55e4ce3fe726043070ecd7de5a74b2459ea8bed19ef2a36ce7884b2ab0863047

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10-02-2024 03:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AnyDesk.exe
Size

5.0MB
MD5

a21768190f3b9feae33aaef660cb7a83
SHA1

24780657328783ef50ae0964b23288e68841a421
SHA256

55e4ce3fe726043070ecd7de5a74b2459ea8bed19ef2a36ce7884b2ab0863047
SHA512

ca6da822072cb0d3797221e578780b19c8953e4207729a002a64a00ced134059c0ed21b02572c43924e4ba3930c0e88cd2cdb309259e3d0dcfb0c282f1832d62
SSDEEP

98304:NzTZ3cINQscs0m++LNkT6OpwDGUUH57yvZ/49Mr8EO3QhA9Kq:Nzt3cINQscNmvLCwDkHEvZ/4R79x

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	AnyDesk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AnyDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AnyDesk.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-768304381-2824894965-3840216961-1000\{36F03940-CE99-4E51-A75D-58C53EFE3EC4}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3720	AnyDesk.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1964	AnyDesk.exe
1964	AnyDesk.exe
1964	AnyDesk.exe
1964	AnyDesk.exe
1964	AnyDesk.exe
1964	AnyDesk.exe
3384	msedge.exe
3384	msedge.exe
4516	msedge.exe
4516	msedge.exe
888	identity_helper.exe
888	identity_helper.exe
964	msedge.exe
964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	AnyDesk.exe
Token: 33	4256	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4256	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
3720	AnyDesk.exe
3720	AnyDesk.exe
3720	AnyDesk.exe
3720	AnyDesk.exe
3720	AnyDesk.exe
3720	AnyDesk.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
2988	AnyDesk.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
3720	AnyDesk.exe
3720	AnyDesk.exe
3720	AnyDesk.exe
3720	AnyDesk.exe
3720	AnyDesk.exe
3720	AnyDesk.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2988	AnyDesk.exe
2988	AnyDesk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 1964	3184	AnyDesk.exe	87
PID 3184 wrote to memory of 1964	3184	AnyDesk.exe	87
PID 3184 wrote to memory of 1964	3184	AnyDesk.exe	87
PID 3184 wrote to memory of 3720	3184	AnyDesk.exe	88
PID 3184 wrote to memory of 3720	3184	AnyDesk.exe	88
PID 3184 wrote to memory of 3720	3184	AnyDesk.exe	88
PID 4516 wrote to memory of 1612	4516	msedge.exe	102
PID 4516 wrote to memory of 1612	4516	msedge.exe	102
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 1388	4516	msedge.exe	103
PID 4516 wrote to memory of 3384	4516	msedge.exe	104
PID 4516 wrote to memory of 3384	4516	msedge.exe	104
PID 4516 wrote to memory of 1952	4516	msedge.exe	105
PID 4516 wrote to memory of 1952	4516	msedge.exe	105
PID 4516 wrote to memory of 1952	4516	msedge.exe	105
PID 4516 wrote to memory of 1952	4516	msedge.exe	105
PID 4516 wrote to memory of 1952	4516	msedge.exe	105
PID 4516 wrote to memory of 1952	4516	msedge.exe	105
PID 4516 wrote to memory of 1952	4516	msedge.exe	105
PID 4516 wrote to memory of 1952	4516	msedge.exe	105
PID 4516 wrote to memory of 1952	4516	msedge.exe	105
PID 4516 wrote to memory of 1952	4516	msedge.exe	105
PID 4516 wrote to memory of 1952	4516	msedge.exe	105
PID 4516 wrote to memory of 1952	4516	msedge.exe	105
PID 4516 wrote to memory of 1952	4516	msedge.exe	105
PID 4516 wrote to memory of 1952	4516	msedge.exe	105

C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1964
- - C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
    "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend
    3⤵
    - Drops file in System32 directory
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2988
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3720

