21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 56:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T484,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample b9ad79eaf7a4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b9ad79eaf7a4…. Malware family: Trojan.Generic. Threat score 100/100. 1/28 AV engines flagged this file. 8 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b9ad79eaf7a4133f95f24c3b9d976c72f34264dc5c99030f0e57992cb5621f78","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","b9ad79eaf7a4133f95f24c3b9d976c72f34264dc5c99030f0e57992cb5621f78"],"about":{"@type":"SoftwareApplication","name":"AnyDesk.exe","applicationCategory":["peexe","executable"],"identifier":"b9ad79eaf7a4133f95f24c3b9d976c72f34264dc5c99030f0e57992cb5621f78","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":1,"total":28},"behavioralIndicators":{"malicious":8,"suspicious":34},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T47b,Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp")23:T6d2,Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00003012.00000000.66453.72581000.00000020.mdmp")24:T6be,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp")25:Ta1a,"anydesk_5-4-2_fr_431427.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002240)26:T502,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003012.00000000.66453.72581000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp")27:T681,Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "QuerySystemInformation"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "QuerySystemInformation"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "RtlNtStatusToDosError" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp")28:T502,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003012.00000000.66453.72581000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp")29:Ta11,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "3830191454,3244,3024,,RtlGetVersion,NTDLL.dll,"00:17:15.703",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp")2a:T4f1,Found string "SELECT MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter = TRUE" (Indicator: " Win32_NetworkAdapter"; Source: "00000000-00003012.00000000.66453.018D0000.00000004.mdmp, 00000000-00003012.00000001.68372.018D0000.00000004.mdmp, 00000000-00003012.00000002.70292.018D0000.00000004.mdmp") Found string "xecqueryselect macaddress from win32_networkadapter where physicaladapter = true" (Indicator: " Win32_NetworkAdapter"; Source: "00000000-00003012.00000000.66453.018D0000.00000004.mdmp, 00000000-00003012.00000001.68372.018D0000.00000004.mdmp, 00000000-00003012.00000002.70292.018D0000.00000004.mdmp") Found string "WMI.ExecQuery(SELECT MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter = TRUE);" (Indicator: " Win32_NetworkAdapter"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") Found string "MI.ExecQuery(SELECT MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter = TRUE);" (Indicator: " Win32_NetworkAdapter"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp")2b:T786,"anydesk_5-4-2_fr_431427.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "LoadLibrary" with a parameter shcore.dll (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "LoadLibrary" with a parameter USER32.DLL (UID: 00000000-00002240)2c:T480c,"anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter DwmEnableComposition (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter DwmGetWindowAttribute (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter DwmSetWindowAttribute (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter DwmExtendFrameIntoClientArea (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter NtClose (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter RtlCopyMemory (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter NtMapViewOfSection (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter NtCreateSection (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter NtOpenProcess (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter NtAllocateVirtualMemory (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter NtProtectVirtualMemory (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter NtFreeVirtualMemory (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter NtTerminateThread (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter NtDuplicateObject (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter RtlCreateUserThread (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter LdrLoadDll (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter LdrGetProcedureAddress (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter LdrUnloadDll (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter WTSGetActiveConsoleSessionId (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter GetProcessId (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockShared (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter K32GetModuleFileNameExW (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter AddClipboardFormatListener (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter RemoveClipboardFormatListener (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter RegisterPowerSettingNotification (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter UnregisterPowerSettingNotification (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter WTSQueryUserToken (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter WTSRegisterSessionNotification (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter WTSUnRegisterSessionNotification (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter WTSEnumerateServersW (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter WTSEnumerateSessionsW (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter WTSQuerySessionInformationW (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter WTSFreeMemory (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter BufferedPaintClear (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter BeginBufferedPaint (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter EndBufferedPaint (UID: 00000000-00003012) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter _OPENSSL_isservice (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter GetQueueStatus (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter CloseToolhelp32Snapshot (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter Heap32First (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter Heap32Next (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter Heap32ListFirst (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter Heap32ListNext (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter Thread32First (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter Thread32Next (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "GetProcAddress" with a parameter Module32Next (UID: 00000000-00002240)2d:T442,Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp")2e:T11e92,Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "NdrClientCall2"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "I_RpcExceptionFilter"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "RpcBindingSetAuthInfoExW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "OpenEventLogA"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "CloseEventLog"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessWithTokenW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "WTSGetActiveConsoleSessionId"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "ProcessIdToSessionId"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockShared"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameExW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "K32GetModuleFileNameExW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "UnregisterClassW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "CreateWellKnownSid"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "RtlCopyMemory"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtMapViewOfSection"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtCreateSection"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtOpenProcess"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtAllocateVirtualMemory"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtProtectVirtualMemory"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtFreeVirtualMemory"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtTerminateThread"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtDuplicateObject"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "RtlCreateUserThread"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "LdrLoadDll"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "LdrUnloadDll"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "UpdateWindow"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "NdrClientCall2"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "I_RpcExceptionFilter"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "RpcBindingSetAuthInfoExW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "OpenEventLogA"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "CloseEventLog"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessWithTokenW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "WTSGetActiveConsoleSessionId"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "ProcessIdToSessionId"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockShared"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameExW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "K32GetModuleFileNameExW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "UnregisterClassW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "CreateWellKnownSid"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "RtlCopyMemory"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtMapViewOfSection"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtCreateSection"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtOpenProcess"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtAllocateVirtualMemory"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtProtectVirtualMemory"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtFreeVirtualMemory"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtTerminateThread"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtDuplicateObject"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "RtlCreateUserThread"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "LdrLoadDll"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "LdrUnloadDll"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "UpdateWindow"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00003012.00000000.66453.72581000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00003012.00000000.66453.72581000.00000020.mdmp, 00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00003012.00000000.66453.72581000.00000020.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00003012.00000000.66453.72581000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00003012.00000000.66453.72581000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00003012.00000000.66453.72581000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00003012.00000000.66453.72581000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00003012.00000000.66453.72581000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00003012.00000000.66453.72581000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00003012.00000000.66453.72581000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00003012.00000000.66453.72581000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00003012.00000000.66453.72581000.00000020.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "NdrClientCall2"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "I_RpcExceptionFilter"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "RpcBindingSetAuthInfoExW"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "OpenEventLogA"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "CloseEventLog"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessWithTokenW"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "WTSGetActiveConsoleSessionId"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "ProcessIdToSessionId"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockShared"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameExW"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "K32GetModuleFileNameExW"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "UnregisterClassW"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "CreateWellKnownSid"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp")2f:T747,Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "NtOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "NtOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp")30:T478,Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp")31:T5e3,"e\SOFTWARE\Pol" in Source: 00000000-00002064.00000000.66608.01850000.00000004.mdmp 00000000-00002064.00000001.68528.01850000.00000004.mdmp 00000000-00002064.00000002.70448.01850000.00000004.mdmp "e\SOFTWARE\Pol" in Source: 00000000-00002240.00000000.66593.01890000.00000004.mdmp 00000000-00002240.00000001.68514.01890000.00000004.mdmp 00000000-00002240.00000002.70432.01890000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}" in Source: 00000000-00002240.00000000.66593.01890000.00000004.mdmp 00000000-00002240.00000001.68514.01890000.00000004.mdmp 00000000-00002240.00000002.70432.01890000.00000004.mdmp "e\SOFTWARE\Pol" in Source: 00000000-00003012.00000000.66453.018D0000.00000004.mdmp 00000000-00003012.00000001.68372.018D0000.00000004.mdmp 00000000-00003012.00000002.70292.018D0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00003012.00000000.66453.046D0000.00000004.mdmp 00000000-00003012.00000001.68372.046D0000.00000004.mdmp 00000000-00003012.00000002.70292.046D0000.00000004.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00003012.00000000.66453.72581000.00000020.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00003012.00000000.66453.72581000.00000020.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00003012.00000000.66453.72581000.00000020.mdmp32:T1099,"anydesk_5-4-2_fr_431427.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75e40000 "anydesk_5-4-2_fr_431427.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75e40000 "anydesk_5-4-2_fr_431427.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75e40000 "anydesk_5-4-2_fr_431427.exe" loaded module "KERNEL32" at base 75740000 "anydesk_5-4-2_fr_431427.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 71c40000 "anydesk_5-4-2_fr_431427.exe" loaded module "CSCAPI.DLL" at base 720c0000 "anydesk_5-4-2_fr_431427.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75bd0000 "anydesk_5-4-2_fr_431427.exe" loaded module "DWMAPI.DLL" at base 72090000 "anydesk_5-4-2_fr_431427.exe" loaded module "NTDLL.DLL" at base 76fa0000 "anydesk_5-4-2_fr_431427.exe" loaded module "KERNEL32.DLL" at base 75740000 "anydesk_5-4-2_fr_431427.exe" loaded module "USER32.DLL" at base 75440000 "anydesk_5-4-2_fr_431427.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75db0000 "anydesk_5-4-2_fr_431427.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 75440000 "anydesk_5-4-2_fr_431427.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 75440000 "anydesk_5-4-2_fr_431427.exe" loaded module "RPCRT4.DLL" at base 76be0000 "anydesk_5-4-2_fr_431427.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 76d00000 "anydesk_5-4-2_fr_431427.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75a80000 "anydesk_5-4-2_fr_431427.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76eb0000 "anydesk_5-4-2_fr_431427.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 71bf0000 "anydesk_5-4-2_fr_431427.exe" loaded module "WTSAPI32.DLL" at base 72f30000 "anydesk_5-4-2_fr_431427.exe" loaded module "UXTHEME.DLL" at base 74910000 "anydesk_5-4-2_fr_431427.exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 71830000 "anydesk_5-4-2_fr_431427.exe" loaded module "KERNELBASE" at base 75e40000 "anydesk_5-4-2_fr_431427.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75e40000 "anydesk_5-4-2_fr_431427.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 71820000 "anydesk_5-4-2_fr_431427.