Edit tour

Windows Analysis Report
AnyDesk.exe

Overview

General Information

Sample Name:	AnyDesk.exe
Analysis ID:	681579
MD5:	36d6be2d72171c741e2989a578011cd8
SHA1:	a1d46b3c7418d8d29208f352e27f5c9af62006e9
SHA256:	7c20393e638d2873153d2873f04464d4bad32a4d40eabb48d66608650f7d4494
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Queries information about the installed CPU (vendor, model number etc)

PE file does not import any functions

Sample file is different than original file name gathered from version info

OS version to string mapping found (often used in BOTs)

PE file contains strange resources

Detected TCP or UDP traffic on non-standard ports

PE / OLE file has an invalid certificate

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Classification

Process Tree

System is w10x64

AnyDesk.exe (PID: 5716 cmdline: "C:\Users\user\Desktop\AnyDesk.exe" MD5: 36D6BE2D72171C741E2989A578011CD8)

AnyDesk.exe (PID: 2612 cmdline: "C:\Users\user\Desktop\AnyDesk.exe" --local-service MD5: 36D6BE2D72171C741E2989A578011CD8)

AnyDesk.exe (PID: 1272 cmdline: "C:\Users\user\Desktop\AnyDesk.exe" --local-control MD5: 36D6BE2D72171C741E2989A578011CD8)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: AnyDesk.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 92.223.88.7:443 -> 192.168.2.3:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.198.34.103:443 -> 192.168.2.3:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.181.174.167:443 -> 192.168.2.3:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.130.237:443 -> 192.168.2.3:49823 version: TLS 1.2

Source: AnyDesk.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dda-64\privacy_feature\privacy_feature.pdb source: AnyDesk.exe, 00000000.00000003.248389858.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.526913244.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_loader\AnyDesk.pdb source: AnyDesk.exe, 00000000.00000002.527811985.0000000001E6B000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000004.00000000.255264870.0000000001E6B000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm-32\win_dwm\win_dwm.pdb source: AnyDesk.exe, 00000000.00000003.248389858.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.526913244.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm-64\win_dwm\win_dwm.pdb source: AnyDesk.exe, 00000000.00000003.248389858.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.526913244.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dda-32\privacy_feature\privacy_feature.pdb source: AnyDesk.exe, 00000000.00000003.248389858.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.526913244.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_app\win_app.pdb source: AnyDesk.exe, 00000000.00000003.248389858.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_app\win_app.pdb` source: AnyDesk.exe, 00000000.00000003.248389858.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: SAS.pdbR source: AnyDesk.exe, 00000000.00000003.248389858.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.526913244.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: SAS.pdb source: AnyDesk.exe, 00000000.00000003.248389858.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.526913244.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp

Source: Joe Sandbox View

JA3 fingerprint: c91bde19008eefabce276152ccd51457

Source: Joe Sandbox View	IP Address: 88.198.34.103 88.198.34.103
Source: Joe Sandbox View	IP Address: 92.223.88.41 92.223.88.41
Source: Joe Sandbox View	IP Address: 195.181.174.174 195.181.174.174
Source: Joe Sandbox View	IP Address: 49.12.130.237 49.12.130.237

Source: global traffic	TCP traffic: 192.168.2.3:49750 -> 92.223.88.41:6568
Source: global traffic	TCP traffic: 192.168.2.3:49753 -> 92.223.88.7:6568
Source: global traffic	TCP traffic: 192.168.2.3:49825 -> 195.181.174.174:6568

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823

Source: AnyDesk.exe, 00000000.00000002.533968454.0000000004580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: =https://www.linkedin.com/shareArticle?mini=true&url=https%3A//anydesk.com/&title=Try%20AnyDesk%20Remote%20Desktop&summary=AnyDesk%20is%20a%20small%20and%20quick%20solution%20for%20screen%20sharing%20and%20remote%20collaboration.%20Get%20it% equals www.linkedin.com (Linkedin)
Source: AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ad.share.fbook.href=https://www.facebook.com/sharer/sharer.php?u=https%3A//anydesk.com/ equals www.facebook.com (Facebook)
Source: AnyDesk.exe, 00000000.00000002.533968454.0000000004580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ad.share.fbook.href=https://www.facebook.com/sharer/sharer.php?u=https%3A//anydesk.com/^ equals www.facebook.com (Facebook)
Source: AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ad.share.linkedin.href=https://www.linkedin.com/shareArticle?mini=true&url=https%3A//anydesk.com/&title=Try%20AnyDesk%20Remote%20Desktop&summary=AnyDesk%20is%20a%20small%20and%20quick%20solution%20for%20screen%20sharing%20and%20remote%20collaboration.%20Get%20it%20here%3A%20https%3A//anydesk.com/&source= equals www.linkedin.com (Linkedin)
Source: AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/sharer/sharer.php?u=https%3A//anydesk.com/ equals www.facebook.com (Facebook)
Source: AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/sharer/sharer.php?u=https%3A//anydesk.com/V equals www.facebook.com (Facebook)
Source: AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/sharer/sharer.php?u=https%3A//anydesk.com/h equals www.facebook.com (Facebook)
Source: AnyDesk.exe, 00000000.00000002.534216032.0000000004910000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.commizyX; equals www.facebook.com (Facebook)
Source: AnyDesk.exe, 00000000.00000002.534216032.0000000004910000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.linkedin.comktop equals www.linkedin.com (Linkedin)

Source: AnyDesk.exe, 00000000.00000003.253646154.0000000004C91000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.534506571.0000000004C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ns.ado/1
Source: AnyDesk.exe, 00000000.00000003.253646154.0000000004C91000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.534506571.0000000004C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.c/g
Source: AnyDesk.exe, 00000000.00000003.253646154.0000000004C91000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.534506571.0000000004C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.cobj
Source: AnyDesk.exe, 00000004.00000002.521998832.000000000188D000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://support.anydesk.com
Source: AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.anydesk.com/
Source: AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.opengl.org/registry/
Source: AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/)
Source: AnyDesk.exe, 00000000.00000003.248389858.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: AnyDesk.exe, 00000000.00000003.248389858.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlEC_PRIVATEKEYpublicKeyparametersprivateKeyECPKPARAMETERSvalue
Source: AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com
Source: AnyDesk.exe, 00000004.00000002.521998832.000000000188D000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://anydesk.com/
Source: AnyDesk.exe, 00000000.00000003.251156371.0000000004576000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251622745.000000000458C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251416540.0000000004587000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251315874.0000000004579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/$
Source: AnyDesk.exe, 00000000.00000003.250987489.00000000044D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/Eh
Source: AnyDesk.exe, 00000000.00000003.251156371.0000000004576000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.250389451.0000000004562000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.250853982.0000000004581000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.250747077.0000000004574000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.533968454.0000000004580000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251622745.000000000458C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.250917923.0000000004587000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251416540.0000000004587000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251315874.0000000004579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/V
Source: AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/company#imprint
Source: AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/order
Source: AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/order.
Source: AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/orderj
Source: AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/privacy
Source: AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/terms
Source: AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/terms4
Source: AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/update
Source: AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/updatef
Source: AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://boot-01.net.anydesk.com
Source: AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://boot-01.net.anydesk.comdP
Source: AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000002.521998832.000000000188D000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://boot.net.anydesk.comabcdefABCDEFtruefalsebase.prot.packetInvalid
Source: AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://console-ui.myanydesk2.on.anydesk.com
Source: AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1524/
Source: AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1526/
Source: AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1914/
Source: AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/
Source: AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/$
Source: AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/;cn
Source: AnyDesk.exe, 00000000.00000003.248389858.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://help.anydesk.com/HelpLinkInstallLocationAnyDesk
Source: AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/access
Source: AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/backup-alias
Source: AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.533968454.0000000004580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/backup-aliasn
Source: AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/d3cf
Source: AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/en
Source: AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/en/abuset
Source: AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/en/android-battery
Source: AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/en/android3
Source: AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/error-messages
Source: AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/error-messages$
Source: AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/macos-security
Source: AnyDesk.exe, 00000000.00000002.534216032.0000000004910000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/share
Source: AnyDesk.exe, 00000000.00000002.534216032.0000000004910000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/sharea
Source: AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/wol
Source: AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/wololn
Source: AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/wolz
Source: AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.com
Source: AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.com/password-generator.
Source: AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.comr(
Source: AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://order.anydesk.com/trial
Source: AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://order.anydesk.com/trial.y
Source: AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.534216032.0000000004910000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/privacy?hl=$
Source: AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/privacy?hl=en
Source: AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/privacy?hl=en=
Source: AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/privacy?hl=enH
Source: AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/privacy?hl=enn$
Source: AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/
Source: AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/AnyDesk_on_macOS
Source: AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/AnyDesk_on_macOSs
Source: AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/ss
Source: AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/home?status=Do%20you%20know%20%23AnyDesk?%20AnyDesk%20is%20a%20small%20and%20qui
Source: AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.533968454.0000000004580000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/$
Source: AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/ay&
Source: AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en
Source: AnyDesk.exe, 00000000.00000002.533259370.00000000044D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/chrome/privacy/eula_text.htmlce
Source: AnyDesk.exe, 00000000.00000002.533968454.0000000004580000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.linkedin.com/shareArticle?mini=true&url=https%3A//anydesk.com/&title=Try%20AnyDesk%20Rem
Source: AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.nayuki.io/page/qr-code-generator-library

Source: unknown

DNS traffic detected: queries for: boot.net.anydesk.com

Source: unknown	HTTPS traffic detected: 92.223.88.7:443 -> 192.168.2.3:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.198.34.103:443 -> 192.168.2.3:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.181.174.167:443 -> 192.168.2.3:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.130.237:443 -> 192.168.2.3:49823 version: TLS 1.2

Source: AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: DirectDrawCreateEx

Source: AnyDesk.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\AnyDesk.exe	Code function: 0_3_044E5409		0_3_044E5409
Source: C:\Users\user\Desktop\AnyDesk.exe	Code function: 4_2_01282DFD		4_2_01282DFD

Source: AnyDesk.exe

Static PE information: No import functions for PE file found

Source: AnyDesk.exe, 00000000.00000003.248389858.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesas.dllj% vs AnyDesk.exe
Source: AnyDesk.exe, 00000000.00000002.526913244.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesas.dllj% vs AnyDesk.exe
Source: AnyDesk.exe, 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesas.dllj% vs AnyDesk.exe

Source: AnyDesk.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AnyDesk.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: AnyDesk.exe

Static PE information: invalid certificate

Source: AnyDesk.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\AnyDesk.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\AnyDesk.exe "C:\Users\user\Desktop\AnyDesk.exe"
Source: C:\Users\user\Desktop\AnyDesk.exe	Process created: C:\Users\user\Desktop\AnyDesk.exe "C:\Users\user\Desktop\AnyDesk.exe" --local-service
Source: C:\Users\user\Desktop\AnyDesk.exe	Process created: C:\Users\user\Desktop\AnyDesk.exe "C:\Users\user\Desktop\AnyDesk.exe" --local-control
Source: C:\Users\user\Desktop\AnyDesk.exe	Process created: C:\Users\user\Desktop\AnyDesk.exe "C:\Users\user\Desktop\AnyDesk.exe" --local-service	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Process created: C:\Users\user\Desktop\AnyDesk.exe "C:\Users\user\Desktop\AnyDesk.exe" --local-control	Jump to behavior

Source: C:\Users\user\Desktop\AnyDesk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2155fee3-2419-4373-b102-6843707eb41f}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM Win32_Processor

Source: C:\Users\user\Desktop\AnyDesk.exe

File created: C:\Users\user\AppData\Roaming\AnyDesk

Jump to behavior

Source: classification engine

Classification label: mal72.evad.winEXE@5/6@12/8

Source: C:\Users\user\Desktop\AnyDesk.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_5716_1829967004_0_mtx
Source: C:\Users\user\Desktop\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Session\1\ad_connect_queue_2612_1892294440_mtx
Source: C:\Users\user\Desktop\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_5716_1829967004_1_mtx
Source: C:\Users\user\Desktop\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_1272_1900228359_1_mtx
Source: C:\Users\user\Desktop\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_1272_1900228359_0_mtx
Source: C:\Users\user\Desktop\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_7013_lsystem_mtx
Source: C:\Users\user\Desktop\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_trace_mtx

Source: AnyDesk.exe, 00000004.00000002.513425608.0000000000E20000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ;.VBp

Source: AnyDesk.exe	String found in binary or memory: Show move/size-helper ad.menu.display.helpers.title=Helpers ad.menu.display.imgqual.adaptive=Detect connection speed ad.menu.displ
Source: AnyDesk.exe	String found in binary or memory: mobile=Your Address ad.connect.share.myid=AnyDesk-Address: ad.connect.share.password_preset=This AnyDesk uses a predefined passwor
Source: AnyDesk.exe	String found in binary or memory: ad.connect.share.myid=AnyDesk-Address:

Source: C:\Users\user\Desktop\AnyDesk.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\AnyDesk.exe

Window found: window name: SysTabControl32

Jump to behavior

Source: AnyDesk.exe

Static file information: File size 3852912 > 1048576

Source: AnyDesk.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x3a0400

Source: AnyDesk.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: AnyDesk.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dda-64\privacy_feature\privacy_feature.pdb source: AnyDesk.exe, 00000000.00000003.248389858.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.526913244.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_loader\AnyDesk.pdb source: AnyDesk.exe, 00000000.00000002.527811985.0000000001E6B000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000004.00000000.255264870.0000000001E6B000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm-32\win_dwm\win_dwm.pdb source: AnyDesk.exe, 00000000.00000003.248389858.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.526913244.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm-64\win_dwm\win_dwm.pdb source: AnyDesk.exe, 00000000.00000003.248389858.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.526913244.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dda-32\privacy_feature\privacy_feature.pdb source: AnyDesk.exe, 00000000.00000003.248389858.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.526913244.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_app\win_app.pdb source: AnyDesk.exe, 00000000.00000003.248389858.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_app\win_app.pdb` source: AnyDesk.exe, 00000000.00000003.248389858.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: SAS.pdbR source: AnyDesk.exe, 00000000.00000003.248389858.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.526913244.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: SAS.pdb source: AnyDesk.exe, 00000000.00000003.248389858.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.526913244.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\AnyDesk.exe	Unpacked PE file: 0.2.AnyDesk.exe.1280000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\AnyDesk.exe	Unpacked PE file: 4.2.AnyDesk.exe.1280000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\AnyDesk.exe	Unpacked PE file: 5.2.AnyDesk.exe.1280000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Source: C:\Users\user\Desktop\AnyDesk.exe

