Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
05-01-2021 05:07
Static task
static1
Behavioral task
behavioral1
Sample
AnyDesk.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
AnyDesk.exe
Resource
win10v20201028
General
-
Target
AnyDesk.exe
-
Size
262KB
-
MD5
53e7b9e873404afdd22cdeba41b4e1c9
-
SHA1
18b1a19f826e9d48d5776f6e3c279547f3ff517d
-
SHA256
c34d0660da24b48480de58aaa394bd27f5a5b1ed9249d897ca4dde70312a87ec
-
SHA512
ccc0af85ea847c45d11e213030e6b3224503c22fe70519049095b1d84cbf61e50c72ab370a03e456338127b52d462826248a6413706ab900afac16adf1deb9dd
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\readme-warning.txt
makop
moloch_helpdesk@tutanota.com
moloch_helpdesk@protonmail.ch
Signatures
-
Makop
Ransomware family discovered by @VK_Intel in early 2020.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
svchost.exedescription pid process target process PID 2220 created 948 2220 svchost.exe AnyDesk.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Processes:
wbadmin.exepid process 2148 wbadmin.exe -
Modifies Installed Components in the registry 2 TTPs
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
AnyDesk.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\FindResize.tiff AnyDesk.exe File opened for modification C:\Users\Admin\Pictures\PushDisable.tiff AnyDesk.exe -
Loads dropped DLL 2 IoCs
Processes:
AnyDesk.exeAnyDesk.exepid process 648 AnyDesk.exe 1520 AnyDesk.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
AnyDesk.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AnyDesk.exe\"" AnyDesk.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
explorer.exedescription ioc process File opened (read-only) \??\D: explorer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
AnyDesk.exeAnyDesk.exedescription pid process target process PID 648 set thread context of 948 648 AnyDesk.exe AnyDesk.exe PID 1520 set thread context of 2544 1520 AnyDesk.exe AnyDesk.exe -
Drops file in Program Files directory 17742 IoCs
Processes:
AnyDesk.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Autumn\autumn_1d.png AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Jumbo\mask\13h.png AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\SmallTile.scale-100.png AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-16_altform-unplated.png AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\manifestAssets\contrast-black\StoreLogo.scale-100.png AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Fues\Background.html AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Light.scale-100.png AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxAccountsSplashLogo.scale-100.png AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\SmallTile.scale-100.png AnyDesk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sk-sk\ui-strings.js AnyDesk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\selector.js AnyDesk.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ppd.xrm-ms AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\beer.png AnyDesk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\add-comment.png AnyDesk.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\readme-warning.txt AnyDesk.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fi-fi\readme-warning.txt AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-256_altform-unplated_contrast-white.png AnyDesk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\selector.js AnyDesk.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-pl.xrm-ms AnyDesk.