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 71790000 "anydesk_5-4-2_fr_431427.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 71430000 "anydesk_5-4-2_fr_431427.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 75e40000 "anydesk_5-4-2_fr_431427.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 75e40000 "anydesk_5-4-2_fr_431427.exe" loaded module "AMSI.DLL" at base 712f0000 "anydesk_5-4-2_fr_431427.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74c80000 "anydesk_5-4-2_fr_431427.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\X86\MPOAV.DLL" at base 72580000 "anydesk_5-4-2_fr_431427.exe" loaded module "SHCORE.DLL" at base 75960000 "anydesk_5-4-2_fr_431427.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 71190000 "anydesk_5-4-2_fr_431427.exe" loaded module "WINHTTP.DLL" at base 71dd0000 "anydesk_5-4-2_fr_431427.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 71130000 "anydesk_5-4-2_fr_431427.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 710d0000 "anydesk_5-4-2_fr_431427.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 710b0000 "anydesk_5-4-2_fr_431427.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 71070000 "anydesk_5-4-2_fr_431427.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 71060000 "anydesk_5-4-2_fr_431427.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 71050000 "anydesk_5-4-2_fr_431427.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 70c20000 "anydesk_5-4-2_fr_431427.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 71770000 "anydesk_5-4-2_fr_431427.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 71690000 "anydesk_5-4-2_fr_431427.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7155000033:Ta99,"anydesk_5-4-2_fr_431427.exe" touched "Local Icon Cache" (Path: "HKCU\WOW6432NODE\CLSID\{2155FEE3-2419-4373-B102-6843707EB41F}") "anydesk_5-4-2_fr_431427.exe" touched "Custom Destination List" (Path: "HKCU\WOW6432NODE\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\TREATAS") "anydesk_5-4-2_fr_431427.exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "anydesk_5-4-2_fr_431427.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "anydesk_5-4-2_fr_431427.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "anydesk_5-4-2_fr_431427.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\WOW6432NODE\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "anydesk_5-4-2_fr_431427.exe" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "anydesk_5-4-2_fr_431427.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "anydesk_5-4-2_fr_431427.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "anydesk_5-4-2_fr_431427.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "anydesk_5-4-2_fr_431427.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "anydesk_5-4-2_fr_431427.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "anydesk_5-4-2_fr_431427.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "anydesk_5-4-2_fr_431427.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "anydesk_5-4-2_fr_431427.exe" touched "HNetCfg.FwMgr" (Path: "HKCU\WOW6432NODE\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}") "anydesk_5-4-2_fr_431427.exe" touched "HNetCfg.FwAuthorizedApplication" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2}") "anydesk_5-4-2_fr_431427.exe" touched "NetworkListManager" (Path: "HKCU\WOW6432NODE\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS") "anydesk_5-4-2_fr_431427.exe" touched "Network List Manager" (Path: "HKCU\WOW6432NODE\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TREATAS")34:T487,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp")35:T8f0,"anydesk_5-4-2_fr_431427.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ANYDESK"; Key: ""; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ANYDESK_5-4-2_FR_431427.EXE"; Key: ""; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86\XTAJIT"; Key: ""; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: ""; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\APPCERTDLLS"; Key: ""; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION"; Key: ""; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS"; Key: ""; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: ""; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES\MANIFESTEDMERGESTUBSDBS"; Key: ""; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "")36:Tc30,"anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\ANYDESK_5-4-2_FR_431427.EXE"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS"; Key: "C:\ANYDESK_5-4-2_FR_431427.EXE"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "DISABLEDOUBLEQUERYSDBS"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMERGE.SDB"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMAIN.SDB"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{60982E44-40A2-4367-9BC3-CA978A87EFC7}"; Key: "DATA"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{60982E44-40A2-4367-9BC3-CA978A87EFC7}"; Key: "GENERATION"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44294F7C-6083-41C6-8176-3C202D755616}"; Key: "DATA"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44294F7C-6083-41C6-8176-3C202D755616}"; Key: "GENERATION"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44104292-2B3C-11EE-88A7-00505691A833}"; Key: "DATA"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44104292-2B3C-11EE-88A7-00505691A833}"; Key: "GENERATION"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{FFA98E4B-99DB-4018-B974-2DFFBCBAF986}"; Key: "GENERATION"; Value: "")37:T40a,"anydesk_5-4-2_fr_431427.exe" reads file "c:\users\%osuser%\appdata\local\iconcache.db" "anydesk_5-4-2_fr_431427.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "anydesk_5-4-2_fr_431427.exe" reads file "c:\users\%osuser%\documents\desktop.ini" "anydesk_5-4-2_fr_431427.exe" reads file "c:\users\%osuser%\music\desktop.ini" "anydesk_5-4-2_fr_431427.exe" reads file "c:\users\%osuser%\pictures\desktop.ini" "anydesk_5-4-2_fr_431427.exe" reads file "c:\users\%osuser%\videos\desktop.ini" "anydesk_5-4-2_fr_431427.exe" reads file "c:\users\%osuser%\downloads\desktop.ini" "anydesk_5-4-2_fr_431427.exe" reads file "c:\users\%osuser%\onedrive\desktop.ini" "anydesk_5-4-2_fr_431427.exe" reads file "c:\windows\fonts\staticcache.dat" "anydesk_5-4-2_fr_431427.exe" reads file "c:\users\%osuser%\appdata\roaming\anydesk\service.conf" "anydesk_5-4-2_fr_431427.exe" reads file "c:\users\%osuser%\appdata\roaming\anydesk\user.conf" "anydesk_5-4-2_fr_431427.exe" reads file "c:\users\%osuser%\appdata\roaming\anydesk\system.conf"38:T694,"anydesk_5-4-2_fr_431427.exe" trying to touch file "C:\Windows\SysWOW64\winmm.dll" "anydesk_5-4-2_fr_431427.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "anydesk_5-4-2_fr_431427.exe" trying to touch file "C:\Windows\SysWOW64\oleaut32.dll" "anydesk_5-4-2_fr_431427.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_6ebca75c88023f94\comctl32.dll" "anydesk_5-4-2_fr_431427.exe" trying to touch file "C:\Windows\WindowsShell.Manifest" "anydesk_5-4-2_fr_431427.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.22621.1635_none_9fa79a41e294b962\GdiPlus.dll" "anydesk_5-4-2_fr_431427.exe" trying to touch file "C:\Windows\SysWOW64\msimg32.dll" "anydesk_5-4-2_fr_431427.exe" trying to touch file "C:\Windows\SysWOW64\winhttp.dll" "anydesk_5-4-2_fr_431427.exe" trying to touch file "C:\Windows\SysWOW64\winspool.drv" "anydesk_5-4-2_fr_431427.exe" trying to touch file "C:\Windows\SysWOW64\kernel.appcore.dll" "anydesk_5-4-2_fr_431427.exe" trying to touch file "C:\Windows\SysWOW64\uxtheme.dll" "anydesk_5-4-2_fr_431427.exe" trying to touch file "C:\Windows\SysWOW64\windows.storage.dll" "anydesk_5-4-2_fr_431427.exe" trying to touch file "C:\Windows\SysWOW64\WinTypes.dll" "anydesk_5-4-2_fr_431427.exe" trying to touch file "C:\Windows\SysWOW64\profapi.dll" "anydesk_5-4-2_fr_431427.exe" trying to touch file "C:\Windows\Globalization\Sorting\SortDefault.nls" "anydesk_5-4-2_fr_431427.exe" trying to touch file "C:\Windows\SysWOW64\ntmarta.dll" "anydesk_5-4-2_fr_431427.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\AnyDesk\ad.trace"39:T466,"anydesk_5-4-2_fr_431427.exe" trying to access non-existent file "\Device\HarddiskVolume3\Windows\SysWOW64\en-US\imageres.dll.mui" "anydesk_5-4-2_fr_431427.exe" trying to access non-existent file "\Device\HarddiskVolume3\Users\Public\AccountPictures\S-1-5-21-1271187874-1938232448-3812392235-1001" "anydesk_5-4-2_fr_431427.exe" trying to access non-existent file "\Device\HarddiskVolume3\Windows\SysWOW64\en-US\KERNELBASE.dll.mui" "anydesk_5-4-2_fr_431427.exe" trying to access non-existent file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms" "anydesk_5-4-2_fr_431427.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\67HTOQOORI364D6CSTGW.temp" "anydesk_5-4-2_fr_431427.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms" "anydesk_5-4-2_fr_431427.exe" trying to access non-existent file "\Device\HarddiskVolume3\Windows\SystemResources\USER32.dll.mun"3a:Te4f,Heuristic match: "F>.km" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Heuristic match: "boot-01.net.anydesk.com" Heuristic match: "boot-02.net.anydesk.com" Pattern match: "crl.microsoft.com/pki/crl/products/CSPCA.crl0H" Pattern match: "http://www.microsoft.com/pki/certs/CSPCA.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/tspca.crl0H" Pattern match: "http://www.microsoft.com/pki/certs/tspca.crt0" Pattern match: "http://microsoft.com0" Heuristic match: "anydeskprintdriver.cat" Pattern match: "https://www.linkedin.com/shareArticle?mini=true&url=http%3A//anydesk.com/&title=Try%20AnyDesk%20Remote%20Desktop&summary=AnyDesk%20is%20a%20small%20and%20quick%20solution%20for%20screen%20sharing%20and%20remote%20collaboration.%20Get%20it%20here%3A%20http%" Pattern match: "https://twitter.com/home?status=Do%20you%20know%20%23AnyDesk?%20AnyDesk%20is%20a%20small%20and%20quick%20solution%20for%20screen%20sharing%20and%20remote%20collaboration.%20Get%20it%20here%3A%20http%3A//anydesk.com/" Heuristic match: "k.com" Heuristic match: "oot-01.net.anydesk.com" Pattern match: "ent.CBS/resources/ProductPkgDisplayName" Pattern match: "ient.Core/resources/ProductPkgDisplayName" Pattern match: "MicrosoftWindows.Client.CBS/resources/ProductPkgDist" Heuristic match: "oot-02.net.anydesk.com" Heuristic match: "ttps://relay.anydesk.com" Heuristic match: "anydesk.co" Heuristic match: "g\AnyDesk\system.co" Heuristic match: "d.license.name" Heuristic match: "d.license.id" Heuristic match: "d.privacy.name" Heuristic match: "d.anynet.id" Heuristic match: "elay.anydesk.com" Heuristic match: "relay.anydesk.com" Heuristic match: ".anydesk.com" Pattern match: "adobe.com/xap/1.0/sType/" Pattern match: "ns.microsoft.com/ph" Pattern match: "http://purl.o" Pattern match: "http://ns.adobe.com" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "http://purl.org/dc/elements/1.1/" Pattern match: "http://ns.adobe.com/xap/1.0/" Pattern match: "http://ns.adobe.com/xmp/Identifier/qual/1.0/" Pattern match: "http://ns.adobe.com/xap/1.0/rights/" Pattern match: "http://ns.adobe.com/xap/1.0/mm/" Pattern match: "http://ns.adobe.com/xap/1.0/bj/" Pattern match: "http://ns.adobe.com/xap/1.0/t/pg/" Pattern match: "http://ns.adobe.com/pdf/1.3/" Pattern match: "http://ns.adobe.com/photoshop/1.0/" Pattern match: "http://ns.adobe.com/tiff/1.0/" Pattern match: "http://ns.adobe.com/exif/1.0/" Pattern match: "http://ns.adobe.com/xap/1.0/sType/Dimensions#" Pattern match: "http://ns.adobe.com/xap/1.0/g/img/" Pattern match: "http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" Pattern match: "http://ns.adobe.com/xap/1.0/sType/ResourceRef#" Pattern match: "http://ns.adobe.com/xap/1.0/sType/Version#" Pattern match: "http://ns.adobe.com/xap/1.0/sType/Job#" Pattern match: "http://ns.adobe.com/exif/1.0/aux/" Pattern match: "http://ns.adobe.com/camera-raw-settings/1.0/" Pattern match: "http://ns.adobe.com/xmp/1.0/DynamicMedia/" Pattern match: "http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/" Pattern match: "http://ns.microsoft.com/photo/1.0/" Pattern match: "http://ns.microsoft.com/photo/1.2/" Pattern match: "http://ns.microsoft.com/photo/1.2/t/RegionInfo#" Pattern match: "http://ns.microsoft.com/photo/1.2/t/Region#" Pattern match: "https://plus.google.com/share?url=http%3A//anydesk.com/" Pattern match: "plus.google.com/share?url=http%3A//anydesk.com/" Pattern match: "www.google.com/chrome/privacy/eula_text.html" Pattern match: "help.anydesk.com/share" Pattern match: "help.anydesk.com/access" Pattern match: "http://www.validationtest.contoso.com/test%ld.html"3b:T17e2,Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0h<0:08,http://www.microsoft.com/pki/certs/cspca.crt0jt;1_zw9gjs2r6$rofh&9ipnt8jo00p1+0)" - Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/tspca.crl0h<0:08,http://www.microsoft.com/pki/certs/tspca.crt0>gbt" - Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found URL "http://microsoft.com03l169-,!8washington1redmond1microsoft" - Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found URL "https://www.linkedin.com/sharearticle?mini=true&url=http%3a//anydesk.com/&title=try%20anydesk%20remote%20desktop&summary=anydesk%20is%20a%20small%20and%20quick%20solution%20for%20screen%20sharing%20and%20remote%20collaboration.%20get%20it%20here%3a%20http%3a//anydesk.com/&source=d.share.twitter.href=https://twitter.com/home?status=do%20you%20know%20%23anydesk?%20anydesk%20is%20a%20small%20and%20quick%20solution%20for%20screen%20sharing%20and%20remote%20collaboration.%20get%20it%20here%3a%20http%3a//anydesk.com/d.status.tooltip.access_denied=windows" - Source: "00000000-00002064.00000000.66608.033E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0h<0:08,http://www.microsoft.com/pki/certs/cspca.crt0jt;1_zw9gjs2r6$rofh&9ipnt8jo00p1+0)" - Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/tspca.crl0h<0:08,http://www.microsoft.com/pki/certs/tspca.crt0>gbt" - Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp") Found URL "http://microsoft.com03l169-,!8washington1redmond1microsoft" - Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0h<0:08,http://www.microsoft.com/pki/certs/cspca.crt0jt;1_zw9gjs2r6$rofh&9ipnt8jo00p1+0)" - Source: "00000000-00002240.00000001.68514.00D51000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/tspca.crl0h<0:08,http://www.microsoft.com/pki/certs/tspca.crt0>gbt" - Source: "00000000-00002240.00000001.68514.00D51000.00000004.mdmp") Found URL "http://microsoft.com03l169-,!8washington1redmond1microsoft" - Source: "00000000-00002240.00000001.68514.00D51000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0h<0:08,http://www.microsoft.com/pki/certs/cspca.crt0jt;1_zw9gjs2r6$rofh&9ipnt8jo00p1+0)" - Source: "00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/tspca.crl0h<0:08,http://www.microsoft.com/pki/certs/tspca.crt0>gbt" - Source: "00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found URL "http://microsoft.com03l169-,!8washington1redmond1microsoft" - Source: "00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found URL "http://nadobe.com/xap/1.0/stype/sourceref" - Source: "00000000-00003012.00000000.66453.018D0000.00000004.mdmp") Found URL "http://w-settings/1.0/xmpdmtp://ns.microsoft.com/phtax-ns" - Source: "00000000-00003012.00000000.66453.018D0000.00000004.mdmp") Found URL "http://purl.ompmmhttp://ns.adobe.comom/photoshop/1.0/tiff:\windows\system32\windows.storage.dllapp1exifunknowninteropapp0app13iptc8bimiptc8bimresinfo8bimiptcdigestthumbtextxmpstructxmpbagxmpseqxmpaltlogscrdescimgdescgrctlextappextcommentextchrominanceluminancegamabkgditxtchrmhisticcpsrgbtimeddsinfoheifpropsheifhdranimanmftiffwmphotoadngheifwebphttp://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00003012.00000000.66453.018D0000.00000004.mdmp") Found URL "https://plus.google.com/share?url=http%3a//anydesk.com/d.dlg.file.delete_confirm.msg=are" - Source: "00000000-00003012.00000000.66453.034B0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%ld.htmlmpoav_forcedeepscan" - Source: "00000000-00003012.00000000.66453.72581000.00000020.