Code function: 4_2_017F49B5 push ecx; ret

4_2_017F49C8

Source: C:\Users\user\Desktop\AnyDesk.exe

Code function: 4_2_01803007 LoadLibraryW,GetProcAddress,GetProcAddress,RtlEncodePointer,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

4_2_01803007

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\AnyDesk.exe

File opened: C:\Users\user\Desktop\AnyDesk.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\AnyDesk.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Users\user\Desktop\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_PhysicalMemory

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Users\user\Desktop\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_PhysicalMemory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter = TRUE

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_BaseBoard

Source: C:\Users\user\Desktop\AnyDesk.exe TID: 4772	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe TID: 4624	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe TID: 3272	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe TID: 4772	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe TID: 4692	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe TID: 4244	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe TID: 2244	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe TID: 4692	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe TID: 5240	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM Win32_Processor

Source: C:\Users\user\Desktop\AnyDesk.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: AnyDesk.exe, 00000004.00000003.279729644.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000002.513561348.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.279408893.0000000000E4A000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.266139496.0000000000E4A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll`

Source: C:\Users\user\Desktop\AnyDesk.exe

Code function: 4_2_017F343D _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_017F343D

Source: C:\Users\user\Desktop\AnyDesk.exe

4_2_01803007

Source: C:\Users\user\Desktop\AnyDesk.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\AnyDesk.exe	Code function: 4_2_017F343D _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		4_2_017F343D
Source: C:\Users\user\Desktop\AnyDesk.exe	Code function: 4_2_017FC239 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		4_2_017FC239

Source: C:\Users\user\Desktop\AnyDesk.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\AnyDesk.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\AnyDesk.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\AnyDesk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\AnyDesk.exe

Code function: 4_2_016E5400 _vswprintf_s,WaitForSingleObject,OutputDebugStringA,GetSystemTime,TlsGetValue,__itow,GetCurrentThreadId,GetCurrentProcessId,__snprintf,SetFilePointer,SetFilePointer,ReadFile,_memmove,SetFilePointer,WriteFile,SetFilePointer,SetEndOfFile,WriteFile,RtlEnterCriticalSection,RaiseException,

4_2_016E5400

Source: AnyDesk.exe, 00000004.00000002.513085511.0000000000AFB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: a6c7da52b180805e2092a8a2a53823e5cd9bee30release/win_7.0.xa08bfd5f6ae21559950209438d9705c4p
Source: AnyDesk.exe, 00000004.00000000.255264870.0000000001E6B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: release/win_7.0.x
Source: AnyDesk.exe, 00000000.00000002.527442783.0000000001DF1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: a6c7da52b180805e2092a8a2a53823e5cd9bee30release/win_7.0.xa08bfd5f6ae21559950209438d9705c4
Source: AnyDesk.exe, 00000004.00000000.255264870.0000000001E6B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: .itext.text.customa08bfd5f6ae21559950209438d9705c4release/win_7.0.xa6c7da52b180805e2092a8a2a53823e5cd9bee30

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	511 Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	1 Input Capture	1 System Time Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	12 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	421 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	331 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Process Injection	NTDS	331 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Software Packing	DCSync	224 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
AnyDesk.exe	0%	Virustotal	Browse
AnyDesk.exe	0%	Metadefender	Browse
AnyDesk.exe	2%	ReversingLabs

Source	Detection	Scanner	Label
http://ns.adobe.c/g	0%	URL Reputation	safe
https://boot-01.net.anydesk.comdP	0%	Avira URL Cloud	safe
https://boot.net.anydesk.comabcdefABCDEFtruefalsebase.prot.packetInvalid	0%	Avira URL Cloud	safe
https://my.anydesk.comr(	0%	Avira URL Cloud	safe
http://ns.adobe.cobj	0%	URL Reputation	safe
http://ns.ado/1	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
boot.net.anydesk.com	92.223.88.7	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://anydesk.com/order.	AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/en	AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anydesk.com/Eh	AnyDesk.exe, 00000000.00000003.250987489.00000000044D5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.anydesk.com/	AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://order.anydesk.com/trial	AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anydesk.com/update	AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/intl/$	AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.533968454.0000000004580000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://policies.google.com/privacy?hl=en=	AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://my.anydesk.com	AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ns.adobe.c/g	AnyDesk.exe, 00000000.00000003.253646154.0000000004C91000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.534506571.0000000004C80000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anydesk.com/V	AnyDesk.exe, 00000000.00000003.251156371.0000000004576000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.250389451.0000000004562000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.250853982.0000000004581000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.250747077.0000000004574000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.533968454.0000000004580000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251622745.000000000458C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.250917923.0000000004587000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251416540.0000000004587000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251315874.0000000004579000.00000004.00000800.00020000.00000000.sdmp	false		high
https://twitter.com/home?status=Do%20you%20know%20%23AnyDesk?%20AnyDesk%20is%20a%20small%20and%20qui	AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.anydesk.com/ss	AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.anydesk.com/AnyDesk_on_macOSs	AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/backup-aliasn	AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.533968454.0000000004580000.00000004.00000800.00020000.00000000.sdmp	false		high
https://policies.google.com/privacy?hl=enH	AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.html	AnyDesk.exe, 00000000.00000003.248389858.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp	false		high
https://anydesk.com/	AnyDesk.exe, 00000004.00000002.521998832.000000000188D000.00000002.00000001.01000000.00000003.sdmp	false		high
https://anydesk.com/updatef	AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anydesk.com/privacy	AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://datatracker.ietf.org/ipr/1526/	AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.nayuki.io/page/qr-code-generator-library	AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/en/android3	AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://policies.google.com/privacy?hl=$	AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.534216032.0000000004910000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.anydesk.com/AnyDesk_on_macOS	AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/en/abuset	AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/macos-security	AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/en/android-battery	AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://datatracker.ietf.org/ipr/1914/	AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anydesk.com/terms4	AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://boot-01.net.anydesk.comdP	AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://policies.google.com/privacy?hl=en	AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anydesk.com/terms	AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://boot.net.anydesk.comabcdefABCDEFtruefalsebase.prot.packetInvalid	AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000002.521998832.000000000188D000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://anydesk.com/order	AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/backup-alias	AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/intl/en	AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/error-messages$	AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://my.anydesk.com/password-generator.	AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/	AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anydesk.com	AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://my.anydesk.comr(	AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://anydesk.com/orderj	AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ns.adobe.cobj	AnyDesk.exe, 00000000.00000003.253646154.0000000004C91000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.534506571.0000000004C80000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.opengl.org/registry/	AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/error-messages	AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/sharea	AnyDesk.exe, 00000000.00000002.534216032.0000000004910000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/wololn	AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/wol	AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/$	AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/d3cf	AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.anydesk.com/	AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anydesk.com/$	AnyDesk.exe, 00000000.00000003.251156371.0000000004576000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251622745.000000000458C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251416540.0000000004587000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251315874.0000000004579000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.linkedin.com/shareArticle?mini=true&url=https%3A//anydesk.com/&title=Try%20AnyDesk%20Rem	AnyDesk.exe, 00000000.00000002.533968454.0000000004580000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/intl/en/chrome/privacy/eula_text.htmlce	AnyDesk.exe, 00000000.00000002.533259370.00000000044D0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://console-ui.myanydesk2.on.anydesk.com	AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
http://support.anydesk.com	AnyDesk.exe, 00000004.00000002.521998832.000000000188D000.00000002.00000001.01000000.00000003.sdmp	false		high
https://help.anydesk.com/;cn	AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/wolz	AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://order.anydesk.com/trial.y	AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/HelpLinkInstallLocationAnyDesk	AnyDesk.exe, 00000000.00000003.248389858.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp	false		high
https://boot-01.net.anydesk.com	AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://datatracker.ietf.org/ipr/1524/	AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anydesk.com/company#imprint	AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://policies.google.com/privacy?hl=enn$	AnyDesk.exe, 00000000.00000003.251929138.00000000044DB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.openssl.org/)	AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/access	AnyDesk.exe, 00000000.00000003.251907032.00000000044D2000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/intl/ay&	AnyDesk.exe, 00000000.00000003.252034987.0000000004590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.htmlEC_PRIVATEKEYpublicKeyparametersprivateKeyECPKPARAMETERSvalue	AnyDesk.exe, 00000000.00000003.248389858.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp	false		high
https://help.anydesk.com/share	AnyDesk.exe, 00000000.00000002.534216032.0000000004910000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.521998839.000000000188D000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 00000000.00000003.244225095.000000000248C000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000004.00000003.257403733.0000000002224000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ns.ado/1	AnyDesk.exe, 00000000.00000003.253646154.0000000004C91000.00000004.00000800.00020000.00000000.sdmp, AnyDesk.exe, 00000000.00000002.534506571.0000000004C80000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
88.198.34.103	unknown	Germany	24940	HETZNER-ASDE	false
92.223.88.7	boot.net.anydesk.com	Austria	199524	GCOREAT	false
92.223.88.41	unknown	Austria	199524	GCOREAT	false
195.181.174.174	unknown	United Kingdom	60068	CDN77GB	false
49.12.130.237	unknown	Germany	24940	HETZNER-ASDE	false
185.229.191.39	unknown	Czech Republic	60068	CDN77GB	false
195.181.174.167	unknown	United Kingdom	60068	CDN77GB	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	681579
Start date and time:	2022-08-10 11:01:59 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	AnyDesk.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.evad.winEXE@5/6@12/8
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 23.211.6.115
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, login.live.com, store-images.s-microsoft.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net
Execution Graph export aborted for target AnyDesk.exe, PID 5716 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:03:18	API Interceptor	2x Sleep call for process: AnyDesk.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
88.198.34.103	AnyDesk.exe	Get hash	malicious	Browse
	AnyDesk.exe	Get hash	malicious	Browse
	AnyDeskUninst5265.exe	Get hash	malicious	Browse
	Vostel-Anydesk.EXE	Get hash	malicious	Browse
	AnyDesk_ETS_WIN.exe	Get hash	malicious	Browse
	AnyDesk.exe	Get hash	malicious	Browse
	AnyDesk.exe	Get hash	malicious	Browse
92.223.88.7	AnyDesk (1).exe	Get hash	malicious	Browse
	AnyDesk.exe	Get hash	malicious	Browse
	AnyDesk.exe	Get hash	malicious	Browse
92.223.88.41	1.msi	Get hash	malicious	Browse
	sJ9Q8UWMAX.exe	Get hash	malicious	Browse
	AnyDesk (5).exe	Get hash	malicious	Browse
	AnyDesk (4).exe	Get hash	malicious	Browse
	AnyDesk.exe	Get hash	malicious	Browse
	AnyDesk (1).exe	Get hash	malicious	Browse
	Vostel-Anydesk.EXE	Get hash	malicious	Browse
	AnyDesk.exe	Get hash	malicious	Browse
195.181.174.174	1.msi	Get hash	malicious	Browse
	AnyDesk (5).exe	Get hash	malicious	Browse
	AnyDesk.exe	Get hash	malicious	Browse
	AnyDesk (1).exe	Get hash	malicious	Browse
	AnyDesk.exe	Get hash	malicious	Browse
49.12.130.237	sJ9Q8UWMAX.exe	Get hash	malicious	Browse
	AnyDesk (5).exe	Get hash	malicious	Browse
	AnyDesk (1).exe	Get hash	malicious	Browse
	handelsbankensupport.com-AnyDesk.exe	Get hash	malicious	Browse
	AnyDesk.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
boot.net.anydesk.com	1.msi	Get hash	malicious	Browse	92.223.88.41
	sJ9Q8UWMAX.exe	Get hash	malicious	Browse	185.229.191.39
	http://anydesk.com	Get hash	malicious	Browse	185.229.191.39
	https://ms94.yolasite.com/	Get hash	malicious	Browse	49.12.130.236
	AnyDesk (5).exe	Get hash	malicious	Browse	49.12.130.237
	AnyDesk (4).exe	Get hash	malicious	Browse	195.181.174.167
	AnyDesk (3).exe	Get hash	malicious	Browse	195.181.174.173
	AnyDesk.exe	Get hash	malicious	Browse	195.181.174.173
	AnyDeskUninst5265.exe	Get hash	malicious	Browse	92.223.88.232
	handelsbankensupport.com-AnyDesk.exe	Get hash	malicious	Browse	49.12.130.237

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
HETZNER-ASDE	4Q8jDDG11Z.exe	Get hash	malicious	Browse	148.251.234.83
	8mgqlBQlo6.exe	Get hash	malicious	Browse	148.251.234.83
	SecuriteInfo.com.W32.AIDetectNet.01.30774.exe	Get hash	malicious	Browse	144.76.136.153
	SecuriteInfo.com.Trojan.GenericKD.61230025.5938.exe	Get hash	malicious	Browse	49.12.58.124
	DmAchH6r7R.exe	Get hash	malicious	Browse	148.251.234.83
	KbMFC1Fvvc.exe	Get hash	malicious	Browse	148.251.234.83
	z6k7ekgy3Z.exe	Get hash	malicious	Browse	148.251.234.83
	80J4pAFU0A.exe	Get hash	malicious	Browse	148.251.234.83
	Rwwsr82vkS.exe	Get hash	malicious	Browse	148.251.234.83
	https://764827.selcdn.ru/mina.owa.osoft-microsoft/owa-authicationmanagerpayment.htm#tori.beattie@osii.com	Get hash	malicious	Browse	88.99.162.33
	RFQ-2022080902401220JP.exe	Get hash	malicious	Browse	144.76.136.153
	https://www.paperturn-view.com/?pid=MjY264197&v=1.1	Get hash	malicious	Browse	148.251.96.155
	7s1WUOiWAU	Get hash	malicious	Browse	197.242.86.251
	700000.dll	Get hash	malicious	Browse	78.47.204.80
	A9F400B739DB381FA4D0EE9DBDA0829407400033B2D5A.exe	Get hash	malicious	Browse	148.251.234.83
	ScudwX7XeQ.exe	Get hash	malicious	Browse	95.217.246.234
	swift.exe	Get hash	malicious	Browse	144.76.136.153
	https://www.paperturn-view.com/?pid=MjY263733	Get hash	malicious	Browse	148.251.96.155
	SecuriteInfo.com.W32.AIDetectNet.01.27962.exe	Get hash	malicious	Browse	144.76.136.153
	3F95733711B8F39FF7BC3458FF49EF57CD4411F3A813D.exe	Get hash	malicious	Browse	148.251.234.83
GCOREAT	1.msi	Get hash	malicious	Browse	92.223.88.41
	ermac02Aug2022.apk	Get hash	malicious	Browse	5.188.33.192
	http://megafonru.ru	Get hash	malicious	Browse	92.223.124.254
	qgL4VE21uB.dll	Get hash	malicious	Browse	92.223.99.21
	ZAGkR4EKbX.dll	Get hash	malicious	Browse	92.223.112.214
	sJ9Q8UWMAX.exe	Get hash	malicious	Browse	92.223.88.41
	dYM5ol1Mx4	Get hash	malicious	Browse	92.38.145.189
	http://info-getting-eu.com	Get hash	malicious	Browse	92.223.124.254
	5fjZZ75ZIi	Get hash	malicious	Browse	5.188.4.184
	PgyjFPUU5u	Get hash	malicious	Browse	92.38.145.157
	https://novawealth.me/wp-content/suedia	Get hash	malicious	Browse	92.223.127.141
	dJPWbHmILN.exe	Get hash	malicious	Browse	92.38.135.62
	dJPWbHmILN.exe	Get hash	malicious	Browse	92.38.135.62
	i9YeKJfeed	Get hash	malicious	Browse	92.223.55.192
	kKH0R03Zoa	Get hash	malicious	Browse	5.188.4.149
	arm	Get hash	malicious	Browse	5.188.4.155
	https://irinwellness.com/wp-content/colour/orange/empty/colour/orange/empty/newabdcolour/next.php	Get hash	malicious	Browse	185.12.242.33
	xd.arm	Get hash	malicious	Browse	92.38.145.160
	SBNGwWC7Wb	Get hash	malicious	Browse	92.38.145.170
	xWqX0SL1Sg.exe	Get hash	malicious	Browse	5.8.71.97

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
c91bde19008eefabce276152ccd51457	sJ9Q8UWMAX.exe	Get hash	malicious	Browse	88.198.34.103 92.223.88.7 49.12.130.237 195.181.174.167
	AnyDesk (5).exe	Get hash	malicious	Browse	88.198.34.103 92.223.88.7 49.12.130.237 195.181.174.167
	AnyDesk (4).exe	Get hash	malicious	Browse	88.198.34.103 92.223.88.7 49.12.130.237 195.181.174.167
	AnyDesk.exe	Get hash	malicious	Browse	88.198.34.103 92.223.88.7 49.12.130.237 195.181.174.167
	AnyDesk (3).exe	Get hash	malicious	Browse	88.198.34.103 92.223.88.7 49.12.130.237 195.181.174.167
	AnyDesk.exe	Get hash	malicious	Browse	88.198.34.103 92.223.88.7 49.12.130.237 195.181.174.167
	AnyDeskUninst5265.exe	Get hash	malicious	Browse	88.198.34.103 92.223.88.7 49.12.130.237 195.181.174.167
	handelsbankensupport.com-AnyDesk.exe	Get hash	malicious	Browse	88.198.34.103 92.223.88.7 49.12.130.237 195.181.174.167
	AnyDesk.exe	Get hash	malicious	Browse	88.198.34.103 92.223.88.7 49.12.130.237 195.181.174.167
	AnyDesk.exe	Get hash	malicious	Browse	88.198.34.103 92.223.88.7 49.12.130.237 195.181.174.167
	AnyDesk_ETS_WIN.exe	Get hash	malicious	Browse	88.198.34.103 92.223.88.7 49.12.130.237 195.181.174.167
	YfbB61z87a.exe	Get hash	malicious	Browse	88.198.34.103 92.223.88.7 49.12.130.237 195.181.174.167
	AnyDesk.exe	Get hash	malicious	Browse	88.198.34.103 92.223.88.7 49.12.130.237 195.181.174.167
	AnyDesk.exe	Get hash	malicious	Browse	88.198.34.103 92.223.88.7 49.12.130.237 195.181.174.167

Process:	C:\Users\user\Desktop\AnyDesk.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	6.014084362695362
Encrypted:	false
SSDEEP:	48:uISTi9UwiKGggL1tsPx0k9N8rTvj6yOgUTr6zg9PP0vY2emZ22bUT7H4L6ZCI4/L:uISTiZiKGggZ6PSeNUTveTHTr6z+PsQy
MD5:	506E0CF72F3227C1096093A518EB28A5
SHA1:	29ACB18A1D598ACC827B290B743573CA681A227F
SHA-256:	94678680465A25A7C345CD6B72DED29ECD79159AE0E704E52098FB96E7FFA74B
SHA-512:	73CCF63AE4BA2BEEFAB3CFBDF374573EC923494F0AE82257C63321A48548C16D5BAEF7C08519BA0AB17D50579B6B8C424577103CEB86AF425623C6D59FE13DEA
Malicious:	false
Reputation:	low
Preview:	ad.anynet.cert=-----BEGIN CERTIFICATE-----\nMIICqDCCAZACAQEwDQYJKoZIhvcNAQELBQAwGTEXMBUGA1UEAwwOQW55RGVzayBD\nbGllbnQwIBcNMjIwODEwMTgwMzE0WhgPMjA3MjA3MjgxODAzMTRaMBkxFzAVBgNV\nBAMMDkFueURlc2sgQ2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEAsUEWcg0PrduSrWk9b3bpp6IzdwXt5JE8xOdAibxRxr0fQ9Z2x1hB9G9cvbZf\nUgaemxPxKgWLe/HkUg95a+9eBcoykSA0fVgvC+QjgotxvYWZytlVxWbj3WLOBBEw\ni+r2g2srwoQJk+lzHZaUk1FOE3x8wI2nwGZ0K9wJnMBZXp0245Zjxl0PSRgY8GcP\npc/lmn68DdAN23R/4YAcXcHc3CF22tCgRG7xj+5GP+QgFLSnihOrNHOwgF0jsMG1\nutz0o7JmrR5vXY48y+lnBOaux+3LH4kVhb3CPLaiMpSTfc6lla4yLQPtF50nAfsg\nVyM4ebX2cP5aZ6uckKUVDZfyzwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBOAynT\nD98Grd6Ju8eh/S6ZcX5fsMMrWls656peNnM8/C6I4x7RTSjwiVTrhBuP+Ns8gCHX\nWFwQ1C3KUJoc4YGL8GdqIiBBeyU5yczSaD7ZLxm7xMXriKK05+cSkkScmw3EA3xy\ncoVysDiv84F9+OrVCgMRdw48rmClcmIFhQVeQ2LR4Mses6g+EK+9RYcOgg4z8DVN\n+AcQfwvKgJX78WjzQphzDXhyIxxz/zqdZOAACQN6iQQjNM+Pe5nYGkYH5IzKarN2\noZIcbekWmafO7EkBJsQ/kJ5wiBxauzP04I3wMIcutObyIbl/xlJD5v7YMaS2kbav\n4x5ZQ/0HdbhyE4tv\n-----END CERTI

C:\Users\user\AppData\Roaming\AnyDesk\system.conf

Download File

Process:	C:\Users\user\Desktop\AnyDesk.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	395
Entropy (8bit):	4.534770156613101
Encrypted:	false
SSDEEP:	6:owvUZEAfQnBXaqQAmvbahOmQgRQUQgRQPYQgRQOYQgfxPZxi3B6QgfxPg3qg3B6g:oRZpPqQHvWhOLroBGgFBGA
MD5:	FE1021BDE85DB853D43688FA543C6311
SHA1:	62CBB936CF93D95C81F6B83EA2B54BFE4AE9DA00
SHA-256:	29DFE9C68EA6C5E7EF8F0F337BA41E6821C53865F0F1F0F626486C349F57E8D0
SHA-512:	7A2F1668E9BF8560F37DE5D2406403B34F769F583BD769CB26E1C290A882CE497898401B4928D306B9B5F90A176B3D833E351C9DE5C13E4944740424382F1D8E
Malicious:	false
Reputation:	low
Preview:	ad.anynet.fpr=0c114ab54e91b33bf2f256939e3c59e39e921dfb.ad.anynet.relay.fatal_result=1.0.ad.anynet.relay.state=0.ad.security.frontend_clipboard=1.ad.security.frontend_clipboard_files=1.ad.security.frontend_clipboard_version=1.ad.security.permission_profiles._default.permissions.sas=1.ad.security.permission_profiles._unattended_access.permissions.sas=1.ad.security.permission_profiles.version=1.

C:\Users\user\AppData\Roaming\AnyDesk\user.conf

Download File

Process:	C:\Users\user\Desktop\AnyDesk.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	4.715271799370542
Encrypted:	false
SSDEEP:	24:snKn2XZ6KdG0WQ6LiMRyvenKn2Xrn3acWy7RDJ5lQ1LReS/k6:snEK+DLitven33ajsLlOLc0
MD5:	136A9B33E7FC051174C80155FD7377B2
SHA1:	BE65E833B2CAF26870055CB99DEFB2C45986D4ED
SHA-256:	681D0F76796123302B838807EA132857E39D1126D835B1B67082D1665A098409
SHA-512:	DFE90643DF802CDE6859B81869D881A296FD9C761F10EE8BF05A16203C46DDA4FFA772078B1C933FF27147268AF637A5007CE1DB6890118481ED43CAE2807A55
Malicious:	false
Reputation:	low
Preview:	ad.invite.created_list_encrypted=6fa74c609a01f31f1f670668df954f4642a4aae8018a18da377f2840f8652cf29c0d4ed023a6faa60bf648310f1fa2df0b53d2e90e4e008262013ecaea920f9bed3ea75558d68ea41233af1803ef06c18e7d2cb8453245b1af1dcfeda9e0c27374ab0862b47b212f41cf5778b89c628dbb1a66efb744799f3dd966523d83ac463a51c70842dda9438a43e1aeaa7e5470f0d97e36c0193453a8e110d56209c712d4c2806804e9a00c68ba796977b7ac95333d5f5f54be6b321124b95fe5380a5089b3a5c0c45842a222ad3a83d593483c80b0104a394d1dbbd8c9af8bcfad0f164cac95a68a4c.ad.invite.received_list_encrypted=6fa74c609a01f31f1f670668df954f4642a4aae8018a18da377f2840f8652cf29c0d4ed023a6faa60bf648310f1fa2df0b53d2e90e4e008262013ecaea927165db38abe09b923f74a86eeef0062170177eb331ffbc790095e6d3899ca190c27374ab0862b47b212f41cf5778b89ca1240d741a8001f7b528e67b2b1004967611cc19dea93e0735a63cc4e7cd6b3d5470f0d9d2690f6fafb9cbdf3ffeec9c0e61a845806804e91d47f7f562038ed56c153209172f35d18513dabba4a793db6746240bfa0e3a57eb69557234c5e2629c37f557c52f90cc39986341671ad0fc2f4972ed0c63281e.ad.roster.c

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms (copy)

Download File

Process:	C:\Users\user\Desktop\AnyDesk.exe
File Type:	data
Category:	dropped
Size (bytes):	3202
Entropy (8bit):	3.234233068951343
Encrypted:	false
SSDEEP:	24:AwnpbrEAd9mEsOpMcWoymPwnpbrEAdEnIsOpM+BjDymU:dpnTd9rsmMZoyRpnTdyIsmM+NyH
MD5:	675595A8A3D533ECFFF229F29DCE2135
SHA1:	F184BB5852658A3638CF1058F050ABEF29B56A5F
SHA-256:	40CDD48F1471F03C895B96285C51224AE96A4CBF1F658D016426BCC92506E8F2
SHA-512:	ED35297E85462AD3EF6820F6B40FBFD1DD57B63D46212BF5147376F2E4E3E39BDC41A0FCB61A8A7D5837A2FD4F8A46BD7F397C2CCB7F3AAFA39C379F68C4DA82
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.@.. .....x..3..b..q...E.Tl...p.:..........................P.O. .:i.....+00.:...:..,.LB.)...A&...&......N....-.......3..4..p.....b.2.p.:..U`. .AnyDesk.exe.H......hT...Ua.....h.........................A.n.y.D.e.s.k...e.x.e.......Q...............-.......P............Fi@.....C:\Users\user\Desktop\AnyDesk.exe....O.p.e.n. .a. .n.e.w. .A.n.y.D.e.s.k. .w.i.n.d.o.w...".C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.D.e.s.k.t.o.p.\.A.n.y.D.e.s.k...e.x.e.........%USERPROFILE%\Desktop\AnyDesk.exe...................................................................................................................................................................................................................................%.U.S.E.R.P.R.O.F.I.L.E.%.\.D.e.s.k.t.o.p.\.A.n.y.D.e.s.k...e.x.e..........................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\BHJWA8656ZX7SMIVXTPF.temp

Download File

Process:	C:\Users\user\Desktop\AnyDesk.exe
File Type:	data
Category:	dropped
Size (bytes):	3202
Entropy (8bit):	3.234233068951343
Encrypted:	false
SSDEEP:	24:AwnpbrEAd9mEsOpMcWoymPwnpbrEAdEnIsOpM+BjDymU:dpnTd9rsmMZoyRpnTdyIsmM+NyH
MD5:	675595A8A3D533ECFFF229F29DCE2135
SHA1:	F184BB5852658A3638CF1058F050ABEF29B56A5F
SHA-256:	40CDD48F1471F03C895B96285C51224AE96A4CBF1F658D016426BCC92506E8F2
SHA-512:	ED35297E85462AD3EF6820F6B40FBFD1DD57B63D46212BF5147376F2E4E3E39BDC41A0FCB61A8A7D5837A2FD4F8A46BD7F397C2CCB7F3AAFA39C379F68C4DA82
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.@.. .....x..3..b..q...E.Tl...p.:..........................P.O. .:i.....+00.:...:..,.LB.)...A&...&......N....-.......3..4..p.....b.2.p.:..U`. .AnyDesk.exe.H......hT...Ua.....h.........................A.n.y.D.e.s.k...e.x.e.......Q...............-.......P............Fi@.....C:\Users\user\Desktop\AnyDesk.exe....O.p.e.n. .a. .n.e.w. .A.n.y.D.e.s.k. .w.i.n.d.o.w...".C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.D.e.s.k.t.o.p.\.A.n.y.D.e.s.k...e.x.e.........%USERPROFILE%\Desktop\AnyDesk.exe...................................................................................................................................................................................................................................%.U.S.E.R.P.R.O.F.I.L.E.%.\.D.e.s.k.t.o.p.\.A.n.y.D.e.s.k...e.x.e..........................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\S8FAV3SVMYENR819RW5P.temp

Download File

Process:	C:\Users\user\Desktop\AnyDesk.exe
File Type:	data
Category:	dropped
Size (bytes):	3202
Entropy (8bit):	3.229809334711375
Encrypted:	false
SSDEEP:	24:LnpbrEAd9mEsOpMcWoym2npbrEAdEnIsOpM+BjDymU:jpnTd9rsmMZoyXpnTdyIsmM+NyH
MD5:	4E79C142254BF474FFA427E972BBEFB6
SHA1:	51A1E7C3F5608A8301C9066EB904B2A24A2E9E98
SHA-256:	A35BD8AD93DFA8E116909BF9F98B1C601D39E4C068F09CCCD8E402E36F2640D4
SHA-512:	AA87E875F4DEAC7B753B03B3875B406F7F4B7B759A11422B09EE30438A028A3790CF39A3F320167319976C88121B233664E03A0D9ED9A38C8D62B6F92D88B991
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.@.. .....x..3...!.m...E.Tl...p.:..........................P.O. .:i.....+00.:...:..,.LB.)...A&...&......N....-.......3..4..p.....b.2.p.:..U`. .AnyDesk.exe.H......hT...Ua.....h.........................A.n.y.D.e.s.k...e.x.e.......Q...............-.......P............Fi@.....C:\Users\user\Desktop\AnyDesk.exe....O.p.e.n. .a. .n.e.w. .A.n.y.D.e.s.k. .w.i.n.d.o.w...".C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.D.e.s.k.t.o.p.\.A.n.y.D.e.s.k...e.x.e.........%USERPROFILE%\Desktop\AnyDesk.exe...................................................................................................................................................................................................................................%.U.S.E.R.P.R.O.F.I.L.E.%.\.D.e.s.k.t.o.p.\.A.n.y.D.e.s.k...e.x.e..........................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.999018806477609
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	AnyDesk.exe
File size:	3852912
MD5:	36d6be2d72171c741e2989a578011cd8
SHA1:	a1d46b3c7418d8d29208f352e27f5c9af62006e9
SHA256:	7c20393e638d2873153d2873f04464d4bad32a4d40eabb48d66608650f7d4494
SHA512:	b686a2963dd4679101eaedafc4cdd62450e91d91a59d19cf0f37bd0df76bdddfecdf66efa1dfa4a7a6390ddc37bfdbeb1fff49d1db4773fb9b718df0810dd659
SSDEEP:	98304:Agps0DrlKJ+vUYhWlO8M2xT6pX2fvnY8nIoVgUrWLHJi:VwJ6b58M5pWnY6Io3WM
TLSH:	72063332F7C89272E87702785352FB2111E1ADDD9D302A521DB1FA81D2B77312E2BD66
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........h.}.;.}.;.}.;..";.}.;..#;.}.;...;.}.;...;.}.;Rich.}.;........................PE..L......b.........."......*...Z:..d.........

File Icon


Icon Hash:	499669d8d82916a8

Static PE Info

General

Entrypoint:	0x401ce9
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x62CDC685 [Tue Jul 12 19:07:49 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The certificate is not valid for the requested usage
Error Number:	-2146762480
Not Before, Not After	12/12/2021 4:00:00 PM 1/8/2025 3:59:59 PM
Subject Chain	CN=philandro Software GmbH, O=philandro Software GmbH, L=Stuttgart, S=Baden-W\xfcrttemberg, C=DE
Version:	3
Thumbprint MD5:	EAE713DFC05244CF4301BF1C9F68B1BE
Thumbprint SHA-1:	9CD1DDB78ED05282353B20CDFE8FA0A4FB6C1ECE
Thumbprint SHA-256:	9D7620A4CEBA92370E8828B3CB1007AEFF63AB36A2CBE5F044FDDE14ABAB1EBF
Serial:	0DBF152DEAF0B981A8A938D53F769DB8

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 64h
push esi
lea ecx, dword ptr [ebp-64h]
call 00007EFE789A4403h
lea eax, dword ptr [ebp-64h]
mov ecx, eax
mov dword ptr [0138C260h], eax
call 00007EFE789A42C1h
test al, al
jne 00007EFE789A4A24h
mov esi, 000003E8h
lea ecx, dword ptr [ebp-64h]
call 00007EFE789A42AFh
mov eax, esi
pop esi
leave
ret
lea eax, dword ptr [ebp-64h]
push eax
lea ecx, dword ptr [ebp-30h]
call 00007EFE789A40E3h
lea eax, dword ptr [ebp-30h]
mov ecx, eax
mov dword ptr [0138C264h], eax
call 00007EFE789A407Bh
test al, al
jne 00007EFE789A4A21h
lea ecx, dword ptr [ebp-30h]
call 00007EFE789A4060h
mov esi, 000003E9h
jmp 00007EFE789A49D7h
cmp dword ptr [ebp-10h], 00000000h
je 00007EFE789A4A1Ah
push 00000800h
call dword ptr [ebp-10h]
cmp dword ptr [ebp-0Ch], 00000000h
je 00007EFE789A4A1Ah
push 00008001h
call dword ptr [ebp-0Ch]
lea eax, dword ptr [ebp-64h]
push eax
lea esi, dword ptr [ebp-30h]
call 00007EFE789A4965h
pop ecx
mov esi, eax
push esi
call dword ptr [ebp-20h]
lea ecx, dword ptr [ebp-30h]
call 00007EFE789A4022h
jmp 00007EFE789A499Eh
mov edx, dword ptr [esp+04h]
push ebx
mov ebx, dword ptr [esp+10h]
push esi
xor esi, esi
test ebx, ebx
je 00007EFE789A4A41h
push edi
mov edi, dword ptr [esp+14h]
sub edi, 0138C268h
imul edx, edx, 0019660Dh
add edx, 3C6EF35Fh
mov eax, edx
shr eax, 0Ch

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ C ] VS2010 build 30319
[RES] VS2010 SP1 build 40219
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf8d000	0x4850	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x3a8400	0x4670	.itext
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf92000	0x84	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xbeb000	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2835	0x2a00	False	0.5950520833333334	data	6.507732863684148	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x4000	0xbe6400	0x0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xbeb000	0x2fa	0x400	False	0.7255859375	data	5.64420370541003	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbec000	0x3a066c	0x3a0400	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf8d000	0x4850	0x4a00	False	0.5122994087837838	data	6.015480647653813	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf92000	0x300	0x400	False	0.1455078125	data	1.181265380704217	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0xf8d280	0x1b8e	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0xf8ee10	0x668	dBase III DBT, version number 0, next free block index 40	English	United States
RT_ICON	0xf8f478	0x2e8	data	English	United States
RT_ICON	0xf8f760	0x1e8	data	English	United States
RT_ICON	0xf8f948	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xf8fac0	0x10a8	data	English	United States
RT_ICON	0xf90b68	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_GROUP_ICON	0xf8fa70	0x4c	data	English	United States
RT_GROUP_ICON	0xf90fd0	0x22	data	English	United States
RT_VERSION	0xf90ff8	0x250	data	English	United States
RT_MANIFEST	0xf91248	0x606	XML 1.0 document, ASCII text	English	United States

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 10, 2022 11:03:18.663152933 CEST	49748	443	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:18.663203001 CEST	443	49748	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:18.663361073 CEST	49748	443	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:18.664983034 CEST	49748	443	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:18.664994001 CEST	443	49748	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:18.733283043 CEST	443	49748	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:18.733417988 CEST	49748	443	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:18.739469051 CEST	49748	443	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:18.739490986 CEST	443	49748	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:18.739732027 CEST	443	49748	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:18.739820957 CEST	49748	443	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:19.010195017 CEST	49748	443	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:19.071468115 CEST	49749	80	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:19.102004051 CEST	80	49749	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:19.102226019 CEST	49749	80	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:19.103179932 CEST	49749	80	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:19.131860018 CEST	80	49749	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:19.134135962 CEST	80	49749	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:19.134179115 CEST	80	49749	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:19.136061907 CEST	49749	80	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:19.147520065 CEST	49749	80	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:19.176630974 CEST	80	49749	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:19.176675081 CEST	80	49749	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:19.176789045 CEST	49749	80	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:19.441553116 CEST	49749	80	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:19.469671011 CEST	49750	6568	192.168.2.3	92.223.88.41
Aug 10, 2022 11:03:19.470415115 CEST	80	49749	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:19.498716116 CEST	6568	49750	92.223.88.41	192.168.2.3
Aug 10, 2022 11:03:19.498868942 CEST	49750	6568	192.168.2.3	92.223.88.41
Aug 10, 2022 11:03:19.505413055 CEST	49750	6568	192.168.2.3	92.223.88.41
Aug 10, 2022 11:03:19.534142971 CEST	6568	49750	92.223.88.41	192.168.2.3
Aug 10, 2022 11:03:19.536046028 CEST	6568	49750	92.223.88.41	192.168.2.3
Aug 10, 2022 11:03:19.536088943 CEST	6568	49750	92.223.88.41	192.168.2.3
Aug 10, 2022 11:03:19.536164999 CEST	49750	6568	192.168.2.3	92.223.88.41
Aug 10, 2022 11:03:19.551502943 CEST	49750	6568	192.168.2.3	92.223.88.41
Aug 10, 2022 11:03:19.580459118 CEST	6568	49750	92.223.88.41	192.168.2.3
Aug 10, 2022 11:03:19.580495119 CEST	6568	49750	92.223.88.41	192.168.2.3
Aug 10, 2022 11:03:19.580651999 CEST	49750	6568	192.168.2.3	92.223.88.41
Aug 10, 2022 11:03:19.756747961 CEST	49750	6568	192.168.2.3	92.223.88.41
Aug 10, 2022 11:03:19.786391020 CEST	6568	49750	92.223.88.41	192.168.2.3
Aug 10, 2022 11:03:24.768785954 CEST	49751	443	192.168.2.3	88.198.34.103
Aug 10, 2022 11:03:24.768851995 CEST	443	49751	88.198.34.103	192.168.2.3
Aug 10, 2022 11:03:24.769110918 CEST	49751	443	192.168.2.3	88.198.34.103
Aug 10, 2022 11:03:24.770359993 CEST	49751	443	192.168.2.3	88.198.34.103
Aug 10, 2022 11:03:24.770420074 CEST	443	49751	88.198.34.103	192.168.2.3
Aug 10, 2022 11:03:24.822004080 CEST	443	49751	88.198.34.103	192.168.2.3
Aug 10, 2022 11:03:24.822105885 CEST	49751	443	192.168.2.3	88.198.34.103
Aug 10, 2022 11:03:24.822948933 CEST	49751	443	192.168.2.3	88.198.34.103
Aug 10, 2022 11:03:24.822968006 CEST	443	49751	88.198.34.103	192.168.2.3
Aug 10, 2022 11:03:24.823340893 CEST	443	49751	88.198.34.103	192.168.2.3
Aug 10, 2022 11:03:24.823573112 CEST	49751	443	192.168.2.3	88.198.34.103
Aug 10, 2022 11:03:24.926590919 CEST	49751	443	192.168.2.3	88.198.34.103
Aug 10, 2022 11:03:24.968343019 CEST	49752	80	192.168.2.3	195.181.174.167
Aug 10, 2022 11:03:24.986150980 CEST	80	49752	195.181.174.167	192.168.2.3
Aug 10, 2022 11:03:24.986402988 CEST	49752	80	192.168.2.3	195.181.174.167
Aug 10, 2022 11:03:24.996462107 CEST	49752	80	192.168.2.3	195.181.174.167
Aug 10, 2022 11:03:25.014334917 CEST	80	49752	195.181.174.167	192.168.2.3
Aug 10, 2022 11:03:25.016727924 CEST	80	49752	195.181.174.167	192.168.2.3
Aug 10, 2022 11:03:25.016745090 CEST	80	49752	195.181.174.167	192.168.2.3
Aug 10, 2022 11:03:25.016876936 CEST	49752	80	192.168.2.3	195.181.174.167
Aug 10, 2022 11:03:25.033684015 CEST	49752	80	192.168.2.3	195.181.174.167
Aug 10, 2022 11:03:25.051698923 CEST	80	49752	195.181.174.167	192.168.2.3
Aug 10, 2022 11:03:25.051723957 CEST	80	49752	195.181.174.167	192.168.2.3
Aug 10, 2022 11:03:25.051871061 CEST	49752	80	192.168.2.3	195.181.174.167
Aug 10, 2022 11:03:25.200220108 CEST	49752	80	192.168.2.3	195.181.174.167
Aug 10, 2022 11:03:25.218249083 CEST	80	49752	195.181.174.167	192.168.2.3
Aug 10, 2022 11:03:25.228688002 CEST	49753	6568	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:25.259516954 CEST	6568	49753	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:25.259649038 CEST	49753	6568	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:25.283776045 CEST	49753	6568	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:25.314125061 CEST	6568	49753	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:25.315670967 CEST	6568	49753	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:25.315695047 CEST	6568	49753	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:25.315787077 CEST	49753	6568	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:25.326988935 CEST	49753	6568	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:25.356419086 CEST	6568	49753	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:25.356460094 CEST	6568	49753	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:25.356530905 CEST	49753	6568	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:25.578869104 CEST	49753	6568	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:25.607850075 CEST	6568	49753	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:42.070823908 CEST	49770	443	192.168.2.3	195.181.174.167
Aug 10, 2022 11:03:42.070874929 CEST	443	49770	195.181.174.167	192.168.2.3
Aug 10, 2022 11:03:42.070998907 CEST	49770	443	192.168.2.3	195.181.174.167
Aug 10, 2022 11:03:42.071688890 CEST	49770	443	192.168.2.3	195.181.174.167
Aug 10, 2022 11:03:42.071717024 CEST	443	49770	195.181.174.167	192.168.2.3
Aug 10, 2022 11:03:42.115318060 CEST	443	49770	195.181.174.167	192.168.2.3
Aug 10, 2022 11:03:42.115468979 CEST	49770	443	192.168.2.3	195.181.174.167
Aug 10, 2022 11:03:42.116590977 CEST	49770	443	192.168.2.3	195.181.174.167
Aug 10, 2022 11:03:42.116610050 CEST	443	49770	195.181.174.167	192.168.2.3
Aug 10, 2022 11:03:42.116902113 CEST	443	49770	195.181.174.167	192.168.2.3
Aug 10, 2022 11:03:42.116976976 CEST	49770	443	192.168.2.3	195.181.174.167
Aug 10, 2022 11:03:42.333893061 CEST	49770	443	192.168.2.3	195.181.174.167
Aug 10, 2022 11:03:42.359267950 CEST	49772	80	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:42.387742043 CEST	80	49772	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:42.387844086 CEST	49772	80	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:42.388772011 CEST	49772	80	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:42.417179108 CEST	80	49772	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:42.419596910 CEST	80	49772	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:42.419622898 CEST	80	49772	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:42.419758081 CEST	49772	80	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:42.430921078 CEST	49772	80	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:42.459448099 CEST	80	49772	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:42.459510088 CEST	80	49772	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:42.459654093 CEST	49772	80	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:42.615886927 CEST	49772	80	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:42.644423008 CEST	49773	6568	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:42.645272970 CEST	80	49772	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:42.673326969 CEST	6568	49773	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:42.673826933 CEST	49773	6568	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:42.680664062 CEST	49773	6568	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:42.709342957 CEST	6568	49773	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:42.711246014 CEST	6568	49773	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:42.711302996 CEST	6568	49773	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:42.712744951 CEST	49773	6568	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:42.724056005 CEST	49773	6568	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:42.752966881 CEST	6568	49773	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:42.752988100 CEST	6568	49773	92.223.88.7	192.168.2.3
Aug 10, 2022 11:03:42.753515959 CEST	49773	6568	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:42.908039093 CEST	49773	6568	192.168.2.3	92.223.88.7
Aug 10, 2022 11:03:42.936788082 CEST	6568	49773	92.223.88.7	192.168.2.3
Aug 10, 2022 11:04:35.339584112 CEST	49823	443	192.168.2.3	49.12.130.237
Aug 10, 2022 11:04:35.339623928 CEST	443	49823	49.12.130.237	192.168.2.3
Aug 10, 2022 11:04:35.339699984 CEST	49823	443	192.168.2.3	49.12.130.237
Aug 10, 2022 11:04:35.340399027 CEST	49823	443	192.168.2.3	49.12.130.237
Aug 10, 2022 11:04:35.340415001 CEST	443	49823	49.12.130.237	192.168.2.3
Aug 10, 2022 11:04:35.393769979 CEST	443	49823	49.12.130.237	192.168.2.3
Aug 10, 2022 11:04:35.393892050 CEST	49823	443	192.168.2.3	49.12.130.237
Aug 10, 2022 11:04:35.394984007 CEST	49823	443	192.168.2.3	49.12.130.237
Aug 10, 2022 11:04:35.394998074 CEST	443	49823	49.12.130.237	192.168.2.3
Aug 10, 2022 11:04:35.395317078 CEST	443	49823	49.12.130.237	192.168.2.3
Aug 10, 2022 11:04:35.395879984 CEST	49823	443	192.168.2.3	49.12.130.237
Aug 10, 2022 11:04:35.548629999 CEST	49823	443	192.168.2.3	49.12.130.237
Aug 10, 2022 11:04:35.574713945 CEST	49824	80	192.168.2.3	185.229.191.39
Aug 10, 2022 11:04:35.599663973 CEST	80	49824	185.229.191.39	192.168.2.3
Aug 10, 2022 11:04:35.602632999 CEST	49824	80	192.168.2.3	185.229.191.39
Aug 10, 2022 11:04:35.603570938 CEST	49824	80	192.168.2.3	185.229.191.39
Aug 10, 2022 11:04:35.628483057 CEST	80	49824	185.229.191.39	192.168.2.3
Aug 10, 2022 11:04:35.630844116 CEST	80	49824	185.229.191.39	192.168.2.3
Aug 10, 2022 11:04:35.630954981 CEST	80	49824	185.229.191.39	192.168.2.3
Aug 10, 2022 11:04:35.631042004 CEST	49824	80	192.168.2.3	185.229.191.39
Aug 10, 2022 11:04:35.643179893 CEST	49824	80	192.168.2.3	185.229.191.39
Aug 10, 2022 11:04:35.668104887 CEST	80	49824	185.229.191.39	192.168.2.3
Aug 10, 2022 11:04:35.668128967 CEST	80	49824	185.229.191.39	192.168.2.3
Aug 10, 2022 11:04:35.668144941 CEST	80	49824	185.229.191.39	192.168.2.3
Aug 10, 2022 11:04:35.668221951 CEST	49824	80	192.168.2.3	185.229.191.39
Aug 10, 2022 11:04:35.834166050 CEST	49824	80	192.168.2.3	185.229.191.39
Aug 10, 2022 11:04:35.859061956 CEST	80	49824	185.229.191.39	192.168.2.3
Aug 10, 2022 11:04:35.861644030 CEST	49825	6568	192.168.2.3	195.181.174.174
Aug 10, 2022 11:04:35.879740953 CEST	6568	49825	195.181.174.174	192.168.2.3
Aug 10, 2022 11:04:35.879865885 CEST	49825	6568	192.168.2.3	195.181.174.174
Aug 10, 2022 11:04:35.881006956 CEST	49825	6568	192.168.2.3	195.181.174.174
Aug 10, 2022 11:04:35.900290966 CEST	6568	49825	195.181.174.174	192.168.2.3
Aug 10, 2022 11:04:35.902108908 CEST	6568	49825	195.181.174.174	192.168.2.3
Aug 10, 2022 11:04:35.902151108 CEST	6568	49825	195.181.174.174	192.168.2.3
Aug 10, 2022 11:04:35.902244091 CEST	49825	6568	192.168.2.3	195.181.174.174
Aug 10, 2022 11:04:35.918519974 CEST	49825	6568	192.168.2.3	195.181.174.174
Aug 10, 2022 11:04:35.936517000 CEST	6568	49825	195.181.174.174	192.168.2.3
Aug 10, 2022 11:04:35.936551094 CEST	6568	49825	195.181.174.174	192.168.2.3
Aug 10, 2022 11:04:35.936649084 CEST	49825	6568	192.168.2.3	195.181.174.174
Aug 10, 2022 11:04:36.126636982 CEST	49825	6568	192.168.2.3	195.181.174.174
Aug 10, 2022 11:04:36.144623041 CEST	6568	49825	195.181.174.174	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 10, 2022 11:03:18.599575043 CEST	57421	53	192.168.2.3	8.8.8.8
Aug 10, 2022 11:03:18.618748903 CEST	53	57421	8.8.8.8	192.168.2.3
Aug 10, 2022 11:03:19.017834902 CEST	65358	53	192.168.2.3	8.8.8.8
Aug 10, 2022 11:03:19.038065910 CEST	53	65358	8.8.8.8	192.168.2.3
Aug 10, 2022 11:03:19.447402954 CEST	49873	53	192.168.2.3	8.8.8.8
Aug 10, 2022 11:03:19.466522932 CEST	53	49873	8.8.8.8	192.168.2.3
Aug 10, 2022 11:03:24.605710983 CEST	53802	53	192.168.2.3	8.8.8.8
Aug 10, 2022 11:03:24.622828960 CEST	53	53802	8.8.8.8	192.168.2.3
Aug 10, 2022 11:03:24.946160078 CEST	65266	53	192.168.2.3	8.8.8.8
Aug 10, 2022 11:03:24.965172052 CEST	53	65266	8.8.8.8	192.168.2.3
Aug 10, 2022 11:03:25.206053019 CEST	63332	53	192.168.2.3	8.8.8.8
Aug 10, 2022 11:03:25.225737095 CEST	53	63332	8.8.8.8	192.168.2.3
Aug 10, 2022 11:03:41.884808064 CEST	63146	53	192.168.2.3	8.8.8.8
Aug 10, 2022 11:03:41.903934002 CEST	53	63146	8.8.8.8	192.168.2.3
Aug 10, 2022 11:03:42.339848995 CEST	58625	53	192.168.2.3	8.8.8.8
Aug 10, 2022 11:03:42.356637955 CEST	53	58625	8.8.8.8	192.168.2.3
Aug 10, 2022 11:03:42.622601986 CEST	52810	53	192.168.2.3	8.8.8.8
Aug 10, 2022 11:03:42.642338037 CEST	53	52810	8.8.8.8	192.168.2.3
Aug 10, 2022 11:04:35.316668987 CEST	64941	53	192.168.2.3	8.8.8.8
Aug 10, 2022 11:04:35.336699963 CEST	53	64941	8.8.8.8	192.168.2.3
Aug 10, 2022 11:04:35.555313110 CEST	55403	53	192.168.2.3	8.8.8.8
Aug 10, 2022 11:04:35.572448015 CEST	53	55403	8.8.8.8	192.168.2.3
Aug 10, 2022 11:04:35.840281010 CEST	54960	53	192.168.2.3	8.8.8.8
Aug 10, 2022 11:04:35.859107018 CEST	53	54960	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 10, 2022 11:03:18.599575043 CEST	192.168.2.3	8.8.8.8	0x8dfd	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)
Aug 10, 2022 11:03:19.017834902 CEST	192.168.2.3	8.8.8.8	0xfca6	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)
Aug 10, 2022 11:03:19.447402954 CEST	192.168.2.3	8.8.8.8	0xac4	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)
Aug 10, 2022 11:03:24.605710983 CEST	192.168.2.3	8.8.8.8	0x1ce6	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)
Aug 10, 2022 11:03:24.946160078 CEST	192.168.2.3	8.8.8.8	0x304e	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)
Aug 10, 2022 11:03:25.206053019 CEST	192.168.2.3	8.8.8.8	0x715c	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)
Aug 10, 2022 11:03:41.884808064 CEST	192.168.2.3	8.8.8.8	0xf0c0	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)
Aug 10, 2022 11:03:42.339848995 CEST	192.168.2.3	8.8.8.8	0x19ad	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)
Aug 10, 2022 11:03:42.622601986 CEST	192.168.2.3	8.8.8.8	0x90bf	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)
Aug 10, 2022 11:04:35.316668987 CEST	192.168.2.3	8.8.8.8	0x80d2	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)
Aug 10, 2022 11:04:35.555313110 CEST	192.168.2.3	8.8.8.8	0xd8ff	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)
Aug 10, 2022 11:04:35.840281010 CEST	192.168.2.3	8.8.8.8	0x492a	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Aug 10, 2022 11:03:18.618748903 CEST	8.8.8.8	192.168.2.3	0x8dfd	No error (0)	boot.net.anydesk.com	92.223.88.7	A (IP address)	IN (0x0001)
Aug 10, 2022 11:03:19.038065910 CEST	8.8.8.8	192.168.2.3	0xfca6	No error (0)	boot.net.anydesk.com	92.223.88.7	A (IP address)	IN (0x0001)
Aug 10, 2022 11:03:19.466522932 CEST	8.8.8.8	192.168.2.3	0xac4	No error (0)	boot.net.anydesk.com	92.223.88.41	A (IP address)	IN (0x0001)
Aug 10, 2022 11:03:24.622828960 CEST	8.8.8.8	192.168.2.3	0x1ce6	No error (0)	boot.net.anydesk.com	88.198.34.103	A (IP address)	IN (0x0001)
Aug 10, 2022 11:03:24.965172052 CEST	8.8.8.8	192.168.2.3	0x304e	No error (0)	boot.net.anydesk.com	195.181.174.167	A (IP address)	IN (0x0001)
Aug 10, 2022 11:03:25.225737095 CEST	8.8.8.8	192.168.2.3	0x715c	No error (0)	boot.net.anydesk.com	92.223.88.7	A (IP address)	IN (0x0001)
Aug 10, 2022 11:03:41.903934002 CEST	8.8.8.8	192.168.2.3	0xf0c0	No error (0)	boot.net.anydesk.com	195.181.174.167	A (IP address)	IN (0x0001)
Aug 10, 2022 11:03:42.356637955 CEST	8.8.8.8	192.168.2.3	0x19ad	No error (0)	boot.net.anydesk.com	92.223.88.7	A (IP address)	IN (0x0001)
Aug 10, 2022 11:03:42.642338037 CEST	8.8.8.8	192.168.2.3	0x90bf	No error (0)	boot.net.anydesk.com	92.223.88.7	A (IP address)	IN (0x0001)
Aug 10, 2022 11:04:35.336699963 CEST	8.8.8.8	192.168.2.3	0x80d2	No error (0)	boot.net.anydesk.com	49.12.130.237	A (IP address)	IN (0x0001)
Aug 10, 2022 11:04:35.572448015 CEST	8.8.8.8	192.168.2.3	0xd8ff	No error (0)	boot.net.anydesk.com	185.229.191.39	A (IP address)	IN (0x0001)
Aug 10, 2022 11:04:35.859107018 CEST	8.8.8.8	192.168.2.3	0x492a	No error (0)	boot.net.anydesk.com	195.181.174.174	A (IP address)	IN (0x0001)

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49749	92.223.88.7	80	C:\Users\user\Desktop\AnyDesk.exe

Timestamp	kBytes transferred	Direction	Data
Aug 10, 2022 11:03:19.103179932 CEST	1027	OUT	Data Raw: 16 03 01 01 0d 01 00 01 09 03 03 d2 00 fd 0d 01 f8 83 2c 36 70 7d 37 f2 d3 fa 37 de 19 49 28 38 a6 c8 96 2d 1d f0 76 4e f4 87 0f 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: ,6p}77I(8-vNn0,($kjih98762.*&=5/+'#g@?>32101-)%</r#
Aug 10, 2022 11:03:19.134135962 CEST	1029	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 62 f3 74 57 c5 bb a0 c9 09 a9 d1 e4 81 18 aa 33 85 e1 f3 8e 5c 9a 2f db 44 4f 57 4e 47 52 44 01 20 6f d8 18 ab c9 33 c6 34 ed a4 19 eb af 49 e5 37 55 14 75 60 83 2a 6a 1d 87 93 09 fd 76 c8 c5 83 c0 2c 00 00 0b ff Data Ascii: WSbtW3\/DOWNGRD o34I7Uu`jv,C0?0'0vtS$0H0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0181118021423Z281115021
Aug 10, 2022 11:03:19.134179115 CEST	1030	IN	Data Raw: e0 cd 68 3b 6a 87 6c a6 0d e7 d8 bd 61 df 56 6b 2a e1 1c 2b f5 9f bf 85 dd 8c 5b 06 1e 71 7f ba 4a a6 40 b0 77 17 ea 2c 3f 5b 94 14 85 2e ad 11 61 ab 88 f6 01 bb b3 47 6b e2 81 18 f1 8e 39 e6 d8 7b 0c 63 86 83 ac 70 84 75 27 2d 35 3d 7b 7b a8 ce Data Ascii: h;jlaVk*+[qJ@w,?[.aGk9{cpu'-5={{Hy8-&~K2vf/bj@kXScuxI#ph3/L^}a}4AkP+g_R4gs@lo67Jv"rR}uMU#[~.K_eCL/3
Aug 10, 2022 11:03:19.147520065 CEST	1031	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 32 30 38 31 30 31 38 30 33 Data Ascii: 000H010UAnyDesk Client0 220810180314Z20720728180314Z010UAnyDesk Client0"0H0Ari=ov3w<@QCvXAo\_R*{Ryk^2 4}X/#q
Aug 10, 2022 11:03:19.176630974 CEST	1031	IN	Data Raw: 15 03 03 00 02 02 2d Data Ascii: -

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49752	195.181.174.167	80	C:\Users\user\Desktop\AnyDesk.exe

Timestamp	kBytes transferred	Direction	Data
Aug 10, 2022 11:03:24.996462107 CEST	1041	OUT	Data Raw: 16 03 01 01 0d 01 00 01 09 03 03 b5 e9 9b 5c 0a 2b 19 75 e5 1d ee c1 3d 54 71 3f 2c 97 40 04 9e 28 df ff 02 44 f4 f5 a1 32 f9 bc 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: \+u=Tq?,@(D2n0,($kjih98762.*&=5/+'#g@?>32101-)%</r#
Aug 10, 2022 11:03:25.016727924 CEST	1043	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 62 f3 74 5c 91 20 b0 73 0a 87 51 de 2b 79 d7 43 8e 45 d9 a2 72 da e5 3a 44 4f 57 4e 47 52 44 01 20 8c 62 82 90 bd 4a db 0d 5a 41 d8 e8 3b 1b d8 7a f9 8a 3c 23 6b 9c 90 f6 4f f3 3f 28 01 40 94 7a c0 2c 00 00 0b ff Data Ascii: WSbt\ sQ+yCEr:DOWNGRD bJZA;z<#kO?(@z,C0?0'0vtS$0*H0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0181118021423Z281115021
Aug 10, 2022 11:03:25.016745090 CEST	1044	IN	Data Raw: e0 cd 68 3b 6a 87 6c a6 0d e7 d8 bd 61 df 56 6b 2a e1 1c 2b f5 9f bf 85 dd 8c 5b 06 1e 71 7f ba 4a a6 40 b0 77 17 ea 2c 3f 5b 94 14 85 2e ad 11 61 ab 88 f6 01 bb b3 47 6b e2 81 18 f1 8e 39 e6 d8 7b 0c 63 86 83 ac 70 84 75 27 2d 35 3d 7b 7b a8 ce Data Ascii: h;jlaVk*+[qJ@w,?[.aGk9{cpu'-5={{Hy8-&~K2vf/bj@kXScuxI#ph3/L^}a}4AkP+g_R4gs@lo67Jv"rR}uMU#[~.K_eCL/3
Aug 10, 2022 11:03:25.033684015 CEST	1045	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 32 30 38 31 30 31 38 30 33 Data Ascii: 000H010UAnyDesk Client0 220810180314Z20720728180314Z010UAnyDesk Client0"0H0Ari=ov3w<@QCvXAo\_R*{Ryk^2 4}X/#q
Aug 10, 2022 11:03:25.051698923 CEST	1045	IN	Data Raw: 15 03 03 00 02 02 2d Data Ascii: -

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49772	92.223.88.7	80	C:\Users\user\Desktop\AnyDesk.exe

Timestamp	kBytes transferred	Direction	Data
Aug 10, 2022 11:03:42.388772011 CEST	1260	OUT	Data Raw: 16 03 01 01 0d 01 00 01 09 03 03 65 ff 19 b0 59 23 05 b9 f2 1c d9 da 43 91 ca d4 d2 a0 bc 2e 83 73 15 30 db db 1d e9 54 55 d6 6a 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: eY#C.s0TUjn0,($kjih98762.*&=5/+'#g@?>32101-)%</r#
Aug 10, 2022 11:03:42.419596910 CEST	1262	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 62 f3 74 6e d3 29 3f 9b 46 c5 e1 5f f2 ef 9d ed 1a db 8d e2 09 f5 01 6f 44 4f 57 4e 47 52 44 01 20 f7 aa e1 61 97 fb 0e 6b 2f b1 a8 99 4a 3f b0 65 1a 88 26 a3 b8 4e a1 df a9 09 f1 63 64 ae 9b 96 c0 2c 00 00 0b ff Data Ascii: WSbtn)?F_oDOWNGRD ak/J?e&Ncd,C0?0'0vtS$0*H0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0181118021423Z281115021
Aug 10, 2022 11:03:42.419622898 CEST	1263	IN	Data Raw: e0 cd 68 3b 6a 87 6c a6 0d e7 d8 bd 61 df 56 6b 2a e1 1c 2b f5 9f bf 85 dd 8c 5b 06 1e 71 7f ba 4a a6 40 b0 77 17 ea 2c 3f 5b 94 14 85 2e ad 11 61 ab 88 f6 01 bb b3 47 6b e2 81 18 f1 8e 39 e6 d8 7b 0c 63 86 83 ac 70 84 75 27 2d 35 3d 7b 7b a8 ce Data Ascii: h;jlaVk*+[qJ@w,?[.aGk9{cpu'-5={{Hy8-&~K2vf/bj@kXScuxI#ph3/L^}a}4AkP+g_R4gs@lo67Jv"rR}uMU#[~.K_eCL/3
Aug 10, 2022 11:03:42.430921078 CEST	1264	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 32 30 38 31 30 31 38 30 33 Data Ascii: 000H010UAnyDesk Client0 220810180314Z20720728180314Z010UAnyDesk Client0"0H0Ari=ov3w<@QCvXAo\_R*{Ryk^2 4}X/#q
Aug 10, 2022 11:03:42.459448099 CEST	1265	IN	Data Raw: 15 03 03 00 02 02 2d Data Ascii: -

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49824	185.229.191.39	80	C:\Users\user\Desktop\AnyDesk.exe

Timestamp	kBytes transferred	Direction	Data
Aug 10, 2022 11:04:35.603570938 CEST	7810	OUT	Data Raw: 16 03 01 01 0d 01 00 01 09 03 03 95 d2 b0 17 8b 63 93 3f 55 ca e2 ae c1 c1 0a a9 15 3f d1 f2 2d c8 98 45 65 6d c4 fc 4e e3 1a 4e 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: c?U?-EemNNn0,($kjih98762.*&=5/+'#g@?>32101-)%</r#
Aug 10, 2022 11:04:35.630844116 CEST	7811	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 62 f3 74 a3 16 a9 b2 8c fd 87 e1 5d cd 97 a3 25 27 f6 02 fc c5 aa 42 b0 44 4f 57 4e 47 52 44 01 20 3e f6 07 b7 b3 86 9f 33 54 15 b3 ab 81 a4 28 32 14 d9 6f 57 51 75 55 b2 3c 75 f3 93 58 a5 1d 9f c0 2c 00 00 0b ff Data Ascii: WSbt]%'BDOWNGRD >3T(2oWQuU<uX,C0?0'0vtS$0*H0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0181118021423Z281115021
Aug 10, 2022 11:04:35.630954981 CEST	7812	IN	Data Raw: e0 cd 68 3b 6a 87 6c a6 0d e7 d8 bd 61 df 56 6b 2a e1 1c 2b f5 9f bf 85 dd 8c 5b 06 1e 71 7f ba 4a a6 40 b0 77 17 ea 2c 3f 5b 94 14 85 2e ad 11 61 ab 88 f6 01 bb b3 47 6b e2 81 18 f1 8e 39 e6 d8 7b 0c 63 86 83 ac 70 84 75 27 2d 35 3d 7b 7b a8 ce Data Ascii: h;jlaVk*+[qJ@w,?[.aGk9{cpu'-5={{Hy8-&~K2vf/bj@kXScuxI#ph3/L^}a}4AkP+g_R4gs@lo67Jv"rR}uMU#[~.K_eCL/3
Aug 10, 2022 11:04:35.643179893 CEST	7813	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 32 30 38 31 30 31 38 30 33 Data Ascii: 000H010UAnyDesk Client0 220810180314Z20720728180314Z010UAnyDesk Client0"0H0Ari=ov3w<@QCvXAo\_R*{Ryk^2 4}X/#q
Aug 10, 2022 11:04:35.668128967 CEST	7814	IN	Data Raw: 15 03 03 00 02 02 2d Data Ascii: -

Target ID:	0
Start time:	11:02:59
Start date:	10/08/2022
Path:	C:\Users\user\Desktop\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AnyDesk.exe"
Imagebase:	0x1280000
File size:	3852912 bytes
MD5 hash:	36D6BE2D72171C741E2989A578011CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	4
Start time:	11:03:05
Start date:	10/08/2022
Path:	C:\Users\user\Desktop\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AnyDesk.exe" --local-service
Imagebase:	0x1280000
File size:	3852912 bytes
MD5 hash:	36D6BE2D72171C741E2989A578011CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	5
Start time:	11:03:06
Start date:	10/08/2022
Path:	C:\Users\user\Desktop\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AnyDesk.exe" --local-control
Imagebase:	0x1280000
File size:	3852912 bytes
MD5 hash:	36D6BE2D72171C741E2989A578011CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Function 044E5409 Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.250547795.00000000044D8000.00000004.00000800.00020000.00000000.sdmp, Offset: 044E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_44d1000_AnyDesk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 804f40a2e2d7a3b9b4c562b9b5f155bd9c75b72475711cfbab62f10d9d28f509
Instruction ID: a69314b7b00ec2bea426f1c7654aad81d788bba606effd44f54399b0e566fed0
Opcode Fuzzy Hash: 804f40a2e2d7a3b9b4c562b9b5f155bd9c75b72475711cfbab62f10d9d28f509
Instruction Fuzzy Hash: 47F1524280E3C05FDB238B300D795A27F716D1721970E4ACBC8DACF5A3E26D9949D762

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AnyDesk.exePID: 2612, Parent PID: 5716COMMON

Executed Functions

Function 016E5400 Relevance: 61.5, APIs: 20, Strings: 15, Instructions: 280filesynchronizationtimeCOMMON

Download Yara Rule

APIs

_vswprintf_s.LIBCMT ref: 016E546B
WaitForSingleObject.KERNEL32(00000000,00000BB8), ref: 016E548D
OutputDebugStringA.KERNEL32(AnyDesk: Mutex broken!), ref: 016E54B9
GetSystemTime.KERNEL32(?), ref: 016E54D3
TlsGetValue.KERNEL32(00000023), ref: 016E54DD
__itow.LIBCMT ref: 016E550F
GetCurrentThreadId.KERNEL32 ref: 016E558D
GetCurrentProcessId.KERNEL32(00000000), ref: 016E5594
__snprintf.LIBCMT ref: 016E55D7
SetFilePointer.KERNEL32(000002DC,00000000,00000000,00000002), ref: 016E55F5
SetFilePointer.KERNEL32(000002DC,00000000,00000000,00000000), ref: 016E562E
ReadFile.KERNEL32(000002DC,00000000,00000000,00000000,00000000), ref: 016E5640
_memmove.LIBCMT ref: 016E5674
SetFilePointer.KERNEL32(000002DC,00000000,00000000,00000000), ref: 016E5686
WriteFile.KERNEL32(000002DC,00000000,00000000,00000000,00000000), ref: 016E569F
SetFilePointer.KERNEL32(000002DC,00000000,00000000,00000000), ref: 016E56AE
SetEndOfFile.KERNEL32(000002DC), ref: 016E56B8
WriteFile.KERNEL32(000002DC,?,?,?,00000000), ref: 016E56EB
RtlEnterCriticalSection.NTDLL(01DF0EE4), ref: 016E5747
RaiseException.KERNEL32(00002329,00000000,00000000,00000000), ref: 016E5758

Strings

debug, xrefs: 016E5541
info, xrefs: 016E5548
verbose, xrefs: 016E5572
AnyDesk: Wait failed., xrefs: 016E54A6
%7s %4i-%02i-%02i %02i:%02i:%02i.%03i %10s %6lu %6lu %4s %32s - %s, xrefs: 016E551C
AnyDesk: Mutex broken!, xrefs: 016E54B4
lsvc, xrefs: 016E559B
auth, xrefs: 016E5564
AnyDesk: Timeout in trace., xrefs: 016E54AD
internal, xrefs: 016E553A, 016E55C3
crash, xrefs: 016E555D
error, xrefs: 016E5556
explode, xrefs: 016E556B
invalid, xrefs: 016E5579
warning, xrefs: 016E554F

Memory Dump Source

Source File: 00000004.00000002.515654949.0000000001286000.00000020.00000001.01000000.00000003.sdmp, Offset: 01280000, based on PE: true

Associated: 00000004.00000002.515589431.0000000001280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515606344.0000000001281000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515640972.0000000001285000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.521998832.000000000188D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527477421.0000000001DF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527504697.0000000001DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527523746.0000000001DF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527546202.0000000001DFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527813845.0000000001E6B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527850088.0000000001E6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.530798284.000000000220D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1280000_AnyDesk.jbxd

Similarity

API ID: File$Pointer$CurrentWrite$CriticalDebugEnterExceptionObjectOutputProcessRaiseReadSectionSingleStringSystemThreadTimeValueWait__itow__snprintf_memmove_vswprintf_s
String ID: %7s %4i-%02i-%02i %02i:%02i:%02i.%03i %10s %6lu %6lu %4s %32s - %s$AnyDesk: Mutex broken!$AnyDesk: Timeout in trace.$AnyDesk: Wait failed.$auth$crash$debug$error$explode$info$internal$invalid$lsvc$verbose$warning
API String ID: 3525123632-2535131103
Opcode ID: 709b7ac80f73e14e9c91febda0e22a9f9bf2e517283ea41b376552d015bbaa8c
Instruction ID: 091fb0ff5e86c9f7838150fe01757aaf2f035e9de71297312d4fe42974814d2a
Opcode Fuzzy Hash: 709b7ac80f73e14e9c91febda0e22a9f9bf2e517283ea41b376552d015bbaa8c
Instruction Fuzzy Hash: 65A105B5E01314EBDB20CFA8DC48BAE37F9AB48718F044258F606AB2C9D774D940CB61

Uniqueness

Uniqueness Score: -1.00%

Function 016A0720 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32(016A0827,?,?,016D207E,?,?,?,01858028,000000FF,016F6B8B), ref: 016A0729
TlsGetValue.KERNEL32(00000024,?,016A0827,?,?,016D207E,?,?,?,01858028,000000FF,016F6B8B), ref: 016A0741
GetLastError.KERNEL32(?,?,016D207E,?,?,?,01858028,000000FF,016F6B8B), ref: 016A074D
_memset.LIBCMT ref: 016A0779
TlsSetValue.KERNEL32(00000024,00000000), ref: 016A0788

Strings

Please contact support@anydesk.com (B), xrefs: 016A0757
Please contact support@anydesk.com (A), xrefs: 016A0739

Memory Dump Source

Source File: 00000004.00000002.515654949.0000000001286000.00000020.00000001.01000000.00000003.sdmp, Offset: 01280000, based on PE: true

Associated: 00000004.00000002.515589431.0000000001280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515606344.0000000001281000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515640972.0000000001285000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.521998832.000000000188D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527477421.0000000001DF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527504697.0000000001DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527523746.0000000001DF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527546202.0000000001DFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527813845.0000000001E6B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527850088.0000000001E6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.530798284.000000000220D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1280000_AnyDesk.jbxd

Similarity

API ID: Value$AllocErrorLast_memset
String ID: Please contact support@anydesk.com (A)$Please contact support@anydesk.com (B)
API String ID: 4091103580-43624127
Opcode ID: e3b062098d35fc7cae4ce00dd0a89a945d5a3b2a0d2e8b8562b8afc3da75848b
Instruction ID: f6b1c232da21dfae4e4da38a2c9c25442d4f1c87ef47779b414c4a394b8b55f0
Opcode Fuzzy Hash: e3b062098d35fc7cae4ce00dd0a89a945d5a3b2a0d2e8b8562b8afc3da75848b
Instruction Fuzzy Hash: 6B016D71B006215BD63027AC7D0CA9A3E94EF04BA1B860218FA08D738EE720CD518FD5

Uniqueness

Uniqueness Score: -1.00%

Function 017E9AF2 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 208COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 017E9B0C

Part of subcall function 017EB811: __FF_MSGBANNER.LIBCMT ref: 017EB82A
Part of subcall function 017EB811: __NMSG_WRITE.LIBCMT ref: 017EB831
Part of subcall function 017EB811: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 017EB856

std::exception::exception.LIBCMT ref: 017E9B41
std::exception::exception.LIBCMT ref: 017E9B5B
__CxxThrowException@8.LIBCMT ref: 017E9B6C

Strings

$, xrefs: 017E9BAD

Memory Dump Source

Source File: 00000004.00000002.515654949.0000000001286000.00000020.00000001.01000000.00000003.sdmp, Offset: 01280000, based on PE: true

Associated: 00000004.00000002.515589431.0000000001280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515606344.0000000001281000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515640972.0000000001285000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.521998832.000000000188D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527477421.0000000001DF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527504697.0000000001DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527523746.0000000001DF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527546202.0000000001DFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527813845.0000000001E6B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527850088.0000000001E6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.530798284.000000000220D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1280000_AnyDesk.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID: $
API String ID: 615853336-3993045852
Opcode ID: 7ddb0e3fda91f075765b5fef48d960fc2b19022468e0d307c685c726672011eb
Instruction ID: c83ea31f30a0b884c0d8e86e3c3b40fd763ed7b8042e876e4c9f405f09556708
Opcode Fuzzy Hash: 7ddb0e3fda91f075765b5fef48d960fc2b19022468e0d307c685c726672011eb
Instruction Fuzzy Hash: FC61073390021ADAEF31EF2DC84C7AEF7E5AF0932CF64051AEA1197291D7708AA0C751

Uniqueness

Uniqueness Score: -1.00%

Function 016F6BA0 Relevance: 7.5, APIs: 5, Instructions: 44comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 016F6BB9
SetEvent.KERNEL32(?,?,?,?,01858028,000000FF,016F6B8B), ref: 016F6BD1
OleUninitialize.OLE32(?,?,?,01858028,000000FF,016F6B8B), ref: 016F6BF7
TlsGetValue.KERNEL32(00000024,?,?,?,01858028,000000FF,016F6B8B), ref: 016F6C07
TlsSetValue.KERNEL32(00000024,00000000), ref: 016F6C1F

Memory Dump Source

Source File: 00000004.00000002.515654949.0000000001286000.00000020.00000001.01000000.00000003.sdmp, Offset: 01280000, based on PE: true

Associated: 00000004.00000002.515589431.0000000001280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515606344.0000000001281000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515640972.0000000001285000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.521998832.000000000188D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527477421.0000000001DF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527504697.0000000001DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527523746.0000000001DF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527546202.0000000001DFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527813845.0000000001E6B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527850088.0000000001E6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.530798284.000000000220D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1280000_AnyDesk.jbxd

Similarity

API ID: Value$EventInitializeUninitialize
String ID:
API String ID: 566941487-0
Opcode ID: 09313a5e7a091199be2f79588c2dad9fa8b64d447a88e1c321ae0633ea5b80d7
Instruction ID: 8c801a5c22dede8c06a777687d87775bb5cdf05aa55f8bb6ff0378d63141f22b
Opcode Fuzzy Hash: 09313a5e7a091199be2f79588c2dad9fa8b64d447a88e1c321ae0633ea5b80d7
Instruction Fuzzy Hash: 7E017CB56046409FD720AFA8DD09B1EBBE9EB44B10F040A2CF606C3789EB39E600CB55

Uniqueness

Uniqueness Score: -1.00%

Function 012819FE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 71memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00000028,00000004,00000000,01281CCE,?), ref: 01281A84
VirtualProtect.KERNEL32(?,00000028,00000000,00000000), ref: 01281A9B

Strings

.text, xrefs: 01281A22
.itext, xrefs: 01281A54

Memory Dump Source

Source File: 00000004.00000002.515606344.0000000001281000.00000020.00000001.01000000.00000003.sdmp, Offset: 01280000, based on PE: true

Associated: 00000004.00000002.515589431.0000000001280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515640972.0000000001285000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515654949.0000000001286000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.521998832.000000000188D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527477421.0000000001DF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527504697.0000000001DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527523746.0000000001DF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527546202.0000000001DFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527813845.0000000001E6B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527850088.0000000001E6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.530798284.000000000220D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1280000_AnyDesk.jbxd

Similarity

API ID: ProtectVirtual
String ID: .itext$.text
API String ID: 544645111-3616233406
Opcode ID: 25157340fd42bb4f24e49e02fc87ced46eb60b7815fbd1ec302d43497ec8cfaa
Instruction ID: 22eaa6492b1932996899698292983b89a40470a9091cd1b61599a0694654ae45
Opcode Fuzzy Hash: 25157340fd42bb4f24e49e02fc87ced46eb60b7815fbd1ec302d43497ec8cfaa
Instruction Fuzzy Hash: 0111E476A61305AED720DF94CC85ABEF7F8EB04B41F044529EE42E61C1E270E9A6C760

Uniqueness

Uniqueness Score: -1.00%

Function 016E53A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(03AD7AE0,C0000000,00000007,00000000,00000004,00000000,00000000,?,?,?,?,016E5457,00000000,?), ref: 016E53C4
GetLastError.KERNEL32(?,?,?,?,016E5457,00000000,?), ref: 016E53D8

Strings

Couldn't open the trace file (%08lx)., xrefs: 016E53DF

Memory Dump Source

Source File: 00000004.00000002.515654949.0000000001286000.00000020.00000001.01000000.00000003.sdmp, Offset: 01280000, based on PE: true

Associated: 00000004.00000002.515589431.0000000001280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515606344.0000000001281000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515640972.0000000001285000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.521998832.000000000188D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527477421.0000000001DF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527504697.0000000001DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527523746.0000000001DF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527546202.0000000001DFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527813845.0000000001E6B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527850088.0000000001E6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.530798284.000000000220D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1280000_AnyDesk.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: Couldn't open the trace file (%08lx).
API String ID: 1214770103-2712327928
Opcode ID: 6b54140b4b40e309689d5109334ca520d55e8b896b695a390e4e1dfffefe6078
Instruction ID: c836158cd822660b917e1b69eebac779d2d7e7e9fcdec8ea075b7d54df95f30d
Opcode Fuzzy Hash: 6b54140b4b40e309689d5109334ca520d55e8b896b695a390e4e1dfffefe6078
Instruction Fuzzy Hash: 7EF082786407409FE7315B789C0DB1A7AE4BB0072CF60070CE28699AC1E3F4E1488B69

Uniqueness

Uniqueness Score: -1.00%

Function 01281000 Relevance: 1.6, APIs: 1, Instructions: 107memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000040,?,?,?,?,01281B87,?,?,?,00BD6400,01284000,00BE6400,?), ref: 01281045

Memory Dump Source

Source File: 00000004.00000002.515606344.0000000001281000.00000020.00000001.01000000.00000003.sdmp, Offset: 01280000, based on PE: true

Associated: 00000004.00000002.515589431.0000000001280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515640972.0000000001285000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515654949.0000000001286000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.521998832.000000000188D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527477421.0000000001DF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527504697.0000000001DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527523746.0000000001DF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527546202.0000000001DFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527813845.0000000001E6B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527850088.0000000001E6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.530798284.000000000220D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1280000_AnyDesk.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8ad0bd426fc4e14450ebb4a25b13beb1236773bfd8cb879707df8a141987a14b
Instruction ID: 40a16e1717a7650387c3976b05758ec85214bf95c194a731d693d3e43024cde5
Opcode Fuzzy Hash: 8ad0bd426fc4e14450ebb4a25b13beb1236773bfd8cb879707df8a141987a14b
Instruction Fuzzy Hash: 7E418DB0621701CFC724DF59C880A66B7F5FF58300B148A2EE99A87AD1E374E496CB90

Uniqueness

Uniqueness Score: -1.00%

Function 017F978A Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 017F97CD

Part of subcall function 017F0961: __getptd_noexit.LIBCMT ref: 017F0961

Memory Dump Source

Source File: 00000004.00000002.515654949.0000000001286000.00000020.00000001.01000000.00000003.sdmp, Offset: 01280000, based on PE: true

Associated: 00000004.00000002.515589431.0000000001280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515606344.0000000001281000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515640972.0000000001285000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.521998832.000000000188D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527477421.0000000001DF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527504697.0000000001DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527523746.0000000001DF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527546202.0000000001DFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527813845.0000000001E6B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527850088.0000000001E6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.530798284.000000000220D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1280000_AnyDesk.jbxd

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: f955055805498c19100d887275a208a89cd1f4302ab2db25adfdda8152a13e4a
Instruction ID: 18559e04958a8feb457d3bfdc336cad52d6122a52f77f5c9bbfae1c2d9998f75
Opcode Fuzzy Hash: f955055805498c19100d887275a208a89cd1f4302ab2db25adfdda8152a13e4a
Instruction Fuzzy Hash: 5801D4312003129BEB399E2DDC44BABB794AB81768F14462DFB15DB395E730D400C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 01281E47 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,?,?,?,?,?,?,?,?,?,?), ref: 01281E5A

Memory Dump Source

Source File: 00000004.00000002.515606344.0000000001281000.00000020.00000001.01000000.00000003.sdmp, Offset: 01280000, based on PE: true

Associated: 00000004.00000002.515589431.0000000001280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515640972.0000000001285000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515654949.0000000001286000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.521998832.000000000188D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527477421.0000000001DF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527504697.0000000001DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527523746.0000000001DF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527546202.0000000001DFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527813845.0000000001E6B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527850088.0000000001E6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.530798284.000000000220D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1280000_AnyDesk.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: da3217a48a35a7f73bb2f243d45cd543263d55fe0a0244ddc97ab40e425c557b
Instruction ID: c69f04f962094293f33136f09b68d1b972346bdb40691324d24f1a1e41741a62
Opcode Fuzzy Hash: da3217a48a35a7f73bb2f243d45cd543263d55fe0a0244ddc97ab40e425c557b
Instruction Fuzzy Hash: 0CC01232404111EFCA506BE0E80CEC6BBA4AF48321F028840F24887061C2309881CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01281E30 Relevance: 1.5, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,?,01281CD9,?,?), ref: 01281E44

