstanceProxy
String ID: ROOT\CIMV2
API String ID: 2036101689-2786109267
Opcode ID: 98fce4bbf486a2ba841543d926c5b3eb3a9501d62c79b50c5af4a17bb9faf076
Instruction ID: f30979610e1e5133ae39702315b948ac53f0d7ae998159737c0e39bf266d2b4b
Opcode Fuzzy Hash: 98fce4bbf486a2ba841543d926c5b3eb3a9501d62c79b50c5af4a17bb9faf076
Instruction Fuzzy Hash: A5213E71A01208FFDB10DFE1C894AAEBB7CEF45648F104599E805ABA80D6719E15DF50

Function 6C372860 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 6C37287D
std::_Xinvalid_argument.LIBCPMT ref: 6C3728ED

Strings

list<T> too long, xrefs: 6C3728E8

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: list<T> too long
API String ID: 909987262-4027344264
Opcode ID: 67760fe74f880a595785ccd32c0a6a3595d8ae9cf85d37faf33581108271a045
Instruction ID: 8daf14c9e188fca6d4d6168028fe3bd233c0273c36151c594d35f1b96ec69622
Opcode Fuzzy Hash: 67760fe74f880a595785ccd32c0a6a3595d8ae9cf85d37faf33581108271a045
Instruction Fuzzy Hash: 6111C176A01209DBCB10CF58C540589F7F5FF89714B24856ADC58AB700D736ED05CF91

Function 6C37C700 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 6C37C717
std::_Xinvalid_argument.LIBCPMT ref: 6C37C78D

Strings

list<T> too long, xrefs: 6C37C788

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: list<T> too long
API String ID: 909987262-4027344264
Opcode ID: 765b2bc5dfac6de4e7b54b4e3a91ce54be38753cf34e7b9ec62f0c7534d39ddd
Instruction ID: 1ba140b24c4a39de908cdb4620e6a6d63839cfc39fba424e007a99046104fe4f
Opcode Fuzzy Hash: 765b2bc5dfac6de4e7b54b4e3a91ce54be38753cf34e7b9ec62f0c7534d39ddd
Instruction Fuzzy Hash: 59119DB5A012059FC724CF58E540A85B7E4FF08304B1485A9E948DB701D77AE941CFE5

Function 6C36A5C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6C36A64E
std::_Xinvalid_argument.LIBCPMT ref: 6C36A658

Strings

string too long, xrefs: 6C36A649, 6C36A653

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: string too long
API String ID: 909987262-2556327735
Opcode ID: 878abe285397f02cfb522205afd5ed7a9ff39a062655fa50dd5e8ab1428fd588
Instruction ID: e51fc0b674749765b4508eb62d239772c35d0c55b09562419889b64beb68689c
Opcode Fuzzy Hash: 878abe285397f02cfb522205afd5ed7a9ff39a062655fa50dd5e8ab1428fd588
Instruction Fuzzy Hash: 3111E3323083245A86206E5EF84095AB7A9FFE47757110A2FE696C7E50DB31E4148FA6

Function 6C373290 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

QueryPerformanceFrequency.KERNEL32(?), ref: 6C3732AE

Strings

AuthenticAMD, xrefs: 6C3732DE
n37l, xrefs: 6C37334E

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: FrequencyPerformanceQuery
String ID: AuthenticAMD$n37l
API String ID: 4204123506-410532846
Opcode ID: ac2c77dc55bb9e3e48e312aaccdfe9a2565a40ddc95d297c1699e4548446c2b4
Instruction ID: 7d70a6ff741a588211a00d1b79a5af941a717d8fcfadc17e9d63f01000da6628
Opcode Fuzzy Hash: ac2c77dc55bb9e3e48e312aaccdfe9a2565a40ddc95d297c1699e4548446c2b4
Instruction Fuzzy Hash: 9821B335E01208DADF60DF95C8406EDBBB8FF06304F204219E840BBA50EB359948CFA5

Function 6C3850A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,"R8l,00000001,00000000,?,6C385222,?,?,00000104), ref: 6C385134
GetLastError.KERNEL32(?,6C385222,?,?,00000104), ref: 6C38514B

Strings

"R8l, xrefs: 6C385128, 6C38512F

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: "R8l
API String ID: 2776309574-400348159
Opcode ID: 438ea970461415646e85214729c7f84a45c8ba3906bd2dcafa4b57af5fbe04b3
Instruction ID: 26f5c19c40ab91abe6384b27d8b35f221c2910706fca3ae23736a7aa6b178dd6
Opcode Fuzzy Hash: 438ea970461415646e85214729c7f84a45c8ba3906bd2dcafa4b57af5fbe04b3
Instruction Fuzzy Hash: FE214693D2C7D67EEF328B68444845A7F606C42266B1B0CEFC58197427C213D2A38782

Function 6C37D170 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6C37D184
GetProcAddress.KERNEL32(00000000), ref: 6C37D195

Strings

kernel32.dll, xrefs: 6C37D178

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: kernel32.dll
API String ID: 1646373207-1793498882
Opcode ID: 640b91042d584b2081686f7f878b3bf84fdcd0ddab3483a8c8dc29918b54f01f
Instruction ID: aee0c9d588e38db998ed4ef6d7bd1f0b1c3de8b823cd932c1eb5e2bb3ffd1288
Opcode Fuzzy Hash: 640b91042d584b2081686f7f878b3bf84fdcd0ddab3483a8c8dc29918b54f01f
Instruction Fuzzy Hash: 7E016171A02209EAEF609E99DC04BEE7BBCEB85654F200095E804E7540DB75D615CFB5

Function 6C3A6411 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 6C3A6431

Part of subcall function 6C362340: GetLastError.KERNEL32(?,00000000), ref: 6C3623D6

Strings

UuidCreate, xrefs: 6C3A645F
c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\misc\uuid.cc, xrefs: 6C3A644B

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: CreateErrorLastUuid
String ID: UuidCreate$c:\b\build\slave\win\build\src\third_party\crashpad\crashpad\util\misc\uuid.cc
API String ID: 3740028514-535133227
Opcode ID: 370a8ae1194fbb455f454eb1dba483e17bff65c13f6b7fc17c717fe5ab138186
Instruction ID: 3e97e742bf1ed8dc7536b17e8a7750de25deb32b80df1bc35ababbaf2ea7c403
Opcode Fuzzy Hash: 370a8ae1194fbb455f454eb1dba483e17bff65c13f6b7fc17c717fe5ab138186
Instruction Fuzzy Hash: A30128756012045EDB00DFA8EC41BEA73B8DF12308F100059E845B7A81CE77590D8E65

Function 015FEF2B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

__wcstoi64.LIBCMT ref: 015FEF58

Strings

d, xrefs: 015FEE9D
*, xrefs: 015FEF2B

Memory Dump Source

Source File: 00000002.00000002.1798261623.00000000015EF000.00000020.00000001.01000000.00000003.sdmp, Offset: 015EF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15ef000__AnyDesk.jbxd

Similarity

API ID: __wcstoi64
String ID: *$d
API String ID: 398114495-1907121859
Opcode ID: 7b81e8c82e394ef311511e9e96cec9307c84f63589ef770a4de38d28e8f61a0b
Instruction ID: ff4fa8fd26cadb4a8c4d0bf3b559a8c44edbe7a6636218264153512ab3d1e967
Opcode Fuzzy Hash: 7b81e8c82e394ef311511e9e96cec9307c84f63589ef770a4de38d28e8f61a0b
Instruction Fuzzy Hash: 51216A729056698FDB25CF18CC45BAC77F0FB05305F1985EED649EA290EB319A84CF81

Function 6C3941DC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

Strings

2:l, xrefs: 6C394202
p8l, xrefs: 6C3941DE

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID: 2:l$p8l
API String ID: 0-2552763724
Opcode ID: 9519f2b95842a0e7f999f20d2477e2d72891853c26b91b668ae0f73648975a68
Instruction ID: fc3a7ca832f801dbc10ff0fc8efab2278def249518847d3be2bb8d9cc01f3a98
Opcode Fuzzy Hash: 9519f2b95842a0e7f999f20d2477e2d72891853c26b91b668ae0f73648975a68
Instruction Fuzzy Hash: DAF09035214249AADB149BD5C800ABA73BCEB04B04F40416ABCA9CB980F674CE91DB66

Function 6C364D10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6C364E2C

Strings

invalid string position, xrefs: 6C364E13, 6C364E1D
string too long, xrefs: 6C364E27

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 909987262-4289949731
Opcode ID: 6e78fb8d481103ff3be43685c5b280d1a65b35014bb89264df382adbb0bb19c2
Instruction ID: 4a65ea1032c26e59cf4eea8b2abe1d13aa122149018653fa01a6bf88bc71dd92
Opcode Fuzzy Hash: 6e78fb8d481103ff3be43685c5b280d1a65b35014bb89264df382adbb0bb19c2
Instruction Fuzzy Hash: 96D05E7450010B3B8624AA8ADCD0D8EB29D6F2C2A47004816FF44A7E89DA7CD8014E77

Function 6C3970A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetOEMCP.KERNEL32(00000000,6C397329,?,?,?), ref: 6C3970CB
GetACP.KERNEL32(00000000,6C397329,?,?,?), ref: 6C3970E2

Strings

)s9l, xrefs: 6C3970A8, 6C397105

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID:
String ID: )s9l
API String ID: 0-3762899304
Opcode ID: 2fdefe53ae347eee21943d0f846a4e253fefa9b624f2c138925d4253d85abb87
Instruction ID: ad54c1d4a4210d64dfaf47e3ed00cbeab5da6faf86c91a49e91fc85092f38cde
Opcode Fuzzy Hash: 2fdefe53ae347eee21943d0f846a4e253fefa9b624f2c138925d4253d85abb87
Instruction Fuzzy Hash: BFF04F31A052488FDB10DB68C4487A877B9AB07339F140388E8348AAD1E7B26995CF86

Function 6C385124 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,"R8l,00000001,00000000,?,6C385222,?,?,00000104), ref: 6C385134
GetLastError.KERNEL32(?,6C385222,?,?,00000104), ref: 6C38514B

Strings

"R8l, xrefs: 6C385128, 6C38512F

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: "R8l
API String ID: 2776309574-400348159
Opcode ID: 9dfd4146ecbeba501e05b90c2d4f5bb9c5d1ff1880123805e657f6377efa7f69
Instruction ID: 89bf72f43a56492c4f9141a505d3014a792af67ba4321727e9c731131824d9f6
Opcode Fuzzy Hash: 9dfd4146ecbeba501e05b90c2d4f5bb9c5d1ff1880123805e657f6377efa7f69
Instruction Fuzzy Hash: F6E01A36346225B79F111FAAD80495F7B7CEE96B66B048129E90AC3710E732D4128BE0

Function 6C3A7450 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 6C3A2CC2: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,6C3A747F,?,?,?,6C36133F), ref: 6C3A2CC7
Part of subcall function 6C3A2CC2: GetLastError.KERNEL32(?,6C3A747F,?,?,?,6C36133F), ref: 6C3A2CD1

IsDebuggerPresent.KERNEL32(?,?,?,6C36133F), ref: 6C3A7483
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,6C36133F), ref: 6C3A7492