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\readme-warning.txt AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\OneConnectStoreLogo.scale-100.png AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\brokenheart.png AnyDesk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-tw\ui-strings.js AnyDesk.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ru-ru\readme-warning.txt AnyDesk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-warning@4x.png AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\82.png AnyDesk.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fi-fi\readme-warning.txt AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Jumbo\mask\12c.png AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupLargeTile.scale-400.png AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\contrast-white\DashboardDefaultThumbnail.png AnyDesk.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\readme-warning.txt AnyDesk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.White.png AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\AppxManifest.xml AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\tk_16x11.png AnyDesk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-cn\ui-strings.js AnyDesk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\ui-strings.js AnyDesk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\main.css AnyDesk.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\jaccess.jar AnyDesk.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-phn.xrm-ms AnyDesk.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\BLUECALM.INF AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Common\ReadMe.txt AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-24.png AnyDesk.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\security\US_export_policy.jar AnyDesk.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\readme-warning.txt AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\186.png AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-72.png AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailBadge.scale-100.png AnyDesk.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul.xrm-ms AnyDesk.exe File created C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\readme-warning.txt AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\highfive.scale-200.png AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarLargeTile.scale-200.png AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreBadgeLogo.scale-200.png AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\AchievementUnlocked.mp3 AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemePreview\Themes\beach.mobile.jpg AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Autumn\autumn_1h.png AnyDesk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL AnyDesk.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-fr\readme-warning.txt AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageMedTile.scale-200.png AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\ninja.png AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\me_60x42.png AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_LogoSmall.targetsize-32.png AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageBadgeLogo.scale-200_contrast-black.png AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\PeopleAppList.targetsize-48.png AnyDesk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\en-us\mso.acl AnyDesk.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 184 2580 WerFault.exe -