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0h<0:08,http://www.microsoft.com/pki/certs/cspca.crt0jt;1_zw9gjs2r6$rofh&9ipnt8jo00p1+0)" - Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/tspca.crl0h<0:08,http://www.microsoft.com/pki/certs/tspca.crt0>gbt" - Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found URL "http://microsoft.com03l169-,!8washington1redmond1microsoft" - Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found URL "http://nadobe.com/xap/1.0/stype/sourceref" - Source: "00000000-00003012.00000001.68372.018D0000.00000004.mdmp") Found URL "http://w-settings/1.0/xmpdmtp://ns.microsoft.com/phtax-ns" - Source: "00000000-00003012.00000001.68372.018D0000.00000004.mdmp") Found URL "http://purl.ompmmhttp://ns.adobe.comom/photoshop/1.0/tiff:\windows\system32\windows.storage.dllapp1exifunknowninteropapp0app13iptc8bimiptc8bimresinfo8bimiptcdigestthumbtextxmpstructxmpbagxmpseqxmpaltlogscrdescimgdescgrctlextappextcommentextchrominanceluminancegamabkgditxtchrmhisticcpsrgbtimeddsinfoheifpropsheifhdranimanmftiffwmphotoadngheifwebphttp://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00003012.00000001.68372.018D0000.00000004.mdmp") Found URL "http://nadobe.com/xap/1.0/stype/sourceref" - Source: "00000000-00003012.00000002.70292.018D0000.00000004.mdmp") Found URL "http://w-settings/1.0/xmpdmtp://ns.microsoft.com/phtax-ns" - Source: "00000000-00003012.00000002.70292.018D0000.00000004.mdmp") Found URL "http://purl.ompmmhttp://ns.adobe.comom/photoshop/1.0/tiff:\windows\system32\windows.storage.dllapp1exifunknowninteropapp0app13iptc8bimiptc8bimresinfo8bimiptcdigestthumbtextxmpstructxmpbagxmpseqxmpaltlogscrdescimgdescgrctlextappextcommentextchrominanceluminancegamabkgditxtchrmhisticcpsrgbtimeddsinfoheifpropsheifhdranimanmftiffwmphotoadngheifwebphttp://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00003012.00000002.70292.018D0000.00000004.mdmp") Found URL "https://plus.google.com/share?url=http%3a//anydesk.com/d.dlg.file.delete_confirm.msg=are" - Source: "00000000-00003012.00000002.70292.034B0000.00000004.mdmp")3c:T4da,GET /v9.0/oemdiscovery?oemId=&scmId=&phoneManufacturerName=&smBiosManufacturerName=2GwbgGNiZ25&phoneDeviceModel=&smBiosDm=ETlquY1qD3c HTTP/1.1Accept-Encoding: gzip deflate Accept: */* TASIGNORE: YES MS-PreciseDeviceFamilyVersion: 2814751249598118 User-Agent: WindowsStore/22310.1401.8.0 MS-CV: pGawDQ6o50eWp+yIaovHOA.1 Accept-Language: en-US Host: storeedgefd.dsx.mp.microsoft.com Connection: Keep-Alive GET /exp017/a5766fee-9478-488b-9fc0-64d1ad72c290-WindowsServices_Evoke/api/v1/tas HTTP/1.1Host: default.exp-tas.com Cache-Control: no-store no-cache X-PHOTOS-CALLERID: 9NMPJ99VJBWV X-EVOKE-RING: X-WINNEXT-RING: Public X-WINNEXT-TELEMETRYLEVEL: Basic X-WINNEXT-OSVERSION: 10.0.22621.0 X-WINNEXT-APPVERSION: 1.23092.158.0 X-WINNEXT-PLATFORM: Desktop X-WINNEXT-CANTAILOR: False X-MSEDGE-CLIENTID: {fe4289f0-6a0d-44ad-a249-527db813dcb0} X-WINNEXT-PUBDEVICEID: 36UTaMR5Mra1jEiOuip2QXJy2Ns7hzfP7l3bgBCDSdI= Accept-Encoding: gzip deflate br GET /geoversion?doClientVersion=10.1.0.7&profile=1048832 HTTP/1.1Connection: Keep-Alive Accept: */* Accept-Encoding: gzip deflate User-Agent: Microsoft-Delivery-Optimization/10.1 MS-CV: 8zMQBhoRgkOsq4kw.9.1.1 Content-Length: 0 Host: geover.prod.do.dsp.mp.microsoft.com3d:T5b6,Found HTTPS POST request to https://msedge.api.cdp.microsoft.com/api/v1.1/contents/Browser/namespaces/Default/names/msedgeupdate-stable-win-x86/versions/latest?action=select Found HTTPS POST request to https://msedge.api.cdp.microsoft.com/api/v1.1/internal/contents/Browser/namespaces/Default/names/msedgeupdate-stable-win-x86/versions/1.3.181.5/files?action=GenerateDownloadInfo&foregroundPriority=false Found HTTPS GET request to https://storeedgefd.dsx.mp.microsoft.com/v9.0/oemdiscovery?oemId=&scmId=&phoneManufacturerName=&smBiosManufacturerName=2GwbgGNiZ25&phoneDeviceModel=&smBiosDm=ETlquY1qD3c Found HTTPS GET request to https://default.exp-tas.com/exp017/a5766fee-9478-488b-9fc0-64d1ad72c290-WindowsServices_Evoke/api/v1/tas Found HTTPS POST request to https://msedge.api.cdp.microsoft.com/api/v2/contents/Browser/namespaces/Default/names?action=batchupdates Found HTTPS POST request to https://msedge.api.cdp.microsoft.com/api/v1.1/internal/contents/Browser/namespaces/Default/names/msedge-stable-win-x64/versions/119.0.2151.97/files?action=GenerateDownloadInfo&foregroundPriority=false Found HTTPS POST request to https://msedge.api.cdp.microsoft.com/api/v1.1/internal/contents/Browser/namespaces/Default/names/msedgewebview-stable-win-x64/versions/119.0.2151.97/files?action=GenerateDownloadInfo&foregroundPriority=false Found HTTPS GET request to https://geover.prod.do.dsp.mp.microsoft.com/geoversion?doClientVersion=10.1.0.7&profile=10488323e:Tb24,Found string "ncalrpc" (Indicator: "ncalrpc"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found string "ncalrpc" (Indicator: "ncalrpc"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found string "+ncalrpc:[OLE4C7F29BA28B70253E5FAD5A30FC1]" (Indicator: "ncalrpc"; Source: "00000000-00002240.00000000.66593.01890000.00000004.mdmp, 00000000-00002240.00000000.66593.018D0000.00000004.mdmp, 00000000-00002240.00000001.68514.01890000.00000004.mdmp, 00000000-00002240.00000002.70432.01890000.00000004.mdmp") Found string "+ncalrpc:[OLEC954314E6944F3C3DBBC39B07F21]" (Indicator: "ncalrpc"; Source: "00000000-00002240.00000000.66593.018D0000.00000004.mdmp, 00000000-00002240.00000001.68514.01890000.00000004.mdmp, 00000000-00002240.00000002.70432.018CD000.00000004.mdmp") Found string "K+ncalrpc:[OLE4C7F29BA28B70253E5FAD5A30FC1]" (Indicator: "ncalrpc"; Source: "00000000-00002240.00000000.66593.018D0000.00000004.mdmp, 00000000-00002240.00000001.68514.01890000.00000004.mdmp, 00000000-00002240.00000002.70432.018CD000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00002240.00000000.66593.018D0000.00000004.mdmp, 00000000-00002240.00000001.68514.01890000.00000004.mdmp, 00000000-00002240.00000002.70432.018CD000.00000004.mdmp") Found string "+ncalrpc:[OLE9B38869004E18D7351B8B2DF5443]" (Indicator: "ncalrpc"; Source: "00000000-00003012.00000000.66453.018D0000.00000004.mdmp, 00000000-00003012.00000001.68372.018D0000.00000004.mdmp, 00000000-00003012.00000002.70292.018D0000.00000004.mdmp") Found string "F+ncalrpc:[OLE9B38869004E18D7351B8B2DF5443]" (Indicator: "ncalrpc"; Source: "00000000-00003012.00000000.66453.018D0000.00000004.mdmp, 00000000-00003012.00000001.68372.018D0000.00000004.mdmp, 00000000-00003012.00000002.70292.018D0000.00000004.mdmp") Found string "+ncalrpc:[OLEB024C272ABE1AEE0EB40A7F16DE2]" (Indicator: "ncalrpc"; Source: "00000000-00003012.00000000.66453.018D0000.00000004.mdmp, 00000000-00003012.00000001.68372.018D0000.00000004.mdmp, 00000000-00003012.00000002.70292.018D0000.00000004.mdmp") Found string "B+ncalrpc:[OLEB024C272ABE1AEE0EB40A7F16DE2]" (Indicator: "ncalrpc"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") Found string "ncalrpc" (Indicator: "ncalrpc"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp")3f:T9e6,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp")40:T644,Found reference to API "wGetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00003012.00000000.66453.72581000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003012.00000000.66453.72581000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003012.00000000.66453.72581000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003012.00000000.66453.72581000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003012.00000000.66453.72581000.00000020.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003012.00000000.66453.72581000.00000020.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003012.00000000.66453.72581000.00000020.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp")41:T6bb,Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp")42:T40c,Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp")43:T4ec,Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp")44:T406,Found string "nyDesk password, user account password or user conf" (Indicator: "password"; Source: "00000000-00002064.00000000.66608.033E0000.00000004.mdmp") Found string "d.connect.share.password_preset=This AnyDesk uses a predefined password." (Indicator: "password"; Source: "00000000-00003012.00000000.66453.034B0000.00000004.mdmp, 00000000-00003012.00000002.70292.034B0000.00000004.mdmp") Found string "nyDesk password or user confirmation required." (Indicator: "password"; Source: "00000000-00003012.00000000.66453.034B0000.00000004.mdmp, 00000000-00003012.00000002.70292.034B0000.00000004.mdmp") Found string "alid password or user confirmation required." (Indicator: "password"; Source: "00000000-00003012.00000000.66453.034B0000.00000004.mdmp, 00000000-00003012.00000002.70292.034B0000.00000004.mdmp") Found string "ser account password or user confirmation required." (Indicator: "password"; Source: "00000000-00003012.00000000.66453.034B0000.00000004.mdmp, 00000000-00003012.00000002.70292.034B0000.00000004.mdmp")45:T1adf,Found string "MI.ExecQuery(SELECT SerialNumber FROM Win32_BaseBoard);" (Indicator: " Win32_BaseBoard"; Source: "00000000-00003012.00000000.66453.018D0000.00000004.mdmp") Found string "SELECT MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter = TRUE" (Indicator: " Win32_NetworkAdapte"; Source: "00000000-00003012.00000000.66453.018D0000.00000004.mdmp, 00000000-00003012.00000001.68372.018D0000.00000004.mdmp, 00000000-00003012.00000002.70292.018D0000.00000004.mdmp") Found string "SELECT MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter = TRUE" (Indicator: " Win32_NetworkAdapter"; Source: "00000000-00003012.00000000.66453.018D0000.00000004.mdmp, 00000000-00003012.00000001.68372.018D0000.00000004.mdmp, 00000000-00003012.00000002.70292.018D0000.00000004.mdmp") Found string "xecqueryselect macaddress from win32_networkadapter where physicaladapter = true" (Indicator: " Win32_NetworkAdapte"; Source: "00000000-00003012.00000000.66453.018D0000.00000004.mdmp, 00000000-00003012.00000001.68372.018D0000.00000004.mdmp, 00000000-00003012.00000002.70292.018D0000.00000004.mdmp") Found string "xecqueryselect macaddress from win32_networkadapter where physicaladapter = true" (Indicator: " Win32_NetworkAdapter"; Source: "00000000-00003012.00000000.66453.018D0000.00000004.mdmp, 00000000-00003012.00000001.68372.018D0000.00000004.mdmp, 00000000-00003012.00000002.70292.018D0000.00000004.mdmp") Found string "xecqueryselect serialnumber from win32_physicalmemory" (Indicator: " Win32_PhysicalMemory"; Source: "00000000-00003012.00000000.66453.018D0000.00000004.mdmp, 00000000-00003012.00000001.68372.018D0000.00000004.mdmp, 00000000-00003012.00000002.70292.018D0000.00000004.mdmp") Found string "xecqueryselect installdate from win32_operatingsystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00003012.00000000.66453.018D0000.00000004.mdmp, 00000000-00003012.00000001.68372.018D0000.00000004.mdmp, 00000000-00003012.00000002.70292.018D0000.00000004.mdmp") Found string "MI.ExecQuery(SELECT SerialNumber FROM Win32_PhysicalMemory);" (Indicator: " Win32_PhysicalMemory"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") Found string "MI.ExecQuery(SELECT InstallDate FROM Win32_OperatingSystem);" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") Found string "xecqueryselect serialnumber from win32_baseboard" (Indicator: " Win32_BaseBoard"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") Found string "xecqueryselect processorid from win32_processor" (Indicator: " Win32_Process"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp") Found string "xecqueryselect processorid from win32_processor" (Indicator: " Win32_Processor"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp") Found string "xecqueryselect serialnumber from win32_diskdrive" (Indicator: " Win32_DiskDrive"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") Found string "WMI.ExecQuery(SELECT ProcessorId FROM Win32_Processor);" (Indicator: " Win32_Process"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") Found string "WMI.ExecQuery(SELECT ProcessorId FROM Win32_Processor);" (Indicator: " Win32_Processor"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") Found string "rWMI.ExecQuery(SELECT SerialNumber FROM Win32_DiskDrive);" (Indicator: " Win32_DiskDrive"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") Found string "|WMI.ExecQuery(SELECT SerialNumber FROM Win32_PhysicalMemory);" (Indicator: " Win32_PhysicalMemory"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") Found string "rWMI.ExecQuery(SELECT SerialNumber FROM Win32_BaseBoard);" (Indicator: " Win32_BaseBoard"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") Found string "WMI.ExecQuery(SELECT MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter = TRUE);" (Indicator: " Win32_NetworkAdapte"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") Found string "WMI.ExecQuery(SELECT MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter = TRUE);" (Indicator: " Win32_NetworkAdapter"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") Found string "|WMI.ExecQuery(SELECT InstallDate FROM Win32_OperatingSystem);" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") Found string "SELECT InstallDate FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") Found string "MI.ExecQuery(SELECT MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter = TRUE);" (Indicator: " Win32_NetworkAdapte"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") Found string "MI.ExecQuery(SELECT MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter = TRUE);" (Indicator: " Win32_NetworkAdapter"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp")46:T1878,Found string "\Device\HarddiskVolume3\anydesk_5-4-2_fr_431427.exe" (Indicator: "\Device\"; Source: "00000000-00003012-00000BC0-40637907") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002064.00000000.66608.01850000.00000004.mdmp, 00000000-00002064.00000000.66608.01BC0000.00000004.mdmp, 00000000-00002064.00000000.66608.033E0000.00000004.mdmp, 00000000-00002064.00000001.68528.01850000.00000004.mdmp, 00000000-00002064.00000002.70448.01850000.00000004.mdmp, 00000000-00002064.00000002.70448.01BC0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002064.00000000.66608.01850000.00000004.mdmp, 00000000-00002064.00000000.66608.01BC0000.00000004.mdmp, 00000000-00002064.00000000.66608.033E0000.00000004.mdmp, 00000000-00002064.00000001.68528.01850000.00000004.mdmp, 00000000-00002064.00000002.70448.01850000.00000004.mdmp, 00000000-00002064.00000002.70448.01BC0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002064.00000000.66608.01850000.00000004.mdmp, 00000000-00002064.00000001.68528.01850000.00000004.mdmp, 00000000-00002064.00000002.70448.01850000.00000004.mdmp") Found string "tindows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002064.00000000.66608.01BC0000.00000004.mdmp, 00000000-00002064.00000002.70448.01BC0000.00000004.mdmp") Found string "tindows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002064.00000000.66608.01BC0000.00000004.mdmp, 00000000-00002064.00000002.70448.01BC0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002240.00000000.66593.01890000.00000004.mdmp, 00000000-00002240.00000000.66593.018D0000.00000004.mdmp, 00000000-00002240.00000000.66593.01AE0000.00000004.mdmp, 00000000-00002240.00000000.66593.03340000.00000004.mdmp, 00000000-00002240.00000001.68514.01890000.00000004.mdmp, 00000000-00002240.00000001.68514.01AE0000.00000004.mdmp, 00000000-00002240.00000001.68514.03340000.00000004.mdmp, 00000000-00002240.00000002.70432.01890000.00000004.mdmp, 00000000-00002240.00000002.70432.01921000.00000004.mdmp, 00000000-00002240.00000002.70432.01AE0000.00000004.mdmp, 00000000-00002240.00000002.70432.03340000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002240.00000000.66593.01890000.00000004.mdmp, 00000000-00002240.00000000.66593.018D0000.00000004.mdmp, 00000000-00002240.00000000.66593.01AE0000.00000004.mdmp, 00000000-00002240.00000000.66593.03340000.00000004.mdmp, 00000000-00002240.00000001.68514.01890000.00000004.mdmp, 00000000-00002240.00000001.68514.01AE0000.00000004.mdmp, 00000000-00002240.00000001.68514.03340000.00000004.mdmp, 00000000-00002240.00000002.70432.01890000.00000004.mdmp, 00000000-00002240.00000002.70432.01921000.00000004.mdmp, 00000000-00002240.00000002.70432.01AE0000.00000004.mdmp, 00000000-00002240.00000002.70432.03340000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002240.00000000.66593.01890000.00000004.mdmp, 00000000-00002240.00000001.68514.01890000.00000004.mdmp, 00000000-00002240.00000002.70432.01890000.00000004.mdmp") Found string "tindows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002240.00000000.66593.01AE0000.00000004.mdmp, 00000000-00002240.00000001.68514.01AE0000.00000004.mdmp, 00000000-00002240.00000002.70432.01AE0000.00000004.mdmp") Found string "tindows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002240.00000000.66593.01AE0000.00000004.mdmp, 00000000-00002240.00000001.68514.01AE0000.00000004.mdmp, 00000000-00002240.00000002.70432.01AE0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00003012.00000000.66453.018D0000.00000004.mdmp, 00000000-00003012.00000000.66453.01B00000.00000004.mdmp, 00000000-00003012.00000000.66453.034B0000.00000004.mdmp, 00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.018D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.018D0000.00000004.mdmp, 00000000-00003012.00000002.70292.01B00000.00000004.mdmp, 00000000-00003012.00000002.70292.034B0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00003012.00000000.66453.018D0000.00000004.mdmp, 00000000-00003012.00000000.66453.01B00000.00000004.mdmp, 00000000-00003012.00000000.66453.034B0000.00000004.mdmp, 00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.018D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.018D0000.00000004.mdmp, 00000000-00003012.00000002.70292.01B00000.00000004.mdmp, 00000000-00003012.00000002.70292.034B0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003012.00000000.66453.018D0000.00000004.mdmp, 00000000-00003012.00000001.68372.018D0000.00000004.mdmp, 00000000-00003012.00000002.70292.018D0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003012.00000000.66453.018D0000.00000004.mdmp, 00000000-00003012.00000001.68372.018D0000.00000004.mdmp, 00000000-00003012.00000002.70292.018D0000.00000004.mdmp") Found string "tindows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00003012.00000000.66453.01B00000.00000004.mdmp, 00000000-00003012.00000002.70292.01B00000.00000004.mdmp") Found string "tindows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00003012.00000000.66453.01B00000.00000004.mdmp, 00000000-00003012.00000002.70292.01B00000.00000004.mdmp")47:T55c,Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp")48:T43f,Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp")49:T511,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003012.00000000.66453.72581000.00000020.