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 6C3A748D

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 450123788-631824599
Opcode ID: 07002fd61932169c32a0e402896df0b9d6cbfa35de6b558a4f85bd875272466f
Instruction ID: d91225fe26cb7dc2776afa542a3a308cd585abb0b9646b99495cfa845a89c824
Opcode Fuzzy Hash: 07002fd61932169c32a0e402896df0b9d6cbfa35de6b558a4f85bd875272466f
Instruction Fuzzy Hash: 8CE06D74308B418FD7609FA9D5443867BF8AF52304F00895DD496C6F00E7B9D4598FA2

Function 6C3A5C01 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6C3A5C2E

Strings

T:l, xrefs: 6C3A5C11
vector<T> too long, xrefs: 6C3A5C29

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: T:l$vector<T> too long
API String ID: 909987262-2121972600
Opcode ID: a83884469fbbe6919b0da70cec562feb34b0cb05b470a5d46cd3913466290d6e
Instruction ID: 05ea94889d7cc6c7378b8f99b97c50dbcaf07bdb97858f1093f2d75fdc6680e1
Opcode Fuzzy Hash: a83884469fbbe6919b0da70cec562feb34b0cb05b470a5d46cd3913466290d6e
Instruction Fuzzy Hash: 6AD02B72040B1CA68125F9C8E485C8AB7DCDB047BDB104463F1044DC08C533E4E2CFD2

Function 6C37FC31 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMONLIBRARYCODE

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 6C37FC3D

Part of subcall function 6C37FBB2: std::exception::exception.LIBCONCRT ref: 6C37FBBF

__CxxThrowException@8.LIBVCRUNTIME ref: 6C37FC4B

Part of subcall function 6C382BD6: RaiseException.KERNEL32(?,?,?,6C3813B7,00000000,00000000,00000000,?,?,?,?,?,6C3813B7,?,6C3BB2E0), ref: 6C382C35

Strings

Unknown exception, xrefs: 6C37FC58

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowstd::exception::exceptionstd::invalid_argument::invalid_argument
String ID: Unknown exception
API String ID: 1586462112-410509341
Opcode ID: bcd94cf2beb1898fccf0a1087f8d040d0a582c7f8708da87b9acd6b146013c6e
Instruction ID: 8b8f537e6d871f0b8ab921abce09f1a80b281bb58050ee1c59bade0fad68da68
Opcode Fuzzy Hash: bcd94cf2beb1898fccf0a1087f8d040d0a582c7f8708da87b9acd6b146013c6e
Instruction Fuzzy Hash: 17D0A73990010877CB11EEE4D854DC8777CBF04248BD08064E964D7D44E775EA1A8FD2

Function 6C394371 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000000,?), ref: 6C394407
GetLastError.KERNEL32 ref: 6C394415
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000), ref: 6C394470

Memory Dump Source

Source File: 00000002.00000002.1853679859.000000006C361000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000002.00000002.1853637611.000000006C360000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1854888142.000000006C3AA000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855286100.000000006C3BD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855351295.000000006C3C1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1855395253.000000006C3C3000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c360000__AnyDesk.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 60d18ed859cfe9206907eb9cc933cef7ca3107fb753d02e62bc70487477cf6df
Instruction ID: 732a936ef1df64b9c16da34fac457ac9ad8c56b165ca0b328e29869124aa81f7
Opcode Fuzzy Hash: 60d18ed859cfe9206907eb9cc933cef7ca3107fb753d02e62bc70487477cf6df
Instruction Fuzzy Hash: 7E416B31605216AFDF118FA5C844BAE7BB8EF02318F214268FD789BA90F7319810CF61

Analysis Process: _AnyDesk.exePID: 6736, Parent PID: 5772COMMON

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3%
Total number of Nodes:	597
Total number of Limit Nodes:	57

Executed Functions

Function 013AABF0 Relevance: 16.7, APIs: 11, Instructions: 172
windowthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 013AAC0B
MsgWaitForMultipleObjectsEx.USER32(00000001,?,000000FF,000004FF,00000000), ref: 013AAC34
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 013AAC6D
TranslateMessage.USER32(?), ref: 013AAD72
DispatchMessageW.USER32(?), ref: 013AAD7D
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 013AAD8D
MsgWaitForMultipleObjectsEx.USER32(00000001,?,000000FF,000004FF,00000000), ref: 013AADBA

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000013AA000.00000020.00000001.01000000.00000003.sdmp, Offset: 013AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13aa000__AnyDesk.jbxd

Similarity

API ID: Message$MultipleObjectsPeekWait$CurrentDispatchThreadTranslate
String ID:
API String ID: 2435604938-0
Opcode ID: e2d9d544c8a4407c44f31fa4ccde476187ead95f5db96c931af2c8f97f114a78
Instruction ID: 6f9225c9949a9c9d9e127944a6f375b2e544e2a13f4a958483aebba8e9534b3f
Opcode Fuzzy Hash: e2d9d544c8a4407c44f31fa4ccde476187ead95f5db96c931af2c8f97f114a78
Instruction Fuzzy Hash: 0C51F671204301AFE720EF68CC90D7A77E9FF95309F804A19F5D687291D634E949CBA2

Function 01362EC0 Relevance: 11.0, APIs: 7, Instructions: 450
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01374170: SetFilePointerEx.KERNEL32(?,00000000,00000000,00000000,00000000,?,01362EF5,?,?), ref: 0137418B
Part of subcall function 01374170: GetLastError.KERNEL32(?,01362EF5,?,?), ref: 01374195

SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000), ref: 01363261
SetEndOfFile.KERNELBASE(?), ref: 0136326B
GetLastError.KERNEL32 ref: 01363275
SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000), ref: 01363293
GetLastError.KERNEL32 ref: 01363299
WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 013632DE
GetLastError.KERNEL32 ref: 013632E8

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: File$ErrorLast$Pointer$Write
String ID:
API String ID: 2270669747-0
Opcode ID: 84105ba62b181f71285ebe3b48bbd410aa136e4b41731a893d6ca73ecb7cd1a6
Instruction ID: 887f6d695582a1982b228285973ec6544692a039b7e17807624e89017bd67439
Opcode Fuzzy Hash: 84105ba62b181f71285ebe3b48bbd410aa136e4b41731a893d6ca73ecb7cd1a6
Instruction Fuzzy Hash: F6F1B0B1A043429FD714DF68C884A2BB7E9BFD4718F14892DF99A87305DB71E805CB92

Function 0137E060 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 0137E097

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 993f0dd167f1c48d74b3daa88665f2761afa4c3e6ed55e9bc929c46f652bfd44
Instruction ID: 15c55410d14bbffd88af132b1390aaeb8de6174ee152654e9fdd623f3c7ef563
Opcode Fuzzy Hash: 993f0dd167f1c48d74b3daa88665f2761afa4c3e6ed55e9bc929c46f652bfd44
Instruction Fuzzy Hash: 33114CB1600301AFE764DF68EC0AF9777D4AB84304F048A3DE55AC7285FB74D4188B92

Function 01359C40 Relevance: 30.1, APIs: 16, Strings: 1, Instructions: 356
filesynchronizationtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32(00000000,00000BB8), ref: 01359CC9
OutputDebugStringA.KERNEL32(01BCC70C), ref: 01359CF5
GetSystemTime.KERNEL32(?), ref: 01359E2A
TlsGetValue.KERNEL32(000002FC), ref: 01359E34
GetCurrentThreadId.KERNEL32 ref: 01359EE4
GetCurrentProcessId.KERNEL32(00000000), ref: 01359EEB
SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000002), ref: 01359F55
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 01359F8E
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 01359FA0
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 01359FE6
WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 01359FFF
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0135A00E
SetEndOfFile.KERNEL32(00000000), ref: 0135A018
WriteFile.KERNELBASE(00000000,?,?,00000000,00000000), ref: 0135A04B
RtlEnterCriticalSection.NTDLL(01D6EB2C), ref: 0135A0A7
RaiseException.KERNEL32(00002329,00000000,00000000,00000000), ref: 0135A0B8

Strings

crash, xrefs: 01359EB4, 01359F1A

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: File$Pointer$CurrentWrite$CriticalDebugEnterExceptionObjectOutputProcessRaiseReadSectionSingleStringSystemThreadTimeValueWait
String ID: crash
API String ID: 3372521217-3622367455
Opcode ID: ec211084ec52e720dbe24e2486a90fe7731d04a94422ca49c39addbc4e2cfc0f
Instruction ID: b3f3e766a81e16e2c131a6b5687138d4d7ab195e11b69a6a5a5e4c3b1fd31ea0
Opcode Fuzzy Hash: ec211084ec52e720dbe24e2486a90fe7731d04a94422ca49c39addbc4e2cfc0f
Instruction Fuzzy Hash: 24D1C9B1E00205EBDF64DF68CC84FAE7BB8AB48B18F084169FE099B285D774D544CB65

Function 01359A60 Relevance: 16.6, APIs: 11, Instructions: 134
threadfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 01359AA0
OpenThreadToken.ADVAPI32(00000000), ref: 01359AA7
CloseHandle.KERNEL32(?,?), ref: 01359AC1
GetLastError.KERNEL32 ref: 01359AF4
CloseHandle.KERNEL32(?), ref: 01359B0C
CreateFileW.KERNELBASE(01D75C54,C0000000,00000007,00000000,00000004,00000000,00000000,?), ref: 01359B4C
RevertToSelf.ADVAPI32 ref: 01359B64
CloseHandle.KERNEL32(?), ref: 01359B78
GetLastError.KERNEL32 ref: 01359BD5
RevertToSelf.ADVAPI32 ref: 01359BF1
CloseHandle.KERNEL32(?), ref: 01359C05

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: CloseHandle$ErrorLastRevertSelfThread$CreateCurrentFileOpenToken
String ID:
API String ID: 347220848-0
Opcode ID: 14d026e43ad6a5b2884375770a340e4f16309157a287b7fb948b19c497c34014
Instruction ID: 83215d5b6c9baf49d2d94ea5f3662e923f12d71e66c4b873210cc008b8a60f0e
Opcode Fuzzy Hash: 14d026e43ad6a5b2884375770a340e4f16309157a287b7fb948b19c497c34014
Instruction Fuzzy Hash: 08419170A08341EAFB719B7C9C08F1A7B98AB01B2CF588A19FDA4972C5D374A4548B52

Function 01372450 Relevance: 12.2, APIs: 8, Instructions: 228
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 013727B0: UnmapViewOfFile.KERNEL32(?,?,?,?,0163A600,000000FF,01372479), ref: 013727D6
Part of subcall function 013727B0: CloseHandle.KERNEL32(?,?,?,?,0163A600,000000FF,01372479), ref: 013727E7

OpenFileMappingW.KERNELBASE(00000006,00000000,?,?), ref: 013724C3
CloseHandle.KERNEL32(?), ref: 013724F0
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,?,?), ref: 0137251A
GetLastError.KERNEL32 ref: 01372527
GetLastError.KERNEL32 ref: 01372548
GetLastError.KERNEL32 ref: 0137256A
MapViewOfFile.KERNELBASE(?,00000006,00000000,00000000,?), ref: 01372666
GetLastError.KERNEL32 ref: 01372678