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x534 0x538
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb71d346f8,0x7ffb71d34708,0x7ffb71d34718
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,1762590542435239944,10697876825547658712,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,1762590542435239944,10697876825547658712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,1762590542435239944,10697876825547658712,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1762590542435239944,10697876825547658712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1762590542435239944,10697876825547658712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1762590542435239944,10697876825547658712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1762590542435239944,10697876825547658712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,1762590542435239944,10697876825547658712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,1762590542435239944,10697876825547658712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1762590542435239944,10697876825547658712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1762590542435239944,10697876825547658712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1762590542435239944,10697876825547658712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1762590542435239944,10697876825547658712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,1762590542435239944,10697876825547658712,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1762590542435239944,10697876825547658712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1762590542435239944,10697876825547658712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2136,1762590542435239944,10697876825547658712,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2136,1762590542435239944,10697876825547658712,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1762590542435239944,10697876825547658712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1762590542435239944,10697876825547658712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1762590542435239944,10697876825547658712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,1762590542435239944,10697876825547658712,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:4740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5e77545b7e1c504b2f5ce7c5cc2ce1fe

SHA1
d81a6af13cf31fa410b85471e4509124ebeaff7e

SHA256
cbb617cd6cde793f367df016b200d35ce3c521ab901bbcb52928576bb180bc11

SHA512
cbc65c61334a8b18ece79acdb30a4af80aa9448c3edc3902b00eb48fd5038bf6013d1f3f6436c1bcb637e78c485ae8e352839ca3c9ddf7e45b3b82d23b0e6e37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
335a23545d07acef2f49548b6397055c

SHA1
ddb3556ecd55f58b505aa7c35c17e0f51a61ab38

SHA256
336d269337dc0ac4a6e18249cec0a94c5604bf45ce5ab490ee787d21caea8749

SHA512
ed78d10fc938e53341df6177d16535b22208d571f15fbd7c06fcd75b37101811fee555ca4f73a5d9a77746d49f6643efb176884ce046b24a3a4b22e8f071a90b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
90fea0a3047d7912f6975ffff99731bd

SHA1
c6b7994c99c3f8fd2d9c00544fe2cfba127975c1

SHA256
44376e871dc1631d06c5dbf3d47682fc31bc08cafffe5973a1fa409a0b7fa6c8

SHA512
8fcff6190e6a98aa17ef24dae9695dfcb74f03fef663e9b4c53ebdca36c0b0de8131921d9741a51357950325c7ead73cb2b042a89dc17e0715bafb37eaa9a12e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3933edd771ee327e662451ea4774e088

SHA1
afa2b015069c2d3afe198b5c76b4c5075cc5c162

SHA256
0a37de38d8e150a38a7d272c75599fbd140a9115ae02f1e0610af05752d05abe

SHA512
a8766686db5ed9b216446fe8b05fa9c73354a46ad7e759296a3021a8d9b0116a2fd73d6c754464a79ce79cb788f2fa0fbd27ba0e42c91846a382e172d7581c2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e2e1dc818174e630f30e9560c3e0e3e4

SHA1
9b5eefec626539cfc93510337585922237954b50

SHA256
ecb3d064ac03715b24198529f6a7a4e8745110cfa5a4678b8ba623bd4ff5e6b8

SHA512
445d9c6332c4964c92fa2b2a321604008228dcf05df4e37b05d6a792a1ce8ff1d33dd25fa783c9b9f7035bd5902a53d048b123e98a53d0a1187cd6b035c82681

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ef270be551334b1f16f2f611912958e6

SHA1
5ba4a7032c1c1c8dc0da8bcef1c02101e04e0bcd

SHA256
64165bdc4d5522be6fea45aa901b4e7cd6996cce4fdad7ec1adc04e1189c649a

SHA512
a0b0a6ced83919fe2a86ff34d2737ac5f88b39ba29485a6c98c6b4d61e3d20ca4d852c4f3da46138e42df4ba8ae58310dbd5f954df5e95bec80574239b0c106a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
64e9d746afe81604aeeb7eba4a24c101

SHA1
b3f15439ad721367a0f981f17bef8d32f1896b1b

SHA256
80279871f798c0b3d7dc4b87e44253695f24624971e673a9e3030e5d5d833f68

SHA512
9356095282c5aec4d07d96fb0545cc05def3ed885d4a446dd7bac1d4c3f1b71ca9b909d0580f9f0411901a91024eb44edf6e98e191c952ae851313c4d635140d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
6db2d2ceb22a030bd1caa72b32cfbf98

SHA1
fe50f35e60f88624a28b93b8a76be1377957618b

SHA256
7b22b0b16088ab7f7d6f938d7cfe9ae807856662ce3a63e7de6c8107186853e4

SHA512
d5a67a394003f559c98e1a1e9e31c2d473d04cc075b08bb0aab115ce42744da536895df2cec73fa54fc36f38d38e4906680cfacfbf4698ee925f1609fbb07912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f665598e03c65e2a73104eddc961e8c8