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp")4a:T93d,"anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\ANYDESK_5-4-2_FR_431427.EXE"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "anydesk_5-4-2_fr_431427.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "")4b:T403,Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00002064.00000000.66608.00D51000.00000004.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00003012.00000001.68372.00D51000.00000004.mdmp")4c:Tfc4,"MI.ExecQuery(SELECT SerialNumber FROM Win32_BaseBoard);" (Indicator: " win32_baseboard"; Source: "00000000-00003012.00000000.66453.018D0000.00000004.mdmp") "SELECT MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter = TRUE" (Indicator: " win32_networkadapter"; Source: "00000000-00003012.00000000.66453.018D0000.00000004.mdmp, 00000000-00003012.00000001.68372.018D0000.00000004.mdmp, 00000000-00003012.00000002.70292.018D0000.00000004.mdmp") "xecqueryselect macaddress from win32_networkadapter where physicaladapter = true" (Indicator: " win32_networkadapter"; Source: "00000000-00003012.00000000.66453.018D0000.00000004.mdmp, 00000000-00003012.00000001.68372.018D0000.00000004.mdmp, 00000000-00003012.00000002.70292.018D0000.00000004.mdmp") "xecqueryselect installdate from win32_operatingsystem" (Indicator: " win32_operatingsystem"; Source: "00000000-00003012.00000000.66453.018D0000.00000004.mdmp, 00000000-00003012.00000001.68372.018D0000.00000004.mdmp, 00000000-00003012.00000002.70292.018D0000.00000004.mdmp") "MI.ExecQuery(SELECT InstallDate FROM Win32_OperatingSystem);" (Indicator: " win32_operatingsystem"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") "xecqueryselect serialnumber from win32_baseboard" (Indicator: " win32_baseboard"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") "xecqueryselect processorid from win32_processor" (Indicator: " win32_process"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp") "xecqueryselect serialnumber from win32_diskdrive" (Indicator: " win32_diskdrive"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") "WMI.ExecQuery(SELECT ProcessorId FROM Win32_Processor);" (Indicator: " win32_process"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") "rWMI.ExecQuery(SELECT SerialNumber FROM Win32_DiskDrive);" (Indicator: " win32_diskdrive"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") "rWMI.ExecQuery(SELECT SerialNumber FROM Win32_BaseBoard);" (Indicator: " win32_baseboard"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") "WMI.ExecQuery(SELECT MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter = TRUE);" (Indicator: " win32_networkadapter"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") "|WMI.ExecQuery(SELECT InstallDate FROM Win32_OperatingSystem);" (Indicator: " win32_operatingsystem"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") "SELECT InstallDate FROM Win32_OperatingSystem" (Indicator: " win32_operatingsystem"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") "MI.ExecQuery(SELECT MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter = TRUE);" (Indicator: " win32_networkadapter"; Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp")4d:Te01,POST /api/v1.1/contents/Browser/namespaces/Default/names/msedgeupdate-stable-win-x86/versions/latest?action=select HTTP/1.1Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/json User-Agent: Microsoft Edge Update/1.3.151.27;winhttp X-Old-UID: {9906EEA6-CEDF-4A93-961E-BD0F0939FC14}; age=0; cnt=3 MS-CorrelationId: {956F90D3-F276-47E7-B710-7DD53E43093E} MS-RequestId: {FC5C013A-842A-49A0-BA5B-71A5BD8550D8} MS-CV: 05BvlXby50e3EH3VPkMJPg.0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Content-Length: 721 Host: msedge.api.cdp.microsoft.com with payload ==> {"targetingAttributes":{"AppAp":"" "AppBrandCode":"INBX" "AppCohort":"rrf@0.93" "AppCohortHint":"" "......., POST /api/v1.1/internal/contents/Browser/namespaces/Default/names/msedgeupdate-stable-win-x86/versions/1.3.181.5/files?action=GenerateDownloadInfo&foregroundPriority=false HTTP/1.1Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/json User-Agent: Microsoft Edge Update/1.3.151.27;winhttp X-Old-UID: {9906EEA6-CEDF-4A93-961E-BD0F0939FC14}; age=0; cnt=3 MS-CorrelationId: {956F90D3-F276-47E7-B710-7DD53E43093E} MS-RequestId: {E7795E47-89E9-44F1-A38D-BEAC288722D7} MS-CV: 05BvlXby50e3EH3VPkMJPg.1 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Content-Length: 2 Host: msedge.api.cdp.microsoft.com with payload ==> {}......., POST /api/v2/contents/Browser/namespaces/Default/names?action=batchupdates HTTP/1.1Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/json User-Agent: Microsoft Edge Update/1.3.181.5;winhttp X-Old-UID: {9906EEA6-CEDF-4A93-961E-BD0F0939FC14}; age=0; cnt=3 MS-CorrelationId: {50FCB814-2504-4035-823A-13673C6167C7} MS-RequestId: {6F2DEDED-3797-40E5-9832-977A2EDC2707} MS-CV: FLj8UAQlNUCCOhNnPGFnxw.0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Content-Length: 2579 Host: msedge.api.cdp.microsoft.com with payload ==> [{"Product":"msedgeupdate-stable-win-x86","targetingAttributes":{"AppAp":"","AppBrandCode":"INBX","A....... POST /api/v1.1/internal/contents/Browser/namespaces/Default/names/msedge-stable-win-x64/versions/119.0.2151.97/files?action=GenerateDownloadInfo&foregroundPriority=false HTTP/1.1Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/json User-Agent: Microsoft Edge Update/1.3.181.5;winhttp X-Old-UID: {9906EEA6-CEDF-4A93-961E-BD0F0939FC14}; age=0; cnt=3 MS-CorrelationId: {50FCB814-2504-4035-823A-13673C6167C7} MS-RequestId: {FEE67C2D-B541-4207-8970-19CCE12A0748} MS-CV: FLj8UAQlNUCCOhNnPGFnxw.1 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Content-Length: 2 Host: msedge.api.cdp.microsoft.com with payload ==> {}....... POST /api/v1.1/internal/contents/Browser/namespaces/Default/names/msedgewebview-stable-win-x64/versions/119.0.2151.97/files?action=GenerateDownloadInfo&foregroundPriority=false HTTP/1.1Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/json User-Agent: Microsoft Edge Update/1.3.181.5;winhttp X-Old-UID: {9906EEA6-CEDF-4A93-961E-BD0F0939FC14}; age=0; cnt=3 MS-CorrelationId: {50FCB814-2504-4035-823A-13673C6167C7} MS-RequestId: {ACCD3A8F-73E7-4A8C-BDE3-AE63E751F5A1} MS-CV: FLj8UAQlNUCCOhNnPGFnxw.2 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Content-Length: 2 Host: msedge.api.cdp.microsoft.com with payload ==> {}.......4e:T6bb,Found string "WMI.ExecQuery(SELECT ProcessorId FROM Win32_Processor);" (Indicator: "wmi.exe"; in Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") Found string "rWMI.ExecQuery(SELECT SerialNumber FROM Win32_DiskDrive);" (Indicator: "wmi.exe"; in Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") Found string "|WMI.ExecQuery(SELECT SerialNumber FROM Win32_PhysicalMemory);" (Indicator: "wmi.exe"; in Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") Found string "rWMI.ExecQuery(SELECT SerialNumber FROM Win32_BaseBoard);" (Indicator: "wmi.exe"; in Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") Found string "WMI.ExecQuery(SELECT MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter = TRUE);" (Indicator: "wmi.exe"; in Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp") Found string "|WMI.ExecQuery(SELECT InstallDate FROM Win32_OperatingSystem);" (Indicator: "wmi.exe"; in Source: "00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp")4f:T4fb,"anydesk_5-4-2_fr_431427.exe" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "Process32NextW with parameter System" (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "Process32NextW with parameter Registry" (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "Process32NextW with parameter smss.exe" (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "Process32NextW with parameter csrss.exe" (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "Process32NextW with parameter wininit.exe" (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "Process32NextW with parameter winlogon.exe" (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "Process32NextW with parameter services.exe" (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "Process32NextW with parameter lsass.exe" (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "Process32NextW with parameter svchost.exe" (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "Process32NextW with parameter fontdrvhost.exe" (UID: 00000000-00002240) "anydesk_5-4-2_fr_431427.exe" called "Process32NextW with parameter dwm.exe" (UID: 00000000-00002240)50:T9a6,"AnyDesk.exe" wrote bytes "60124574" to virtual address "0x74084028" (part of module "WEBIO.DLL") "AnyDesk.exe" wrote bytes "b840134574ffe0" to virtual address "0x75193AD8" (part of module "SSPICLI.DLL") "AnyDesk.exe" wrote bytes "d83a0200" to virtual address "0x75194E38" (part of module "SSPICLI.DLL") "AnyDesk.exe" wrote bytes "d83a0200" to virtual address "0x75194D78" (part of module "SSPICLI.DLL") "AnyDesk.exe" wrote bytes "d83a1975" to virtual address "0x751A0258" (part of module "SSPICLI.DLL") "AnyDesk.exe" wrote bytes "b4361975" to virtual address "0x751A0278" (part of module "SSPICLI.DLL") "AnyDesk.exe" wrote bytes "b4361975" to virtual address "0x751A025C" (part of module "SSPICLI.DLL") "AnyDesk.exe" wrote bytes "d83a1975" to virtual address "0x751A01FC" (part of module "SSPICLI.DLL") "AnyDesk.exe" wrote bytes "2e6974657874000000e8900000400000000000000000000000000000000000000000000020000060" to virtual address "0x001701F0" (part of module "ANYDESK.EXE") "AnyDesk.exe" wrote bytes "c0df8f771cf98e77ccf88e770d64907700000000c011d77500000000fc3ed77500000000e013d7750000000094571f7625e08f77c6e08f7700000000bc6a1e7600000000cf31d7750000000093191f76000000002c32d77500000000" to virtual address "0x75E71000" (part of module "NSI.DLL") "AnyDesk.exe" wrote bytes "f811d7752014d7754cbcd975f516d775a911d7758548d775b934d775a934d7756834d77500000000a56b1f75e4851f75e04d1f759cc01f75a3bf1f7592ae1f750c7d1f7500000000" to virtual address "0x74481000" (part of module "MSIMG32.DLL") "AnyDesk.exe" wrote bytes "71116d027a3b6c02ab8b02007f950200fc8c0200729602006cc805001ecd69027d266902" to virtual address "0x752807E4" (part of module "USER32.DLL") "AnyDesk.exe" wrote bytes "b8c0154574ffe0" to virtual address "0x751936B4" (part of module "SSPICLI.DLL") "AnyDesk.exe" wrote bytes "d83a1975" to virtual address "0x751A0274" (part of module "SSPICLI.DLL") "AnyDesk.exe" wrote bytes "b4360200" to virtual address "0x75194D68" (part of module "SSPICLI.DLL") "AnyDesk.exe" wrote bytes "68130000" to virtual address "0x76361680" (part of module "WS2_32.DLL") "AnyDesk.exe" wrote bytes "d83a1975" to virtual address "0x751A01E0" (part of module "SSPICLI.DLL") "AnyDesk.exe" wrote bytes "b4361975" to virtual address "0x751A0200" (part of module "SSPICLI.DLL") "AnyDesk.exe" wrote bytes "b4360200" to virtual address "0x75194EA4" (part of module "SSPICLI.DLL") "AnyDesk.exe" wrote bytes "b4361975" to virtual address "0x751A01E4" (part of module "SSPICLI.DLL")51:T60a,Found malicious artifacts related to "1.1.1.1": ... URL: http://moidoc.ignorelist.com/info_pdn.php> (AV positives: 1/72 scanned on 12/20/2019 02:11:33) URL: http://down.memkoo.cn/ (AV positives: 5/72 scanned on 12/20/2019 01:56:34) URL: http://azdown.net/ (AV positives: 1/72 scanned on 12/20/2019 00:23:09) URL: http://nlus-romania.ro/wp-includes/simplepie/data/6549624d8d2923a326f02dd676c5986b (AV positives: 10/72 scanned on 12/19/2019 23:11:48) URL: http://www.connect-freestyle.de/wp-dev/connectchaaseaccount/onlinechsesecuity/zchasex/dashboard/index.php (AV positives: 8/72 scanned on 12/19/2019 20:47:37) File SHA256: 91cfe734760bb8f46d5857b69b6dc4b2f000c98c1c70b662ba8975bb82d1f412 (Date: 12/20/2019 01:11:55) File SHA256: 6f1b85ff0df2e6b8fbd37d230f28ed4f6905cb36267fb2ce99220546c76f8b4d (Date: 12/20/2019 00:12:16) File SHA256: 9143ae097acc89060a3f14fc588c10b879437de8cdb4d247489d5ad8956eee4f (Date: 12/19/2019 05:06:32) File SHA256: bba631cc2421ed8bcf2fa36342c246b3fbba6353494cd6278485680171499fbf (Date: 12/19/2019 05:06:28) File SHA256: 83cd53d42f276d88109b9491f9afa0526e41f800083e0ce8953fc8cb9d7151f7 (Date: 12/19/2019 05:06:04) File SHA256: 1c6c32f969e7f5d9bd7a3361388643db8955b8d3bf72c5fb73ea1b989702ab3e (AV positives: 1/71 scanned on 10/27/2019 01:32:01) File SHA256: 9f89814b48fc3249bf67a8a6e4439d97391b10b99f02b3da9e38345be1f1ed3f (AV positives: 1/72 scanned on 09/18/2019 22:43:06) File SHA256: 0773b94a2e3239eeda0d02f32d8beea116783b48172c116c9b6b382338f8be13 (AV positives: 23/62 scanned on 04/16/2018 02:49:06)52:Tc4a,"info 2023-01-08 12:06:00.344 front 5728 6044 impl_selector - using sse2 (intrinsics)" (Indicator: "select") "warning 2023-01-08 12:08:00.791 front 5728 6044 internal - Could not open process 6880 (0x00000002)." (Indicator: "open") "info 2023-01-08 11:52:00.460 lsvc 4072 3748 impl_selector - using sse2 (intrinsics)" (Indicator: "select") "info 2023-01-08 11:52:00.648 lsvc 4072 3748 1 app.service - Starting the connector." (Indicator: "connect") "info 2023-01-08 11:52:00.648 lsvc 4072 3748 1 anynet.connection_mgr - Generating a new certificate and key." (Indicator: "connect") "info 2023-01-08 11:54:00.868 lsvc 4072 3748 1 anynet.connection_mgr - 2 CA certificate(s) loaded." (Indicator: "connect") "info 2023-01-08 11:54:00.883 lsvc 4072 3748 1 app.service - Setting up the listen sockets." (Indicator: "socket") "info 2023-01-08 11:54:00.899 lsvc 4072 3748 2 anynet.connection_mgr - Starting connection manager fiber." (Indicator: "connect") "info 2023-01-08 11:54:00.899 lsvc 4072 3748 3 anynet.main_relay_conn - Starting main relay connection." (Indicator: "connect") "info 2023-01-08 11:54:00.899 lsvc 4072 3748 3 anynet.main_relay_conn - No connect addresses found. Starting with boot relays." (Indicator: "connect") "info 2023-01-08 11:54:00.899 lsvc 4072 3748 3 anynet.relay_connector - New execution plan:" (Indicator: "connect") "info 2023-01-08 11:54:00.914 lsvc 4072 3748 3 anynet.relay_connector - Relay 0:" (Indicator: "connect") "info 2023-01-08 11:54:00.914 lsvc 4072 3748 3 anynet.relay_connector - boot-01.net.anydesk.com:443 (ID 1, offset 0)" (Indicator: "connect") "info 2023-01-08 11:54:00.914 lsvc 4072 3748 3 anynet.relay_connector - boot-01.net.anydesk.com:80 (ID 3, offset 2000)" (Indicator: "connect") "info 2023-01-08 11:54:00.914 lsvc 4072 3748 3 anynet.relay_connector - boot-01.net.anydesk.com:6568 (ID 5, offset 4000)" (Indicator: "connect") "info 2023-01-08 11:54:00.914 lsvc 4072 3748 3 anynet.relay_connector - boot-01.net.anydesk.com:443 (ID 7, offset 6000, with proxy)" (Indicator: "connect") "info 2023-01-08 11:54:00.914 lsvc 4072 3748 3 anynet.relay_connector - boot-01.net.anydesk.com:80 (ID 9, offset 8000, with proxy)" (Indicator: "connect") "info 2023-01-08 11:54:00.914 lsvc 4072 3748 3 anynet.relay_connector - boot-01.net.anydesk.com:6568 (ID 11, offset 10000, with proxy)" (Indicator: "connect") "info 2023-01-08 11:54:00.914 lsvc 4072 3748 3 anynet.relay_connector - Relay 1:" (Indicator: "connect") "info 2023-01-08 11:54:00.914 lsvc 4072 3748 3 anynet.relay_connector - boot-02.net.anydesk.com:443 (ID 13, offset 12000)" (Indicator: "connect")53:T6cc,"BARTBehkaA4180175187623885384.