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: ErrorFileLast$CloseHandleMappingView$CreateOpenUnmap
String ID:
API String ID: 2610373023-0
Opcode ID: 8c1b4c60f9335df1d47df28d6ffabe64ce7bd2d861c73a4055720751c4f9ed0e
Instruction ID: d82e46a681ff2133b35bdea563406aa328e02b2fcf4c2ef6cf155ecdd58f9f98
Opcode Fuzzy Hash: 8c1b4c60f9335df1d47df28d6ffabe64ce7bd2d861c73a4055720751c4f9ed0e
Instruction Fuzzy Hash: 1381E4B1808385AFD731EF68CC8095BFBA8FB54218F448A1DF99597600D778E954CBA2

Function 0139EED0 Relevance: 12.1, APIs: 8, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(0000000C,?), ref: 0139EEE6
OpenProcessToken.ADVAPI32(00000000), ref: 0139EEED
GetTokenInformation.KERNELBASE(FFFFFFFF,00000001,00000000,00000000,?), ref: 0139EF12
GetLastError.KERNEL32 ref: 0139EF18
CloseHandle.KERNEL32(FFFFFFFF,?,00000000,00000000), ref: 0139EF30
GetTokenInformation.KERNELBASE(FFFFFFFF,00000001,?,00000000,00000000), ref: 0139EF5A
CloseHandle.KERNELBASE(FFFFFFFF,?,00000000,00000000), ref: 0139EF6D
IsWellKnownSid.ADVAPI32(?,00000016,?,00000000,00000000), ref: 0139EF7F

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000139E000.00000020.00000001.01000000.00000003.sdmp, Offset: 0139E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_139e000__AnyDesk.jbxd

Similarity

API ID: Token$CloseHandleInformationProcess$CurrentErrorKnownLastOpenWell
String ID:
API String ID: 4246584975-0
Opcode ID: 3f65c0078e10cd4780715e918f5bfc2b2bc9e219907b7f2934e46de38d2c0450
Instruction ID: 3e5997846b8e2df76575b55735082411433680821115099660403d31a22269a6
Opcode Fuzzy Hash: 3f65c0078e10cd4780715e918f5bfc2b2bc9e219907b7f2934e46de38d2c0450
Instruction Fuzzy Hash: 6421C531600609EBEF30DBA8DC48BAE7BBCEB44765F250365FA15D31C0E730AA558B60

Function 01294020 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 495
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0129455B
GetDC.USER32(00000000), ref: 012945AC
GetDeviceCaps.GDI32(00000000,0000000C), ref: 012945B7
ReleaseDC.USER32(00000000,00000000), ref: 012945C3
KiUserCallbackDispatcher.NTDLL(?), ref: 01294604

Strings

@, xrefs: 01294553

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000127B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0127B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_127b000__AnyDesk.jbxd

Similarity

API ID: CallbackCapsDeviceDispatcherGlobalMemoryReleaseStatusUser
String ID: @
API String ID: 1282229438-2766056989
Opcode ID: 300231bc8dcb9381b4ba5d477921f6efa6831cffa7ed53034be1515903c8fe63
Instruction ID: a15a15810605fefba1ae1e8d7e39da8289909b25f65955af8509926499cd07f5
Opcode Fuzzy Hash: 300231bc8dcb9381b4ba5d477921f6efa6831cffa7ed53034be1515903c8fe63
Instruction Fuzzy Hash: 09227DB5A08742AFC318DF69C580A9BFBE5BFD9304F04896CE58987311D770E919CB92

Function 013620C0 Relevance: 10.7, APIs: 7, Instructions: 240
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL ref: 01362105
GetCurrentThreadId.KERNEL32 ref: 01362118
RtlLeaveCriticalSection.NTDLL(?), ref: 013621C5
LockFileEx.KERNEL32(?,00000002,00000000,000000FF,000000FF,?), ref: 0136220C
GetLastError.KERNEL32 ref: 01362216
RtlLeaveCriticalSection.NTDLL(?), ref: 01362287
RtlLeaveCriticalSection.NTDLL(00000001), ref: 0136236D

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: CriticalSection$Leave$CurrentEnterErrorFileLastLockThread
String ID:
API String ID: 3816518944-0
Opcode ID: ef219b17743f4b9d79bb9252869045f2f3ad48d07c70f1725f9cb60279376094
Instruction ID: c9c2fc4f9dc2af77d3aedf1eea2eb3e7d556f6e8d74d8dc1c1cde54e80dbb0ed
Opcode Fuzzy Hash: ef219b17743f4b9d79bb9252869045f2f3ad48d07c70f1725f9cb60279376094
Instruction Fuzzy Hash: B691E0725083419FDB11DF28C840BABBBE8BF95728F044A1DFA5587391E775E805CBA2

Function 01360820 Relevance: 9.2, APIs: 6, Instructions: 232
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL ref: 01360896
GetCurrentThreadId.KERNEL32 ref: 013608A9
RtlEnterCriticalSection.NTDLL(?), ref: 013608F5
GetCurrentThreadId.KERNEL32 ref: 01360908

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: CriticalCurrentEnterSectionThread
String ID:
API String ID: 3488303727-0
Opcode ID: 66f6f6e40e5738160a95da6a7305ab7a93a72a39f80e3d093089468aaeef7577
Instruction ID: e75ea280fa33aa53666b2f5c112391990c3dd64c24e8124ce86e5b175e270ec4
Opcode Fuzzy Hash: 66f6f6e40e5738160a95da6a7305ab7a93a72a39f80e3d093089468aaeef7577
Instruction Fuzzy Hash: 8491CC72508341DFD71ACF28C880B5BBBE8BF85718F048A5DF9858B245E775E909CB92

Function 01363590 Relevance: 9.2, APIs: 6, Instructions: 178
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSizeEx.KERNEL32(?,00000000,?,00000000,?,?,?,00000000,01675400,000000FF,?,01362D6C,?,?), ref: 013635CE
ReadFile.KERNELBASE(?,00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 01363614
GetLastError.KERNEL32(?,?,?,00000000), ref: 0136361E
GetLastError.KERNEL32(?,?,?,00000000), ref: 01363635
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00000000), ref: 013636D7
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000), ref: 01363712

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWide$ReadSize
String ID:
API String ID: 2484957182-0
Opcode ID: 1f4e47f4ae33a167275dec90b29c9dd8386e917d85ff8a3b42ece7f02781dcb0
Instruction ID: 60e6e1228d1b9a3cb5391dab5db89eaeaba52f98a6425a459ef55bfa04cab370
Opcode Fuzzy Hash: 1f4e47f4ae33a167275dec90b29c9dd8386e917d85ff8a3b42ece7f02781dcb0
Instruction Fuzzy Hash: F051D8B1D04205ABDB10DFA8CC85BAEBBFCFF58324F048129E91997345E77599108BA1

Function 012EFF00 Relevance: 9.2, APIs: 6, Instructions: 155
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 012EFF23
ConvertThreadToFiber.KERNELBASE(00000000), ref: 012EFF31
RtlEnterCriticalSection.NTDLL(?), ref: 012F0020
GetCurrentThreadId.KERNEL32 ref: 012F0033
RtlLeaveCriticalSection.NTDLL(?), ref: 012F0067

Part of subcall function 012F57D0: GetLastError.KERNEL32(?,?,01653B78,000000FF,?,012EFF40), ref: 012F57F0

Part of subcall function 012F03E0: RtlEnterCriticalSection.NTDLL ref: 012F0461
Part of subcall function 012F03E0: RtlLeaveCriticalSection.NTDLL(?), ref: 012F04C9

Part of subcall function 012F58B0: ConvertFiberToThread.KERNEL32(?,?), ref: 012F58D0
Part of subcall function 012F58B0: GetLastError.KERNEL32 ref: 012F58DE

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000012AB000.00000020.00000001.01000000.00000003.sdmp, Offset: 012AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12ab000__AnyDesk.jbxd

Similarity

API ID: CriticalSectionThread$ConvertCurrentEnterErrorFiberLastLeave
String ID:
API String ID: 225206499-0
Opcode ID: a7720cf0100aed0d6910cc18f82081583a36d76542faba917a4c25df92830289
Instruction ID: dc50407db1c784dc224c52a73c438a99f948cd831a96b4552a0b720401eec201
Opcode Fuzzy Hash: a7720cf0100aed0d6910cc18f82081583a36d76542faba917a4c25df92830289
Instruction Fuzzy Hash: 10510A71514202AFD315AB38CC05F7BF7FDBF91A08F44062CF69593241DB75A4198BA6

Function 01369D00 Relevance: 9.2, APIs: 6, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,0000000C,?), ref: 01369D5C
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,0000000C,?), ref: 01369D63
GetTokenInformation.KERNELBASE(?,00000001,00000000,?,?), ref: 01369E64
IsWellKnownSid.ADVAPI32(?,00000016), ref: 01369E93
GetLastError.KERNEL32(?,?,?,?,?,0000000C,?), ref: 01369D6D

Part of subcall function 01373270: CloseHandle.KERNELBASE(?,00000000,01BCD320,00000000,0164908B,000000FF,01367CA9,?,?,?,?,?,?,?,00000000,00000008), ref: 013732A8
Part of subcall function 01373270: GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00000008,?), ref: 013732B2

GetTokenInformation.KERNELBASE(?,00000001,00000000,00000000,?,?,?,?,?,?,0000000C,?), ref: 01369DD8

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: Token$ErrorInformationLastProcess$CloseCurrentHandleKnownOpenWell
String ID:
API String ID: 2890381121-0
Opcode ID: 019fb1106d923a3172b629cfb349314655d6d40ae89c5622f616de7d8ac490c8
Instruction ID: 3d84aa61e0c25fb0d356da82e34bf5ad95b917d006bf3f27bee7aa6e43baf8be
Opcode Fuzzy Hash: 019fb1106d923a3172b629cfb349314655d6d40ae89c5622f616de7d8ac490c8
Instruction Fuzzy Hash: 6551C2B1508341AFD710EF68DC80B5BBBE8BF9564CF44492DF98582251D67AE508CBA3

Function 01367B40 Relevance: 7.6, APIs: 5, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0136AEB0: GetVersionExW.KERNEL32(?), ref: 0136AEE3

GetCurrentProcess.KERNEL32 ref: 01367B92
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,00000000,00000008,?), ref: 01367BC2
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00000008,?), ref: 01367BCC

Part of subcall function 01373270: CloseHandle.KERNELBASE(?,00000000,01BCD320,00000000,0164908B,000000FF,01367CA9,?,?,?,?,?,?,?,00000000,00000008), ref: 013732A8
Part of subcall function 01373270: GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00000008,?), ref: 013732B2

GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,?,00000000,00000008,?), ref: 01367C38
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00000008,?), ref: 01367C42

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: ErrorLast$ProcessToken$CloseCurrentHandleInformationOpenVersion
String ID:
API String ID: 1113521340-0
Opcode ID: 123efe71e7711807dd988e1aae22eb2ecbb3c7be001e1d725fe012604ffcf478
Instruction ID: 85e318111185f738e5fead17f23227a07d841180c58c7f2409ece02f54ccd429
Opcode Fuzzy Hash: 123efe71e7711807dd988e1aae22eb2ecbb3c7be001e1d725fe012604ffcf478
Instruction Fuzzy Hash: D741A07250C3419FC710DF68D984A5BBBE8BB9860CF444A6DF98983245E775E508CB93