Checks SCSI registry key(s) 3 TTPs 16 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vds.exeexplorer.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
SearchUI.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchUI.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchUI.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1188 vssadmin.exe -
Modifies Control Panel 5 IoCs
Processes:
explorer.exeSearchUI.exeShellExperienceHost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\TranscodedImageCount = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\LastUpdated = "4294967295" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Colors SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Colors ShellExperienceHost.exe -
Modifies registry class 30 IoCs
Processes:
explorer.exeSearchUI.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "56" SearchUI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance explorer.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortana SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchUI.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.cortana SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "23" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010005000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c100000000000002000000e50701004100720067006a006200650078000a005600610067007200650061007200670020006e007000700072006600660000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000074ae2078e323294282c1e41cb67d5b9c0000000000000000000000002c5536d429e3d60100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e50701004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000073ae2078e323294282c1e41cb67d5b9c000000000000000000000000f332d2d329e3d60100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c004a0076006100710062006a0066002000510072007300720061007100720065005c005a0046004e00460050006800760059002e0072006b007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000e4070a004e0070006700760062006100660020006100720072007100720071002e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000fffffffff9a6406d323dcb4f8a86be992e03dc760000000000000000000000005aa40d5557add60100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e4070a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e4070a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "23" SearchUI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance explorer.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "56" SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "132483827320340134" explorer.exe -
Processes:
AnyDesk.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 AnyDesk.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e AnyDesk.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
AnyDesk.exeWerFault.exepid process 948 AnyDesk.exe 948 AnyDesk.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
AnyDesk.exeAnyDesk.exepid process 648 AnyDesk.exe 1520 AnyDesk.exe -
Suspicious use of AdjustPrivilegeToken 95 IoCs
Processes:
svchost.exevssvc.exewbengine.exeWMIC.exeWerFault.exeexplorer.exedescription pid process Token: SeTcbPrivilege 2220 svchost.exe Token: SeTcbPrivilege 2220 svchost.exe Token: SeBackupPrivilege 2128 vssvc.exe Token: SeRestorePrivilege 2128 vssvc.exe Token: SeAuditPrivilege 2128 vssvc.exe Token: SeBackupPrivilege 2036 wbengine.exe Token: SeRestorePrivilege 2036 wbengine.exe Token: SeSecurityPrivilege 2036 wbengine.exe Token: SeIncreaseQuotaPrivilege 584 WMIC.exe Token: SeSecurityPrivilege 584 WMIC.exe Token: SeTakeOwnershipPrivilege 584 WMIC.exe Token: SeLoadDriverPrivilege 584 WMIC.exe Token: SeSystemProfilePrivilege 584 WMIC.exe Token: SeSystemtimePrivilege 584 WMIC.exe Token: SeProfSingleProcessPrivilege 584 WMIC.exe Token: SeIncBasePriorityPrivilege 584 WMIC.exe Token: SeCreatePagefilePrivilege 584 WMIC.exe Token: SeBackupPrivilege 584 WMIC.exe Token: SeRestorePrivilege 584 WMIC.exe Token: SeShutdownPrivilege 584 WMIC.exe Token: SeDebugPrivilege 584 WMIC.exe Token: SeSystemEnvironmentPrivilege 584 WMIC.exe Token: SeRemoteShutdownPrivilege 584 WMIC.exe Token: SeUndockPrivilege 584 WMIC.exe Token: SeManageVolumePrivilege 584 WMIC.exe Token: 33 584 WMIC.exe Token: 34 584 WMIC.exe Token: 35 584 WMIC.exe Token: 36 584 WMIC.exe Token: SeIncreaseQuotaPrivilege 584 WMIC.exe Token: SeSecurityPrivilege 584 WMIC.exe Token: SeTakeOwnershipPrivilege 584 WMIC.exe Token: SeLoadDriverPrivilege 584 WMIC.exe Token: SeSystemProfilePrivilege 584 WMIC.exe Token: SeSystemtimePrivilege 584 WMIC.exe Token: SeProfSingleProcessPrivilege 584 WMIC.exe Token: SeIncBasePriorityPrivilege 584 WMIC.exe Token: SeCreatePagefilePrivilege 584 WMIC.exe Token: SeBackupPrivilege 584 WMIC.exe Token: SeRestorePrivilege 584 WMIC.exe Token: SeShutdownPrivilege 584 WMIC.exe Token: SeDebugPrivilege 584 WMIC.exe Token: SeSystemEnvironmentPrivilege 584 WMIC.exe Token: SeRemoteShutdownPrivilege 584 WMIC.exe Token: SeUndockPrivilege 584 WMIC.exe Token: SeManageVolumePrivilege 584 WMIC.exe Token: 33 584 WMIC.exe Token: 34 584 WMIC.exe Token: 35 584 WMIC.exe Token: 36 584 WMIC.exe Token: SeDebugPrivilege 184 WerFault.exe Token: SeShutdownPrivilege 4076 explorer.exe Token: SeCreatePagefilePrivilege 4076 explorer.exe Token: SeShutdownPrivilege 4076 explorer.exe Token: SeCreatePagefilePrivilege 4076 explorer.exe Token: SeShutdownPrivilege 4076 explorer.exe Token: SeCreatePagefilePrivilege 4076 explorer.exe Token: SeShutdownPrivilege 4076 explorer.exe Token: SeCreatePagefilePrivilege 4076 explorer.exe Token: SeShutdownPrivilege 4076 explorer.exe Token: SeCreatePagefilePrivilege 4076 explorer.exe Token: SeShutdownPrivilege 4076 explorer.exe Token: SeCreatePagefilePrivilege 4076 explorer.exe Token: SeShutdownPrivilege 4076 explorer.exe -
Suspicious use of FindShellTrayWindow 45 IoCs
Processes:
explorer.exepid process 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
explorer.exepid process 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe 4076 explorer.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
ShellExperienceHost.exeSearchUI.exepid process 2352 ShellExperienceHost.exe 204 SearchUI.exe 2352 ShellExperienceHost.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
AnyDesk.exesvchost.exeAnyDesk.execmd.exeAnyDesk.exedescription pid process target process PID 648 wrote to memory of 948 648 AnyDesk.exe AnyDesk.exe PID 648 wrote to memory of 948 648 AnyDesk.exe AnyDesk.exe PID 648 wrote to memory of 948 648 AnyDesk.exe AnyDesk.exe PID 648 wrote to memory of 948 648 AnyDesk.exe AnyDesk.exe PID 2220 wrote to memory of 1520 2220 svchost.exe AnyDesk.exe PID 2220 wrote to memory of 1520 2220 svchost.exe AnyDesk.exe PID 2220 wrote to memory of 1520 2220 svchost.exe AnyDesk.exe PID 2220 wrote to memory of 1520 2220 svchost.exe AnyDesk.exe PID 2220 wrote to memory of 1520 2220 svchost.exe AnyDesk.exe PID 2220 wrote to memory of 1520 2220 svchost.exe AnyDesk.exe PID 2220 wrote to memory of 1520 2220 svchost.exe AnyDesk.exe PID 948 wrote to memory of 4088 948 AnyDesk.exe cmd.exe PID 948 wrote to memory of 4088 948 AnyDesk.exe cmd.exe PID 4088 wrote to memory of 1188 4088 cmd.exe vssadmin.exe PID 4088 wrote to memory of 1188 4088 cmd.exe vssadmin.exe PID 4088 wrote to memory of 2148 4088 cmd.exe wbadmin.exe PID 4088 wrote to memory of 2148 4088 cmd.exe wbadmin.exe PID 4088 wrote to memory of 584 4088 cmd.exe WMIC.exe PID 4088 wrote to memory of 584 4088 cmd.exe WMIC.exe PID 1520 wrote to memory of 2544 1520 AnyDesk.exe AnyDesk.exe PID 1520 wrote to memory of 2544 1520 AnyDesk.exe AnyDesk.exe PID 1520 wrote to memory of 2544 1520 AnyDesk.exe AnyDesk.exe PID 1520 wrote to memory of 2544 1520 AnyDesk.exe AnyDesk.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"2⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" n9483⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" n9484⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2580 -s 25601⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Control Panel
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
- Modifies Control Panel
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
- Enumerates system info in registry
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_324a22d6b747ed978d3969eb719eea89c473c72_41822faa_cab_0fcdd283\Report.werMD5
1b0183b94d6195675d29f6fb981ec199
SHA1cdbc07c4e23daffe06c88c3ae8b8ec048174a9d5
SHA25615b1683fb7bdf72bb552c8d8b70f5c9e516e7cd15b66c424acc7b8a950029963
SHA51237c68670d70e6b49cf7cba1aed65b6ab32b599ea1fc54cd44eaffd76ae3439ba01a6437cb8dfe5955cdc1e9dfca505a2361e234171335798012b5e3adf0f95cd
-
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_324a22d6b747ed978d3969eb719eea89c473c72_41822faa_cab_0fcdd283\memory.hdmpMD5
456581b4a023d5e3d6dac00fd2b05d12
SHA14fbf9bb127749d0c855b8228a2e9bd037fc96178
SHA256d049675d5bf0d18e3ea50d76bb0272a1d53014ad99d792b64906c4a9705b7be1
SHA5127bf19987bfc36ed6311a46fd05869114c46ab5d748b889978ffd89ec708c916fa83244545b241c2a9e011378047ae1f633138d041ab303cb1a2f3189bef7ee1c
-
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_324a22d6b747ed978d3969eb719eea89c473c72_41822faa_cab_0fcdd283\minidump.mdmpMD5
84820e1274aecb77d2bb6ba35b770a30
SHA18d0f874d57c46253bf52bd5c5f7b9f9987cefafd
SHA2565d1b7cc2eff664a29c51c155eb1b2baf28f36dc967aedb30bb8fa51c16ea24f9
SHA51200dfda5299d5a36136cb7440a4d9d29552bad6ca830d011f6033e00fa96483fb82dad8aa88aa87aeb1fe1a02360ad6716bb34ee576eec57c7deeb9734801c616
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\cversions.3.dbMD5
d866df59ea63885d8aaa6b1484afd465
SHA1448fd8bc776d169ac532f5fd7b3ea4db3b441667
SHA256f4a0db9e82c1205a10f1f2b9c4c4bb12fa50182b84704859bdd992ddad22917b
SHA512bcbba072bddd276ce4ac28bdf9dda08b1503cb72bbd45135ff45f760725aa6673072c6e098c323c6054895717d73279015790150b24c244463e649098d6b1462
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001d.dbMD5
bf74bc31171404279d5fc6e5b442be80
SHA19245a523a0132988d5ed5ac791c9f3de57b3f810
SHA256ed849f246e6b390eac2cd8a67d199aa60055db65b100bd2f4ea92797be58e284
SHA512d1bf765cd06ea8e6c760ee23223b4822a84980b62fd5cb2ed96f4e535d5bfb8e64f6b497472ed6cea664f985557cdd44d0d31d2e6a3ec6b6c4aae273d26a186b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001e.dbMD5
44fb9bb86eeb0205272a6e5b0f4d1122
SHA1afeb766d20c5d57cf6ffa0908cfb25f6365a7032
SHA25611a515503f170f1fdab8eef78354c1868e8b93897ae7db77dd0b71d00c11765c
SHA5126db267285815c5dcd783c5cb69f026541cc89e80b9feb341e91895f49a61f85c4fbbd23d9c36c3aa5de6bb44414ca28afb8d0ae117513b36a4c2c74f019874e7
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.dbMD5