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "BARTBehkaA4180175187623885384.exe" trying to access non-existent file "C:\BARTBEHKAA4180175187623885384.EXE.LOCAL" "BARTBehkaA4180175187623885384.exe" trying to access non-existent file "C:\BARTBehkaA4180175187623885384.exe.Local\" "BARTBehkaA4180175187623885384.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "BARTBehkaA4180175187623885384.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "BARTBehkaA4180175187623885384.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Explorer\ICONCACHETODELETE" "BARTBehkaA4180175187623885384.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Explorer\IconCacheToDelete" "BARTBehkaA4180175187623885384.exe" trying to access non-existent file "C:\Users\Public\AccountPictures\S-1-5-21-735145574-3570218355-1207367261-1001" "BARTBehkaA4180175187623885384.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75FDACD8330BAC18.CUSTOMDESTINATIONS-MS" "BARTBehkaA4180175187623885384.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PUSZDUVVPUS0U8SEEY4F.TEMP" "BARTBehkaA4180175187623885384.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PUSZDUVVPUS0U8SEEY4F.temp" "BARTBehkaA4180175187623885384.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms"54:T461,"BARTBehkaA4180175187623885384.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Ole" (Filter: 268435457; Subtree: 1478509824) "BARTBehkaA4180175187623885384.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\Local Settings\Software\Microsoft" (Filter: 268435457; Subtree: 1478509825) "BARTBehkaA4180175187623885384.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes" (Filter: 268435461; Subtree: 1478509825) "BARTBehkaA4180175187623885384.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes" (Filter: 268435461; Subtree: 16514305) "BARTBehkaA4180175187623885384.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 18505728) "BARTBehkaA4180175187623885384.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 18505216) "BARTBehkaA4180175187623885384.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes" (Filter: 268435461; Subtree: 70902529)55:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZiJmZiJmZmZmZmZmZmZmZmP+JmP+JmZmZmZmZmZmZmY//+JmP+JmZmZmZmZmZmZj///+JmP+JmZmZmZmZmZmP////+JmP+JmZmZmZmZmY//////+JmP+JmZmZmZmZj///////+JmP+JmZmZmZmY////////iZj/iZmZmZmZmY//////+JmP+JmZmZmZmZmY/////4mY/4mZmZmZmZmZmY////iZj/iZmZmZmZmZmZmY//+JmP+JmZmZmZmZmZmZmY/4mY/4mZmZmZmZmZmZmZmYiZmYiZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"b9ad79eaf7a4133f95f24c3b9d976c72f34264dc5c99030f0e57992cb5621f78","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790365722803,"unified_at":"2026-09-25T19:48:42.803Z","metadata":{"hashes":{"sha256":"b9ad79eaf7a4133f95f24c3b9d976c72f34264dc5c99030f0e57992cb5621f78","sha1":"df6abbfd20e731689f3c7d2a55f45ac83fbbc40b","md5":"eb80f7bddb699784baa9fbf2941eaf4a","sha512":"3a1162e9fef849cb7143dc1898d4cfcfd87eb80ced0edb321dfa096686b25ae8a9a7f3ae8f37a09724d94f96d64e08940fc23c0b931ddd8a1e70e2792cb3fe47","ssdeep":"98304:6aJXyQTrRGlSMoIuORmKBQielvZlpkiSti:3olMcR9BTY3WS","ssdeep_chunks":["98304:6aJXyQT","98304:aJXyQTr","98304:JXyQTrR","98304:XyQTrRG","98304:yQTrRGl","98304:QTrRGlS","98304:TrRGlSM","98304:rRGlSMo","98304:RGlSMoI","98304:GlSMoIu","98304:lSMoIuO","98304:SMoIuOR","98304:MoIuORm","98304:oIuORmK","98304:IuORmKB","98304:uORmKBQ","98304:ORmKBQi","98304:RmKBQie","98304:mKBQiel","98304:KBQielv","98304:BQielvZ","98304:QielvZl","98304:ielvZlp","98304:elvZlpk","98304:lvZlpki","98304:vZlpkiS","98304:ZlpkiSt","98304:lpkiSti","196608:6aJXyQT","196608:aJXyQTr","196608:JXyQTrR","196608:XyQTrRG","196608:yQTrRGl","196608:QTrRGlS","196608:TrRGlSM","196608:rRGlSMo","196608:RGlSMoI","196608:GlSMoIu","196608:lSMoIuO","196608:SMoIuOR","196608:MoIuORm","196608:oIuORmK","196608:IuORmKB","196608:uORmKBQ","196608:ORmKBQi","196608:RmKBQie","196608:mKBQiel","196608:KBQielv","196608:BQielvZ","196608:QielvZl","196608:ielvZlp","196608:elvZlpk","196608:lvZlpki","196608:vZlpkiS","196608:ZlpkiSt","196608:lpkiSti","98304:3olMcR9","98304:olMcR9B","98304:lMcR9BT","98304:McR9BTY","98304:cR9BTY3","98304:R9BTY3W","98304:9BTY3WS"]},"file_info":{"file_name":"AnyDesk.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":3153872,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1576808217000,"last_seen":1761398182000,"last_multi_scan":1761398182000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["tag","0day","rce","inject","spyware","corporateinject","sniffer","fipeg","evasive","windows-server-utility","hacktool","metasploit","meterpreter","mofksys","sality","swrort","autorun","tenga"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":64},"sandbox_signatures":{"informative_count":155,"suspicious_count":34,"malicious_count":8,"total":197},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.lgkg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Digital Certificates","attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Contains ability to access the loader directly (API string)"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"},{"type":"informative","value":"Contains reference to Hijacked CLSID(s)"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Defense Evasion","technique":"Clear Windows Event Logs","attack_id":"T1070.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve event logs (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Process deletes itself"},{"type":"malicious","value":"Tries to hide tracks of having downloaded a file from the internet"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Contains ability to detect virtual environment"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"informative","value":"The input sample is signed with a valid certificate"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file contains unusual section name"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"References to WMI query strings used to retrieve network adapter information"},{"type":"informative","value":"References to WMI query strings used to retrieve disk information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Contains the ability to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Reads the windows installation language"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1116","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Process deletes itself"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"tactic":"Command and Control","technique":"Commonly Used Port","attack_id":"T1043","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1043","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"}],"sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"RtlCreateUserThread\" (Indicator: \"RtlCreateUserThread\"; Source: \"00000000-00002064.00000000.66608.00D51000.00000004.mdmp\")\n Found reference to API \"RtlCreateUserThread\" (Indicator: \"RtlCreateUserThread\"; Source: \"00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$22","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002064.00000000.66608.00D51000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$23","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$24","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00003012.00000000.66453.725B9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00002064.00000000.66608.00D51000.00000004.mdmp\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00003012.00000000.66453.046D0000.00000004.mdmp\n 00000000-00003012.00000001.68372.046D0000.00000004.mdmp\n 00000000-00003012.00000002.70292.046D0000.00000004.mdmp\n Observed string: \"amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00003012.00000000.66453.046D0000.00000004.mdmp\n 00000000-00003012.00000001.68372.046D0000.00000004.mdmp\n 00000000-00003012.00000002.70292.046D0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002064.00000000.66608.00D51000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002240.00000000.66593.00D51000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002240.00000001.68514.00D51000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002240.00000002.70432.00D51000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003012.00000001.68372.00D51000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"\"anydesk_5-4-2_fr_431427.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\67HTOQOORI364D6CSTGW.temp\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\75fdacd8330bac18.customDestinations-ms\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".itext\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"file/memory contains long string with (Indicator: \"private key\"; Source: \"00000000-00002240.00000000.66593.03340000.00000004.mdmp, 00000000-00002240.00000001.68514.03340000.00000004.mdmp, 00000000-00002240.00000002.70432.03340000.00000004.mdmp\")\n Found string \"----BEGIN PRIVATE KEY-----\" (Indicator: \"private key\"; Source: \"00000000-00002240.00000000.66593.03340000.00000004.mdmp, 00000000-00002240.00000001.68514.03340000.00000004.mdmp, 00000000-00002240.00000002.70432.03340000.00000004.mdmp\")\n Found string \"-----END PRIVATE KEY-----\" (Indicator: \"private key\"; Source: \"00000000-00002240.00000000.66593.03340000.00000004.mdmp, 00000000-00002240.00000001.68514.03340000.00000004.mdmp, 00000000-00002240.00000002.70432.03340000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.999084845406342","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Reads the cryptographic machine GUID","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"anydesk_5-4-2_fr_431427.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002240)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"anydesk_5-4-2_fr_431427.exe\" called \"IsWow64Process\" with parameter \"3012\" - (UID: 00000000-00003012)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"anydesk_5-4-2_fr_431427.exe\" called \"GetWindowTextW\" with parameter \"New Connection\" - (UID: 00000000-00003012)\n \"anydesk_5-4-2_fr_431427.exe\" called \"GetWindowTextW\" with parameter \"Browse Files\" - (UID: 00000000-00003012)\n \"anydesk_5-4-2_fr_431427.exe\" called \"GetWindowTextW\" with parameter \"Connect\" - (UID: 00000000-00003012)\n \"anydesk_5-4-2_fr_431427.exe\" called \"GetWindowTextW\" with parameter \"3000\" - (UID: 00000000-00003012)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"anydesk_5-4-2_fr_431427.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003012)\n \"anydesk_5-4-2_fr_431427.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002240)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$25","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002064.00000000.66608.00D51000.00000004.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003012.00000001.68372.00D51000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"anydesk_5-4-2_fr_431427.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"anydesk_5-4-2_fr_431427.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002064.00000000.66608.00D51000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"\"anydesk_5-4-2_fr_431427.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"anydesk_5-4-2_fr_431427.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{45F5205B-FA7A-11ED-8886-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"anydesk_5-4-2_fr_431427.exe\" queries volume information of \"C:\\\" at 00000000-00003012-00000C15-39444484","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"anydesk_5-4-2_fr_431427.exe\" queries volume information of \"C:\\\" at 00000000-00003012-00000C15-39444484","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"anydesk_5-4-2_fr_431427.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"anydesk_5-4-2_fr_431427.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"anydesk_5-4-2_fr_431427.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\ANYDESK\")\n \"anydesk_5-4-2_fr_431427.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ANYDESK_5-4-2_FR_431427.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"xecqueryselect processorid from win32_processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp\")\n Found string \"WMI.ExecQuery(SELECT ProcessorId FROM Win32_Processor);\" (Indicator: \" Win32_Process\"; Source: \"00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used to retrieve disk information","description":"Found string \"xecqueryselect serialnumber from win32_diskdrive\" (Indicator: \" Win32_DiskDrive\"; Source: \"00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp\")\n Found string \"rWMI.ExecQuery(SELECT SerialNumber FROM Win32_DiskDrive);\" (Indicator: \" Win32_DiskDrive\"; Source: \"00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-514","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used to retrieve network adapter information","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-515","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"\"anydesk_5-4-2_fr_431427.exe\" trying to touch file \"\\Device\\HarddiskVolume3\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"anydesk_5-4-2_fr_431427.exe\" trying to touch file \"\\Device\\HarddiskVolume3\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\75fdacd8330bac18.customDestinations-ms\"\n \"anydesk_5-4-2_fr_431427.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\67HTOQOORI364D6CSTGW.temp\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET POLICY SSL/TLS Certificate Observed (AnyDesk Remote Desktop Software)\" (SID: 2027761, Rev: 5, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/43 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"anydesk_5-4-2_fr_431427.exe\" called \"CreateProcessW\" with parameter \"\"C:\\anydesk_5-4-2_fr_431427.exe\" --local-service\" - (UID: 00000000-00003012)\n \"anydesk_5-4-2_fr_431427.exe\" called \"CreateProcessW\" with parameter \"\"C:\\anydesk_5-4-2_fr_431427.exe\" --local-control\" - (UID: 00000000-00003012)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"92.223.88.7:443\"\n \"92.223.88.7:80\"\n \"92.223.88.7:6568\"\n \"37.59.29.33:443\"\n \"37.59.29.33:80\"\n \"37.59.29.33:6568\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\Buildbot\\ad-windows-32\\build\\release\\app-32\\win_loader\\AnyDesk.