Function 012F1070 Relevance: 7.6, APIs: 5, Instructions: 83
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL ref: 012F10F8
GetCurrentThreadId.KERNEL32 ref: 012F110B
RtlLeaveCriticalSection.NTDLL(00000890), ref: 012F114A
SetEvent.KERNEL32(?), ref: 012F1157
GetLastError.KERNEL32 ref: 012F1161

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000012AB000.00000020.00000001.01000000.00000003.sdmp, Offset: 012AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12ab000__AnyDesk.jbxd

Similarity

API ID: CriticalSection$CurrentEnterErrorEventLastLeaveThread
String ID:
API String ID: 1361677360-0
Opcode ID: 3bd834d5aef4ab2d6c43329ed9ddd91e9a96984d85838f0b98b82e4d3a428ecc
Instruction ID: 2790351e4fabed1cfa612deab0adcd834ed89b71ad56bcfb63f98178bae59856
Opcode Fuzzy Hash: 3bd834d5aef4ab2d6c43329ed9ddd91e9a96984d85838f0b98b82e4d3a428ecc
Instruction Fuzzy Hash: 2B317A716047429FC321EF28C844BAAB7E8FB44718F408A2CEA6687280EB35A5158FD1

Function 0136C650 Relevance: 7.6, APIs: 5, Instructions: 67
threadsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,013674FC), ref: 0136C65F
CreateThread.KERNELBASE(00000000,00000000,Function_0004F7A0,?,00000004,?), ref: 0136C68D
ResumeThread.KERNELBASE(00000000,?,013674FC), ref: 0136C6B8
WaitForSingleObject.KERNEL32(00000000,000000FF,?,013674FC), ref: 0136C6DD
CloseHandle.KERNELBASE(00000000), ref: 0136C705

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: CreateThread$CloseEventHandleObjectResumeSingleWait
String ID:
API String ID: 1091366347-0
Opcode ID: b2383dd46f48374cfc211f94169c5c914acb1eb85df6a393fcd6f35419cb7cfd
Instruction ID: 0cbb78d38170ac037c923b4585433b538a149854795114297e389f482e8110f0
Opcode Fuzzy Hash: b2383dd46f48374cfc211f94169c5c914acb1eb85df6a393fcd6f35419cb7cfd
Instruction Fuzzy Hash: 5F11B4715007015BD730AB78DC45F473AFCAB50728F645B25F5A2D21D5EB34F4048BA4

Function 0136C7C0 Relevance: 7.5, APIs: 5, Instructions: 44comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0136C7D9
SetEvent.KERNEL32(?,?,?,?,016601B8,000000FF,0136C7AB), ref: 0136C7F1
OleUninitialize.OLE32(?,?,?,016601B8,000000FF,0136C7AB), ref: 0136C817
TlsGetValue.KERNEL32(01D7561C,?,?,?,016601B8,000000FF,0136C7AB), ref: 0136C827
TlsSetValue.KERNEL32(01D7561C,00000000), ref: 0136C83F

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: Value$EventInitializeUninitialize
String ID:
API String ID: 566941487-0
Opcode ID: f1471925b45a9f86fd5517e8b469a75c60d55f85b4cef99890afc3af9cba8d2d
Instruction ID: b58c5ef091387d6a498a0e508ebcd1a2469cb6da94a09280e14dadcb88873222
Opcode Fuzzy Hash: f1471925b45a9f86fd5517e8b469a75c60d55f85b4cef99890afc3af9cba8d2d
Instruction Fuzzy Hash: 2D0171B1600741DBD7209F68DC09B1E7AE8FB44A54F449A2CF556C3784EB75E411CB62

Function 013AA550 Relevance: 6.1, APIs: 4, Instructions: 81threadwindowCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 013AA5D5
GetCurrentThreadId.KERNEL32 ref: 013AA5E3
RtlLeaveCriticalSection.NTDLL(?), ref: 013AA619
PostMessageW.USER32(?,00008066,00000000,00000000), ref: 013AA62F

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000013AA000.00000020.00000001.01000000.00000003.sdmp, Offset: 013AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13aa000__AnyDesk.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveMessagePostThread
String ID:
API String ID: 1910765660-0
Opcode ID: 294a2cf90c2eedff016e60550dbd844cb9ec9a2b04633a1711237a0a1662a495
Instruction ID: 0efe10184106bad57ff1e7bd5f61324a8d1bef0112a2cb4067b75357421eb2c3
Opcode Fuzzy Hash: 294a2cf90c2eedff016e60550dbd844cb9ec9a2b04633a1711237a0a1662a495
Instruction Fuzzy Hash: 6231CF72504711AFC321DF28C844B96FBE4FB84B28F444A1DE5A69B280E775A505CFD5

Function 0136B740 Relevance: 5.2, APIs: 4, Instructions: 152COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 0136B7CB
GetLastError.KERNEL32 ref: 0136B7D5
GetLastError.KERNEL32 ref: 0136B834
GetLastError.KERNEL32 ref: 0136B8BA

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: ErrorLast$CloseHandle
String ID:
API String ID: 3463825546-0
Opcode ID: e66ac3de16daa4d6b6936cad54e062b158d2d87e49b30c7cc63fc45ab1b1297f
Instruction ID: 885fe43b380ac627526f4c7dcda25643317f04e8969ce8b8209c6bf015a54e85
Opcode Fuzzy Hash: e66ac3de16daa4d6b6936cad54e062b158d2d87e49b30c7cc63fc45ab1b1297f
Instruction Fuzzy Hash: 9D51AD72A083459FC710DF69C884A5BFBE8AF94318F048A2EF6A5D7254D770E9048F93

Function 013A7B50 Relevance: 4.8, APIs: 3, Instructions: 318COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 013A7D20
GetProcessId.KERNELBASE(00000000,?), ref: 013A7D30
ProcessIdToSessionId.KERNEL32(00000000), ref: 013A7D37

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000013A7000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13a7000__AnyDesk.jbxd

Similarity

API ID: Process$CurrentSession
String ID:
API String ID: 2701954971-0
Opcode ID: 3212724a7bb0ec1b003d5874d0bfb4cecb9d294ddb271b596a87ac688a259edc
Instruction ID: 3dbd10ee8ac4232bf49cd60041f0c16bf471865723c9fba56a8f1dcbf7fe43ba
Opcode Fuzzy Hash: 3212724a7bb0ec1b003d5874d0bfb4cecb9d294ddb271b596a87ac688a259edc
Instruction Fuzzy Hash: 99C12BB19083029FC714DF28C88596BF7E5FF98318F448A2DF5AA9B251D731E905CB82

Function 0136BE40 Relevance: 4.7, APIs: 3, Instructions: 156COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 0136BED1
GetLastError.KERNEL32 ref: 0136BEDB
LookupAccountSidW.ADVAPI32(00000000,?,?,?,?,?,?), ref: 0136BFF3

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: AccountCloseErrorHandleLastLookup
String ID:
API String ID: 4244725088-0
Opcode ID: c64f205e6e335fe89845d0beac26ee013476dbcdcb2cb63040da0f4b1b9ac09f
Instruction ID: ac6d2caee13dcc141d732fb229a8961ab44e407e905d8c8f7d885d849fe44a99
Opcode Fuzzy Hash: c64f205e6e335fe89845d0beac26ee013476dbcdcb2cb63040da0f4b1b9ac09f
Instruction Fuzzy Hash: C1519CB2508342ABD310DF59DC80E6BFBECABD4608F444A1DF69587254E775E508CB63

Function 01373C20 Relevance: 4.6, APIs: 3, Instructions: 140sleepfileCOMMON

Download Yara Rule

APIs

Part of subcall function 01373E20: CloseHandle.KERNELBASE(?,?,01373C4D,?,00000001), ref: 01373E2E
Part of subcall function 01373E20: GetLastError.KERNEL32 ref: 01373E38

CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,?,?,00000000,?,?,?,?,?,?,?,00000001), ref: 01373D02
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000001), ref: 01373D1A
Sleep.KERNEL32(00000001,?,?,?,?,?,?,?,00000001), ref: 01373D2B

Part of subcall function 0137C720: GetTickCount.KERNEL32 ref: 0137C773

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: ErrorLast$CloseCountCreateFileHandleSleepTick
String ID:
API String ID: 1424836537-0
Opcode ID: e86d5f56a56e5816290faf1d4c9cfc2546862bbe8949dc5938b79e66997f8d9f
Instruction ID: 513ff126979b953e334f934ba8424c92930f35366873c028364d176b6acb3995
Opcode Fuzzy Hash: e86d5f56a56e5816290faf1d4c9cfc2546862bbe8949dc5938b79e66997f8d9f
Instruction Fuzzy Hash: 8A51BF716083428BD730DF2DD884B5ABBE4FB84718F140A1EF99587381D778E5049B93

Function 013AAA10 Relevance: 4.6, APIs: 3, Instructions: 119threadCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL ref: 013AAAE3
GetCurrentThreadId.KERNEL32 ref: 013AAAF6
RtlLeaveCriticalSection.NTDLL(?), ref: 013AAB46

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000013AA000.00000020.00000001.01000000.00000003.sdmp, Offset: 013AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13aa000__AnyDesk.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID:
API String ID: 2351996187-0
Opcode ID: 45abc92a15731469ffcc54dd211086e630f8d8f0c448ee6fb69717a6c0851bd7
Instruction ID: 4f686c8dc9a8f20571e5e683f77817920fd9ad77fa6289c1ec3da1c9885c9adb
Opcode Fuzzy Hash: 45abc92a15731469ffcc54dd211086e630f8d8f0c448ee6fb69717a6c0851bd7
Instruction Fuzzy Hash: C44178322087418FCB21CF68C880B9ABBE5FF98714F048A5DE9A58B395D735E945CB91

Function 01385DF0 Relevance: 4.6, APIs: 3, Instructions: 109synchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 01385E1A
CreateMutexW.KERNELBASE(00000000,00000000,?), ref: 01385E46
GetLastError.KERNEL32 ref: 01385E53

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: CloseCreateErrorHandleLastMutex
String ID:
API String ID: 4294037311-0
Opcode ID: 88df773bb0f46b17edf8b3c27a3d718e89a8394eac3780a82f5baf6dd674538a
Instruction ID: bade8e575d523b05003aa8e9e472fe394735372be549e5c2261771803f3282c4
Opcode Fuzzy Hash: 88df773bb0f46b17edf8b3c27a3d718e89a8394eac3780a82f5baf6dd674538a
Instruction Fuzzy Hash: 3D414DB28093C1AFD311DF688880A5BFFE4BB99614F88891DF19487240D774E948CFA3

Function 0137CBA0 Relevance: 4.6, APIs: 3, Instructions: 95libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,01BCD6C8), ref: 0137CBFB
GetDC.USER32(00000000), ref: 0137CC85
ReleaseDC.USER32(00000000,00000000), ref: 0137CCAA