Memory Dump Source

Source File: 00000004.00000002.515606344.0000000001281000.00000020.00000001.01000000.00000003.sdmp, Offset: 01280000, based on PE: true

Associated: 00000004.00000002.515589431.0000000001280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515640972.0000000001285000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515654949.0000000001286000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.521998832.000000000188D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527477421.0000000001DF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527504697.0000000001DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527523746.0000000001DF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527546202.0000000001DFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527813845.0000000001E6B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527850088.0000000001E6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.530798284.000000000220D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1280000_AnyDesk.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: de6bbabe96f113b533bb21972aeeda081bfeb88c9d1d0998e645ee4a68d9c0c3
Instruction ID: 73ed44fdf97f2c504bc4ff3c0e3f5f81778f09d1ae47c9e34c1b1a6220599687
Opcode Fuzzy Hash: de6bbabe96f113b533bb21972aeeda081bfeb88c9d1d0998e645ee4a68d9c0c3
Instruction Fuzzy Hash: 0AC04C75545100AFCA51ABE4E88CF4577E4AB8CB11F045581F109C71A5C6309850DB11

Uniqueness

Uniqueness Score: -1.00%

Function 017F43AE Relevance: 1.5, APIs: 1, Instructions: 3COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 017F43B0

Memory Dump Source

Source File: 00000004.00000002.515654949.0000000001286000.00000020.00000001.01000000.00000003.sdmp, Offset: 01280000, based on PE: true

Associated: 00000004.00000002.515589431.0000000001280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515606344.0000000001281000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515640972.0000000001285000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.521998832.000000000188D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527477421.0000000001DF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527504697.0000000001DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527523746.0000000001DF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527546202.0000000001DFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527813845.0000000001E6B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527850088.0000000001E6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.530798284.000000000220D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1280000_AnyDesk.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: e33b940f48d76387fe716e4dfe11e7ca2dd71624a46d2d6590f1cd277a3d331c
Instruction ID: 2b5d312b1ff1638184019f7e070a1c8ddaf15a11d45847caeb29d021b7be5b98
Opcode Fuzzy Hash: e33b940f48d76387fe716e4dfe11e7ca2dd71624a46d2d6590f1cd277a3d331c
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 017FC239 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0180537A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0180538F
UnhandledExceptionFilter.KERNEL32(01896B74), ref: 0180539A
GetCurrentProcess.KERNEL32(C0000409), ref: 018053B6
TerminateProcess.KERNEL32(00000000), ref: 018053BD

Strings

RP.m, xrefs: 0180536F

Memory Dump Source

Source File: 00000004.00000002.515654949.0000000001286000.00000020.00000001.01000000.00000003.sdmp, Offset: 01280000, based on PE: true

Associated: 00000004.00000002.515589431.0000000001280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515606344.0000000001281000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515640972.0000000001285000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.521998832.000000000188D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527477421.0000000001DF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527504697.0000000001DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527523746.0000000001DF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527546202.0000000001DFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527813845.0000000001E6B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527850088.0000000001E6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.530798284.000000000220D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1280000_AnyDesk.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: RP.m
API String ID: 2579439406-351806028
Opcode ID: cd1304753bc6e9159b1385309ed5a9a2b4d02d187048dc666b23580cc447712c
Instruction ID: 4d73f6a50c92f0339ca55c152d3e40cc95539c93fd1b458f4b91caf1b52532f1
Opcode Fuzzy Hash: cd1304753bc6e9159b1385309ed5a9a2b4d02d187048dc666b23580cc447712c
Instruction Fuzzy Hash: 7E21D2B84113089FD7A1DF68E9887483BB6BB08315F50411EF9088778AEBB097A5CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0149F0E0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 016F93C0: LoadLibraryW.KERNEL32(advapi32.dll,00000000,01DF0EE8,016E58DD), ref: 016F93D9
Part of subcall function 016F93C0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,01DF0EE8), ref: 016F93FB
Part of subcall function 016F93C0: _free.LIBCMT ref: 016F9426

GetProcAddress.KERNEL32(00000000,ConvertStringSecurityDescriptorToSecurityDescriptorW), ref: 0149F106
GetProcAddress.KERNEL32(014A91E0,OpenEventLogA), ref: 0149F120
GetProcAddress.KERNEL32(012911F0,CloseEventLog), ref: 0149F13A
GetProcAddress.KERNEL32(0135D2B0,ReportEventA), ref: 0149F154
GetProcAddress.KERNEL32(014A69F0,CreateProcessWithTokenW), ref: 0149F16E

Strings

OpenEventLogA, xrefs: 0149F11A
CloseEventLog, xrefs: 0149F134
ConvertStringSecurityDescriptorToSecurityDescriptorW, xrefs: 0149F100
advapi32.dll, xrefs: 0149F0E4
ReportEventA, xrefs: 0149F14E
CreateProcessWithTokenW, xrefs: 0149F168

Memory Dump Source

Source File: 00000004.00000002.515654949.0000000001286000.00000020.00000001.01000000.00000003.sdmp, Offset: 01280000, based on PE: true

Associated: 00000004.00000002.515589431.0000000001280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515606344.0000000001281000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515640972.0000000001285000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.521998832.000000000188D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527477421.0000000001DF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527504697.0000000001DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527523746.0000000001DF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527546202.0000000001DFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527813845.0000000001E6B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527850088.0000000001E6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.530798284.000000000220D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1280000_AnyDesk.jbxd

Similarity

API ID: AddressProc$ErrorLastLibraryLoad_free
String ID: CloseEventLog$ConvertStringSecurityDescriptorToSecurityDescriptorW$CreateProcessWithTokenW$OpenEventLogA$ReportEventA$advapi32.dll
API String ID: 1327587910-3518705215
Opcode ID: 5e00eff6208d6d82d910f8b942fe836fc046c5ec6669ff5f4a727a46e406e4bd
Instruction ID: 7b42d8f9b98572626b07712b3eeeedd25e6ef3b32b9492e83580e902ae29feb2
Opcode Fuzzy Hash: 5e00eff6208d6d82d910f8b942fe836fc046c5ec6669ff5f4a727a46e406e4bd
Instruction Fuzzy Hash: 6E118BB0B00313AAAF509E7ECC42B57BFDCAF01A94704003AA914D7361E734EC548BE0

Uniqueness

Uniqueness Score: -1.00%

Function 017F3BB4 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 017F3BC0

Part of subcall function 017F459B: __getptd_noexit.LIBCMT ref: 017F459E
Part of subcall function 017F459B: __amsg_exit.LIBCMT ref: 017F45AB

__amsg_exit.LIBCMT ref: 017F3BE0
__lock.LIBCMT ref: 017F3BF0
InterlockedDecrement.KERNEL32(?), ref: 017F3C0D
_free.LIBCMT ref: 017F3C20
InterlockedIncrement.KERNEL32(03AD15F8), ref: 017F3C38

Memory Dump Source

Source File: 00000004.00000002.515654949.0000000001286000.00000020.00000001.01000000.00000003.sdmp, Offset: 01280000, based on PE: true

Associated: 00000004.00000002.515589431.0000000001280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515606344.0000000001281000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515640972.0000000001285000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.521998832.000000000188D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527477421.0000000001DF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527504697.0000000001DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527523746.0000000001DF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527546202.0000000001DFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527813845.0000000001E6B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527850088.0000000001E6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.530798284.000000000220D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1280000_AnyDesk.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: d020544596a8ffab8eb8495c110cbe673f9d2de777f227c3f325482df0a7bd40
Instruction ID: c8c57f7edc2ca4801de1b28e17f58e0a11f28c44c60fbd4bb23f6f2c00b5f42f
Opcode Fuzzy Hash: d020544596a8ffab8eb8495c110cbe673f9d2de777f227c3f325482df0a7bd40
Instruction Fuzzy Hash: 0F019235E05616ABE731AF6EA448B5FF7A0BF14B24F04010EEA04A7388C774E951CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 017EBE49 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 017EBE57

Part of subcall function 017EB811: __FF_MSGBANNER.LIBCMT ref: 017EB82A
Part of subcall function 017EB811: __NMSG_WRITE.LIBCMT ref: 017EB831
Part of subcall function 017EB811: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 017EB856

_free.LIBCMT ref: 017EBE6A

Memory Dump Source

Source File: 00000004.00000002.515654949.0000000001286000.00000020.00000001.01000000.00000003.sdmp, Offset: 01280000, based on PE: true

Associated: 00000004.00000002.515589431.0000000001280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515606344.0000000001281000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515640972.0000000001285000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.521998832.000000000188D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527477421.0000000001DF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527504697.0000000001DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527523746.0000000001DF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527546202.0000000001DFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527813845.0000000001E6B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527850088.0000000001E6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.530798284.000000000220D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1280000_AnyDesk.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: aa0dbf0ae212c1ba654690157fb4bf50f19535823e4fbf8a4800150a5306585d
Instruction ID: 631eb9ad24904cfbe2911c0d15f0035b6b1a12c79c83902561b6293656250365
Opcode Fuzzy Hash: aa0dbf0ae212c1ba654690157fb4bf50f19535823e4fbf8a4800150a5306585d
Instruction Fuzzy Hash: 6911AB32544616ABDB316B78A80C65FBFE5AF5C3B0F144529FB4897395DB3089408B90

Uniqueness

Uniqueness Score: -1.00%

Function 017F4335 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 017F4341

Part of subcall function 017F459B: __getptd_noexit.LIBCMT ref: 017F459E
Part of subcall function 017F459B: __amsg_exit.LIBCMT ref: 017F45AB

__getptd.LIBCMT ref: 017F4358
__amsg_exit.LIBCMT ref: 017F4366
__lock.LIBCMT ref: 017F4376
__updatetlocinfoEx_nolock.LIBCMT ref: 017F438A

Memory Dump Source

Source File: 00000004.00000002.515654949.0000000001286000.00000020.00000001.01000000.00000003.sdmp, Offset: 01280000, based on PE: true

Associated: 00000004.00000002.515589431.0000000001280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515606344.0000000001281000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515640972.0000000001285000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.521998832.000000000188D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527477421.0000000001DF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527504697.0000000001DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527523746.0000000001DF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527546202.0000000001DFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527813845.0000000001E6B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527850088.0000000001E6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.530798284.000000000220D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1280000_AnyDesk.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: adc8354cd9d9d6aa18725b93add8f11e3cc1869f97a6ab17bd3569e953f8a3ae
Instruction ID: a589290343f18e9044c9a4ad9fc0cbc32b0361d227982f9b1910aa848e7afc86
Opcode Fuzzy Hash: adc8354cd9d9d6aa18725b93add8f11e3cc1869f97a6ab17bd3569e953f8a3ae
Instruction Fuzzy Hash: FBF06732A44616DBE621BB68980DB5BE7A0BF20624F12420DE752BB389CB2495408A5A

Uniqueness

Uniqueness Score: -1.00%

Function 016F93C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(advapi32.dll,00000000,01DF0EE8,016E58DD), ref: 016F93D9
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,01DF0EE8), ref: 016F93FB
_free.LIBCMT ref: 016F9426

Part of subcall function 017EA7CE: RtlFreeHeap.NTDLL(00000000,00000000,?,016F6C13,00000000,?,?,?,01858028,000000FF,016F6B8B), ref: 017EA7E4

Strings

advapi32.dll, xrefs: 016F93D8, 016F9402

Memory Dump Source

Source File: 00000004.00000002.515654949.0000000001286000.00000020.00000001.01000000.00000003.sdmp, Offset: 01280000, based on PE: true

Associated: 00000004.00000002.515589431.0000000001280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515606344.0000000001281000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515640972.0000000001285000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.521998832.000000000188D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527477421.0000000001DF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527504697.0000000001DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527523746.0000000001DF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527546202.0000000001DFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527813845.0000000001E6B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527850088.0000000001E6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.530798284.000000000220D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1280000_AnyDesk.jbxd

Similarity

API ID: ErrorFreeHeapLastLibraryLoad_free
String ID: advapi32.dll
API String ID: 1383136612-4050573280
Opcode ID: 8fdfcc6985efc424b78c1969bcbe2cfec34d66c6ec69aba6a73bb0155b3d5da7
Instruction ID: 24749d407c8d625544bb8cb51136a354eeab9f2f93f61d1aaaac6287c4c753a1
Opcode Fuzzy Hash: 8fdfcc6985efc424b78c1969bcbe2cfec34d66c6ec69aba6a73bb0155b3d5da7
Instruction Fuzzy Hash: 29018CB4949702ABD712AF28CD08B1BBBE8FF94714F048A2DF995C2741E738D504CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0180381F Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 01803853
__isleadbyte_l.LIBCMT ref: 01803886
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?,?,?), ref: 018038B7
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?,?,?), ref: 01803925

Memory Dump Source

Source File: 00000004.00000002.515654949.0000000001286000.00000020.00000001.01000000.00000003.sdmp, Offset: 01280000, based on PE: true

Associated: 00000004.00000002.515589431.0000000001280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515606344.0000000001281000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.515640972.0000000001285000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.521998832.000000000188D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.526917908.0000000001D4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527477421.0000000001DF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527504697.0000000001DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527523746.0000000001DF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527546202.0000000001DFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527813845.0000000001E6B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.527850088.0000000001E6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.530798284.000000000220D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1280000_AnyDesk.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: b963f1f065643b657eda8e9d62af72ea1896da79ac30da5ed381c21534f6a7c5
Instruction ID: d89155e45363ee777ebf7a151c85f28dccf751ead5d6f06a79880c06b415fae1
Opcode Fuzzy Hash: b963f1f065643b657eda8e9d62af72ea1896da79ac30da5ed381c21534f6a7c5
Instruction Fuzzy Hash: FE318231A0024EEFDB62DFA9CC849AA7FA5BF01310F1585A9E961CB2D1E731DB40DB50

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AnyDesk.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\AnyDesk\service.conf

C:\Users\user\AppData\Roaming\AnyDesk\system.conf

C:\Users\user\AppData\Roaming\AnyDesk\user.conf

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\BHJWA8656ZX7SMIVXTPF.temp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\S8FAV3SVMYENR819RW5P.temp

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
AnyDesk.exe

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre