agenttesla | b9ad79eaf7a4133f95f24c3b9d976c72f34264dc5c99030f0e57992cb5621f78

Analysis

max time kernel
1800s
max time network
1798s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AnyDesk.exe
Size

3.0MB
MD5

eb80f7bddb699784baa9fbf2941eaf4a
SHA1

df6abbfd20e731689f3c7d2a55f45ac83fbbc40b
SHA256

b9ad79eaf7a4133f95f24c3b9d976c72f34264dc5c99030f0e57992cb5621f78
SHA512

3a1162e9fef849cb7143dc1898d4cfcfd87eb80ced0edb321dfa096686b25ae8a9a7f3ae8f37a09724d94f96d64e08940fc23c0b931ddd8a1e70e2792cb3fe47
SSDEEP

98304:6aJXyQTrRGlSMoIuORmKBQielvZlpkiSti:3olMcR9BTY3WS

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 4 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023259-349.dat	family_agenttesla
behavioral2/files/0x0008000000023259-350.dat	family_agenttesla
behavioral2/memory/3668-353-0x0000000000270000-0x0000000001BE0000-memory.dmp	family_agenttesla
behavioral2/memory/3668-356-0x0000000006660000-0x0000000006856000-memory.dmp	family_agenttesla

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Downloads MZ/PE file

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	runthis++.exe
File opened (read-only)	\??\F:	runthis++.exe
File opened (read-only)	\??\F:	ProcessHacker.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
152	raw.githubusercontent.com
153	raw.githubusercontent.com

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	Arcade.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	runthis++.exe

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	AnyDesk.exe
File created	C:\Windows\System32\DriverStore\Temp\{8ed2ec4f-f61b-2943-86e8-4ec6ceea215c}\SET3C39.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8ed2ec4f-f61b-2943-86e8-4ec6ceea215c}\AnyDeskPrintDriverRenderFilter-PipelineConfig.xml	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8ed2ec4f-f61b-2943-86e8-4ec6ceea215c}\AnyDeskPrintDriver.gpd	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	AnyDesk.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8ed2ec4f-f61b-2943-86e8-4ec6ceea215c}\AnyDeskPrintDriver.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8ed2ec4f-f61b-2943-86e8-4ec6ceea215c}\SET3C5C.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{8ed2ec4f-f61b-2943-86e8-4ec6ceea215c}\SET3C5C.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	AnyDesk.exe
File created	C:\Windows\System32\DriverStore\Temp\{8ed2ec4f-f61b-2943-86e8-4ec6ceea215c}\SET3C3A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8ed2ec4f-f61b-2943-86e8-4ec6ceea215c}	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	AnyDesk.exe
File created	C:\Windows\System32\DriverStore\Temp\{8ed2ec4f-f61b-2943-86e8-4ec6ceea215c}\SET3C4B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8ed2ec4f-f61b-2943-86e8-4ec6ceea215c}\SET3C4C.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	AnyDesk.exe
File created	C:\Windows\System32\DriverStore\Temp\{8ed2ec4f-f61b-2943-86e8-4ec6ceea215c}\SET3C4C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8ed2ec4f-f61b-2943-86e8-4ec6ceea215c}\SET3C5D.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	AnyDesk.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8ed2ec4f-f61b-2943-86e8-4ec6ceea215c}\SET3C39.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8ed2ec4f-f61b-2943-86e8-4ec6ceea215c}\AnyDeskPrintDriverRenderFilter.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8ed2ec4f-f61b-2943-86e8-4ec6ceea215c}\AnyDeskPrintDriver-manifest.ini	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8ed2ec4f-f61b-2943-86e8-4ec6ceea215c}\SET3C3A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8ed2ec4f-f61b-2943-86e8-4ec6ceea215c}\SET3C4B.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{8ed2ec4f-f61b-2943-86e8-4ec6ceea215c}\SET3C5D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8ed2ec4f-f61b-2943-86e8-4ec6ceea215c}\anydeskprintdriver.inf	DrvInst.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	ProcessHacker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	ProcessHacker.exe

Drops file in Program Files directory 44 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Process Hacker 2\plugins\OnlineChecks.dll	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-03B0V.tmp	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\unins000.dat	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-5275S.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-F5C2D.tmp	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\Updater.dll	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\UserNotes.dll	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-R1RDV.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-FP7IU.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-LLD4Q.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-PBHJR.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-IB8VO.tmp	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files (x86)\AnyDesk\AnyDesk.exe	AnyDesk.exe
File opened for modification	C:\Program Files\Process Hacker 2\plugins\ToolStatus.dll	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-L4GAA.tmp	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\ExtendedTools.dll	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\unins000.dat	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-PK4M4.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-H01BL.tmp	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\ProcessHacker.exe	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\NetworkTools.dll	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\x86\plugins\DotNetTools.dll	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-OARML.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-8SQFF.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-4GKAV.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-6GNSD.tmp	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\DotNetTools.dll	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\ExtendedNotifications.dll	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\ExtendedServices.dll	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-T3N93.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\x86\plugins\is-F1M01.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-86OVT.tmp	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\HardwareDevices.dll	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\SbieSupport.dll	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-J7TU2.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-NDRHG.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-L82KG.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-C4PF6.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files (x86)\AnyDesk\AnyDesk.exe	AnyDesk.exe
File opened for modification	C:\Program Files\Process Hacker 2\x86\ProcessHacker.exe	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-811VE.tmp	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\peview.exe	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\WindowExplorer.dll	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\x86\is-R0HSJ.tmp	processhacker-2.39-setup.tmp

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Executes dropped EXE 10 IoCs

pid	Process
3668	Arcade.exe
3740	AnyDesk.exe
3488	AnyDesk.exe
3492	AnyDesk.exe
6752	proshac.exe
7092	runthis++.exe
1328	proshac.exe
4340	processhacker-2.39-setup.exe
6480	processhacker-2.39-setup.tmp
524	ProcessHacker.exe

Loads dropped DLL 12 IoCs

pid	Process
524	ProcessHacker.exe
524	ProcessHacker.exe
524	ProcessHacker.exe
524	ProcessHacker.exe
524	ProcessHacker.exe
524	ProcessHacker.exe
524	ProcessHacker.exe
524	ProcessHacker.exe
524	ProcessHacker.exe
524	ProcessHacker.exe
524	ProcessHacker.exe
524	ProcessHacker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 31 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	ProcessHacker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	ProcessHacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters	ProcessHacker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	ProcessHacker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	ProcessHacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	ProcessHacker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters	ProcessHacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000\LogConf	ProcessHacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	ProcessHacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	ProcessHacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	ProcessHacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000\LogConf	ProcessHacker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	ProcessHacker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters	ProcessHacker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	ProcessHacker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	ProcessHacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000\Control	ProcessHacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000\Control	ProcessHacker.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AnyDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AnyDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ProcessHacker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	ProcessHacker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ProcessHacker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ProcessHacker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ProcessHacker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	ProcessHacker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ProcessHacker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	ProcessHacker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	ProcessHacker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AnyDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ProcessHacker.exe
Key opened	\Registry\Machine\Hardware\Description\System\CentralProcessor	ProcessHacker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	ProcessHacker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	ProcessHacker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AnyDesk.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	ProcessHacker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ProcessHacker.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Arcade.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Arcade.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Arcade.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\TypedURLs	taskmgr.exe

Modifies data under HKEY_USERS 57 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "248"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	AnyDesk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open\command\ = "\"C:\\Program Files (x86)\\AnyDesk\\AnyDesk.exe\" --play \"%1\""	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\DefaultIcon	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	runthis++.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open\command	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\ = "URL:AnyDesk Protocol"	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open\command\ = "\"C:\\Program Files (x86)\\AnyDesk\\AnyDesk.exe\" \"%1\""	AnyDesk.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	runthis++.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\DefaultIcon	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\DefaultIcon\ = "\"C:\\Program Files (x86)\\AnyDesk\\AnyDesk.exe\",0"	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\URL Protocol	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\DefaultIcon\ = "AnyDesk.exe,0"	AnyDesk.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	runthis++.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	runthis++.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open\command	AnyDesk.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	proshac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	proshac.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	proshac.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Arcade.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\processhacker-2.39-setup.exe:Zone.Identifier	firefox.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5612	AnyDesk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4460	AnyDesk.exe
4460	AnyDesk.exe
4460	AnyDesk.exe
4460	AnyDesk.exe
4460	AnyDesk.exe
4460	AnyDesk.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
3740	AnyDesk.exe
3740	AnyDesk.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
3492	AnyDesk.exe
3492	AnyDesk.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 6 IoCs

pid	Process
5028	AnyDesk.exe
6752	proshac.exe
5168	taskmgr.exe
7092	runthis++.exe
1328	proshac.exe
524	ProcessHacker.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
656	Process not Found
3412	Process not Found
5836	Process not Found
3084	Process not Found
5832	Process not Found
5272	Process not Found
3448	Process not Found
6568	Process not Found
6548	Process not Found
5564	Process not Found
6588	Process not Found
2248	Process not Found
5972	Process not Found
424	Process not Found
1516	Process not Found
4300	Process not Found
6616	Process not Found
4468	Process not Found
5988	Process not Found
2660	Process not Found
1980	Process not Found
5752	Process not Found
4052	Process not Found
2532	Process not Found
6632	Process not Found
6648	Process not Found
6660	Process not Found
1056	Process not Found
5364	Process not Found
6628	Process not Found
1124	Process not Found
3612	Process not Found
6696	Process not Found
6764	Process not Found
6832	Process not Found
2120	Process not Found
3152	Process not Found
6816	Process not Found
6904	Process not Found
2208	Process not Found
6740	Process not Found
6920	Process not Found
4340	Process not Found
1604	Process not Found
6476	Process not Found
5340	Process not Found
6464	Process not Found
1832	Process not Found
4628	Process not Found
3640	Process not Found
3692	Process not Found
6224	Process not Found
6656	Process not Found
2196	Process not Found
6940	Process not Found
6688	Process not Found
4020	Process not Found
4976	Process not Found
6944	Process not Found
5284	Process not Found
5420	Process not Found
3988	Process not Found
5368	Process not Found
3516	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4460	AnyDesk.exe
Token: 33	4196	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4196	AUDIODG.EXE
Token: SeDebugPrivilege	3700	firefox.exe
Token: SeDebugPrivilege	3700	firefox.exe
Token: SeDebugPrivilege	5168	taskmgr.exe
Token: SeSystemProfilePrivilege	5168	taskmgr.exe
Token: SeCreateGlobalPrivilege	5168	taskmgr.exe
Token: SeDebugPrivilege	3668	Arcade.exe
Token: SeAuditPrivilege	5372	svchost.exe
Token: SeSecurityPrivilege	5372	svchost.exe
Token: SeDebugPrivilege	6752	proshac.exe
Token: SeIncBasePriorityPrivilege	6752	proshac.exe
Token: 33	6752	proshac.exe
Token: SeLoadDriverPrivilege	6752	proshac.exe
Token: SeProfSingleProcessPrivilege	6752	proshac.exe
Token: SeRestorePrivilege	6752	proshac.exe
Token: SeShutdownPrivilege	6752	proshac.exe
Token: SeTakeOwnershipPrivilege	6752	proshac.exe
Token: SeDebugPrivilege	6752	proshac.exe
Token: SeDebugPrivilege	6752	proshac.exe
Token: SeDebugPrivilege	7092	runthis++.exe
Token: SeDebugPrivilege	7092	runthis++.exe
Token: SeDebugPrivilege	7092	runthis++.exe
Token: SeDebugPrivilege	7092	runthis++.exe
Token: SeDebugPrivilege	7092	runthis++.exe
Token: SeDebugPrivilege	7092	runthis++.exe
Token: SeDebugPrivilege	7092	runthis++.exe
Token: SeDebugPrivilege	7092	runthis++.exe
Token: SeDebugPrivilege	7092	runthis++.exe
Token: SeDebugPrivilege	7092	runthis++.exe
Token: SeDebugPrivilege	7092	runthis++.exe
Token: SeDebugPrivilege	3700	firefox.exe
Token: SeDebugPrivilege	3700	firefox.exe
Token: SeDebugPrivilege	3700	firefox.exe
Token: SeDebugPrivilege	1328	proshac.exe
Token: SeIncBasePriorityPrivilege	1328	proshac.exe
Token: 33	1328	proshac.exe
Token: SeLoadDriverPrivilege	1328	proshac.exe
Token: SeProfSingleProcessPrivilege	1328	proshac.exe
Token: SeRestorePrivilege	1328	proshac.exe
Token: SeShutdownPrivilege	1328	proshac.exe
Token: SeTakeOwnershipPrivilege	1328	proshac.exe
Token: SeDebugPrivilege	6480	processhacker-2.39-setup.tmp
Token: SeDebugPrivilege	6480	processhacker-2.39-setup.tmp
Token: SeDebugPrivilege	6480	processhacker-2.39-setup.tmp
Token: SeDebugPrivilege	6480	processhacker-2.39-setup.tmp
Token: SeDebugPrivilege	6480	processhacker-2.39-setup.tmp
Token: SeDebugPrivilege	6480	processhacker-2.39-setup.tmp
Token: SeDebugPrivilege	6480	processhacker-2.39-setup.tmp
Token: SeDebugPrivilege	6480	processhacker-2.39-setup.tmp
Token: SeDebugPrivilege	6480	processhacker-2.39-setup.tmp
Token: SeDebugPrivilege	6480	processhacker-2.39-setup.tmp
Token: SeDebugPrivilege	6480	processhacker-2.39-setup.tmp
Token: SeDebugPrivilege	6480	processhacker-2.39-setup.tmp
Token: SeDebugPrivilege	6480	processhacker-2.39-setup.tmp
Token: SeDebugPrivilege	6480	processhacker-2.39-setup.tmp
Token: SeDebugPrivilege	6480	processhacker-2.39-setup.tmp
Token: SeDebugPrivilege	6480	processhacker-2.39-setup.tmp
Token: SeDebugPrivilege	6480	processhacker-2.39-setup.tmp
Token: SeDebugPrivilege	6480	processhacker-2.39-setup.tmp
Token: SeDebugPrivilege	6480	processhacker-2.39-setup.tmp
Token: SeDebugPrivilege	6480	processhacker-2.39-setup.tmp
Token: SeDebugPrivilege	6480	processhacker-2.39-setup.tmp

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5612	AnyDesk.exe
5612	AnyDesk.exe
5612	AnyDesk.exe
5612	AnyDesk.exe
3700	firefox.exe
3700	firefox.exe
3700	firefox.exe
3700	firefox.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
3488	AnyDesk.exe
3488	AnyDesk.exe
5168	taskmgr.exe
3488	AnyDesk.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5612	AnyDesk.exe
5612	AnyDesk.exe
5612	AnyDesk.exe
5612	AnyDesk.exe
3700	firefox.exe
3700	firefox.exe
3700	firefox.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
3488	AnyDesk.exe
3488	AnyDesk.exe
5168	taskmgr.exe
3488	AnyDesk.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
5028	AnyDesk.exe
5028	AnyDesk.exe
3700	firefox.exe
3700	firefox.exe
3700	firefox.exe
3700	firefox.exe
5168	taskmgr.exe
3700	firefox.exe
3700	firefox.exe
3700	firefox.exe
6996	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 4460	2656	AnyDesk.exe	85
PID 2656 wrote to memory of 4460	2656	AnyDesk.exe	85
PID 2656 wrote to memory of 4460	2656	AnyDesk.exe	85
PID 2656 wrote to memory of 5612	2656	AnyDesk.exe	86
PID 2656 wrote to memory of 5612	2656	AnyDesk.exe	86
PID 2656 wrote to memory of 5612	2656	AnyDesk.exe	86
PID 4392 wrote to memory of 3700	4392	firefox.exe	101
PID 4392 wrote to memory of 3700	4392	firefox.exe	101
PID 4392 wrote to memory of 3700	4392	firefox.exe	101
PID 4392 wrote to memory of 3700	4392	firefox.exe	101
PID 4392 wrote to memory of 3700	4392	firefox.exe	101
PID 4392 wrote to memory of 3700	4392	firefox.exe	101
PID 4392 wrote to memory of 3700	4392	firefox.exe	101
PID 4392 wrote to memory of 3700	4392	firefox.exe	101
PID 4392 wrote to memory of 3700	4392	firefox.exe	101
PID 4392 wrote to memory of 3700	4392	firefox.exe	101
PID 4392 wrote to memory of 3700	4392	firefox.exe	101
PID 3700 wrote to memory of 2576	3700	firefox.exe	102
PID 3700 wrote to memory of 2576	3700	firefox.exe	102
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103
PID 3700 wrote to memory of 940	3700	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4460
- - C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
    "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:5028
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5612
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --install "C:\Program Files (x86)\AnyDesk" --start-with-win --create-shortcuts --create-taskbar-icon --create-desktop-icon --install-drv --update-auto --svc-conf "C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf"
  2⤵
  - Drops file in Program Files directory
  - Modifies registry class
  PID:1316
- C:\Windows\SysWOW64\expand.exe
  expand -F:* "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver\v4.cab" "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver"
  2⤵
  - Drops file in Windows directory
  PID:5780
- C:\Windows\SysWOW64\rundll32.exe
  "rundll32" printui.dll, PrintUIEntry /if /b "AnyDesk Printer" /f "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver\AnyDeskPrintDriver.inf" /r "AD_Port" /m "AnyDesk v4 Printer Driver"
  2⤵
  - Drops file in Windows directory
  PID:3920

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x2f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4196

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3700.0.1498563460\1749271301" -parentBuildID 20221007134813 -prefsHandle 1888 -prefMapHandle 1880 -prefsLen 20671 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {538eb51d-917b-409b-bad6-b8bff561fe6c} 3700 "\\.\pipe\gecko-crash-server-pipe.3700" 1980 24c2c0eee58 gpu
    3⤵
    PID:2576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3700.1.1552808540\1400422295" -parentBuildID 20221007134813 -prefsHandle 2352 -prefMapHandle 2348 -prefsLen 20707 -prefMapSize 233414 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e60a9b38-df0a-4cb3-ae77-e0ccad3c6cd5} 3700 "\\.\pipe\gecko-crash-server-pipe.3700" 2380 24c1f86fe58 socket
    3⤵
    PID:940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3700.2.1480778834\1449083600" -childID 1 -isForBrowser -prefsHandle 3180 -prefMapHandle 3012 -prefsLen 20810 -prefMapSize 233414 -jsInitHandle 1420 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {573c0ddb-ad80-40e4-84cb-03c4d54f5462} 3700 "\\.\pipe\gecko-crash-server-pipe.3700" 3300 24c2c062058 tab
    3⤵
    PID:1504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3700.3.1183330431\8899169" -childID 2 -isForBrowser -prefsHandle 3024 -prefMapHandle 3020 -prefsLen 25988 -prefMapSize 233414 -jsInitHandle 1420 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3d871dd-b9a4-4310-87c8-49505b935216} 3700 "\\.\pipe\gecko-crash-server-pipe.3700" 3600 24c2f784258 tab
    3⤵
    PID:5644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3700.4.1198232443\1743471665" -childID 3 -isForBrowser -prefsHandle 4560 -prefMapHandle 4556 -prefsLen 26047 -prefMapSize 233414 -jsInitHandle 1420 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae8d8422-806e-4ef0-8eb9-6448fc02fb2c} 3700 "\\.\pipe\gecko-crash-server-pipe.3700" 4344 24c31b51158 tab
    3⤵
    PID:3356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3700.5.1844730591\1407356270" -childID 4 -isForBrowser -prefsHandle 4952 -prefMapHandle 2972 -prefsLen 26126 -prefMapSize 233414 -jsInitHandle 1420 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9cf3fe55-e175-4904-84d1-9072e62fecd8} 3700 "\\.\pipe\gecko-crash-server-pipe.3700" 5064 24c2ef09058 tab
    3⤵
    PID:4664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3700.7.757041223\967208168" -childID 6 -isForBrowser -prefsHandle 5384 -prefMapHandle 5388 -prefsLen 26126 -prefMapSize 233414 -jsInitHandle 1420 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e086830-dc9d-49cb-a47f-b62cf2ffe673} 3700 "\\.\pipe\gecko-crash-server-pipe.3700" 5376 24c320fc858 tab
    3⤵
    PID:5172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3700.6.720080794\2009086759" -childID 5 -isForBrowser -prefsHandle 5196 -prefMapHandle 5200 -prefsLen 26126 -prefMapSize 233414 -jsInitHandle 1420 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8d7661a-8b61-4f67-a47b-a69d15fc49b8} 3700 "\\.\pipe\gecko-crash-server-pipe.3700" 5188 24c320faa58 tab
    3⤵
    PID:2268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3700.8.789020122\158186073" -childID 7 -isForBrowser -prefsHandle 5892 -prefMapHandle 5896 -prefsLen 26301 -prefMapSize 233414 -jsInitHandle 1420 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {56b8682c-b5bf-4771-8327-8c85213d2681} 3700 "\\.\pipe\gecko-crash-server-pipe.3700" 5884 24c33b44c58 tab
    3⤵
    PID:5144
- - C:\Users\Admin\Downloads\Arcade.exe
    "C:\Users\Admin\Downloads\Arcade.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:3668
  - - C:\Arcade\proshac.exe
      "C:\Arcade\proshac.exe"
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:6752
  - - C:\Arcade\runthis++.exe
      "C:\Arcade\runthis++.exe"
      4⤵
      Enumerates connected drives
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:7092
    - - C:\Arcade\proshac.exe
        
        "C:\Arcade\proshac.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:1328
- - C:\Users\Admin\Downloads\processhacker-2.39-setup.exe
    "C:\Users\Admin\Downloads\processhacker-2.39-setup.exe"
    3⤵
    - Executes dropped EXE
    PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\is-BCKV7.tmp\processhacker-2.39-setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-BCKV7.tmp\processhacker-2.39-setup.tmp" /SL5="$7077C,1874675,150016,C:\Users\Admin\Downloads\processhacker-2.39-setup.exe"
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:6480
    - - C:\Program Files\Process Hacker 2\ProcessHacker.exe
        
        "C:\Program Files\Process Hacker 2\ProcessHacker.exe"
        5⤵
        Enumerates connected drives
        Checks system information in the registry
        Executes dropped EXE
        Loads dropped DLL
        Checks SCSI registry key(s)
        Checks processor information in registry
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:524

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5168
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:1824
- - C:\Windows\system32\net.exe
    net user barbi /add
    3⤵
    PID:6544
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user barbi /add
      4⤵
      PID:6560
- - C:\Windows\system32\net.exe
    net localgroup administrators barbi /add
    3⤵
    PID:6632
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup administrators barbi /add
      4⤵
      PID:6648

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3912

C:\Program Files (x86)\AnyDesk\AnyDesk.exe
"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --service
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3740

C:\Program Files (x86)\AnyDesk\AnyDesk.exe
"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --control
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3488

C:\Program Files (x86)\AnyDesk\AnyDesk.exe
"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --new-install
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5372
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{42208231-7aa8-4544-b5df-78dc626aff87}\anydeskprintdriver.inf" "9" "49a18f3d7" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "c:\users\admin\appdata\roaming\anydesk\printer_driver"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:3380
- - C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{a0d69680-9edd-a94c-9e9d-4321ac57a0b3} Global\{abfb968b-962a-d849-bd41-74e18bd34929} C:\Windows\System32\DriverStore\Temp\{8ed2ec4f-f61b-2943-86e8-4ec6ceea215c}\anydeskprintdriver.inf C:\Windows\System32\DriverStore\Temp\{8ed2ec4f-f61b-2943-86e8-4ec6ceea215c}\AnyDeskPrintDriver.cat
    3⤵
    PID:6164

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3840855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:6996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Privilege Escalation

Account Manipulation

T1098

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Arcade\proshac.exe

Filesize
1.6MB

MD5
b365af317ae730a67c936f21432b9c71

SHA1
a0bdfac3ce1880b32ff9b696458327ce352e3b1d

SHA256
bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4

SHA512
cc3359e16c6fe905a9e176a87acf4c4ed5e22c29bfca11949799caf8442e00ec0d1679b3d8754dbc3e313528d3e8e82c0ec1941e2c3530b48229c1cb337f6b8b

Download Submit
C:\Arcade\runthis++.exe

Filesize
1.8MB

MD5
e18e3e97006f26595b73a76ff9836fa9

SHA1
e43b33f3ef1183b43df1496cbbabd456afd50b75

SHA256
1e2ac076bd8af7d01eed4476d0d10472a4aa31bc5f1b41364d97af674b115db3

SHA512
a4a620b8e64867b43ac1a6589d0265d92dc3ed682e66d5b9ef9e3bb50ba9c5cb8a07ff20be7ccc6d48690903ea84dda94138a56b57c3fd260aee53c571307469

Download Submit
C:\Program Files (x86)\AnyDesk\AnyDesk.exe

Filesize
3.0MB

MD5
eb80f7bddb699784baa9fbf2941eaf4a

SHA1
df6abbfd20e731689f3c7d2a55f45ac83fbbc40b

SHA256
b9ad79eaf7a4133f95f24c3b9d976c72f34264dc5c99030f0e57992cb5621f78

SHA512
3a1162e9fef849cb7143dc1898d4cfcfd87eb80ced0edb321dfa096686b25ae8a9a7f3ae8f37a09724d94f96d64e08940fc23c0b931ddd8a1e70e2792cb3fe47

Download Submit
C:\Program Files (x86)\AnyDesk\AnyDesk.exe

Filesize
1.5MB

MD5
82855ada61d85361e35994d70371eb12

SHA1
e984a1353de5973f861f48eb2bd249106b250cec

SHA256
20d49afcc4a27c3388a80529489e10389dbe1ae9c482124b4c6fb917e9393fa1

SHA512
7177835aa8cc36afd52f6ba2f2e34224e9bc26b01ca9335e48b6560aa55070ce489662de83b10548653a0824986b23e3767000c49ccab287b637b5f786e4d3ab

Download Submit
C:\Program Files (x86)\AnyDesk\AnyDesk.exe

Filesize
1.1MB

MD5
d7671dd382f737d5fe742c2b1922ccb4

SHA1
f07da78224847ad42b741045fecad7adcf1df6fa

SHA256
cf5839310086b5209556f938e3738866dbab206fb3ae9a005705ef8288c05700

SHA512
ac1e6dfd60fe25e33ea7c3255c63ba8ed95e42065ea2b342e8426ea2a6a2407ab0aa5053902f513b465f2d97d6a1d42aba8dcbbc90757839fed0bf3e187751c0

Download Submit
C:\ProgramData\AnyDesk\service.conf

Filesize
2KB

MD5
8b268ea8610c03de6e63ef9a3b6467c6

SHA1
8f8011f42250dd3cc449aa2489f6a6a94475750b

SHA256
e97b994829d524d3deaa79f1c1e53a59f5e48e60a365fbf7f57b3326a5610140

SHA512
b229c968ba04b6c9ef645423c77ae84e6d2a585c45ffb6796cc071bfe42c6f4312b0ee8613712d7137335e30ef0f74377a3af9f97a06f37a4fa43545d962c8a9

Download Submit
C:\ProgramData\AnyDesk\system.conf

Filesize
165B

MD5
ba39586502c2536a2b598a20de37eef2

SHA1
4f6f938ec2a098adca9683928aa57be89fdb3e61

SHA256
28d145e455f68e705f27b12708f2b6ae52899c294d07ef832f48a3da28d6efe6

SHA512
7d4ea07434f336b2333a3894fa5965e7a71eb38138b01c3219065147e9f5bd21305f7cb5bb946eab5541dc92f7b45983230c9b3f7d3524c35d79fedb70427a0f

Download Submit
C:\ProgramData\AnyDesk\system.conf

Filesize
414B

MD5
20651cfee3d05a0278213ffef2b04b20

SHA1
1d34d21aebdba1cdd0452d0cc10faa027e6c4ae1

SHA256
f626d6cd90792771260082a283a664e4c92cc5c25e3e8466cb897e98b8ad5708

SHA512
6a996e009cc338b300efbbaccd210a1d072e19872c00d7d918572c0a8897817673112219dd15e841581abd26246ce9e9e31dab5dc4a76c6474460f81429be765

Download Submit
C:\ProgramData\AnyDesk\system.conf

Filesize
414B

MD5
c082e0af257fee4eff4948f9229c736d

SHA1
744d84ade1a357537b1f07acd7fcf7c1e09d73c8

SHA256
7df185fd168141c8de1547865b619fb3da49fce07467495eef77bbdbb01956a7

SHA512
e2e1265fb160817a8f02e4cb9b3c543aa037b8b5e4c07b203f4257b7b6e2feef9a2e551955d10b56956825722c624f51fb7b996d51639779af10ede7d10860f9

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AnyDesk.lnk

Filesize
1KB

MD5
79db15e3ec7fb1c376e0c30bc497ae1e

SHA1
c9598cc988c5bf016bfa8bdffd0106f290fc8864

SHA256
3eb4593aa4e281243cc0fb5f0681bb01dcd5b5b822249a550b149bbdee76c902

SHA512
01a56b4b8d1d6e31e775c105375de3eb6b23f253f637018560479171827329de391ba2ab4f56507de883bd82353e804f494dbeee371081a389d5ad8c17be7d77

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BCKV7.tmp\processhacker-2.39-setup.tmp

Filesize
785KB

MD5
1c96ed29e0136825e06f037bf10b2419

SHA1
b74a55279474253639bebf9c92f10f947145ff30

SHA256
b10cf8cdf541ca0dd6df79e66fb4b0854dcac717aba034ba0c4961bff92fd021

SHA512
0e74854d9de4e3944b2cff9b5de7eb19fdec1fee6c9576cae6cd81741adf84eac421cb743b1df30183f645ffe849357b6a85b5be8d7f6e2efe289bbe4573e177

Download Submit
C:\Users\Admin\AppData\Local\Temp\{42208231-7aa8-4544-b5df-78dc626aff87}\SET3B33.tmp

Filesize
11KB

MD5
e0d32d133d4fe83b0e90aa22f16f4203

SHA1
a06b053a1324790dfd0780950d14d8fcec8a5eb9

SHA256
6e996f3523bcf961de2ff32e5a35bcbb59cb6fe343357eff930cd4d6fa35f1f4

SHA512
c0d24104d0b6cb15ff952cbef66013e96e5ed2d4d3b4a17aba3e571a1b9f16bd0e5c141e6aabac5651b4a198dbd9e65571c8c871e737eb5dcf47196c87b8907b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{42208~1\AnyDeskPrintDriver-manifest.ini

Filesize
271B

MD5
0d7876b516b908aab67a8e01e49c4ded

SHA1
0900c56619cd785deca4c302972e74d5facd5ec9

SHA256
98933de1b6c34b4221d2dd065715418c85733c2b8cb4bd12ac71d797b78a1753

SHA512
6874f39fff34f9678e22c47b67f5cd33b825c41f0b0fd84041450a94cc86cc94811293ba838f5267c9cd167d9abcf74e00a2f3c65e460c67e668429403124546

Download Submit
C:\Users\Admin\AppData\Local\Temp\{42208~1\AnyDeskPrintDriverRenderFilter-PipelineConfig.xml

Filesize
584B

MD5
b76df597dd3183163a6d19b73d28e6d3

SHA1
9f7d18a7e09b3818c32c9654fb082a784be35034

SHA256
cba7c721b76bb7245cd0f1fbfdf85073d57512ead2593050cad12ce76886ac33

SHA512
6f74ad6bbbb931fe78a6545bb6735e63c2c11c025253a7cb0c4605e364a1e3ac806338bb62311d715bf791c5a5610ee02942ff5a0280282d68b93708f1317c69

Download Submit
C:\Users\Admin\AppData\Local\Temp\{42208~1\AnyDeskPrintDriverRenderFilter.dll

Filesize
277KB

MD5
1e4faaf4e348ba202dee66d37eb0b245

SHA1
bb706971bd21f07af31157875e0521631ecf8fa5

SHA256
3aa636e7660be17f841b7f0e380f93fb94f25c62d9100758b1d480cbb863db9d

SHA512
008e59d645b30add7d595d69be48192765dac606801e418eeb79991e0645833abeacfc55aa29dae52dc46aaf22b5c6bc1a9579c2005f4324bece9954ebb182ba

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
7KB

MD5
699a6e88cdc1585129bbe38e761848f7

SHA1
267dd17fdd219f91d4803fc9bf65d0255a4f955f

SHA256
7b7d32628c6e54c255bcb5f2709c75831da7eea537f28747beaa1774c9f59eef

SHA512
6a562135ae5d41c61bd793c15fee41579426ea9958dbe1932f219f7923a634b49ea2f09456373e1d83940d05cb966f3542c9cfaf2ce7cece5ab555bc4d07df11

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
7KB

MD5
22dde55f60b4ca513f32f06a80bec4cf

SHA1
658c38977ab5683911c6fc6194d8669d223f07b9

SHA256
a0caafa18b936f9c0d8f6f9e9c9b9a2fd111b960278a7866293841665f8e314e

SHA512
7e34ec85f16c86b7acb49aea2f7f9b0c58dc4f808f80a4b329c49fdb46889bb7d1657203ee914cbf2b7f467a54aeb2b54d92833887dce292056bc2c28c56fed3

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
55KB

MD5
a3a8a4f81523a89ae4e2de1adead2ece

SHA1
a6f3f57551593c7615153edef12ec86275153ea6

SHA256
cc39a14ff1e7ce59e190e1bb0b85560b7aea7f1be1cb0f37ae45b4f56031cb2a

SHA512
f408860075cf361b8fe97a36849f5f94efd081d0094b5829e2f8ca32b7ad5d401f07e05de14cb7f1adaafaef355d4d38153a798809c8c5c437cf08aa89703a46

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
60KB

MD5
8a491d2dd2b19c0a2ee5bd37961c4307

SHA1
83e6bb4215f3d2be12bbd03b6c1dff701f2dd8c7

SHA256
b83c71790c40bb135ea9ac5587247896128f7bf320458ee02d1211f98df68059

SHA512
eb65d9ade13cfb36ee32098932cfc68aec431b70366784aea33aef3bc287a64d0dd1e0e33aee72249f49dc53fa7bfc5801a926132614c8a4495e8c451153dc6a

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
61KB

MD5
755258e513f5be697e7a97a21af09b74

SHA1
8916bb664d460390e05ce41da20a325f7880e664

SHA256
b14908d1cb8fac011c0e1cdeb55a89c683ad5163b5ca80de2a8b989815dbc61b

SHA512
c5af5a551f0aa5186a7298b59c7dda0b339c1153366abfac3bddd20cb860a8d3093b6b9de86e884264e16c0b9e449756184a79ce488aef4c44e99bec48e4837e

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
37KB

MD5
8cffd43264835d8a74e1abf1422079b3

SHA1
82fdd0a6e546b794f269f821163f6681893ad3a4

SHA256
6c7b339595092b25096aa6155b5f9b688a07422a622450e802e3e5c05d38493f

SHA512
f0653eb6efa68e4cc61956e78fd996f4c54647376c190e5fab736030d22e4cefe07d219d0788f120ed1530eaebb9b366bffc24043013f36526e01ab53c17516c

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
4b8592e9725179eefb177205bf4e401e

SHA1
55d396ad59d20315dfc0d1273ba92c60f3928369

SHA256
f20a291066949ef3c94e68d6f16b7acfc60d83b254818d7bb4a1a40d905d0211

SHA512
165cbb67f2562b971996d327ec2870e76498b95106e94acb2499d5c6d1cc89beaf7c71d0f8a82fd7a152f4d2848ec86fed9279fed1e9553f88e4129fcd1f8bc3

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
105B

MD5
b8a79bed015a80a0568cc7dd45c2f93d

SHA1
89343a26e3d2897f88bbe67acf01f37beb85c868

SHA256
78bc36551d1282adf77d6961fefa4c2206144e377a290c675ad97b54232494ee

SHA512
1a7feb339791e6aa9a64aed4c0d8f4ad8aad19f9cb8feebb8211e7f3a6bf2bb5d49dea98a099b84b51e7a40406b9f4fb5853d423d31be0bd9d72477332e7cd6b

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
329B

MD5
5edf5e357615b1d6d27094615fd338bb

SHA1
3a4f7c1bf2d8ab8d5cfe9278727c180c13c6bc16

SHA256
5bbebc0bbcbb013ee1187c77624e2b5aab972bd9221a1506777f5776bdee264e

SHA512
760fc0b6261a697cb5f807cd1d250de54708d112efeec7183a365134aa4e318160ce97d824097c08bee2b14b59951a4b8647baff4150ae7cf47a1f7d869f3980

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
107B

MD5
f25e48e1d9e1e1398bc5fbc6885570b8

SHA1
46557c8ebb9236af6c28c9bdd317d1d25749e710

SHA256
0379e6a5dff30a991e0acdb9932cac828eb3e30ca8cc23447a2bc73ae78181db

SHA512
41e61480f5141b6950d7b96f3e4dfcca19bc480e0b11eeebdedaeb266c6e525f41f3d29a3c1c0bf8f17a3c30111d8fba7e269d5fcf84b336bee916e21881acb7

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
205B

MD5
59352c2b0c590c5fd96365d3168d723b

SHA1
53ab571639cc3e3a38032c1095985f7f4278d8fc

SHA256
079db0d18cb8ca55e8653f3d67608c5e445d32e368feb874ed3fa1d797c7c286

SHA512
2d21bcd26ef934095ca5b37aa1e66091547870f5e09c2d203dfd75923d2575f93f1a42f31e4fb7b2423b766984464ed65b048f49519837918de246a892c82828

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
245B

MD5
22b9e4e628573bdac8cb04791f575ad2

SHA1
2446b2c4343ca89d1aa687718c7734d695784ccf

SHA256
c5968aa38c37ee9e4956d04bae2e1334535f171259efacaa914ddfe587f81059

SHA512
c4f7b0387d64cd67d0a452d25bd737e1f69af73f010510eb33d8278335e44a25b882eaae95d85535fbde69081b88a0044ce642dcc149a68aa9d1eea061f1b730

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
3KB

MD5
4efb19f56965c1b10851e6084024906b

SHA1
904c21f6107bf4ab67ebce9162c2375d4f9c8da7

SHA256
e4be81d13f5f5aefcac2d8602e5a2aa03d3f50364cc8c1439c01e0c551b03cc6

SHA512
1ac70204cb378ab94ed1be776c51788a9e8d950c50a3714e283fb043024901327b0da1a21a4c4a343de30c2658dee08b889ad4d7d3b00017310126818e9048b3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
3KB

MD5
1a7ee1fa262bd37eefa64fc489606cb0

SHA1
ade11ef1ef130e6768f115813ad74e2c77166b5f

SHA256
f0d5f77cf16591e40c2de3437631a4ef54e997492210618fc775df33130325d4

SHA512
fea0178d05bda232ca704f1c8d1e5580521a39a41df61d62b6b0b56bc942302d08989706b4318a802f066d8c93e6201feecbd4e2f994146c7f6eb166795e1518

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
3KB

MD5
a26073a387e10f86237631f206a3941d

SHA1
8e616759b79d12583dc0fd5dafefe930d72f4f1e

SHA256
31c59f89f442984f5f9532b9fa36cfd3930f7736cfe124e1672c0c587669917e

SHA512
d188ffe11573497ebf108f191b0c1bcc58c921a1f1ee4af8c275d9dacf424a09c074dece16c1c2d0b2a9482dc24ae48f0281bb18f5a51726c003ffa70b9edd20

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
c7986478ed75cc008b54f796471b80fb

SHA1
386bc902063ed07005f0065f07308b897c8444db

SHA256
c410df6a4a211f183b7cf8097fffd932d3155f31fd3170cef50d8add18ab3bc0

SHA512
bef8000041b1baeebd0dc4f10e183e78611e2e884167c3dc6b7072e35f946d6f7fc615687e42cc0d8fe729898a65b9c79c8bf334bc662d673fb1e94041675204

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\datareporting\glean\pending_pings\500c37dc-115c-40fa-8036-dba385e619d2

Filesize
9KB

MD5
9d2c81b7741833417cec6fcae67197d0

SHA1
120e4873fd2b68f7e855cea399837508597e064d

SHA256
1b0a5466e1288fe3171f556c0cb19533d2dd5ca68288f2a74b05bbc176fba847

SHA512
f6bc041d03977f9fc381f9c389fbfd067bc1e65ab789bd5921101164df4803fe521d9566ebab22122314729f74b98e3435170128382ea5ed448f1fa98976ef6b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\datareporting\glean\pending_pings\8a1bddcb-9578-4380-a894-990ad242db21

Filesize
746B

MD5
481078d51094a8cb3f9a6b50bc7e74f7

SHA1
dc0e85fa3e57084769ebbc811a3b9e943f1c415e

SHA256
8220493032d4da49d8409c1c1b69a96a982fc14a6bd634690420c3e7e4ef599f

SHA512
a6b29808e1b79291a6f9b8acaab981aaef110e5256bd3c848c8c78a1789c17354f4ca973a75c3f18cd0ef21fda655e3fe93c417324ad145654162c2b955e5e5d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\prefs-1.js

Filesize
6KB

MD5
736baf865cc41e274c6c3c919fa69622

SHA1
039770d48e57d5bdbf804e6e8d1066e922ab4dc1

SHA256
c6995819b6ab967b2a2fa5e8de23cc6769a87e66e82d329acd4139a2e4e24756

SHA512
90851e1a438e307e34e738db3ea92996daf498bb3f4b95339bd020b58f97ac1367bf72fb4b93dbe8945966ad8fde5c32e623972530b339fdfa6ec1389a256b48

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\prefs-1.js

Filesize
6KB

MD5
5b6777ed295b9434b0f3adf2c2da8676

SHA1
ddb5385ab5c8963d25a17dd2e3f06814ea439070

SHA256
62b661e5bdd63ca9c8cb5c6cf8118c136072221dac77d87d768d0ba5b96cb828

SHA512
13faa8681995430d979f92b0a9a022a1b19cc0dba72db935e47829e301f37deea3370b11638616de5ce5652a9ef975e44ec1fb9fd89d1fc8db11c1fa3099d962

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\prefs.js

Filesize
6KB

MD5
febe3fda02ac28f18e1261b945e42fba

SHA1
8484ce4b40308924538f88ef6221cfedc3037b86

SHA256
172350c01451774475397d0e10117c070321f54535c60ccf5016069065736ef7

SHA512
458cc85d4a2fc43a6ae00298e10d320363e706391032c6aefdfff484453899434abe98606029905ed0b7d0999f384ad881b50bf0910a853812344a9c077a4d12

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\prefs.js

Filesize
5KB

MD5
2f409bebf22e40c93a9f336bdf8c8679

SHA1
69d918dbbd045ed00676602b985ed79c7b4bba02

SHA256
f70fde2a4b87070ae4b5e78cde561606aaefe50f624e1127dca117f4a6fdd12a

SHA512
54bb6662bb6f222f76c72ec3fd0e02a417a86f8a8b08a9e3daf73b872cb9ec1b17489da2e7adceb1e7e6e587cbc093492b5f341e8e068f8fbe12ea4a299193b9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\prefs.js

Filesize
6KB

MD5
3aaaadc36e72c966872659c61ff2d2ff

SHA1
7a4d2c43a7b3431be3c96013d307d9c8220833ea

SHA256
0b3260665d51d9e648a4958ac88b522c3a77af78a1fd16d2dd6eb8bff7ef7a24

SHA512
8d4b9bc5407f95088c9f9c95e3240d19bd216975f579171871a2212238844e990027a5e42df2b38e5d6535ee140026f4eb319cd3a8360486e55549dba6c31bf1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
c8dc58eff0c029d381a67f5dca34a913

SHA1
3576807e793473bcbd3cf7d664b83948e3ec8f2d

SHA256
4c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17

SHA512
b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
30KB

MD5
f9989674ec6e87f36d29c6b3df1b2425

SHA1
ed7a9a2ef5a5ca7bcae1eaeb2bc1fa80425883ce

SHA256
e99ac51c992fc6062036395ce8539437dad15c7de0529d03238266d78457b96a

SHA512
fad251939950b9b78a4dd70527ea73a21e86546ef0fcf1a63c563342d62bf931e0508f3f2094811a328e2481bdffbfb3272505090c682a6ef9c7c00eb806f132

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
30KB

MD5
97c500e579db30dc7b4fb166caf77fa6

SHA1
607549bb8653da86db456761274fc72b577dcff9

SHA256
f7f72b66adc0ea04eb5744da46b216e947c3a4177dbfe7fe5df463906db3976b

SHA512
10bf4b5e7b96f2722c48ab52f0116c90b1812852b25c4605b3e9907438b1f8b1ccd087d408390216200808836d8225bfea841a2b5b0b6cf1a4aeb022e56bf9f7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
30KB

MD5
62c22b7b9786e3dece360c2bdc0007da

SHA1
ecc14b6f7b1cbb7bdceabcce2003fcfddacf8639

SHA256
6d21c5678071d6285bdf4e91dcdb10b6ecd4282c63b5fb583ac305332e0b228c

SHA512
fae3c12f909630becae756d38da4b2e3f37b7435f5cbf3980df7c21a460636b1dfc104dc9b2f4b3e4160cc76555fbd43600d720f94cb73a226311c936a276113

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\sessionstore.jsonlz4

Filesize
30KB

MD5
c1a4f4fc961299e0ced1344522a33c57

SHA1
9fd80040fd9c2bdaee526552a4fba02660134c97

SHA256
d615c9371e6e5823977b21a9771d956f736472eeacaec2ff0503e8105de0b833

SHA512
030de841febf36b82f092f9e1a985845e2a99d09670b5d0d20c75019e7ea36b294767a30e6ec5bb812a021caf0af9297e3ce33881866dc8d436d211a79ad84d8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
b4e248b8f969358a7bfa32c68bda5789

SHA1
201120599bc3a747d419adc989473b524b7bc56c

SHA256
53bba6be73ce1c9b4ae9b1810a5225aaa7dfa9abd0ac1eb3e9b9bff37b266443

SHA512
bd21e656c602c09e140eb153225054a947e3b446927d8bbe0720e2e6cfeff0b237e0a5deea5d575ee170479e0b8472799f19c553cf3955982123e32cca006c35

Download Submit
C:\Users\Admin\AppData\Roaming\Process Hacker 2\settings.xml

Filesize
7KB

MD5
8dfb10568bc527b89b4a747a9bf7c0b4

SHA1
de05c26736d6e61a647c17d69f103257a5b4ea02

SHA256
9c16aaefee94778ef136f23db8ed4d7b36d9990dd6abfad1164e3913eb2b14e9

SHA512
7dc8f5026443dedb8eecf74e2a15758df075b88662d9d119520c98ceec38b2870ff11786b2d19cbddf304f4582c90e4cfd5db1150ddbe41fb627441e5856eaf7

Download Submit
C:\Users\Admin\Downloads\Arcade.RfMtjNda.exe.part

Filesize
39KB

MD5
0596fec45b60c2f31835d7c45c243b9a

SHA1
9cd3e96bf6550279491fb03d2d75aa67764b63d2

SHA256
e65c40d00c18613b9afd38385fc0acc2fc8c4448acc0c4f1505bdb9aef522a0a

SHA512
5e626ba165c254d63b021d3668152bc9497dd9e2e34975a9d6d1f6de8bc1ca2a3009b630f2c29935b94803fcd8e7783520d6b42334b3a088a5bc8fcc75c62b4f

Download Submit
C:\Users\Admin\Downloads\Arcade.exe

Filesize
1.5MB

MD5
8d6a0bfe12873c87c8d063b30e94237e

SHA1
05ccdd21c2ea01053d6c5bf10da14a8692e71d4c

SHA256
f7b0dffb0d077742186acf4cf2aa924a89447e63332715d9edefcbfdb9ef6ca2

SHA512
337c55ccfcb78244fd8e621a744bc59d1c8e61c31eccbfeacbf0cc34aec5ac2dcb9f6b172f925e04e3422e12ad4541c2fa36d52a8af4f794e1c53c4781cacfaa

Download Submit
C:\Users\Admin\Downloads\Arcade.exe

Filesize
1.8MB

MD5
d18b3e34c732db0783aef0101102de27

SHA1
b19cbd1d661e27450529f83371df812aa0a9ab99

SHA256
ab08e67c0f116b224728699a25601aef8974926dff50dd17d36f4349a6a42ac8

SHA512
4ffa542a871474f9d7d8f4aad3dd5584c7c0cbd4d6124cfd333f73b248192539fe780f017326d04af63c60406a22790cd6e0f93bfb56bbaaa385c13a6f67e73c

Download Submit
C:\Users\Admin\Downloads\processhacker-2.39-setup.exe

Filesize
2.2MB

MD5
54daad58cce5003bee58b28a4f465f49

SHA1
162b08b0b11827cc024e6b2eed5887ec86339baa

SHA256
28042dd4a92a0033b8f1d419b9e989c5b8e32d1d2d881f5c8251d58ce35b9063

SHA512
8330de722c8800ff64c6b9ea16a4ff7416915cd883e128650c47e5cb446dd3aaa2a9ba5c4ecda781d243be7fb437b054bbcf942ea714479e6cc3cef932390829

Download Submit
C:\Users\Admin\Downloads\processhacker-2.X52xGN4M.39-setup.exe.part

Filesize
10KB

MD5
90aceb42647395d690bfeb87a05c0bc6

SHA1
9ec2e94e26711aefa422659d7b3fc28a5dce46e7

SHA256
b495fdaf60278aef393b65e4053e8568f655b079e74bbf21ce4add31159a8601

SHA512
3197b63262bdb66ac8936829cab8c84dadf1e2b6b5ba90249405a4ec1dc3d589e66177e875ab3ad6b3bd93b3bda6a422b812fa77d9080320437d09fc5577587f

Download Submit
C:\Windows\System32\.exe

Filesize
7.2MB

MD5
299b2d1253c26c0d5b1c1e23f8c4d27b

SHA1
aa372b24736f739cfcfbaa4bed885b62ca71858a

SHA256
b84631585730826615b1cb9fd23552808521f8376b3540e4375df392b19b526f

SHA512
ace1302e434ed04f07841799159bb4ea54353e6a849f66b58d8c45c8f2ec8ee4e1b2f20b8f64080fb667658b00cd8723f74b1fdc680466f3cce0e18216a65c64

Download Submit
\??\c:\users\admin\appdata\roaming\anydesk\printer_driver\AnyDeskPrintDriver.cat

Filesize
9KB

MD5
6d1663f0754e05a5b181719f2427d20a

SHA1
5affb483e8ca0e73e5b26928a3e47d72dfd1c46e

SHA256
12af5f4e8fc448d02bcfd88a302febe6820a5a497157ef5dca2219c50c1621e3

SHA512
7895f6e35591270bfa9e373b69b55389d250751b56b7ea0d5b10ab770283b8166182c75dca4ebbecdd6e9790dbbfda23130fb4f652545fd39c95619b77195424

Download Submit
\??\c:\users\admin\appdata\roaming\anydesk\printer_driver\anydeskprintdriver.inf

Filesize
2KB

MD5
d4ca3f9ceeb46740c6c43826d94aba18

SHA1
d863cb54ad2fa0cfc0329954cbe49f70f49fdb87

SHA256
494e4351b85d2821e53a22434f51a4186aa0f7be5724922fc96dfb16687ad37c

SHA512
be08bc144ee2a491fbc80449b4339c01871c6e7d2ddc0e251475d8e426220c6ef35f67698b0586156f0a62b22db764c43842f577b82c3f9e4e93957f9d617db4

Download Submit
\??\c:\users\admin\appdata\roaming\anydesk\printer_driver\v4.cab

Filesize
127KB

MD5
5a4f0869298454215cccf8b3230467b3

SHA1
924d99c6bf1351d83b97df87924b482b6711e095

SHA256
5214e8ff8454c715b10b448e496311b4ff18306ecf9cbb99a97eb0076304ce9a

SHA512
0acf25d5666113ce4b39aa4b17ce307bef1a807af208560471a508d1ecadfa667d80f97c191e187b8ea6af02128d55685a4dd0ddc6dd5aabe8b460f6bc727eee

Download Submit
memory/1316-439-0x0000000000380000-0x0000000000F92000-memory.dmp

Filesize
12.1MB

Download
memory/1316-398-0x0000000000380000-0x0000000000F92000-memory.dmp

Filesize
12.1MB

Download
memory/2656-35-0x0000000000380000-0x0000000000F92000-memory.dmp

Filesize
12.1MB

Download
memory/2656-22-0x00000000067D0000-0x00000000067D1000-memory.dmp

Filesize
4KB

Download
memory/2656-24-0x0000000006800000-0x0000000006801000-memory.dmp

Filesize
4KB

Download
memory/2656-25-0x0000000006810000-0x0000000006811000-memory.dmp

Filesize
4KB

Download
memory/2656-26-0x0000000006820000-0x0000000006821000-memory.dmp

Filesize
4KB

Download
memory/2656-27-0x0000000006850000-0x0000000006851000-memory.dmp

Filesize
4KB

Download
memory/2656-528-0x0000000000380000-0x0000000000F92000-memory.dmp

Filesize
12.1MB

Download
memory/2656-1-0x0000000000380000-0x0000000000F92000-memory.dmp

Filesize
12.1MB

Download
memory/2656-28-0x0000000006870000-0x0000000006871000-memory.dmp

Filesize
4KB

Download
memory/2656-29-0x0000000004370000-0x0000000004371000-memory.dmp

Filesize
4KB

Download
memory/2656-23-0x00000000067F0000-0x00000000067F1000-memory.dmp

Filesize
4KB

Download
memory/2656-19-0x0000000006790000-0x0000000006791000-memory.dmp

Filesize
4KB

Download
memory/2656-15-0x0000000003FE0000-0x0000000003FE1000-memory.dmp

Filesize
4KB

Download
memory/2656-3-0x0000000001850000-0x0000000001851000-memory.dmp

Filesize
4KB

Download
memory/2656-13-0x0000000003FD0000-0x0000000003FD1000-memory.dmp

Filesize
4KB

Download
memory/2656-14-0x00000000043A0000-0x00000000043A1000-memory.dmp

Filesize
4KB

Download
memory/2656-0-0x0000000000380000-0x0000000000F92000-memory.dmp

Filesize
12.1MB

Download
memory/2656-72-0x0000000000380000-0x0000000000F92000-memory.dmp

Filesize
12.1MB

Download
memory/2656-21-0x00000000067C0000-0x00000000067C1000-memory.dmp

Filesize
4KB

Download
memory/2656-20-0x00000000067B0000-0x00000000067B1000-memory.dmp

Filesize
4KB

Download
memory/3488-434-0x0000000000890000-0x00000000014A2000-memory.dmp

Filesize
12.1MB

Download
memory/3492-438-0x0000000000890000-0x00000000014A2000-memory.dmp

Filesize
12.1MB

Download
memory/3492-638-0x0000000000890000-0x00000000014A2000-memory.dmp

Filesize
12.1MB

Download
memory/3492-653-0x0000000000890000-0x00000000014A2000-memory.dmp

Filesize
12.1MB

Download
memory/3668-355-0x00000000065C0000-0x0000000006652000-memory.dmp

Filesize
584KB

Download
memory/3668-354-0x0000000006B70000-0x0000000007114000-memory.dmp

Filesize
5.6MB

Download
memory/3668-353-0x0000000000270000-0x0000000001BE0000-memory.dmp

Filesize
25.4MB

Download
memory/3668-352-0x0000000071AF0000-0x00000000722A0000-memory.dmp

Filesize
7.7MB

Download
memory/3668-356-0x0000000006660000-0x0000000006856000-memory.dmp

Filesize
2.0MB

Download
memory/3668-357-0x0000000006920000-0x0000000006930000-memory.dmp

Filesize
64KB

Download
memory/3668-358-0x00000000068C0000-0x00000000068CA000-memory.dmp

Filesize
40KB

Download
memory/3740-420-0x0000000000890000-0x00000000014A2000-memory.dmp

Filesize
12.1MB

Download
memory/3740-636-0x0000000000890000-0x00000000014A2000-memory.dmp

Filesize
12.1MB

Download
memory/4460-362-0x0000000000380000-0x0000000000F92000-memory.dmp

Filesize
12.1MB

Download
memory/4460-199-0x0000000000380000-0x0000000000F92000-memory.dmp

Filesize
12.1MB

Download
memory/4460-39-0x0000000000380000-0x0000000000F92000-memory.dmp

Filesize
12.1MB

Download
memory/4460-30-0x0000000000380000-0x0000000000F92000-memory.dmp

Filesize
12.1MB

Download
memory/4460-107-0x0000000000380000-0x0000000000F92000-memory.dmp

Filesize
12.1MB

Download
memory/4460-73-0x0000000000380000-0x0000000000F92000-memory.dmp

Filesize
12.1MB

Download
memory/5028-94-0x0000000005070000-0x0000000005071000-memory.dmp

Filesize
4KB

Download
memory/5028-96-0x00000000075D0000-0x00000000075D1000-memory.dmp

Filesize
4KB

Download
memory/5028-223-0x0000000000380000-0x0000000000F92000-memory.dmp

Filesize
12.1MB

Download
memory/5028-116-0x0000000005270000-0x0000000005271000-memory.dmp

Filesize
4KB

Download
memory/5028-114-0x000000000A460000-0x000000000A461000-memory.dmp

Filesize
4KB

Download
memory/5028-75-0x0000000000380000-0x0000000000F92000-memory.dmp

Filesize
12.1MB

Download
memory/5028-79-0x00000000016A0000-0x00000000016A1000-memory.dmp

Filesize
4KB

Download
memory/5028-80-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download
memory/5028-81-0x0000000004D80000-0x0000000004D81000-memory.dmp

Filesize
4KB

Download
memory/5028-82-0x0000000004F20000-0x0000000004F21000-memory.dmp

Filesize
4KB

Download
memory/5028-83-0x0000000004F30000-0x0000000004F31000-memory.dmp

Filesize
4KB

Download
memory/5028-85-0x0000000004F40000-0x0000000004F41000-memory.dmp

Filesize
4KB

Download
memory/5028-84-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Filesize
4KB

Download
memory/5028-86-0x0000000004F80000-0x0000000004F81000-memory.dmp

Filesize
4KB

Download
memory/5028-88-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/5028-87-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download
memory/5028-89-0x0000000005000000-0x0000000005001000-memory.dmp

Filesize
4KB

Download
memory/5028-646-0x0000000000380000-0x0000000000F92000-memory.dmp

Filesize
12.1MB

Download
memory/5028-113-0x000000000A450000-0x000000000A451000-memory.dmp

Filesize
4KB

Download
memory/5028-112-0x000000000A440000-0x000000000A441000-memory.dmp

Filesize
4KB

Download
memory/5028-111-0x0000000008070000-0x0000000008071000-memory.dmp

Filesize
4KB

Download
memory/5028-109-0x00000000076D0000-0x00000000076D1000-memory.dmp

Filesize
4KB

Download
memory/5028-108-0x00000000075B0000-0x00000000075B1000-memory.dmp

Filesize
4KB

Download
memory/5028-91-0x0000000005020000-0x0000000005021000-memory.dmp

Filesize
4KB

Download
memory/5028-76-0x0000000000380000-0x0000000000F92000-memory.dmp

Filesize
12.1MB

Download
memory/5028-93-0x0000000005060000-0x0000000005061000-memory.dmp

Filesize
4KB

Download
memory/5028-95-0x0000000005090000-0x0000000005091000-memory.dmp

Filesize
4KB

Download
memory/5028-385-0x0000000000380000-0x0000000000F92000-memory.dmp

Filesize
12.1MB

Download
memory/5028-97-0x00000000075F0000-0x00000000075F1000-memory.dmp

Filesize
4KB

Download
memory/5028-98-0x0000000007610000-0x0000000007611000-memory.dmp

Filesize
4KB

Download
memory/5028-99-0x0000000007630000-0x0000000007631000-memory.dmp

Filesize
4KB

Download
memory/5028-100-0x0000000007650000-0x0000000007651000-memory.dmp

Filesize
4KB

Download
memory/5028-101-0x0000000007670000-0x0000000007671000-memory.dmp

Filesize
4KB

Download
memory/5028-102-0x0000000007690000-0x0000000007691000-memory.dmp

Filesize
4KB

Download
memory/5028-103-0x00000000076B0000-0x00000000076B1000-memory.dmp

Filesize
4KB

Download
memory/5028-104-0x00000000076E0000-0x00000000076E1000-memory.dmp

Filesize
4KB

Download
memory/5028-105-0x00000000076F0000-0x00000000076F1000-memory.dmp

Filesize
4KB

Download
memory/5028-106-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/5028-92-0x0000000005050000-0x0000000005051000-memory.dmp

Filesize
4KB

Download
memory/5028-90-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/5168-324-0x000001DEC6730000-0x000001DEC6731000-memory.dmp

Filesize
4KB

Download
memory/5168-322-0x000001DEC6730000-0x000001DEC6731000-memory.dmp

Filesize
4KB

Download
memory/5168-318-0x000001DEC6730000-0x000001DEC6731000-memory.dmp

Filesize
4KB

Download
memory/5168-312-0x000001DEC6730000-0x000001DEC6731000-memory.dmp

Filesize
4KB

Download
memory/5168-314-0x000001DEC6730000-0x000001DEC6731000-memory.dmp

Filesize
4KB

Download
memory/5168-313-0x000001DEC6730000-0x000001DEC6731000-memory.dmp

Filesize
4KB

Download
memory/5168-319-0x000001DEC6730000-0x000001DEC6731000-memory.dmp

Filesize
4KB

Download
memory/5168-323-0x000001DEC6730000-0x000001DEC6731000-memory.dmp

Filesize
4KB

Download
memory/5168-320-0x000001DEC6730000-0x000001DEC6731000-memory.dmp

Filesize
4KB

Download
memory/5168-321-0x000001DEC6730000-0x000001DEC6731000-memory.dmp

Filesize
4KB

Download
memory/5612-31-0x0000000000380000-0x0000000000F92000-memory.dmp

Filesize
12.1MB

Download
memory/5612-32-0x0000000000380000-0x0000000000F92000-memory.dmp

Filesize
12.1MB

Download
memory/5612-74-0x0000000000380000-0x0000000000F92000-memory.dmp

Filesize
12.1MB

Download
memory/5612-40-0x0000000001420000-0x0000000001421000-memory.dmp

Filesize
4KB

Download