SHA1
5321e4eb982a0d858ad47c87b1625d9c8d82ab3f

SHA256
6622cb9e2479c4d801a0334672664660695fd87b798cba9e46026619fb5be958

SHA512
9f5fc2d8fe84a89642d54d7d8c726e36130b5dd3a9a4652480c25ecd6e55abdc84d0fc73c6e5cca2afd89807bda72f306dbc4859930a8bc12e51e02dc764c02b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a0c4d5feb0b603cc3127c2fdfb03487b

SHA1
3795eb34dc85811013e45fc967d338683b18e084

SHA256
435675000bd655e631f52a10d1320974e9c60d8d304cb3f64efb5b4fb9508409

SHA512
2d7a0c7bbbe450eae29498b94b4a384ac1f2df2055f97da1ab4d546a63684c8bc4a57bdcfff6b1dc09351e82a70283bc4476138508519c7400d9e82044c6b8f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe592e0b.TMP

Filesize
1KB

MD5
56fcb613cb1c740ad843ae2387f3ef2c

SHA1
ee55988fce1b34069e171dec687497295a9a3d28

SHA256
c4ae2b013575068e6ca67a09df05a4e7b763df9209c444b56d7a6c38f096ba29

SHA512
e30d48507fa5d3a69ed37800351f38b2709c481eb4ac085c4604ab920680dcca8a2c25b64fb8acf4b2ef553e770638215771b855018ba30e0b31d9f6b7e098a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
931fa5464a8441bae45d93849bf1373e

SHA1
d2a865b51ee71ba16db54fc316a426b703d36412

SHA256
e57edf3473e6a51b286f22d1c8367f925bfc26b5928bc0305ff1f4a10980dec2

SHA512
c1b8fb89ca470cb7f220e96f471495b82ec6c586a899adfc08ebdd06f2103d92c76e45f914b866abfc8c73ea36ad433237a015a0326a5f2fea2521b6213348dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2d142b62cc1bc9bedcad997839071266

SHA1
b76949dd1d045c5ed38fdecd93117cc0dc0eca60

SHA256
bc737117046b53d456e17dc364d9713908af16594ad25f4892c0d45271028e35

SHA512
9d5bf3c586ccb5e4c46471ffa6fb211dc14a79fb6181be6aa5bfb3717f8296e29d828aa49f32ad9d128fd911ba5b4ef361d2e2572d3308e1bf0dee9ac9adac4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\gcapi.dll

Filesize
385KB

MD5
1ce7d5a1566c8c449d0f6772a8c27900

SHA1
60854185f6338e1bfc7497fd41aa44c5c00d8f85

SHA256
73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf

SHA512
7e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
9KB

MD5
6a39d9366d3defdb5367bc5eb804a308

SHA1
dce1191af1ae058133817f2cb31739a7f7f84336

SHA256
65844834aa610b596db16cc61ffe364ebfa486b4c082c6246d3058db4079aef0

SHA512
cef8cce93da601e3300c67ed86caf0c15fba84a3227ec184cbbdb8d3cdca44d9e09c7400a312c7d9129d38d4d99a7943836edbfe0e4e28fe37f8b2c9f6f0357d

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
39KB

MD5
eaa838dd73248a7d794483178ab98ace

SHA1
eaa9a4a7aa4c8772866a79e5b8c66631641c78eb

SHA256
e0a1bce98015c3d5078cf3075130d15b81de03abf2d3fea8126a99901d97ea00

SHA512
df56ae898f8a428ce83586208ccc67f4f3baa573723d8222d07394b579e8795266fe47bf8be05c6cd824e051d0a1c43ac567ae2c6a7d566ccecacf901d1c84e5

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
f2fa42035910d2f567a6f4c5db58644f

SHA1
a60570293fa4d1bdc8de979a7e78e0899cd47f6e

SHA256
1b4af2e231909e0ae811f8352eae31c1d89f8aec40c2fa98151302f64e1a7576

SHA512
8535f2643b4391e48316ae36a77a806cbe05ce44071eb1f021b37fab6ef82986fccf4bd5a9e0b33001917f73547c30d86f51719109ea12c882d966016653369b

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
a07b07d7353a1c04ac2f1cb8444471a0

SHA1
698a50596b1fceeb341923278cb824bc12906b60

SHA256
1afc15b7fafabc4e43fb43f6c6e3327d7f0f292ac63dd7126ef6c99d283baa3b

SHA512
de5b5474a0de98a45a1e1df1d8cc4bc898c1b581e4264f03ddad81e554466054a734ab5f10e01a54237f184fa6791fa1528b230f11346d24b432273a57569fb9