Part of subcall function 0136EEC0: LoadLibraryW.KERNELBASE(01BCD0F0), ref: 0136EED9
Part of subcall function 0136EEC0: GetLastError.KERNEL32 ref: 0136EEF9

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: AddressErrorLastLibraryLoadProcRelease
String ID:
API String ID: 1696082785-0
Opcode ID: f28141bd297c4a51cb7250cf2a64369f22d12dfbfdaecc9cd1570158ee38cc4e
Instruction ID: c25b27ab145864ea1de7f23b78165aec0a34f2b42ca273c6c18d4111245aafe8
Opcode Fuzzy Hash: f28141bd297c4a51cb7250cf2a64369f22d12dfbfdaecc9cd1570158ee38cc4e
Instruction Fuzzy Hash: 4731DEB15047029BD724DF19CC44B07BBE4FF84B20F048A2EE9599B384D778E405CBA2

Function 01361BF0 Relevance: 4.6, APIs: 3, Instructions: 90threadCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 01361C3D
GetCurrentThreadId.KERNEL32 ref: 01361C4B
RtlLeaveCriticalSection.NTDLL(?), ref: 01361CDE

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID:
API String ID: 2351996187-0
Opcode ID: b30001bd06488e508b40decbd9639b7b34402fce422cd9eb918962e4a44a816e
Instruction ID: 1801f89aee9c4eb32171e91bdb7356f235a4cb048d284edab13bb0b141e4b2d8
Opcode Fuzzy Hash: b30001bd06488e508b40decbd9639b7b34402fce422cd9eb918962e4a44a816e
Instruction Fuzzy Hash: 12315971A043529FDB11CF29C880B5AFBE8BF88B14F448A2EF959C7249D770E904CB91

Function 013599C0 Relevance: 4.5, APIs: 3, Instructions: 43memorysynchronizationCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL ref: 013599EE
CreateMutexW.KERNELBASE(00000000,00000000,?), ref: 01359A34
TlsAlloc.KERNEL32 ref: 01359A3C

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: AllocCreateCriticalInitializeMutexSection
String ID:
API String ID: 1132411893-0
Opcode ID: 64f6f786c1a668f0f6ba4de3105e4e983883a5f24d43a4f5bcb0e65499b3ff93
Instruction ID: bd8aa5581eaef4b0ec8111a46eaa8ad131880f95c63ba8d0112a256c65c9d4dc
Opcode Fuzzy Hash: 64f6f786c1a668f0f6ba4de3105e4e983883a5f24d43a4f5bcb0e65499b3ff93
Instruction Fuzzy Hash: 25015EB1500701AFE3309F68DCC4A97BBE8FB18700F80582DF59A83201E774A958CB65

Function 012F59B0 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

CreateFiberEx.KERNELBASE(00000000,00000000,00000000,012F5D30,?), ref: 012F5B35
GetLastError.KERNEL32(01D75C58), ref: 012F5B55

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000012AB000.00000020.00000001.01000000.00000003.sdmp, Offset: 012AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12ab000__AnyDesk.jbxd

Similarity

API ID: CreateErrorFiberLast
String ID:
API String ID: 2628972780-0
Opcode ID: 5597f724f5237a5ef132db7e28fe77d51a345fae611b6b75adedc58e373c5bcf
Instruction ID: 46d40233ddb573299d9c52defe26210ee1b29456328333f526bc192167890922
Opcode Fuzzy Hash: 5597f724f5237a5ef132db7e28fe77d51a345fae611b6b75adedc58e373c5bcf
Instruction Fuzzy Hash: 405157B1600746AFD348CF29C884B56FBE8FB49314F44863EE259C7651E770E869CB91

Function 01359770 Relevance: 3.1, APIs: 2, Instructions: 143windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNELBASE(00001300,00000000,?,00000409,?,00000000,00000000,00000000,00000000,?,00000000), ref: 013597B1
LocalFree.KERNEL32(?,?,?,00000000), ref: 013597D6

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: FormatFreeLocalMessage
String ID:
API String ID: 1427518018-0
Opcode ID: 27c4557a07fe86761c00d546c6a9f871eeaaaf8082f947f6d03e72b0b990a99d
Instruction ID: c1ef9e33b1ab2224c00afa679b23c39dd69391be6f1d027e89666eb66592175e
Opcode Fuzzy Hash: 27c4557a07fe86761c00d546c6a9f871eeaaaf8082f947f6d03e72b0b990a99d
Instruction Fuzzy Hash: C05168B2908345AFC344DF99C880E5BFBE8EFD8B48F44491DF98657250D671E905CBA2

Function 013637A0 Relevance: 3.1, APIs: 2, Instructions: 140fileCOMMON

Download Yara Rule

APIs

LockFileEx.KERNEL32(?,00000000,00000000,000000FF,000000FF,00000000,?,00000000,00000001,00000000), ref: 01363882
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,016821F2,000000FF), ref: 0136388C

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: ErrorFileLastLock
String ID:
API String ID: 1811722133-0
Opcode ID: 75a59a9cf13c7511934fb03613c58dff3a72793daccbffdb25a250b2c58b0700
Instruction ID: af11f896f5b7ac5135ab53578b1e0af97c48c68b1564de1bb422d9f28e7383ab
Opcode Fuzzy Hash: 75a59a9cf13c7511934fb03613c58dff3a72793daccbffdb25a250b2c58b0700
Instruction Fuzzy Hash: 7C41AAB25083819FD710DF6C9C40A5FBBE8FF94728F044A2DF5A993241D77595098BA3

Function 0135E090 Relevance: 3.1, APIs: 2, Instructions: 100registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?), ref: 0135E0B4
RegQueryValueExW.KERNELBASE(?,00000001,00000000,00000000,?,?), ref: 0135E106

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 2e417ac495fa2f9cccfadff9e7b1b5e3f79ea4dcce2bb7fe47c5ec4b372ee640
Instruction ID: 86f4a4ba7f04136295513085b3bf131cef3d7e822fad90bcc5a672bee936b75e
Opcode Fuzzy Hash: 2e417ac495fa2f9cccfadff9e7b1b5e3f79ea4dcce2bb7fe47c5ec4b372ee640
Instruction Fuzzy Hash: 68312DB5A01219ABCB14DF59DC80EABFBB8FF49704F108169E9199B250D731AA21CBD1

Function 0136C9B0 Relevance: 3.1, APIs: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0136C9E1
GetLastError.KERNEL32 ref: 0136CA3B

Part of subcall function 0136EF40: FreeLibrary.KERNELBASE(?), ref: 0136EF63
Part of subcall function 0136EF40: GetLastError.KERNEL32 ref: 0136EF81

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: ErrorLast$FreeInfoLibrarySystem
String ID:
API String ID: 2953551198-0
Opcode ID: fccf2f5c134f9b85ddee05753756aad63e427135fd8c9ece2f6457508a7b8550
Instruction ID: 54ce7d51762c382666dc209b3566e02297d59029f03f2e34f4ecfbdffe3f4b86
Opcode Fuzzy Hash: fccf2f5c134f9b85ddee05753756aad63e427135fd8c9ece2f6457508a7b8550
Instruction Fuzzy Hash: EE31D672A0021ACFDF20DFA8DC40BAEB7B8FB44318F144659E465D3288E730AA44CF91

Function 01293B60 Relevance: 3.1, APIs: 2, Instructions: 80registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000002,01BBBDE8,00000000,00020019,?), ref: 01293BA3
RegCloseKey.KERNELBASE(00000000,00000000), ref: 01293C38

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000127B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0127B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_127b000__AnyDesk.jbxd

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: d40bde7d041dfe084ebd5c318019b428b6c3ea21453120761cac6ad48bb2cc8a
Instruction ID: e59e4149e1822541af0f2fba2b1ab35f40665e586584ab38491b42e4ac68f32e
Opcode Fuzzy Hash: d40bde7d041dfe084ebd5c318019b428b6c3ea21453120761cac6ad48bb2cc8a
Instruction Fuzzy Hash: B621E2B56483459FC714DF19D981B6BFBE8FB88A14F400D6EF98593301C775A5048B62

Function 013AA450 Relevance: 3.1, APIs: 2, Instructions: 78registryCOMMON

Download Yara Rule

APIs

RegisterClassW.USER32(?), ref: 013AA4DF
CreateWindowExW.USER32(00000000,?,01BCEA2C,00000000,00000000,00000000,00000001,00000001,00000000,00000000,?), ref: 013AA518

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000013AA000.00000020.00000001.01000000.00000003.sdmp, Offset: 013AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13aa000__AnyDesk.jbxd

Similarity

API ID: ClassCreateRegisterWindow
String ID:
API String ID: 3469048531-0
Opcode ID: 93fdc3899b841c8dfa4c27200d9b2a4b7e40bc3c78868dd87a10b142302c02bf
Instruction ID: 25fab51efd2bf3249372cc69e79c8b3d391b026341a23117de4e30902dffd103
Opcode Fuzzy Hash: 93fdc3899b841c8dfa4c27200d9b2a4b7e40bc3c78868dd87a10b142302c02bf
Instruction Fuzzy Hash: 64216DB1944701AFD360DF29DC45B47BBE4EF98B04F004A2EF599D7250E771E5048B92

Function 01370A90 Relevance: 3.1, APIs: 2, Instructions: 62COMMON

Download Yara Rule

APIs

EnumDisplayMonitors.USER32(00000000,00000000,013711A0,?), ref: 01370ADE
GetLastError.KERNEL32 ref: 01370AE8

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: DisplayEnumErrorLastMonitors
String ID:
API String ID: 4025898072-0
Opcode ID: 4897c98812134e2f5916827fb11944b24d6f1873868459c2b52afe0660c499e1
Instruction ID: b3e70dc8338de7dc18a7b625a8024fc9acaa64aac5c0ff3925930176078c8280
Opcode Fuzzy Hash: 4897c98812134e2f5916827fb11944b24d6f1873868459c2b52afe0660c499e1
Instruction Fuzzy Hash: AE11E5F29003026BDB34BFBDDC84D6BB79CAE65618B044625FD18EB205E634F91087B1

Function 0136BD50 Relevance: 3.1, APIs: 2, Instructions: 62timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNELBASE(?,?,?,?,?), ref: 0136BD83
GetLastError.KERNEL32 ref: 0136BDA4

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: ErrorLastProcessTimes
String ID:
API String ID: 57209380-0
Opcode ID: 181489c2e3affd54e761a5b68c413e1127ddce191a3b21d2b4f74c8fc41a6f2b
Instruction ID: 2353c692fc833f34aa2df53f7d284edcf704ec2e88296f7c8ec14a697634fa6b
Opcode Fuzzy Hash: 181489c2e3affd54e761a5b68c413e1127ddce191a3b21d2b4f74c8fc41a6f2b
Instruction Fuzzy Hash: 8611B6B16083019FD314DF68DC44B6BB7ECEB98A14F008A1EF895C7644E734E5048BD2

Function 013AAE00 Relevance: 3.1, APIs: 2, Instructions: 61threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 013AAE57
RtlInitializeCriticalSection.NTDLL(?), ref: 013AAE91