ec189e1aca87207542dd0bcbedc7d4b8
SHA16f742134f0d5ab2f56d8ea5930d1988e57fdd303
SHA256a8d097b09b44aa510605845e9e158c3979d2c5163a4766798f249129ea07cd00
SHA51200c55b83feb2db9d9ef3bf27fbe9866cc41b24d56535648e2b3541fe644f2547e420035bad2f07bffaa11431bc93b21c90bef8cc7ed89c7b2f2ad691df408ffc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.dbMD5
780b5f65ebc34a05c4172df9aabbe611
SHA1ed1dad03d80493bc196887a57291e07a844a178c
SHA256de0ffb27572af8963048ad5eaca4e9f49116174ee198cc510316e7d1de43f2c1
SHA512d85f43aece33225dda07c64a128edaeda426e42aea1c941e56823cd4544c6b7717d73e7bc505ecd847563b32ad5ebba12d8501f5ab53f127ea1ec21b3b492d19
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.dbMD5
0dee6f7f34cfa122decfeab8048b5330
SHA15ddd0c25a047b382338b05d525e3025a099ffc79
SHA256ff79914bc22b3ec0c238ce67444d372fc019f97d221d0582def390c2a0c8b108
SHA512f0f4ed97b8ca9be72eb6cec6361c87f172feb6cd64392f155577151ad4e96301410f89854d725c7805f507f2de0383ab117c32b24a989c7ed29189759bff7c5b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.dbMD5
919186437ad6397f4e553d8f4e9efc08
SHA1c32c27992316c27fc2685a6ade4b260e037af80c
SHA2562aad32bec48bf20931772ead0ade101f5a8a0840ff799ad309d35cc32a5e5ca6
SHA512198187213530c561fa38e48844c6e6024363eedd04e94a30b88a8589a0bb6323c39e0b0475fd2a96887b3ac30efcc0b02a4afb259531a6b376f8534ae9826814
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.dbMD5
32802467e38b751209fd7b8329ac7414
SHA1e3413823d1d554a5281a05d0c7b095ac1f915435
SHA2569227ddd17df8f1315b1d15aac0f503c9facf41252dd912e2c392f3ff6791711d
SHA512658a49831683f0edebb5f78f1be8c383e81089f000e55322c79b94abd7eef8327d23b4b150911161762a294de8122a0182860ac9edaf040962566e3af1b745ff
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.dbMD5
f1a1901e68d4a1e846aefe7032d2f026
SHA1bbad1df2b708d7905b8aa732ed8e4c13eefd27cf
SHA2561be12e11ca7c861aad4b0242de11ee50d465a2453f1e14bcf1736c1380f659b6
SHA512a395c1bcff6e074edc088a5a2f1998ed9065af7509ecea439c3c2a4f526eb291e36efabec40c659ff9aa6c39faf68e672b70b79683677585a46597f2599ffa2f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.dbMD5
4a888955350bceeefada3ab18d41cd1e
SHA15a5c73eb2ac0f1f4fa5682fa4f85e17780a4177f
SHA25653cf9a4b42b87a5ac1fcac04788b2dcd3acdf60f5c725de36e2c58c53b87cdce
SHA512cd8ea54af10aea78d1f1cd59e92ffa342b35c888e05b5f5620916d1773c0de4e5d6e130f6e96f6c5a912a8300c4ccdb03acffc758631243e8722579333418da5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.dbMD5
f13013721e539b0287b62b80297dbafc
SHA1bb4365eb30c21ef74cbd7d25710752074ac4855d
SHA256936da531c61f0af3a4603b08b7c299fec63cf70d6bcb55142d7aa93c9c6a7318
SHA5120deeb120905a7bf1db0a84f6eefa667ec514cc54d8ee689127a84b041b2f644525f6aa9627737bd4d30967a510483f3745e5a527f2f3a1bff0d2c710dbb5c9ca
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.dbMD5
0c4f90602242339a6dd6d555006d3c9e
SHA101ee7be425b18653520376a129f5fdc2b46f0700
SHA256bfe080ca2b68ddfd543cb340a7fe821aebeebc315a313c824fcfbe0afd813091
SHA512ec5e214dbda4dad8aaaedad29ce6ab0209ebdd74db154a872eaadd70906be9c8c4da8fb9692401bcc6569a311becce0e092aba0b9611fdf9d00f1a570c8261ab
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.dbMD5
6296de68e3bce2bd433a57feee1197e1
SHA1f6050ef83ffe3effd43a872e30d20aac368db989
SHA256b39acaf2496f8c21e9b81da4c3636d1b0510975549a7abeedc252e010e3fb935
SHA512485cdaf172c92489b0006dd759bf6876c0d7bbd23fad042fd00e049831f85facfb979c1fa9c61a468456574cd8e04b653493dab30c6fd9863f0fdb7be2d2a4d0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.dbMD5
d4f6f6a7eab5f7fb159c85de4875a475
SHA1d9178a64d13be270bae0e5f19f9bd2ed1edff961