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
680B

MD5
95e0f34a7c1a839e22339d0e4a4bec1b

SHA1
2fdb7365443943f149b3f040e5283eaa1891fc65

SHA256
b14725e832d8656095a27e31ab5783345bcca4fa41f44219e6e3f9810bc32bd8

SHA512
ba3f85949c3439f7202956aaff78f8de4fd841d2fef6b9b8e3f50555671841ff78bc3f4d6e4342690fea26c815cc35685759b08e58a0d6cf3bd6b659f0cd6a85

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
801B

MD5
0f5e985ed6bd6e26e54a93f21ad123b9

SHA1
a78feb9b748d20832c75971baddbd36ebdf28c94

SHA256
5d9819d26bf48bf76b37aa98defb026611305714baf1745b5307d842fba0b7d6

SHA512
b68442a396aa9a101c9599251626ec294854fe99d4de2fab9c24008d266ecec088d01ee325befa108f8d610531071911cbdabf0e2f21ca257576696226c22483

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
312B

MD5
0c04ad1083dc5c7c45e3ee2cd344ae38

SHA1
f1cf190f8ca93000e56d49732e9e827e2554c46f

SHA256
6452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0

SHA512
6c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
424B

MD5
103f827f9a142820e51d684c5a941ec7

SHA1
5da805f6a7403f3461996132a4f216999b50e064

SHA256
5acd179be33948621b0529720b6813edc969d452c1fa563e5b12bdb324da65a4

SHA512
64d1204f8aee8bce5c9be09ec519db9ffc66afc67d89dd0f3e396ee846d3aba6ec64f41c4d7bc946f8af9961f5cff3d32a131eafe12063b47f1fe426e4bdeebb

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
2KB

MD5
c4cd44288edb1a8990449ad751a7a0c9

SHA1
283074b1f8475575af750992717cd74151cc6be3

SHA256
3e1dc943f6d17c6968c77c82f7b454f564ebc8431fa30f3b69e1fbf3837d6c94

SHA512
efe684abe1a5dbf90d83b68a6aa2be1b8b3ad20a22b1f02ddc55a98d09835e49c4cf3cadf5db42c2b985f8096c143e1c02c578622fd32a3b0c62a74afff13d43

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
3KB

MD5
e08a8e5436725f3c0f17aec65cd81e32

SHA1
1820f1b5dd14876f7ac85d3aa9dea5917a437093

SHA256
d6651c9349d02b2d877d4eea49d91c2a3027296fefb6873245dc25b79e4b3346

SHA512
3266f52b19bd472a58f1def46143ad1aef9c0de1b1f54128e3d0882962d5e8744adfeeb38afc3366c014a3bdd2bfea1612709d2b73794084a92a6ebfa252e4f0

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
3KB

MD5
85ebb720c0c6dfd65909a81814f9fed6

SHA1
955770a7fa2dab4962656fe7efc4a41639f43231

SHA256
18ea8865f9df5ad843d6ede4b3e65b07b8c617b90cb12c22a7f59d5fd0eb9185

SHA512
99d1efb671b282c588b5cd6b1c8bfba995ec08249d5a043becaeded910e922a7e21d8ee71a911e4492e39333ae6046f1757a8df0c7509596ecbe9dac6d82c6f3

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
246cda2b723641ffcf73f6808eb3974e

SHA1
fe5ab8fd9502d6cbcd81587be48aabe7dffb3c82

SHA256
d15e3e2c1eddebc5665f4ba48423924a7e829df0a5c5826b598e2f02138bf387

SHA512
b97365bf5e609078ef397b062fd77a3526ad34898db1e97af40751ce3c16cccfdbf8de2a50224258b15e034c255a968b1eb4ed11db1387c3b277c53bba825673

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
c25c2a82be950e74a78fe6f184085594

SHA1
30c954ece176ae6d560d46ab9b4b053adc4b3abb

SHA256
4cdc5a30384254ec85201316ec661f2b1fa4711c27a87b968695e327d5b5cbfa

SHA512
9cad856669bf93667cc423e0c714c3c386bdef567f373247254caf92f75558ec361eb39d361e16506084191bd4cb699900c0d5440ef95d690895b99cca2ce5f1

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
91bf8daba91b32ba317c1562f2123cf3

SHA1
ef5b0666e77104f9783ddc96ec83760ec39ba43f

SHA256
bddd1474076ad4b170b6cb2ec5ab17866c12fb3c947e2d5db63bcfca4678c091

SHA512
679fd086a60ab150ae7d251b985621b76f23266e193ddc7aba2f1918c427e8273f056c1c97df4c883c486d223a708e7a74d07fa94e4e4b2c8c93da0735f2ae68

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
230f17639344068dc0b3541660c0d518

SHA1
9b417eda1896a05914ac6458d98a90be3ec55d4e

SHA256
e3c4210e0057c528836629e619be7a0dca6819018d4371813585ae9b864ccfea

SHA512
98aea08055d95bbf9bd9668d3192b9f2f392f232148626c31fe1926ba18ada989e0041037cc20be5da33d026cb009e2870dda855facebe5f9c1010ffe91437cc

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
d4729e26ccaeb5be2223b4dc1356b179

SHA1
1bd2694e81ed1f8a27744e2ac6b8e7d5ffeed242

SHA256
1b143276e3d70947d18bd7ffd7bc517de010ea61ada7e234bce557d206892ee5

SHA512
3f3c5ac530cb5e1f803532c59940e3429190eccb93e6a807253701996fa820c4e3de23cb827dd2c09a802adda65030805f94614ed39d8a1a1bf5b8b190c6d326

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
7KB

MD5
23545d828ce56d99c6399b8e00523c2d

SHA1
c759632ccf5d59879675e4dda500cd464d32158e

SHA256
43684b01f1db2f137f2e44c69bb4f25f71a35281ed7232184f8f6e74699e2b8c

SHA512
0b1b815e694dd0ed21dfac92ce3993dc403f8aa01aa3cd11768e119bb9fbc9a349a1b0b9da19ed245e7f78b494ee81cdeb4172cc4abb127f4f924ffdc2499fee

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
aaa03404fe939b04689d3b34ee8a8b59

SHA1
06b2fb317ad10b562c280c34237e61ec05aa46d8

SHA256
645de5854d972a868dcb49df2d01795fb6f1b41e8100b46acc790ac22d7d767b

SHA512
2a8bc4e65f41d89801f88679cb2de9223dbe0ac031f1193cde427fc6227c1ec89f341de8f020bc0c6726eeaee936d5b858b6d4fe4740c0d95a269de0a826e7f6

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
0eb44d777838eef0fcbffcc1fe7f4af9

SHA1
8c7099b6c04031b0fb419863df7eb57995b83ae3

SHA256
af112b29c10c309b38fd8306d3f1664dd8dae71825be455899942ad064b291ce

SHA512
8ee5dd85ec062329d2fdd874b8b958adc3af435eddea9f759abfd691d3b1f0b2f2a6880637a701410bc72838555f87a618f83888bee629766fc4b432e4721f04

Download Submit
memory/1964-342-0x0000000000DD0000-0x0000000002507000-memory.dmp

Filesize
23.2MB

Download
memory/1964-32-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/1964-232-0x0000000000DD0000-0x0000000002507000-memory.dmp

Filesize
23.2MB

Download
memory/1964-259-0x0000000000DD0000-0x0000000002507000-memory.dmp

Filesize
23.2MB

Download
memory/1964-12-0x0000000000DD0000-0x0000000002507000-memory.dmp

Filesize
23.2MB

Download
memory/1964-293-0x0000000000DD0000-0x0000000002507000-memory.dmp

Filesize
23.2MB

Download
memory/2988-265-0x0000000005FC0000-0x0000000005FC1000-memory.dmp

Filesize
4KB

Download
memory/2988-290-0x0000000009140000-0x0000000009141000-memory.dmp

Filesize
4KB

Download
memory/2988-830-0x0000000000DD0000-0x0000000002507000-memory.dmp

Filesize
23.2MB

Download
memory/2988-266-0x0000000005FE0000-0x0000000005FE1000-memory.dmp

Filesize
4KB

Download
memory/2988-272-0x0000000006050000-0x0000000006051000-memory.dmp

Filesize
4KB

Download
memory/2988-273-0x0000000006060000-0x0000000006061000-memory.dmp

Filesize
4KB

Download
memory/2988-271-0x0000000006040000-0x0000000006041000-memory.dmp

Filesize
4KB

Download
memory/2988-278-0x00000000060B0000-0x00000000060B1000-memory.dmp

Filesize
4KB

Download
memory/2988-277-0x00000000060A0000-0x00000000060A1000-memory.dmp

Filesize
4KB

Download
memory/2988-279-0x00000000060C0000-0x00000000060C1000-memory.dmp

Filesize
4KB

Download
memory/2988-282-0x00000000060F0000-0x00000000060F1000-memory.dmp

Filesize
4KB

Download
memory/2988-280-0x00000000060D0000-0x00000000060D1000-memory.dmp

Filesize
4KB

Download
memory/2988-276-0x0000000006090000-0x0000000006091000-memory.dmp

Filesize
4KB

Download
memory/2988-274-0x0000000006070000-0x0000000006071000-memory.dmp

Filesize
4KB

Download
memory/2988-275-0x0000000006080000-0x0000000006081000-memory.dmp

Filesize
4KB

Download
memory/2988-270-0x0000000006030000-0x0000000006031000-memory.dmp

Filesize
4KB

Download
memory/2988-269-0x0000000006020000-0x0000000006021000-memory.dmp

Filesize
4KB

Download
memory/2988-268-0x0000000006000000-0x0000000006001000-memory.dmp

Filesize
4KB

Download
memory/2988-267-0x0000000005FF0000-0x0000000005FF1000-memory.dmp

Filesize
4KB

Download
memory/2988-281-0x00000000060E0000-0x00000000060E1000-memory.dmp

Filesize
4KB

Download
memory/2988-283-0x0000000006100000-0x0000000006101000-memory.dmp

Filesize
4KB

Download
memory/2988-284-0x0000000006110000-0x0000000006111000-memory.dmp

Filesize
4KB

Download
memory/2988-263-0x0000000005E20000-0x0000000005E21000-memory.dmp

Filesize
4KB

Download
memory/2988-264-0x0000000005FB0000-0x0000000005FB1000-memory.dmp

Filesize
4KB

Download
memory/2988-292-0x0000000000DD0000-0x0000000002507000-memory.dmp

Filesize
23.2MB

Download
memory/2988-262-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/2988-824-0x0000000000A20000-0x0000000000A21000-memory.dmp

Filesize
4KB

Download
memory/2988-261-0x0000000005DE0000-0x0000000005DE1000-memory.dmp

Filesize
4KB

Download
memory/2988-253-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/2988-335-0x0000000000DD0000-0x0000000002507000-memory.dmp

Filesize
23.2MB

Download
memory/2988-247-0x0000000000DD0000-0x0000000002507000-memory.dmp

Filesize
23.2MB

Download
memory/2988-248-0x0000000000DD0000-0x0000000002507000-memory.dmp

Filesize
23.2MB

Download
memory/3184-4-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

Filesize
4KB

Download
memory/3184-230-0x0000000000DD0000-0x0000000002507000-memory.dmp

Filesize
23.2MB

Download
memory/3184-229-0x0000000007DA0000-0x0000000007DA1000-memory.dmp

Filesize
4KB

Download
memory/3184-85-0x0000000007D90000-0x0000000007D91000-memory.dmp

Filesize
4KB

Download
memory/3184-82-0x0000000008D20000-0x0000000008D21000-memory.dmp

Filesize
4KB

Download
memory/3184-26-0x0000000006600000-0x0000000006601000-memory.dmp

Filesize
4KB

Download
memory/3184-0-0x0000000000DD0000-0x0000000002507000-memory.dmp

Filesize
23.2MB

Download
memory/3184-22-0x0000000006610000-0x0000000006611000-memory.dmp

Filesize
4KB

Download
memory/3184-1-0x0000000000DD0000-0x0000000002507000-memory.dmp

Filesize
23.2MB

Download
memory/3720-13-0x0000000000DD0000-0x0000000002507000-memory.dmp

Filesize
23.2MB

Download
memory/3720-11-0x0000000000DD0000-0x0000000002507000-memory.dmp

Filesize
23.2MB

Download
memory/3720-823-0x0000000000DD0000-0x0000000002507000-memory.dmp

Filesize
23.2MB

Download
memory/3720-294-0x0000000000DD0000-0x0000000002507000-memory.dmp

Filesize
23.2MB

Download
memory/3720-233-0x0000000000DD0000-0x0000000002507000-memory.dmp

Filesize
23.2MB

Download
memory/3720-31-0x00000000027D0000-0x00000000027D1000-memory.dmp

Filesize
4KB

Download
memory/3720-837-0x0000000000DD0000-0x0000000002507000-memory.dmp

Filesize
23.2MB

Download