Part of subcall function 013AA450: RegisterClassW.USER32(?), ref: 013AA4DF
Part of subcall function 013AA450: CreateWindowExW.USER32(00000000,?,01BCEA2C,00000000,00000000,00000000,00000001,00000001,00000000,00000000,?), ref: 013AA518

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000013AA000.00000020.00000001.01000000.00000003.sdmp, Offset: 013AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13aa000__AnyDesk.jbxd

Similarity

API ID: ClassCreateCriticalCurrentInitializeRegisterSectionThreadWindow
String ID:
API String ID: 1203834240-0
Opcode ID: a7af526e9055777ebb08815b2499d609ff04c03e3bcc3a4468d8592c5b70ff74
Instruction ID: e62359a2cfb3708f3b9f9615165288746bec6836b17cbb733fad16ae74a3ec08
Opcode Fuzzy Hash: a7af526e9055777ebb08815b2499d609ff04c03e3bcc3a4468d8592c5b70ff74
Instruction Fuzzy Hash: 372143B5604B46AFC304CF2AD884A42FFE8FB99B14F04861EE94987711D734B518CBA5

Function 0136B930 Relevance: 3.0, APIs: 2, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0136B740: CloseHandle.KERNEL32(?), ref: 0136B7CB
Part of subcall function 0136B740: GetLastError.KERNEL32 ref: 0136B7D5
Part of subcall function 0136B740: GetLastError.KERNEL32 ref: 0136B834

GetProcessId.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,01654108,000000FF), ref: 0136B9A5
ProcessIdToSessionId.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,01654108,000000FF), ref: 0136B9AC

Part of subcall function 01373270: CloseHandle.KERNELBASE(?,00000000,01BCD320,00000000,0164908B,000000FF,01367CA9,?,?,?,?,?,?,?,00000000,00000008), ref: 013732A8
Part of subcall function 01373270: GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00000008,?), ref: 013732B2

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: ErrorLast$CloseHandleProcess$Session
String ID:
API String ID: 3895184084-0
Opcode ID: df9d5bd06bbb27969b27510dbf137ed0b70d3a9bc3efdfbd99aeb0d82af52540
Instruction ID: c8289316591c3358951466a35dbf8b6d490baf1dbe5a99c6ce757a2c2e4b72c7
Opcode Fuzzy Hash: df9d5bd06bbb27969b27510dbf137ed0b70d3a9bc3efdfbd99aeb0d82af52540
Instruction Fuzzy Hash: CC118FB15083428FC718DF28C84465BBBE4BB98728F048B2DF4AA932C4D7349544CB92

Function 0135A110 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON

Download Yara Rule

APIs

Part of subcall function 01359A60: GetCurrentThread.KERNEL32 ref: 01359AA0
Part of subcall function 01359A60: OpenThreadToken.ADVAPI32(00000000), ref: 01359AA7
Part of subcall function 01359A60: CloseHandle.KERNEL32(?,?), ref: 01359AC1
Part of subcall function 01359A60: GetLastError.KERNEL32 ref: 01359AF4
Part of subcall function 01359A60: CloseHandle.KERNEL32(?), ref: 01359B0C
Part of subcall function 01359A60: CreateFileW.KERNELBASE(01D75C54,C0000000,00000007,00000000,00000004,00000000,00000000,?), ref: 01359B4C
Part of subcall function 01359A60: RevertToSelf.ADVAPI32 ref: 01359B64
Part of subcall function 01359A60: CloseHandle.KERNEL32(?), ref: 01359B78

SetFilePointer.KERNELBASE(020007D0,00000000,00000000,00000002,?,?,?), ref: 0135A13F
WriteFile.KERNELBASE(020007D0,?,?,00000000,00000000,?,?,?), ref: 0135A17A

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: CloseFileHandle$Thread$CreateCurrentErrorLastOpenPointerRevertSelfTokenWrite
String ID:
API String ID: 822686942-0
Opcode ID: 2bf720e5adc9dd9c95c613887add60475ea3bb2d7b03291b7104cff8b7bda44f
Instruction ID: 7b1ade4103af95e16e8d8c96f278cd685c2a4399e88d3fa50a07d4de9b862170
Opcode Fuzzy Hash: 2bf720e5adc9dd9c95c613887add60475ea3bb2d7b03291b7104cff8b7bda44f
Instruction Fuzzy Hash: 8E01D6316003026FE725CE38CC88FA73B98EB85B54F184A19FA519B185D768E60987A0

Function 0136EF40 Relevance: 3.0, APIs: 2, Instructions: 38COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?), ref: 0136EF63
GetLastError.KERNEL32 ref: 0136EF81

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: ErrorFreeLastLibrary
String ID:
API String ID: 2365526361-0
Opcode ID: 50c43412051eb3f3a1c0e5320e328168598a36d09b1f485fb78265f57704f715
Instruction ID: c31f37a82cefb4058b527d03e571b44783d0e2195cb9ad2b9463f63bcf6ff6ea
Opcode Fuzzy Hash: 50c43412051eb3f3a1c0e5320e328168598a36d09b1f485fb78265f57704f715
Instruction Fuzzy Hash: FA014FB55487419BD710DB68DE08B1ABBE8EB50708F048A2CF855C7284E778E148CB52

Function 0136EEC0 Relevance: 3.0, APIs: 2, Instructions: 37libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(01BCD0F0), ref: 0136EED9
GetLastError.KERNEL32 ref: 0136EEF9

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: ErrorLastLibraryLoad
String ID:
API String ID: 3568775529-0
Opcode ID: c2a1713f59fe6083a77dc56d3f219ad239ce8c7592e1c42db04ed0ac707015ca
Instruction ID: b151a94fca92aed9dbfc041f2cb0643767ef66516a314d3455bc954c3679e2cf
Opcode Fuzzy Hash: c2a1713f59fe6083a77dc56d3f219ad239ce8c7592e1c42db04ed0ac707015ca
Instruction Fuzzy Hash: B8016DB4508742AFD711EB68CD04B5BBBE8EB50704F448928F855C6241E738E108CB56

Function 0136BE10 Relevance: 3.0, APIs: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetProcessId.KERNELBASE ref: 0136BE1E
ProcessIdToSessionId.KERNEL32(00000000), ref: 0136BE25

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: Process$Session
String ID:
API String ID: 780043717-0
Opcode ID: 42b43bd7fb82aadc938bdb345734e39cf024477fb7b1e4c5de66c348133c1193
Instruction ID: f59efe20b4e6e663fef6eac9faca4b27f321b757d6d11318d9bf974244b9ea22
Opcode Fuzzy Hash: 42b43bd7fb82aadc938bdb345734e39cf024477fb7b1e4c5de66c348133c1193
Instruction Fuzzy Hash: 2BD0A9B12191009FCB249B78EC08A9A7BECAB04326F245B0EF0BAC24C8DB30D0148F21

Function 01363F10 Relevance: 2.6, APIs: 2, Instructions: 123COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 01364005
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 01364045

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 14fe2422a70f62d13eb6492d0fea5166dfcfb7f3cbbe13ba6d7bfb28ff7e5d16
Instruction ID: d44ad9b4577495b1ccd8d05ef7ae48920336258bee592258dcd25a07a17cd23c
Opcode Fuzzy Hash: 14fe2422a70f62d13eb6492d0fea5166dfcfb7f3cbbe13ba6d7bfb28ff7e5d16
Instruction Fuzzy Hash: 0D41B2B1909385AFD304DF29C88571AFFE8FB95718F04851DF4898B641D376E85887E2

Function 01373270 Relevance: 2.5, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,00000000,01BCD320,00000000,0164908B,000000FF,01367CA9,?,?,?,?,?,?,?,00000000,00000008), ref: 013732A8
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00000008,?), ref: 013732B2

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 514f16f4689f50534038df15da0e8b84142296f74e75c02f763a46dfabe2a9e9
Instruction ID: 30e63536c0c06bab365aa9533d203d1f742021d5a0f9ec821c6df5639b0e9947
Opcode Fuzzy Hash: 514f16f4689f50534038df15da0e8b84142296f74e75c02f763a46dfabe2a9e9
Instruction Fuzzy Hash: F00121B1904B419BD734DF68DC49B177AE8BB44B18F044B1DE4A6C3690E779E004DB91

Function 01373E20 Relevance: 2.5, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,01373C4D,?,00000001), ref: 01373E2E
GetLastError.KERNEL32 ref: 01373E38

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: b061bd94fc1d10638be3b85d23a75cf42c66f0ca360ed89b9e87c26e996ab743
Instruction ID: ea712b8abbd7ef92ac0d4bf097634a9bddbca18cf3ec75fdf75d4fa16ee04c76
Opcode Fuzzy Hash: b061bd94fc1d10638be3b85d23a75cf42c66f0ca360ed89b9e87c26e996ab743
Instruction Fuzzy Hash: 08F0E5726007015BEB306B3DBC44F2B36E8EF8165C7580F28F859C2955E728E4559B65

Function 011D3580 Relevance: 1.7, APIs: 1, Instructions: 173COMMON

Download Yara Rule

APIs

PathFileExistsW.KERNELBASE(?), ref: 011D35EC

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000011C4000.00000020.00000001.01000000.00000003.sdmp, Offset: 011C4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11c4000__AnyDesk.jbxd

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: 0c6bf2fc319b63d8aba7462a1701366eced3036a9bfdd8a43cf56a1997ca32c7
Instruction ID: 7471d12eb2713631fe0352213eb1569056bdc7d9e1d9d8a15ec4371e2ff68281
Opcode Fuzzy Hash: 0c6bf2fc319b63d8aba7462a1701366eced3036a9bfdd8a43cf56a1997ca32c7
Instruction Fuzzy Hash: A75137F16047819BDB25EF2C8C80F5BB7E8BF54218F054928FD989B241EB34E90487A3

Function 0136E660 Relevance: 1.6, APIs: 1, Instructions: 82threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0136E686

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: ff40b8bdcd1fb79f9b2f413cc677a06910827ab2bf2ebb6296efa20b2c1d89ec
Instruction ID: c8b2934efc08cd6c0ef176cf7ddf4aad1c42d3e7e92724d9b09992f79dff6a95
Opcode Fuzzy Hash: ff40b8bdcd1fb79f9b2f413cc677a06910827ab2bf2ebb6296efa20b2c1d89ec
Instruction Fuzzy Hash: 1531D4796047418FD324DF29C840B56B7E9BF98718F048A3DF5A997391DB34E809CB91

Function 0136DE60 Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(?), ref: 0136DF29

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: 6407feacfb1c905cdd9825e17b76ab1690c485d4e841bf0fe013f6737917e2a6
Instruction ID: 10187326b81c31af088af5c7bdc408b7d92f52e414033a310c0dc95b5e2e7a1a
Opcode Fuzzy Hash: 6407feacfb1c905cdd9825e17b76ab1690c485d4e841bf0fe013f6737917e2a6
Instruction Fuzzy Hash: C2316DB1504741AFD305DF29C840B9AFFE8FF99704F44852EE59987311D774A819CBA2

Function 013A75B0 Relevance: 1.6, APIs: 1, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,016720D8,000000FF), ref: 013A7625