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter = TRUE\" (Source: 00000000-00003012.00000000.66453.018D0000.00000004.mdmp, 00000000-00003012.00000001.68372.018D0000.00000004.mdmp, 00000000-00003012.00000002.70292.018D0000.00000004.mdmp, Indicator: \"select macaddress from win32_networkadapter where physicaladapter = true\")\n \"SELECT InstallDate FROM Win32_OperatingSystem\" (Source: 00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp, Indicator: \"select installdate from win32_operatingsystem\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00003012.00000000.66453.725B9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002064.00000000.66608.00D51000.00000004.mdmp\")\n Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp\")\n Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003012.00000001.68372.00D51000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"Win32API|Device Input and Output Functions|DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00003012.00000000.66453.018D0000.00000004.mdmp, 00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.018D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.018D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp\")\n Found reference to API \"evice Input and Output Functions|DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003012.00000000.66453.725B9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00003012.00000000.66453.725B9000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00003012.00000000.66453.725B9000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00003012.00000000.66453.725B9000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00003012.00000000.66453.725B9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003012.00000000.66453.725B9000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003012.00000000.66453.725B9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\"C:\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \"c:\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00003012.00000000.66453.018D0000.00000004.mdmp\n 00000000-00003012.00000001.68372.018D0000.00000004.mdmp\n 00000000-00003012.00000002.70292.018D0000.00000004.mdmp\n \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \"c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00003012.00000000.66453.018D0000.00000004.mdmp\n 00000000-00003012.00000001.68372.018D0000.00000004.mdmp\n 00000000-00003012.00000002.70292.018D0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$31","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00003012.00000000.66453.725B9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:3012:168:WilStaging_02\"\n \"ad_mailbox_3012_1859988187_1_mtx\"\n \"Local\\SM0:3012:64:WilError_03\"\n \"ad_542_lsystem_mtx\"\n \"ad_connect_queue_2240_1881503917_mtx\"\n \"ad_mailbox_3012_1859988187_0_mtx\"\n \"Session\\1\\ad_connect_queue_2240_1881503917_mtx\"\n \"Session\\1\\ad_mailbox_2064_1883800540_0_mtx\"\n \"Session\\1\\ad_mailbox_3012_1859988187_0_mtx\"\n \"Local\\SM0:2240:168:WilStaging_02\"\n \"Session\\1\\ad_mailbox_2064_1883800540_1_mtx\"\n \"Session\\1\\ad_mailbox_3012_1859988187_1_mtx\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"anydesk_5-4-2_fr_431427.exe\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"anydesk_5-4-2_fr_431427.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 712F0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"anydesk_5-4-2_fr_431427.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75BD0000\n \"anydesk_5-4-2_fr_431427.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72180000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"anydesk_5-4-2_fr_431427.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76BE0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"anydesk_5-4-2_fr_431427.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"anydesk_5-4-2_fr_431427.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$33","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"anydesk_5-4-2_fr_431427.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"anydesk_5-4-2_fr_431427.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"anydesk_5-4-2_fr_431427.exe\" has an writable section named \".itext\"\n \"anydesk_5-4-2_fr_431427.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"anydesk_5-4-2_fr_431427.exe\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,sub\tesp, 0x64,push\tesi,lea\tecx, [ebp - 0x64],call\t0x4016e6,lea\teax, [ebp - 0x64],mov\tecx, eax,mov\tdword ptr [0x100bc78], eax,call\t0x4015b3,test\tal, al,jne\t0x401d1d,mov\tesi, 0x3e8,lea\tecx, [ebp - 0x64],call\t0x4015b2,mov\teax, esi,pop\tesi,leave\t,ret\t,lea\teax, [ebp - 0x64],push\teax,lea\tecx, [ebp - 0x30],call\t0x4013f7,lea\teax, [ebp - 0x30],mov\tecx, eax,mov\tdword ptr [0x100bc7c], eax,call\t0x40139e,test\tal, al,jne\t0x401d4b,lea\tecx, [ebp - 0x30],call\t0x40138f,mov\tesi, 0x3e9,jmp\t0x401d10,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".data\" is \"0x2f7e00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".itext\" is \"0x90e800\" greater than 0x100000\n Virtual size of \".data\" is \"0x2f8084\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"anydesk_5-4-2_fr_431427.exe\" (UID: 00000000-00002240) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"anydesk_5-4-2_fr_431427.exe\" (UID: 00000000-00002240) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"boot-01.net.anydesk.com\"\n \"boot-02.net.anydesk.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"anydesk_5-4-2_fr_431427.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"anydesk_5-4-2_fr_431427.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"anydesk_5-4-2_fr_431427.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"anydesk_5-4-2_fr_431427.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"anydesk_5-4-2_fr_431427.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00003012-00000C25-41463118]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"General","name":"Sample shows a variety of benign indicators","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","origin":"Indicator Combinations","relevance":10,"id":"summary-6","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"anydesk_5-4-2_fr_431427.exe\" with commandline \"--local-service\" (UID: 00000000-00002240)\n Spawned process \"anydesk_5-4-2_fr_431427.exe\" with commandline \"--local-control\" (UID: 00000000-00002064)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"anydesk_5-4-2_fr_431427.exe\" with commandline \"--local-service\" (UID: 00000000-00002240)\n Spawned process \"anydesk_5-4-2_fr_431427.exe\" with commandline \"--local-control\" (UID: 00000000-00002064)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 8F:2D:E7:E7:70:A8:B1:E4:12:C2:DE:13:10:64:D7:A5:2D:A6:22:87; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 92:C1:58:8E:85:AF:22:01:CE:79:15:E8:53:8B:49:2F:60:5B:80:C6; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Assured ID CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 61:4D:27:1D:91:02:E3:01:69:82:24:87:FD:E5:DE:00:A3:52:B0:1D; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 19:A0:9B:5A:36:F4:DD:99:72:7D:F7:83:C1:7A:51:23:1A:56:C1:17; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"anydesk_5-4-2_fr_431427.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to access the loader directly (API string)","description":"Found reference to API \"LdrLoadDll\" (Indicator: \"LdrLoadDll\"; Source: \"00000000-00002064.00000000.66608.00D51000.00000004.mdmp\")\n Found reference to API \"LdrLoadDll\" (Indicator: \"LdrLoadDll\"; Source: \"00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1129","relevance":1,"id":"string-548","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"anydesk_5-4-2_fr_431427.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"service.conf\" has type \"ASCII text with very long lines\"- Location: [%APPDATA%\\AnyDesk\\service.conf]- [targetUID: 00000000-00003012]\n \"user.conf\" has type \"ASCII text\"- Location: [%APPDATA%\\AnyDesk\\user.conf]- [targetUID: 00000000-00003012]\n \"system.conf\" has type \"ASCII text\"- Location: [%APPDATA%\\AnyDesk\\system.conf]- [targetUID: 00000000-00003012]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"anydesk_5-4-2_fr_431427.exe\" queries basic process information of the \"C:\\anydesk_5-4-2_fr_431427.exe\" (UID: 3012)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to detect virtual environment","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"anydesk_5-4-2_fr_431427.exe\" touched file \"\\Device\\HarddiskVolume3\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Explorer\"\n \"anydesk_5-4-2_fr_431427.exe\" touched file \"\\Device\\HarddiskVolume3\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"anydesk_5-4-2_fr_431427.exe\" touched file \"\\Device\\HarddiskVolume3\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"anydesk_5-4-2_fr_431427.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\67HTOQOORI364D6CSTGW.temp\"\n \"anydesk_5-4-2_fr_431427.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\67HTOQOORI364D6CSTGW.temp\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"anydesk_5-4-2_fr_431427.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\rpcss.dll\"\n \"anydesk_5-4-2_fr_431427.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\wbem\\wbemcomn.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"anydesk_5-4-2_fr_431427.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\anydesk\\ad.trace\"\n \"anydesk_5-4-2_fr_431427.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\anydesk\\user.conf\"\n \"anydesk_5-4-2_fr_431427.exe\" writes file \"\\device\\namedpipe\\srvsvc\"\n \"anydesk_5-4-2_fr_431427.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\67htoqoori364d6cstgw.temp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"5.4.2.0\"\n \"192.168.242.130\"\n \"39.255.102.18\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3b","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"$3c","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$3d","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"92.223.88.7\" on port \"443\"\n HTTPS traffic to \"37.59.29.33\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"anydesk_5-4-2_fr_431427.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"50398972\"\n \"cx\": \"32\"\n \"cy\": \"32\"}\n \"anydesk_5-4-2_fr_431427.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"50398972\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"anydesk_5-4-2_fr_431427.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"67875\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"anydesk_5-4-2_fr_431427.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"68375\"\n \"cx\": \"1296\"\n \"cy\": \"768\"}\n \"anydesk_5-4-2_fr_431427.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"838928733\"\n \"cx\": \"1\"\n \"cy\": \"1\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"anydesk_5-4-2_fr_431427.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"anydesk_5-4-2_fr_431427.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"15\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"anydesk_5-4-2_fr_431427.exe\" called \"GetComputerNameW\" (UID: 00000000-00003012)\n \"anydesk_5-4-2_fr_431427.exe\" called \"GetComputerNameW\" (UID: 00000000-00002240)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"anydesk_5-4-2_fr_431427.exe\" called \"GetUserNameW\" (UID: 00000000-00003012)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"anydesk_5-4-2_fr_431427.exe\" called \"FindFirstFileW\" with parameter %PUBLIC%\\AccountPictures\\S-1-5-21-1271187874-1938232448-3812392235-1001\\* (UID: 00000000-00003012)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"d.welcome.encryption.2nd=TLS makes AnyDesk as secure as online banking. The identity of the participants is verified by our server network.\" (Indicator: \".encrypt\"; Source: \"00000000-00002064.00000000.66608.033E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00002064.00000000.66608.00D51000.00000004.mdmp\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp\")\n Found reference to API \"9164647286,1724,3155,,CreateCompatibleBitmap,Gdi32.dll,\"00:17:17.921\",RX=0,PX=0\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00003012.00000000.66453.046D0000.00000004.mdmp\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00003012.00000001.68372.00D51000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00003012.00000000.66453.725B9000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003012.00000000.66453.725B9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00003012.00000000.66453.725B9000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00003012.00000000.66453.725B9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002064.00000000.66608.00D51000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003012.00000001.68372.00D51000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002064.00000000.66608.00D51000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003012.00000000.66453.725B9000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002064.00000000.66608.00D51000.00000004.mdmp\")\n Found reference to API \"LdrGetProcedureAddress\" (Indicator: \"LdrGetProcedureAddress\"; Source: \"00000000-00002064.00000000.66608.00D51000.00000004.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp\")\n Found reference to API \"LdrGetProcedureAddress\" (Indicator: \"LdrGetProcedureAddress\"; Source: \"00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00002064.00000000.66608.00D51000.00000004.mdmp\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00003012.00000001.68372.00D51000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve event logs (API string)","description":"Found reference to API \"OpenEventLogA\" (Indicator: \"OpenEventLog\"; Source: \"00000000-00002064.00000000.66608.00D51000.00000004.mdmp\")\n Found reference to API \"OpenEventLogA\" (Indicator: \"OpenEventLog\"; Source: \"00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp\")\n Found reference to API \"OpenEventLogA\" (Indicator: \"OpenEventLog\"; Source: \"00000000-00003012.00000001.68372.00D51000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.001","relevance":1,"id":"string-237","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"3830191454,3244,3024,,RtlGetVersion,NTDLL.dll,\"00:17:15.703\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003012.00000000.66453.046D0000.00000004.mdmp, 00000000-00003012.00000001.68372.046D0000.00000004.mdmp, 00000000-00003012.00000002.70292.046D0000.00000004.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003012.00000000.66453.725B9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00002064.00000000.66608.00D51000.00000004.mdmp\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00003012.00000001.68372.00D51000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002064.00000000.66608.00D51000.00000004.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00003012.00000001.68372.00D51000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00003012.00000000.66453.72581000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$44","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"anydesk_5-4-2_fr_431427.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$45","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$46","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcessWithToken\"; Source: \"00000000-00002064.00000000.66608.00D51000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002064.00000000.66608.00D51000.00000004.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002240.00000000.66593.00D51000.00000004.mdmp, 00000000-00002240.00000001.68514.00D51000.00000004.mdmp, 00000000-00002240.00000002.70432.00D51000.00000004.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003012.00000000.66453.725B9000.00000002.mdmp, 00000000-00003012.00000001.68372.00D51000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\" (Indicator: \"{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\") in Source: 00000000-00002240.00000000.66593.01890000.00000004.mdmp\n 00000000-00002240.00000001.68514.01890000.00000004.mdmp\n 00000000-00002240.00000002.70432.01890000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"anydesk_5-4-2_fr_431427.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\ANYDESK_5-4-2_FR_431427.EXE\"; Value: \"D6983F70572ADA0100000000000000000000000002000000\")\n \"anydesk_5-4-2_fr_431427.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\ANYDESK_5-4-2_FR_431427.EXE\"; Value: \"CBF96070572ADA0100000000000000000000000002000000\")\n \"anydesk_5-4-2_fr_431427.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"67HTOQOORI364D6CSTGW.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\67HTOQOORI364D6CSTGW.temp]- [targetUID: 00000000-00003012]\n Dropped file: \"service.conf\" - Location: [%APPDATA%\\AnyDesk\\service.conf]- [targetUID: 00000000-00003012]\n Dropped file: \"user.conf\" - Location: [%APPDATA%\\AnyDesk\\user.conf]- [targetUID: 00000000-00003012]\n Dropped file: \"system.conf\" - Location: [%APPDATA%\\AnyDesk\\system.conf]- [targetUID: 00000000-00003012]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"anydesk_5-4-2_fr_431427.exe\" was detected as \"Borland Delphi 3.0 (???)\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"SystemRoot%\\system32\\dashost.exe\" (Indicator: \"dashost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"anydesk_5-4-2_fr_431427.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"anydesk_5-4-2_fr_431427.exe\" queried SystemProcessInformation at 00000000-00003012-00000C13-39576549 [PID: 3012]\n \"anydesk_5-4-2_fr_431427.exe\" queried SystemProcessInformation at 00000000-00003012-00000C13-39578246 [PID: 3012]\n \"anydesk_5-4-2_fr_431427.exe\" queried SystemProcessInformation at 00000000-00003012-00000C13-40133687 [PID: 3012]\n \"anydesk_5-4-2_fr_431427.exe\" queried SystemProcessInformation at 00000000-00003012-00000C13-40135332 [PID: 3012]\n \"anydesk_5-4-2_fr_431427.exe\" queried SystemProcessInformation at 00000000-00002240-00000C13-41909506 [PID: 2240]\n \"anydesk_5-4-2_fr_431427.exe\" queried SystemProcessInformation at 00000000-00002240-00000C13-41911262 [PID: 2240]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".data with unusual entropies 7.99994039551","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"\"anydesk_5-4-2_fr_431427.exe\" called \"CryptAcquireContextW\" with parameters {\"phProv\": \"e04f8c0100199372\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531840\"}\n \"anydesk_5-4-2_fr_431427.exe\" called \"CryptAcquireContextW\" with parameters {\"phProv\": \"e04f8c0100199372\"\n \"szProvider\": \"Intel Hardware Cryptographic Service Provider\"\n \"dwProvType\": \"22\"\n \"dwFlags\": \"0\"\n \"$error\": \"80090019\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"anydesk_5-4-2_fr_431427.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0\"; Key: \"PROCESSORNAMESTRING\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques using MAC address detection","description":"\"\\?\\Volume{44104292-2b3c-11ee-88a7-00505691a833}\\\" (Indicator: \"005056\")\n \"00:50:56:91:7D:76\" (Indicator: \"00:50:56\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":10,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"anydesk_5-4-2_fr_431427.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"anydesk_5-4-2_fr_431427.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"anydesk_5-4-2_fr_431427.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"anydesk_5-4-2_fr_431427.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"anydesk_5-4-2_fr_431427.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"anydesk_5-4-2_fr_431427.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"anydesk_5-4-2_fr_431427.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"suspicious","category":"Network Related","name":"POSTs data to a webserver (HTTPS)","description":"$4d","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-67","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 92.223.88.7 on port 443 is sent without HTTP header\n TCP traffic to 92.223.88.7 on port 80 is sent without HTTP header\n TCP traffic to 37.59.29.33 on port 443 is sent without HTTP header\n TCP traffic to 37.59.29.33 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"C:\\anydesk_5-4-2_fr_431427.exe\" connects to 92.223.88.7 on port 443 (TCP); Domain: \"boot-01.net.anydesk.com\"\n Process \"C:\\anydesk_5-4-2_fr_431427.exe\" connects to 92.223.88.7 on port 80 (TCP); Domain: \"boot-01.net.anydesk.com\"\n Process \"C:\\anydesk_5-4-2_fr_431427.exe\" connects to 92.223.88.7 on port 6568 (TCP); Domain: \"boot-01.net.anydesk.com\"\n Process \"C:\\anydesk_5-4-2_fr_431427.exe\" connects to 37.59.29.33 on port 443 (TCP); Domain: \"boot-02.net.anydesk.com\"\n Process \"C:\\anydesk_5-4-2_fr_431427.exe\" connects to 37.59.29.33 on port 80 (TCP); Domain: \"boot-02.net.anydesk.com\"\n Process \"C:\\anydesk_5-4-2_fr_431427.exe\" connects to 37.59.29.33 on port 6568 (TCP); Domain: \"boot-02.net.anydesk.com\"","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"anydesk_5-4-2_fr_431427.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"anydesk_5-4-2_fr_431427.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"anydesk_5-4-2_fr_431427.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"anydesk_5-4-2_fr_431427.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"91\"}\n \"anydesk_5-4-2_fr_431427.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"92\"}\n \"anydesk_5-4-2_fr_431427.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"164\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$4f","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"he specified hostname could not be resolved.\" (Indicator: \"hostname\"; Source: \"00000000-00003012.00000000.66453.034B0000.00000004.mdmp, 00000000-00003012.00000002.70292.034B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"anydesk_5-4-2_fr_431427.exe\" opened \"C:\\anydesk_5-4-2_fr_431427.exe:Zone.Identifier\" with delete access\n \"anydesk_5-4-2_fr_431427.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\67HTOQOORI364D6CSTGW.temp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"anydesk_5-4-2_fr_431427.exe\" has a section named \".itext\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to hide tracks of having downloaded a file from the internet","description":"\"anydesk_5-4-2_fr_431427.exe\" opened \"C:\\anydesk_5-4-2_fr_431427.exe:Zone.Identifier\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-42","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"anydesk_5-4-2_fr_431427.exe\" wrote 00000004 bytes to a remote process \"C:\\anydesk_5-4-2_fr_431427.exe\" (Handle: 1512)\n \"anydesk_5-4-2_fr_431427.exe\" wrote 00000004 bytes to a remote process \"C:\\anydesk_5-4-2_fr_431427.exe\" (Handle: 1508)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 92.223.88.7 on port 6568\n TCP traffic to 37.59.29.33 on port 6568","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"AnyDesk.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"AnyDesk.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"AnyDesk.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Process deletes itself","description":"\"C:\\AnyDesk.exe\" deletes itself","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-27","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"AnyDesk.exe\" at 00011066-00003288-00000033-11241108417\n \"AnyDesk.exe\" at 00011504-00002728-00000033-23297875331","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"AnyDesk.exe\" is protecting 8192 bytes with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"AnyDesk.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/72 reputation engines marked \"https://www.digicert.com\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"AnyDesk.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 1.1.1.1\"\n \"UDP connection to 9.9.9.9\"","origin":"Network Traffic","mitre_attack_id":"T1043","relevance":7,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\AnyDesk.exe\" marked \"C:\\AnyDesk.exe:Zone.Identifier\" for deletion\n \"C:\\AnyDesk.exe\" marked \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\75fdacd8330bac18.customDestinations-ms~RF65287.TMP\" for deletion","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$50","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/21 Antivirus vendors marked sample as malicious (4% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"1/81 Antivirus vendors marked spawned process \"AnyDesk.exe\" (PID: 2728) as malicious (classified as \"Trojan.Heur\" with 1% detection rate)\n 1/81 Antivirus vendors marked spawned process \"AnyDesk.exe\" (PID: 3056) as malicious (classified as \"Trojan.Heur\" with 1% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"AnyDesk.exe\" allocated memory in \"\\Sessions\\1\\BaseNamedObjects\\ad_mailbox_3288_2299010326_0_shm\"\n \"AnyDesk.exe\" allocated memory in \"%APPDATA%\\AnyDesk\\service.conf\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$51","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetUserDefaultUILanguage@KERNEL32.dll at 13857-1458-1001D200","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"api.playanext.com\"\n \"boot-01.net.anydesk.com\"\n \"relay-b9f41fe2.net.anydesk.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"AnyDesk.exe\" created file \"%TEMP%\\gcapi.dll\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"gcapi.dll\" as clean (type is \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 40 calls to GetProcAddress@KERNEL32.dll at 13857-2720-100203B7","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"gcapi.dll.818606085\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.dll at 13857-1941-10042BB8\n LoadResource@KERNEL32.dll at 13857-1942-10042CE9","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"gcapi.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"gcapi.dll\" claimed CRC 0 while the actual is CRC 3215736","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegCloseKey\n OpenProcessToken\n RegDeleteValueW\n RegOpenKeyExW\n RegDeleteKeyW\n CreateProcessAsUserW\n GetDriveTypeW\n GetFileAttributesW\n UnhandledExceptionFilter\n GetTempPathW\n OutputDebugStringA\n OutputDebugStringW\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryExA\n LoadLibraryExW\n TerminateProcess\n GetModuleHandleExW\n GetVersionExW\n GetTickCount\n VirtualProtect\n OpenProcess\n GetStartupInfoW\n CreateDirectoryW\n DeleteFileW\n WriteFile\n FindFirstFileExA\n FindNextFileA\n GetProcAddress\n CreateFileW\n LockResource\n GetCommandLineW\n GetCommandLineA\n GetModuleHandleW\n FindResourceW\n CreateProcessW\n Sleep\n GetWindowThreadProcessId","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"BARTBehkaA4180175187623885384.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\AnyDesk (UID: 00000000-00004072)\n \"BARTBehkaA4180175187623885384.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\AnyDesk (UID: 00000000-00007488)","origin":"API Call","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$52","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"General","name":"PE file contains data exceeding the last FAT sector (overlay)","description":"Pe file has overlay in b9ad79eaf7a4133f95f24c3b9d976c72f34264dc5c99030f0e57992cb5621f78.bin","origin":"Static Parser","relevance":1,"id":"static-131","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"\"https://www.digicert.com/CPS0\" (Indicator: \"https://\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Tries to access non-existent files","description":"$53","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Detects sample launching another instance of itself","description":"C:\\BARTBehkaA4180175187623885384.exe","origin":"API Call","relevance":8,"id":"api-8704","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$54","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\"BARTBehkaA4180175187623885384.exe\" adjusted SE_DEBUG_PRIVILEGE","origin":"API Call","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"level":"malicious","category":"Network Related","name":"Contacts very many different hosts","description":"Contacted 12 (or more) hosts in at least 2 different countries","origin":"Network Traffic","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Tries to hide tracks of having downloaded a file from the internet"},{"detail":"Possibly tries to implement anti-virtualization techniques using MAC address detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":114,"imported_dlls_count":144,"dropped_files_count":0,"extracted_files_count":11,"files_written_count":40,"files_deleted_count":0,"registry_keys_created_count":14,"registry_keys_modified_count":0,"registry_keys_deleted_count":3,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":17,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":25,"dns_resolutions_count":4,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["tag","0day","rce","inject","spyware","corporateinject","sniffer","fipeg","evasive","windows-server-utility","hacktool","metasploit","meterpreter","mofksys","sality","swrort","autorun","tenga"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","User Comment","TOR analysis"],"sandbox_reports":[{"id":"65737abcf37669ecf900a59f","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"no specific threat","contacted_countries":["AUT","FRA"],"submit_name":"anydesk_5-4-2_fr_431427.exe","analysis_start_time":"2023-12-08T20:21:17+00:00","indicators_count":{"informative":143,"suspicious":26,"malicious":3},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"63baaccac2d9540155717424","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"no specific threat","malware_family":"Trojan.Generic","contacted_countries":["CZE","DEU"],"submit_name":"BARTBehkaA4180175187623885384.exe","analysis_start_time":"2023-01-08T11:45:15+00:00","indicators_count":{"informative":44,"suspicious":21,"malicious":6},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"5e22b37d56178a3ee070d86b","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Heur","contacted_countries":["DEU","USA"],"submit_name":"AnyDesk.exe","analysis_start_time":"2020-01-18T07:28:10+00:00","indicators_count":{"informative":25,"suspicious":32,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"5dfc2d07f7b6f70187776505","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Heur","contacted_countries":["AUS","USA"],"submit_name":"AnyDesk.exe","analysis_start_time":"2019-12-20T02:08:21+00:00","indicators_count":{"informative":21,"suspicious":22,"malicious":6},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"92.223.88.7","port":443,"protocol":"TCP","country":"Austria","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"address":"92.223.88.7","port":80,"protocol":"TCP","country":"Austria","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"address":"92.223.88.7","port":6568,"protocol":"TCP","country":"Austria","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"address":"37.59.29.33","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"address":"37.59.29.33","port":80,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"address":"37.59.29.33","port":6568,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"address":"1.1.1.1","port":53,"protocol":"UDP","country":"Australia","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"address":"9.9.9.9","port":53,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"address":"134.119.217.177","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"address":"134.119.217.177","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"address":"148.72.170.90","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"address":"148.72.170.90","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"address":"52.40.55.253","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"address":"185.229.191.41","port":443,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"address":"185.229.191.41","port":80,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"address":"185.229.191.41","port":6568,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"address":"88.198.34.103","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"address":"88.198.34.103","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"address":"88.198.34.103","port":6568,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"address":"213.239.219.11","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"address":"213.239.219.11","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"address":"213.239.219.11","port":6568,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"address":"49.12.130.237","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"address":"49.12.130.237","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"address":"49.12.130.237","port":6568,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]}],"dns_resolutions":[{"domain":"boot-01.net.anydesk.com","address":"92.223.88.7","ttl":210,"country":"Austria","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"domain":"boot-02.net.anydesk.com","address":"37.59.29.33","ttl":181,"country":"France","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"domain":"api.playanext.com","address":"54.200.132.60","ttl":3599,"country":"United States","registrar_name":"GoDaddy.com, LLC","registrar_organization":"Domains By Proxy, LLC","registrar_name_servers":"NS59.DOMAINCONTROL.COM","registrar_creation_date":"2017-07-05T18:57:51+00:00","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"domain":"relay-b9f41fe2.net.anydesk.com","address":"148.72.170.90","ttl":21081,"country":"United States","registrar_name":"Hetzner Online GmbH","registrar_organization":"philandro Software GmbH","registrar_creation_date":"2004-02-07T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}],"processes":[{"pid":3012,"ppid":0,"name":"anydesk_5-4-2_fr_431427.exe","command_line":"","sha256":"b9ad79eaf7a4133f95f24c3b9d976c72f34264dc5c99030f0e57992cb5621f78","normalized_path":"C:\\anydesk_5-4-2_fr_431427.exe","uid":"00000000-00003012","icon":"$55"},{"pid":2240,"ppid":3012,"name":"anydesk_5-4-2_fr_431427.exe","command_line":"--local-service","sha256":"b9ad79eaf7a4133f95f24c3b9d976c72f34264dc5c99030f0e57992cb5621f78","normalized_path":"C:\\anydesk_5-4-2_fr_431427.exe","parent_uid":"00000000-00003012","uid":"00000000-00002240"},{"pid":2064,"ppid":3012,"name":"anydesk_5-4-2_fr_431427.exe","command_line":"--local-control","sha256":"b9ad79eaf7a4133f95f24c3b9d976c72f34264dc5c99030f0e57992cb5621f78","normalized_path":"C:\\anydesk_5-4-2_fr_431427.exe","parent_uid":"00000000-00003012","uid":"00000000-00002064"}],"all_imported_dlls":["rasadhlp.dll","ntdll.dll","kernel32.dll","rpcrt4.dll","gdi32full.dll","clbcatq.dll","msvcp110_win.dll","propsys.dll","cryptbase.dll","user32.dll","crypt32.dll","srvcli.dll","ExplorerFrame.dll","wbemcomn.dll","fwpolicyiomgr.dll","IPHLPAPI.DLL","nsi.dll","SHCore.dll","fastprox.dll","FirewallAPI.dll","rsaenh.dll","dhcpcsvc6.dll","dhcpcsvc.dll","KernelBase.dll","ntshrui.dll","fltLib.dll","setupapi.dll","thumbcache.dll","userenv.dll","ucrtbase.dll","ws2_32.dll","msvcp_win.dll","ntmarta.dll","sspicli.dll","cfgmgr32.dll","amsi.dll","cryptsp.dll","wow64.dll","shell32.dll","uxtheme.dll","msctf.dll","TextInputFramework.dll","shlwapi.dll","oleaut32.dll","version.dll","wkscli.dll","wow64base.dll","combase.dll","TextShaping.dll","wtsapi32.dll","MpOAV.dll","netprofm.dll","wow64con.dll","winmm.dll","advapi32.dll","netutils.dll","samcli.dll","dnsapi.dll","OnDemandConnRouteHelper.dll","FWPUCLNT.DLL","wow64win.dll","linkinfo.dll","bcrypt.dll","CoreMessaging.dll","CoreUIComponents.dll","DataExchange.dll","imm32.dll","comctl32.dll","policymanager.dll","fwbase.dll","npmproxy.dll","wow64cpu.dll","ole32.dll","winhttp.dll","kernel.appcore.dll","WinTypes.dll","VxSSL32.dll","cscapi.dll","wbemsvc.dll","msvcrt.dll","win32u.dll","sechost.dll","msimg32.dll","dwmapi.dll","twinapi.appcore.dll","wbemprox.dll","windows.storage.dll","profapi.dll","WindowsCodecs.dll","netapi32.dll","gdi32.dll","GdiPlus.dll","bcryptprimitives.dll","mswsock.dll","imageres.dll","Wldap32.dll","msvcr110.dll","xmllite.dll","api-ms-win-downlevel-user32-l1-1-0.dll","usp10.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","msvcp110.dll","webio.dll","LoggingPlatform.dll","slc.dll","duser.dll","nlaapi.dll","devobj.dll","wsock32.dll","iertutil.dll","dui70.dll","FileSyncShell.dll","normaliz.dll","EhStorShell.dll","winnsi.dll","wininet.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","lpk.dll","psapi.dll","cabinet.dll","msasn1.dll","msvcr100.dll","api-ms-win-downlevel-version-l1-1-0.dll","ntdsapi.dll","credssp.dll","wship6.dll","apphelp.dll","RpcRtRemote.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","WSHTCPIP.DLL","Telemetry.dll","cscui.dll","api-ms-win-core-synch-l1-2-0.dll","cscdll.dll","gcapi.dll","rpcss.dll","cldapi.dll","d3d11.dll","aepic.dll","dxgi.dll","powrprof.dll","rmclient.dll","winmmbase.dll","dcomp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"service.conf","sha256":"7ea4a3255514cd01622089d3d9338d66382c0fc1cb75a3b0c794b4f485457667","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"system.conf","sha256":"6c5170f3284b6ce164a936489137c68e1af2fe43ca4e84cee5da89da5ae2e112","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"user.conf","sha256":"3d0f04781a3165698b2e6e3399673edd3825537fdc95aca537b97a49dd84df2b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"67HTOQOORI364D6CSTGW.temp","sha256":"6bf7f8b9e2953def9c7eab796c1e223ec34b7b449a3d5e33dae619482628dd56","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"name":"QDROTPGJXIKKGYB4LRID.temp","sha256":"a3f22ade5f314cdc98ec88a2d4e97f360d7d3bb434370b3bc60b1039fb27faa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"name":"ad.trace","sha256":"860057cae87e21ea9f54865a2ece6ddcf62807e38f129bf069d06f52d03b1a82","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"2ZMGQMYCLCC1JJARB5IB.temp","sha256":"a3f22ade5f314cdc98ec88a2d4e97f360d7d3bb434370b3bc60b1039fb27faa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"name":"gcapi.dll","sha256":"73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"name":"9ROM09G5HV30AWQQT88I.temp","sha256":"77b0eaed2d8d1718d58427719dc12d728034d6a524b0448ea3cf2dea8785eb15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"name":"CH9AXZTMB59DFD1D78IO.temp","sha256":"77b0eaed2d8d1718d58427719dc12d728034d6a524b0448ea3cf2dea8785eb15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"name":"PUSZDUVVPUS0U8SEEY4F.temp","sha256":"9b9bbd6ca4ae3cdc2703ab41cbf97f967a59158781beeb0c7246db07ecba5160","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]}],"files_written":[{"path":"%APPDATA%\\AnyDesk\\ad.trace","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"path":"%APPDATA%\\AnyDesk\\user.conf","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\67HTOQOORI364D6CSTGW.temp","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"path":"%APPDATA%\\AnyDesk\\system.conf","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"path":"%APPDATA%\\AnyDesk\\service.conf","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"},{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"path":"%APPDATA%\\AnyDesk","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"path":"%WINDIR%\\SysWOW64\\EhStorShell.dll","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\EhStorShell.dll.mui","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"path":"%WINDIR%\\SysWOW64\\ntshrui.dll","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\ntshrui.dll.mui","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"path":"%WINDIR%\\SysWOW64\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"path":"C:\\AnyDesk.exe","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"path":"%TEMP%\\%OSUSER%.bmp","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\75fdacd8330bac18.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001f.db","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"path":"%WINDIR%\\System32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"path":"%TEMP%\\PGJ2cI9.bmp","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"path":"%TEMP%\\gcapi.dll","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"key":"HKLM\\SOFTWARE\\GOOGLE\\GCAPITEMP\\","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"key":"HKLM\\SOFTWARE\\GOOGLE\\NO CHROME OFFER UNTIL\\","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"key":"HKCU\\SOFTWARE\\GOOGLE\\NO CHROME OFFER UNTIL\\","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"key":"HKCU\\SOFTWARE\\GOOGLE\\","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLM\\SOFTWARE\\GOOGLE\\GCAPITEMP\\TEST\\TEST","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"key":"HKLM\\SOFTWARE\\GOOGLE\\GCAPITEMP\\","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"key":"HKLM\\SOFTWARE\\GOOGLE\\NO CHROME OFFER UNTIL\\PHILANDRO SOFTWARE GMBH\\PHILANDRO SOFTWARE GMBH","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:3012:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"name":"ad_mailbox_3012_1859988187_1_mtx","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"name":"Local\\SM0:3012:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"name":"ad_542_lsystem_mtx","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"name":"ad_connect_queue_2240_1881503917_mtx","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"name":"ad_mailbox_3012_1859988187_0_mtx","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"name":"Session\\1\\ad_connect_queue_2240_1881503917_mtx","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"name":"Session\\1\\ad_mailbox_2064_1883800540_0_mtx","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"name":"Session\\1\\ad_mailbox_3012_1859988187_0_mtx","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"name":"Local\\SM0:2240:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"name":"Session\\1\\ad_mailbox_2064_1883800540_1_mtx","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"name":"Session\\1\\ad_mailbox_3012_1859988187_1_mtx","sources":[{"report_type":"sandbox","report_id":"65737abcf37669ecf900a59f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ad_trace_mtx","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Local\\ad_mailbox_3288_2299010326_1_mtx","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"name":"Local\\ad_trace_mtx","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Local\\ad_542_lsystem_mtx","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Session\\1\\ad_connect_queue_2728_2367291576_mtx","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"name":"Local\\ad_mailbox_3288_2299010326_0_mtx","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ad_542_lsystem_mtx","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"},{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"},{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ad_mailbox_3288_2299010326_0_mtx","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ad_mailbox_3288_2299010326_1_mtx","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Session\\1\\ad_connect_queue_2728_2367291576_mtx","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Session\\1\\ad_mailbox_3288_2299010326_1_mtx","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Session\\1\\ad_mailbox_3288_2299010326_0_mtx","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Session\\1\\ad_mailbox_3056_2368697826_1_mtx","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Session\\1\\ad_mailbox_3056_2368697826_0_mtx","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"name":"Session\\1\\ad_mailbox_3288_2299010326_1_mtx","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"name":"Session\\1\\ad_mailbox_3056_2368697826_0_mtx","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"name":"Session\\1\\ad_mailbox_3056_2368697826_1_mtx","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"name":"Session\\1\\ad_mailbox_3288_2299010326_0_mtx","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ad_mailbox_3056_2368697826_0_mtx","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ad_mailbox_3056_2368697826_1_mtx","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"name":"Local\\ad_mailbox_3056_2368697826_0_mtx","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"name":"Local\\ad_mailbox_3056_2368697826_1_mtx","sources":[{"report_type":"sandbox","report_id":"5dfc2d07f7b6f70187776505"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ad_mailbox_3516_118250892_0_mtx","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ad_mailbox_3516_118250892_1_mtx","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Session\\1\\ad_connect_queue_3560_187782142_mtx","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"name":"Session\\1\\ad_connect_queue_3560_187782142_mtx","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"name":"Local\\ad_mailbox_3516_118250892_0_mtx","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"name":"Local\\ad_mailbox_3516_118250892_1_mtx","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Session\\1\\ad_mailbox_3516_118250892_1_mtx","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Session\\1\\ad_mailbox_3516_118250892_0_mtx","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Session\\1\\ad_mailbox_1340_189032142_1_mtx","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Session\\1\\ad_mailbox_1340_189032142_0_mtx","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"name":"Session\\1\\ad_mailbox_1340_189032142_0_mtx","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"name":"Session\\1\\ad_mailbox_1340_189032142_1_mtx","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"name":"Session\\1\\ad_mailbox_3516_118250892_0_mtx","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"name":"Session\\1\\ad_mailbox_3516_118250892_1_mtx","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"name":"Local\\ad_mailbox_1340_189032142_0_mtx","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"name":"Local\\ad_mailbox_1340_189032142_1_mtx","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ad_mailbox_1340_189032142_0_mtx","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ad_mailbox_1340_189032142_1_mtx","sources":[{"report_type":"sandbox","report_id":"5e22b37d56178a3ee070d86b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5728:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5728:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Local\\SM0:5728:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Local\\ad_mailbox_5728_3755766241_1_mtx","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Session\\1\\ad_connect_queue_4072_1770012570_mtx","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Local\\SM0:5728:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Local\\ad_mailbox_5728_3755766241_0_mtx","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ad_mailbox_5728_3755766241_0_mtx","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ad_mailbox_5728_3755766241_1_mtx","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Session\\1\\ad_connect_queue_4072_1770012570_mtx","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4072:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Session\\1\\ad_mailbox_5728_3755766241_1_mtx","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Session\\1\\ad_mailbox_5728_3755766241_0_mtx","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Local\\SM0:4072:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Session\\1\\ad_mailbox_7488_2966365045_1_mtx","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Session\\1\\ad_mailbox_7488_2966365045_0_mtx","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Session\\1\\ad_mailbox_5728_3755766241_1_mtx","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Session\\1\\ad_mailbox_5728_3755766241_0_mtx","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Session\\1\\ad_mailbox_7488_2966365045_1_mtx","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Session\\1\\ad_mailbox_7488_2966365045_0_mtx","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ad_mailbox_7488_2966365045_0_mtx","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ad_mailbox_7488_2966365045_1_mtx","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Local\\SM0:7488:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Local\\ad_mailbox_7488_2966365045_1_mtx","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Local\\SM0:7488:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"Local\\ad_mailbox_7488_2966365045_0_mtx","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7488:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7488:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"63baaccac2d9540155717424"}]}]}},"report_ids":{"sandbox_job_ids":["5e22b37d56178a3ee070d86b","5dfc2d07f7b6f70187776505","65737abcf37669ecf900a59f","63baaccac2d9540155717424"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Generic Sample b9ad79eaf7a4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b9ad79eaf7a4…. Malware family: Trojan.Generic. Threat score 100/100. 1/28 AV engines flagged this file. 8 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b9ad79eaf7a4133f95f24c3b9d976c72f34264dc5c99030f0e57992cb5621f78"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample b9ad79eaf7a4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b9ad79eaf7a4…. Malware family: Trojan.Generic. Threat score 100/100. 1/28 AV engines flagged this file. 8 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b9ad79eaf7a4133f95f24c3b9d976c72f34264dc5c99030f0e57992cb5621f78"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample b9ad79eaf7a4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b9ad79eaf7a4…. Malware family: Trojan.Generic. Threat score 100/100. 1/28 AV engines flagged this file. 8 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L56","11",{}]]