SHA256891a95db0666659ca614a8646329f1eb46062d5c1ccd65698149327310483163
SHA5128180e4a17d6886be0a14b735e6f1b559550c36189cc305702861e022d65bb41792bd1309cceef3c0667646fd7fbe475426d271ab791d0eca2037b3d22081fa24
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.dbMD5
53b5ea9ea39c6b0793e2216374c6c2c9
SHA1f52723a807c163cef0fe8ebc87f0a45424fcd1b7
SHA256c1722770257e3f8d81259072f44b3a4561a6cf952645ed8715f6ad503765e930
SHA512688a86b5d39a6a70c9b20b47115bc46a69a2e11ab98a52f84181d9b08fd86a52f3fc05db5f84da3f46d84d6b33bc69f790e7f28fc5c5e9f00ad3efcfacd69966
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.dbMD5
dfa322b8646f086363d9ac9765aa6ceb
SHA1f9141486db87be30695977051d9072abefe70ddb
SHA256489d7006b0cadbf2a324eb02832862e3d1e58a7a7a76c3df865fb1b7b3eb389b
SHA51296545c6223a65abc0e7e36b2330cacb12107366a0f752c2d97605299e5e5e948badcd70f3fb0f18e6cbf72f68d7d59e227a613b7ff3d8d9dbff8a5ad7ae11f91
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.dbMD5
ca29ac31c558fc594b13ca464d8a1e45
SHA16f02e666992452a6521847ca3067767cc870366e
SHA25603b06b01da7d98790893dcc968c1d3899143c3f56967d68a2860faf0ac315311
SHA512e75c631a60871da1c2b46935ca2bd5998e7cca0b24fa09b0d7249107c3a56c7f477d0fdd62d715cb1a9c38f1a07aeb101f0d6d023463731f6a65e72103fb2185
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.dbMD5
a7757e9ef6396bda23a35a093ece92cc
SHA131560fc98cd30d9a4a7eceac35c33e4a1435ebc0
SHA2561ea8bf5a3a95f3beab67ef42b716534930aea51134ffe5ddcda4c8bc22b1e39d
SHA512fad1bb1b63576b240ce558082988eac6035ae063297cc73382dc6ab72ae64deb06e580e80e2bb825f3c5dd691fc73b4cf1d6578fa04a797e4861ebdb63f1ec85
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.dbMD5
07d9ed155acfe3217698debb8fb0a27c
SHA1180e8f55347ad26a16710aeaae115fa272d2956b
SHA25695dbb32b9549a437e77b5390c2573bf48492f0d8586f1ec03176e90699c32ad7
SHA51278e15b651c708962f4c4dea853c072f9b9990b0d8633f2111c6da6e63c7b7cac353ac7e0dfe948404dedcfafc84593af13d5f2dadf4a627ce4e33605478e2a48
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.dbMD5
1d7c0989659664f2958eee46442a17a9
SHA1b8b0ed744c443e471591463609ac83cda46c8ab6
SHA25694f096a5ea99b3fbe31348d55ca9985c5d4f40a50089db5f10acf1990868d4ef
SHA512938b9ddb9d8ff9e1d09503cbe6fa1dbd775f508bbd9e4f14935f086f118d249827be9ed61ad87673d90c7060bc68d8448143f20272dc8b8f8b68fe5870e668c6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.dbMD5
a7ec9520ffcc8111414697367ea6e4ec
SHA14d29730c4465f058635c204e4ed1b2d6b23097ee
SHA2562ec501a1741f285d42f23b131274f18fb4846b80e7eace651a8871722227a130
SHA512b83d132026da3cea6e7310cc83b3f98654bcf18c5d17a23c448cd62bff16d4ccc8dc6f7d5d597a6f3c12f743d7ffc9a3145958af0002fa7398e99c9fb37ae29f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.dbMD5
593cc1b8f4044a8bdba11788ed3ed73d
SHA19f1f1ce04f45199df93f66fd0099338df832ed9e
SHA256cb339c8a46d1f994c8fd79959be188634d4143cbd7055fab94c8aad680183776
SHA51238444cb8012ac44a6020bfd9d6c35950a41b00269df3c499216384933735ef0d9b6d530542ce19cbafac33ca119c8675337d090205f3d78c3ef7efe9b4199d9b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.dbMD5
8f4fbd923f7f88e501bb30bb0dc1e6bb
SHA1c6e0426d01ce5249b5b457b81646b3e42ffbc4b9
SHA256a0ed2eaa493c8fb4691291d939da2fe3c9eb223ef786c491f86c78c3b9188658
SHA5129e8b715879b5f01d41db864a2df1577372fa98dc49037ccc6fbf8fc5314af19e7e81214f01b34dfb9b5b2f374753fd9f5256af81d70b690c11940e1ed12b8b58
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.dbMD5
c27765be33d0f5906f59905bd234abbe
SHA1520f2fbb7d720fdf0e1d90ba6e533343a65ab878
SHA256d5ed14137ec08a694dfcd267ecea49a8e807d10028a72517a2967b3b86876217
SHA512837d2acd0443139f79f6920c3f6aa1aca08637556ea8c809f08032e2124f9427bbfda070247d9411fc905dfbd9d7ec3d6dec57205e98cd57c005334bdb8131c0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.dbMD5
a09acafd2296496773e5701c9ec1c891
SHA1f091b9a6e9364e23fc5fa5c702deae03bc7772dd
SHA2562e71617591daf75f63e1aa9789919b62ffa1278672c2a1a4fd45ca417a4efc12
SHA5126c4b7eb6556b16fa1a360016633f50b665a40ddade22d1a0e1fcb7f0cf619bedc28cdf6d75fe05d7e70e124f1048f1c5a82411ba706feb13f4827fbaf3271500
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\UnifiedTileCache.datMD5
78682ca408ac0c394ad5ec9e7ae36edc
SHA1b721fbe9a7e8e9031add8b3d42ecea141d6e3130
SHA25600f0158414ac6ecf96d49bd7f1961f112d44b351ef1ede454280cf3a61540073
SHA512c5b8a1983a65da634af7f1223863b6bb45cd9305b0cb781f6bf38773e0814abb47c1cd5c7e2d51a7e7df345fd38e215887939256db788824b3cb00502e899517
-
C:\Users\Admin\AppData\Local\Temp\WERD1CA.tmp.appcompat.txtMD5
573a631ebe2958dd73d3eea8c0c03063
SHA1b7690fca8d976307755700380a6f3a0bf46c74f6
SHA25654ac56f28ef8b1d5fcb697a16426d7889da4c6a4c66b1e2a61f22ba1fc4128f2
SHA512c7424642afa01cf4abb39ee97f4d47c087f3f617e627480f1a9f19c8002cb306b1673d8fdafc783ddff8418e6051a8293ca523c759215b7bfab2614473267fe0
-
C:\Users\Admin\AppData\Roaming\827763568MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Roaming\827763568MD5
bc56a6edf3619ff519ba00f436a812d8
SHA1a344a1d107b20ff70eb45ee9af00e19991493624
SHA256917670687a68199f0258565da44a2a89f0e532c5c424b3efa8669ccc6d999911
SHA512c0861202006f40252f021eb9b656e5f8777d83e2869e82382f6f60692ab82fc6ff5428b3fd7e14a31b77ebc53562a35608cfdc6e5845fe7deffdc700d3d608cc
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpgMD5
38ad9694abe9d773b00cc87fc340aa5a
SHA1f7ff13ace4f027e253b2a9265ee892b5d5fd9633
SHA256dbe6fbbcc7b80ec3ab4cc55a96779765614e32423e87bbd1a780749bad601f7f
SHA512d98a42050a47044d99b2a2ab15d9f72d0b508825477284b1d0c02c60eee6de946b62977d3ef4ddd677148a47f10a3d802ea66f143c3d365dbe9ebef3108fad8b
-
C:\Users\All Users\Microsoft\Windows\WER\Temp\WERCF38.tmp.WERInternalMetadata.xmlMD5
629cf6726b358b100bb9eed7bb792d15
SHA1c4f9aef8b9e8c385020f83a6c4ecf0bc28e4a182
SHA2568b6813850aca9b807b9a691a07507f08ea918351d70718c659ee85fe050d3083
SHA512782aa2b65b6ad661dadc2409d58fe107c1bb2067387dece0be78f879faebb3cff31c21e246a7cfca8c56ecade07effaec403dfcd7fa35b08043ca411dcc9c11b
-
\Users\Admin\AppData\Local\Temp\nsa8709.tmp\System.dllMD5
fccff8cb7a1067e23fd2e2b63971a8e1
SHA130e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA2566fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
SHA512f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
-
\Users\Admin\AppData\Local\Temp\nsaACD1.tmp\System.dllMD5
fccff8cb7a1067e23fd2e2b63971a8e1
SHA130e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA2566fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
SHA512f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
-
memory/184-20-0x0000020304800000-0x0000020304801000-memory.dmpFilesize
4KB
-
memory/184-18-0x0000020304800000-0x0000020304801000-memory.dmpFilesize
4KB
-
memory/184-19-0x0000020304800000-0x0000020304801000-memory.dmpFilesize
4KB
-
memory/584-13-0x0000000000000000-mapping.dmp
-
memory/948-5-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/948-4-0x0000000000405A20-mapping.dmp
-
memory/948-3-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1188-9-0x0000000000000000-mapping.dmp
-
memory/1520-7-0x0000000000000000-mapping.dmp
-
memory/2148-12-0x0000000000000000-mapping.dmp
-
memory/2544-15-0x0000000000405A20-mapping.dmp
-
memory/4088-8-0x0000000000000000-mapping.dmp