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000013A7000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13a7000__AnyDesk.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 317c0e22b8c045b85de57ac99b7bef5b8ba2927004ca35ffc17efd5273b5bc8c
Instruction ID: 3ad7c4ec8b221c1fddd3e8588276ddf6f8593f5b94ef93ac8f6efdcfe134ecca
Opcode Fuzzy Hash: 317c0e22b8c045b85de57ac99b7bef5b8ba2927004ca35ffc17efd5273b5bc8c
Instruction Fuzzy Hash: 7B11E972710B115BE724DA3DDD95F6773EAFBC4224F48492CE945C3241DB6AE8058620

Function 013A7680 Relevance: 1.6, APIs: 1, Instructions: 71registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,?,?,?,?,?,013A77F2,?), ref: 013A76F0

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000013A7000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13a7000__AnyDesk.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 5894a39ef290e68c360a4ed21ad9b4d8404073a7a252ec88d1c48486d40d8c67
Instruction ID: 360c7a9fb0515917d052a1df5a5efe7bdeaa9631d07d552f9682c38a6030a904
Opcode Fuzzy Hash: 5894a39ef290e68c360a4ed21ad9b4d8404073a7a252ec88d1c48486d40d8c67
Instruction Fuzzy Hash: 441104B13117115BF7388B28DDA1FB777E9EB84618F84091CE686C7282E66BE8408710

Function 01373790 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

SetSecurityInfo.ADVAPI32(?,?,?,?,?,?,00000000,016A62D0,?,?,01BDB888), ref: 01373828

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: InfoSecurity
String ID:
API String ID: 3528565900-0
Opcode ID: 091c3e8baea7fb2285fa109912cc2695421bc960feec467a4d749a887b1046a9
Instruction ID: 320395da3f226be05df52fc1420d06394115fc6efb471ba09a17a4e7695e5669
Opcode Fuzzy Hash: 091c3e8baea7fb2285fa109912cc2695421bc960feec467a4d749a887b1046a9
Instruction Fuzzy Hash: 0A213DB5508341EFD324DF18D844F5BBBE8BB94718F04C92DE99947291D739E408DBA2

Function 0136E870 Relevance: 1.5, APIs: 1, Instructions: 46threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0136E892

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 9cbda8ee172cdae093b00f7162de6a5301cbb3bd4695fef1f5de527dfe993268
Instruction ID: 6e1c044a0e70aa97cc5e5486de288686786429c235dde35fa10408d20d4de4ab
Opcode Fuzzy Hash: 9cbda8ee172cdae093b00f7162de6a5301cbb3bd4695fef1f5de527dfe993268
Instruction Fuzzy Hash: 5901F1B29087009FD330DF3D9C05B12BBE8EB45A24F004B7AE469E72C4E774A404CB52

Function 0136B9F0 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 0136B740: CloseHandle.KERNEL32(?), ref: 0136B7CB
Part of subcall function 0136B740: GetLastError.KERNEL32 ref: 0136B7D5
Part of subcall function 0136B740: GetLastError.KERNEL32 ref: 0136B834

GetExitCodeProcess.KERNELBASE(00000000,?), ref: 0136BA27

Memory Dump Source

Source File: 00000003.00000002.1794604051.000000000131D000.00000020.00000001.01000000.00000003.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_131d000__AnyDesk.jbxd

Similarity

API ID: ErrorLast$CloseCodeExitHandleProcess
String ID:
API String ID: 3680885805-0
Opcode ID: 5b9bcf3f4c285b89d3bfe99791198709341a4abcffac4812eeee6930b76e2fb8
Instruction ID: ef4455e6846140c191774e52cbead2cd108c3474f06eee6cd1b60ec39cf8bd71
Opcode Fuzzy Hash: 5b9bcf3f4c285b89d3bfe99791198709341a4abcffac4812eeee6930b76e2fb8
Instruction Fuzzy Hash: BCF05875508302AEE700AF68CC8414FBBE8AB90249F84C82DF98886115D378954CCFA2

Non-executed Functions

Function 012C8310 Relevance: 10.9, APIs: 7, Instructions: 447networkCOMMON

Download Yara Rule

APIs

WSAEnumNetworkEvents.WS2_32(?,00000000,?), ref: 012C834A
WSAGetLastError.WS2_32 ref: 012C8355
ioctlsocket.WS2_32(?,4004667F,?), ref: 012C839E

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000012AB000.00000020.00000001.01000000.00000003.sdmp, Offset: 012AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12ab000__AnyDesk.jbxd

Similarity

API ID: EnumErrorEventsLastNetworkioctlsocket
String ID:
API String ID: 1092182194-0
Opcode ID: 6c4ce61f45faba1957fecb075da3c9374be906fe1ea38cfac291f7118bfc1a2d
Instruction ID: 677af00780a9740786ae30c9a4afc1fa526452b5f881a635626b1735e3cecf5f
Opcode Fuzzy Hash: 6c4ce61f45faba1957fecb075da3c9374be906fe1ea38cfac291f7118bfc1a2d
Instruction Fuzzy Hash: E3026FB59083819FD360DF68D840BABBBE4FBD9714F108A2DE699C7391D771A804CB52

Function 012CA080 Relevance: 6.1, APIs: 4, Instructions: 147networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 012CA0FB
WSAGetLastError.WS2_32 ref: 012CA112

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000012AB000.00000020.00000001.01000000.00000003.sdmp, Offset: 012AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12ab000__AnyDesk.jbxd

Similarity

API ID: ErrorLastSocket
String ID:
API String ID: 1164164305-0
Opcode ID: 53e08ac1fb4266da157e3af601276644ccbdf76a3fe6fe1ac857f3e0f3f685e0
Instruction ID: 26b2dae1773ad3bac7723a368dae942fb40fd669845ac672ba5f64456f5fa643
Opcode Fuzzy Hash: 53e08ac1fb4266da157e3af601276644ccbdf76a3fe6fe1ac857f3e0f3f685e0
Instruction Fuzzy Hash: 1851B2716142098FC720DF2CD885B5ABBE4FF84760F14866EEE199B382D776D804CBA1

Function 012C8990 Relevance: 3.1, APIs: 2, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 012C81E0: WSASocketW.WS2_32(?,00000002,00000011,00000000,00000000,00000001), ref: 012C8227
Part of subcall function 012C81E0: WSAGetLastError.WS2_32 ref: 012C8235
Part of subcall function 012C81E0: WSAEventSelect.WS2_32(000000FF,00000000), ref: 012C8275
Part of subcall function 012C81E0: WSAGetLastError.WS2_32(?,?,?,?,?,?,?,00000000,0168EE48,000000FF,012C8143,?), ref: 012C8280

Part of subcall function 012C7E50: htons.WS2_32(00000000), ref: 012C7E94

bind.WS2_32(?,00000000,?), ref: 012C8A06
WSAGetLastError.WS2_32 ref: 012C8A10

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000012AB000.00000020.00000001.01000000.00000003.sdmp, Offset: 012AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12ab000__AnyDesk.jbxd

Similarity

API ID: ErrorLast$EventSelectSocketbindhtons
String ID:
API String ID: 330256413-0
Opcode ID: d21b6cf25175374259e5219dd5fc2f0390c3f9ce1ce9c6a554c0bbd3320377d7
Instruction ID: 5224b25f6932788b0d956776ad47c8867c6b6cbc6d0a5497f1eda49ce028d2d9
Opcode Fuzzy Hash: d21b6cf25175374259e5219dd5fc2f0390c3f9ce1ce9c6a554c0bbd3320377d7
Instruction Fuzzy Hash: 2B1112F29143019FC350DF68D84096FBBE8BBD9754F44492EF989D3200E675D5098FA2

Function 012D9A20 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 238threadCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 012D9A57
GetCurrentThreadId.KERNEL32 ref: 012D9A6A
RtlLeaveCriticalSection.NTDLL(?), ref: 012D9A85

Strings

0, xrefs: 012D9B5E

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000012AB000.00000020.00000001.01000000.00000003.sdmp, Offset: 012AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12ab000__AnyDesk.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: 0
API String ID: 2351996187-4108050209
Opcode ID: decf0c51a38860556426407ddb4e6e87bdc27818b7fc988e33fa6326913bbd4e
Instruction ID: 50074a07b75a1dd9164d9bb8b8272949f6510b160258ed0e58062ad34b4e67e7
Opcode Fuzzy Hash: decf0c51a38860556426407ddb4e6e87bdc27818b7fc988e33fa6326913bbd4e
Instruction Fuzzy Hash: 13A19D71514312DFCB25DF28C880A9ABBF9FF85708F044A2EF6958B250E771E945CB92

Function 012F08F0 Relevance: 10.7, APIs: 7, Instructions: 155threadCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL ref: 012F0924
GetCurrentThreadId.KERNEL32 ref: 012F0937
QueryPerformanceCounter.KERNEL32(?,00000000,?,0163D808,000000FF,?,012F666E,?,?,?), ref: 012F0976
GetCurrentThreadId.KERNEL32 ref: 012F0A6F
SetEvent.KERNEL32(?), ref: 012F0A84
GetLastError.KERNEL32 ref: 012F0A8E
RtlLeaveCriticalSection.NTDLL(?), ref: 012F0AC0

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000012AB000.00000020.00000001.01000000.00000003.sdmp, Offset: 012AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12ab000__AnyDesk.jbxd

Similarity

API ID: CriticalCurrentSectionThread$CounterEnterErrorEventLastLeavePerformanceQuery
String ID:
API String ID: 2225677122-0
Opcode ID: 55d8a02d71fe4345f3fdf1507050f3ea3aea346d9e6f532863502f2eae5945c2
Instruction ID: 6cd9c2e295b3d746442695819742f89f7caa78ae1743355f79c5fb7f9618829d
Opcode Fuzzy Hash: 55d8a02d71fe4345f3fdf1507050f3ea3aea346d9e6f532863502f2eae5945c2
Instruction Fuzzy Hash: DC51FF70514302CFD724CF28D984A5ABBE6FF84710F18867DE69A8B256EB30E504CF95

Function 012F23F0 Relevance: 9.1, APIs: 6, Instructions: 83threadCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 012F2426
GetCurrentThreadId.KERNEL32 ref: 012F2434
RtlLeaveCriticalSection.NTDLL(?), ref: 012F2481
RtlEnterCriticalSection.NTDLL(?), ref: 012F249E
GetCurrentThreadId.KERNEL32 ref: 012F24AC
RtlLeaveCriticalSection.NTDLL(?), ref: 012F24FA

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000012AB000.00000020.00000001.01000000.00000003.sdmp, Offset: 012AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12ab000__AnyDesk.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID:
API String ID: 2351996187-0
Opcode ID: ca95df384326c26295bf95d216ccb7bb5f369eb76a16ab037f12cd8133978a5a
Instruction ID: 981c2f9c6f67c81378d4551a8fe9911eb7fc4fb4198d6a8f1ab1f746a810fa24
Opcode Fuzzy Hash: ca95df384326c26295bf95d216ccb7bb5f369eb76a16ab037f12cd8133978a5a
Instruction Fuzzy Hash: 3B316971009752CFD722CF28C944BAAFBF4FF91A18F104A2DE6A286251D775A509CF92

Function 012F03E0 Relevance: 7.9, APIs: 5, Instructions: 381threadCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL ref: 012F0461
RtlLeaveCriticalSection.NTDLL(?), ref: 012F04C9

Part of subcall function 012F4D40: GetCurrentThreadId.KERNEL32 ref: 012F4D65

RtlEnterCriticalSection.NTDLL(?), ref: 012F05DC
GetCurrentThreadId.KERNEL32 ref: 012F05EF
RtlLeaveCriticalSection.NTDLL(?), ref: 012F08B5

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000012AB000.00000020.00000001.01000000.00000003.sdmp, Offset: 012AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12ab000__AnyDesk.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID:
API String ID: 2351996187-0
Opcode ID: 3a4b081e7d8407743ef1f9464c5fc7393e5b3d1712d44285492742fbffffd491
Instruction ID: d2e0326e0d225cf56078a8be2f53ecaaf54ef7c13a0a861b6e155d478b964216
Opcode Fuzzy Hash: 3a4b081e7d8407743ef1f9464c5fc7393e5b3d1712d44285492742fbffffd491
Instruction Fuzzy Hash: 0FE181B19083429FD725DF28C884A5EF7E6BF94304F04892DF69997341EB35E844CB96

Function 012CA9F0 Relevance: 7.7, APIs: 5, Instructions: 175networkCOMMON

Download Yara Rule

APIs

getpeername.WS2_32 ref: 012CAA7D
WSAGetLastError.WS2_32 ref: 012CAA88
getpeername.WS2_32 ref: 012CAB7D
WSAGetLastError.WS2_32 ref: 012CAB88
htons.WS2_32(?), ref: 012CAC35

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000012AB000.00000020.00000001.01000000.00000003.sdmp, Offset: 012AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12ab000__AnyDesk.jbxd

Similarity

API ID: ErrorLastgetpeername$htons
String ID:
API String ID: 4208043520-0
Opcode ID: 807c8bfc2deb33096fa4688ecbe6ac3243e864ba064834d80d39a51c7569c84e
Instruction ID: 1c1614366303aac7f5e81dd02e21527039496468321454525b72ad850d242874
Opcode Fuzzy Hash: 807c8bfc2deb33096fa4688ecbe6ac3243e864ba064834d80d39a51c7569c84e
Instruction Fuzzy Hash: 0C71EDB09087429FC360CF28C480A5BFBE5BB98714F408A2EF99AC3381E775E504CB52

Function 012F2080 Relevance: 6.2, APIs: 4, Instructions: 153threadCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL ref: 012F20B4
GetCurrentThreadId.KERNEL32 ref: 012F20C7
QueryPerformanceCounter.KERNEL32(?), ref: 012F20DD
RtlLeaveCriticalSection.NTDLL(0000092B), ref: 012F225C

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000012AB000.00000020.00000001.01000000.00000003.sdmp, Offset: 012AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12ab000__AnyDesk.jbxd

Similarity

API ID: CriticalSection$CounterCurrentEnterLeavePerformanceQueryThread
String ID:
API String ID: 1903187103-0
Opcode ID: c21ba37269448011a6fd938785d3156f02426c7dc092d6e3f604fc62925d83ae
Instruction ID: eee29cff8f0bc76fbaeda352feb3a3b4ea81b2eb0c61e1ad1d790de26b66d192
Opcode Fuzzy Hash: c21ba37269448011a6fd938785d3156f02426c7dc092d6e3f604fc62925d83ae
Instruction Fuzzy Hash: 69518D71914702DFD715CF28C880656FBE0FF96324F148A6DE29A8B2A1DB71E845CB81

Function 012C81E0 Relevance: 6.1, APIs: 4, Instructions: 92networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,00000002,00000011,00000000,00000000,00000001), ref: 012C8227
WSAGetLastError.WS2_32 ref: 012C8235
WSAEventSelect.WS2_32(000000FF,00000000), ref: 012C8275
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,00000000,0168EE48,000000FF,012C8143,?), ref: 012C8280

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000012AB000.00000020.00000001.01000000.00000003.sdmp, Offset: 012AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12ab000__AnyDesk.jbxd

Similarity

API ID: ErrorLast$EventSelectSocket
String ID:
API String ID: 267719889-0
Opcode ID: b9fd1586fa3617c07313fb7196f6064d870482b82a3d44f367b846d5d11ff310
Instruction ID: b40b65e61fc4d43e7c7b80295cfc47289473b52123d2b2881105fc8b8cef6b05
Opcode Fuzzy Hash: b9fd1586fa3617c07313fb7196f6064d870482b82a3d44f367b846d5d11ff310
Instruction Fuzzy Hash: 1131F4B2A44743AFD714AB349C45FBA7768BB50B20F804B1CFA50961C0D775E9148B92

Function 012F1190 Relevance: 6.1, APIs: 4, Instructions: 83threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 012F11B4
RtlEnterCriticalSection.NTDLL(?), ref: 012F11F6
GetCurrentThreadId.KERNEL32 ref: 012F1204
RtlLeaveCriticalSection.NTDLL(?), ref: 012F1266

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000012AB000.00000020.00000001.01000000.00000003.sdmp, Offset: 012AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12ab000__AnyDesk.jbxd

Similarity

API ID: CriticalCurrentSectionThread$EnterLeave
String ID:
API String ID: 637047042-0
Opcode ID: 5e9b0ab860e1d4933713acb39d50ccd69f8b3252dd42d46608688552f616582b
Instruction ID: 4870725d95f247b61a046629901ea9cff4842ea538ecbed0c351c899ac113012
Opcode Fuzzy Hash: 5e9b0ab860e1d4933713acb39d50ccd69f8b3252dd42d46608688552f616582b
Instruction Fuzzy Hash: 4C316C75108751DFC351DF68C880B9BFBF8FB95614F444A2DFA9283251D775A804CBA2

Function 012F12A0 Relevance: 6.1, APIs: 4, Instructions: 65threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 012F12C6
RtlEnterCriticalSection.NTDLL ref: 012F12F8
GetCurrentThreadId.KERNEL32 ref: 012F130B
RtlLeaveCriticalSection.NTDLL(?), ref: 012F1357

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000012AB000.00000020.00000001.01000000.00000003.sdmp, Offset: 012AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12ab000__AnyDesk.jbxd

Similarity

API ID: CriticalCurrentSectionThread$EnterLeave
String ID:
API String ID: 637047042-0
Opcode ID: 09d9ab19fac8bac761753efdf0f91d6bdc48589b243ec391ce4d8693e1ec1fbe
Instruction ID: 19408fd327ae0b136dc927ff8b042e4c55acc029bff009ab07538325eca76a6d
Opcode Fuzzy Hash: 09d9ab19fac8bac761753efdf0f91d6bdc48589b243ec391ce4d8693e1ec1fbe
Instruction Fuzzy Hash: 8B21C9729007128FC321DF39C800786BBE8FB95724F440A3EE66683280EB75A505CFA2

Function 012D9029 Relevance: 6.1, APIs: 4, Instructions: 63threadCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 012D903A
GetCurrentThreadId.KERNEL32 ref: 012D904D
RtlLeaveCriticalSection.NTDLL(?), ref: 012D906C
QueryPerformanceCounter.KERNEL32(?), ref: 012D9082

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000012AB000.00000020.00000001.01000000.00000003.sdmp, Offset: 012AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12ab000__AnyDesk.jbxd

Similarity

API ID: CriticalSection$CounterCurrentEnterLeavePerformanceQueryThread
String ID:
API String ID: 1903187103-0
Opcode ID: d4c80bf435820ce0c36614ab67de93e264bf39ed1f4a4e4d919e44fe9ecb1215
Instruction ID: 41bc6875ec612d57550e1575cfbe2fdd746618a60e4930e7db676229a3cb3a26
Opcode Fuzzy Hash: d4c80bf435820ce0c36614ab67de93e264bf39ed1f4a4e4d919e44fe9ecb1215
Instruction Fuzzy Hash: B0219A704187529BDB128F20D40839BBBF0FF89309F848E1CF9D992144EB36E554CB82

Function 012CB140 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

WSAEnumNetworkEvents.WS2_32(?,00000000,?), ref: 012CB18B
WSAGetLastError.WS2_32 ref: 012CB196

Strings

, xrefs: 012CB267

Memory Dump Source

Source File: 00000003.00000002.1794604051.00000000012AB000.00000020.00000001.01000000.00000003.sdmp, Offset: 012AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12ab000__AnyDesk.jbxd

Similarity

API ID: EnumErrorEventsLastNetwork
String ID:
API String ID: 2660629773-3916222277
Opcode ID: 336ec4dc3f727611534fd03c5dd7052cc54bac1279b5b70806577d6498628609
Instruction ID: b0ac5183e9a02a5078219b711dccd2b6dd57cd51e41e21600b24b6ac39c91ea3
Opcode Fuzzy Hash: 336ec4dc3f727611534fd03c5dd7052cc54bac1279b5b70806577d6498628609
Instruction Fuzzy Hash: 6F51BF716183428BE311DF699846B2EBBD5AF94B94F040B2DFB95832D0EB74D804CB53

Source: global traffic	DNS traffic detected: DNS query: boot.net.anydesk.com
Source: global traffic	DNS traffic detected: DNS query: relay-b8f8a0be.net.anydesk.com
Source: global traffic	DNS traffic detected: DNS query: relay-75ef99c7.net.anydesk.com
Source: global traffic	DNS traffic detected: DNS query: api.playanext.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report _AnyDesk.exe_

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\gcapi.dll

C:\Users\user\AppData\Roaming\AnyDesk\ad.trace

C:\Users\user\AppData\Roaming\AnyDesk\global_cache\device-id.cache

C:\Users\user\AppData\Roaming\AnyDesk\service.conf

C:\Users\user\AppData\Roaming\AnyDesk\system.conf

C:\Users\user\AppData\Roaming\AnyDesk\user.conf

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZQTLWF9V88R56MVSE0K1.temp

C:\Users\user\Desktop\gcapi.dll

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Windows Analysis Report
_AnyDesk.exe_

Function 0142EE40 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 487
COMMON

Function 01601481 Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Function 6C39F787 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 68
registrystringCOMMON

Function 6C380AF4 Relevance: 9.1, APIs: 6, Instructions: 93
COMMONLIBRARYCODE

Function 6C385598 Relevance: 4.6, APIs: 3, Instructions: 58
COMMONLIBRARYCODE

Function 01637F2C Relevance: 3.1, APIs: 2, Instructions: 87
COMMON

Function 6C368A90 Relevance: 3.0, APIs: 2, Instructions: 46
COMMONLIBRARYCODE

Function 01637B92 Relevance: 3.0, APIs: 2, Instructions: 44
COMMON

Function 01637B9B Relevance: 3.0, APIs: 2, Instructions: 42
COMMONLIBRARYCODE

Function 6C3740D0 Relevance: 3.0, APIs: 2, Instructions: 39
registryCOMMON

Function 013A6E40 Relevance: 1.6, APIs: 1, Instructions: 129
COMMON

Function 01422200 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Function 013C1CE0 Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Function 015EF649 Relevance: 1.6, APIs: 1, Instructions: 68
COMMONLIBRARYCODE

Function 6C37EF28 Relevance: 1.5, APIs: 1, Instructions: 48
COMMONLIBRARYCODE

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre