b9ad79eaf7a4133f95f24c3b9d976c72f34264dc5c99030f0e57992cb5621f78

Resubmissions

12-02-2024 14:18

240212-rmqw8she34 9

12-02-2024 14:14

240212-rkfngshd56 6

12-02-2024 14:08

240212-rflzpsfe9x 8

Analysis

max time kernel
270s
max time network
271s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AnyDesk.exe
Size

3.0MB
MD5

eb80f7bddb699784baa9fbf2941eaf4a
SHA1

df6abbfd20e731689f3c7d2a55f45ac83fbbc40b
SHA256

b9ad79eaf7a4133f95f24c3b9d976c72f34264dc5c99030f0e57992cb5621f78
SHA512

3a1162e9fef849cb7143dc1898d4cfcfd87eb80ced0edb321dfa096686b25ae8a9a7f3ae8f37a09724d94f96d64e08940fc23c0b931ddd8a1e70e2792cb3fe47
SSDEEP

98304:6aJXyQTrRGlSMoIuORmKBQielvZlpkiSti:3olMcR9BTY3WS

Score

8^/10

discovery pyinstaller

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\8F2DE7E770A8B1E412C2DE131064D7A52DA62287\Blob = 0300000001000000140000008f2de7e770a8b1e412c2de131064d7a52da62287190000000100000010000000aa6fd6bd7df2864341e10de037f41dc6040000000100000010000000a7c9563a13f15ee0e171ef6aa4c7a7870f0000000100000020000000dcb8261fa22c834b1ffb69470c0cc7baff034b5c656a6c297259addfbf73f1e320000000010000002c0500003082052830820410a003020102021003e9eb4dff67d4f9a554a422d5ed86f3300d06092a864886f70d01010b05003072310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3131302f0603550403132844696769436572742053484132204173737572656420494420436f6465205369676e696e67204341301e170d3138313032343030303030305a170d3232303130353132303030305a3065310b300906035504061302444531123010060355040713095374757474676172743120301e060355040a13177068696c616e64726f20536f66747761726520476d62483120301e060355040313177068696c616e64726f20536f66747761726520476d624830820122300d06092a864886f70d01010105000382010f003082010a0282010100c670a0d7fd91b6a5a0608435029365d11e529a2d43df54680357ad83dfb4ee6cbf54d74c4bc9205fbbca3b436d0fe3370b3200d8c655e242c92b4b2a2fa6040c81e530fcc1a60d849d52886bf3e29c50b52413e2a321f756b314f3bcbc47e550ea4b6ecf895132ae6f99a947ea9ad00982b86ebce0cd6a198bc65f1cc1bb6a1638931cb630c26ca343eb7f2bb394f36cb302bec93f3828dcf165700e7a00712cc914ce5f4b6c6945f201d769ca2fffe1268b6cf57965bd8d5c4177a2d176f32c9c9e60a7a96c3f775e64b84734394983790f56701d1b8f9614028ca180e7d03ffafa30bb51149059ae4d93d8b696c1160319e9945a760a640dd6bd134ce6db270203010001a38201c5308201c1301f0603551d230418301680145ac4b97b2a0aa3a5ea7103c060f92df665750e58301d0603551d0e0416041437566615f0b266ff2f5295d1ae83c4e065330e43300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330770603551d1f0470306e3035a033a031862f687474703a2f2f63726c332e64696769636572742e636f6d2f736861322d617373757265642d63732d67312e63726c3035a033a031862f687474703a2f2f63726c342e64696769636572742e636f6d2f736861322d617373757265642d63732d67312e63726c304c0603551d2004453043303706096086480186fd6c0301302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533008060667810c01040130818406082b0601050507010104783076302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304e06082b060105050730028642687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727453484132417373757265644944436f64655369676e696e6743412e637274300c0603551d130101ff04023000300d06092a864886f70d01010b0500038201010081f8e7b945d68610bab4057f23259843f454fd9c7aac4180dec936794e4a664dda255b30644288538121e30a69d4447dbc04c2da21e44f5c4ba41e706c9de0cb51c67931e31207ba3ac11791f9e551deb1aa3feee2a6e199a4d10b0cd71c05143f4466d6c84747d9bc3127e47102d90a2487440ea1b9a8e7317ddeeee3a0f42c296bf03314fa6e86f3743b9a4a6e756a54e67b0513c343e9e9f7c730af9f00acb32a27f707d3d04f22d58cbbb588c2fc72d5a37c4acaaab650c9533e96aa7a0bf53a60d86fb6ee8c982ec49b49130956b064d62e010da8a75e786a4445cff7b506eac4a40ab672d91dd23a272c7e28fb670cb502ff0f5572d88d8706580c5caf	DrvInst.exe

Downloads MZ/PE file

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
147	discord.com
148	discord.com
149	discord.com
151	discord.com
163	discord.com
146	discord.com
150	discord.com
161	discord.com
162	discord.com
164	discord.com
165	discord.com

Drops file in System32 directory 53 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6c05513e-0aa9-fc42-822f-5b7e888ddb99}\AnyDeskPrintDriverRenderFilter.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a\anydeskprintdriver.inf	DrvInst.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\System32\DriverStore\Temp\{6c05513e-0aa9-fc42-822f-5b7e888ddb99}\SET4EF8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6c05513e-0aa9-fc42-822f-5b7e888ddb99}\SET4EF9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6c05513e-0aa9-fc42-822f-5b7e888ddb99}\AnyDeskPrintDriver.gpd	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	AnyDesk.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a\AnyDeskPrintDriverRenderFilter-PipelineConfig.xml	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a\AnyDeskPrintDriver.cat	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	AnyDesk.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a\AnyDeskPrintDriverRenderFilter.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a\AnyDeskPrintDriver.gpd	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	AnyDesk.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6c05513e-0aa9-fc42-822f-5b7e888ddb99}\SET4EFB.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	AnyDesk.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6c05513e-0aa9-fc42-822f-5b7e888ddb99}	DrvInst.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	AnyDesk.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6c05513e-0aa9-fc42-822f-5b7e888ddb99}\AnyDeskPrintDriver.cat	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	AnyDesk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\System32\DriverStore\Temp\{6c05513e-0aa9-fc42-822f-5b7e888ddb99}\SET4EA8.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{6c05513e-0aa9-fc42-822f-5b7e888ddb99}\SET4EF9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6c05513e-0aa9-fc42-822f-5b7e888ddb99}\AnyDeskPrintDriverRenderFilter-PipelineConfig.xml	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	AnyDesk.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6c05513e-0aa9-fc42-822f-5b7e888ddb99}\SET4EA9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6c05513e-0aa9-fc42-822f-5b7e888ddb99}\SET4EFA.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	AnyDesk.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6c05513e-0aa9-fc42-822f-5b7e888ddb99}\SET4EF8.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	AnyDesk.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a\AnyDeskPrintDriver-manifest.ini	DrvInst.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\System32\DriverStore\Temp\{6c05513e-0aa9-fc42-822f-5b7e888ddb99}\SET4EA9.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{6c05513e-0aa9-fc42-822f-5b7e888ddb99}\SET4EFB.tmp	DrvInst.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6c05513e-0aa9-fc42-822f-5b7e888ddb99}\SET4EA8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6c05513e-0aa9-fc42-822f-5b7e888ddb99}\AnyDeskPrintDriver-manifest.ini	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6c05513e-0aa9-fc42-822f-5b7e888ddb99}\anydeskprintdriver.inf	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	AnyDesk.exe
File created	C:\Windows\System32\DriverStore\Temp\{6c05513e-0aa9-fc42-822f-5b7e888ddb99}\SET4EFA.tmp	DrvInst.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\AnyDesk\AnyDesk.exe	AnyDesk.exe
File opened for modification	C:\Program Files (x86)\AnyDesk\AnyDesk.exe	AnyDesk.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe

Executes dropped EXE 7 IoCs

pid	Process
4852	AnyDesk.exe
900	AnyDesk.exe
2140	AnyDesk.exe
5840	main.exe
6048	main.exe
5744	main.exe
6092	main.exe

Loads dropped DLL 57 IoCs

pid	Process
6048	main.exe
6048	main.exe
6048	main.exe
6048	main.exe
6048	main.exe
6048	main.exe
6048	main.exe
6048	main.exe
6048	main.exe
6048	main.exe
6048	main.exe
6048	main.exe
6048	main.exe
6048	main.exe
6048	main.exe
6048	main.exe
6048	main.exe
6048	main.exe
6048	main.exe
6048	main.exe
6048	main.exe
6048	main.exe
6048	main.exe
6048	main.exe
6048	main.exe
6048	main.exe
6048	main.exe
6048	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe
6092	main.exe

Detects Pyinstaller 4 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0009000000022769-569.dat	pyinstaller
behavioral1/files/0x0009000000022769-591.dat	pyinstaller
behavioral1/files/0x0009000000022769-592.dat	pyinstaller
behavioral1/files/0x0009000000022769-629.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 29 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AnyDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AnyDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	AnyDesk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\DefaultIcon	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open\command	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\URL Protocol	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\DefaultIcon\ = "AnyDesk.exe,0"	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open\command\ = "\"C:\\Program Files (x86)\\AnyDesk\\AnyDesk.exe\" \"%1\""	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open\command	AnyDesk.exe
Key created	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open\command\ = "\"C:\\Program Files (x86)\\AnyDesk\\AnyDesk.exe\" --play \"%1\""	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\ = "URL:AnyDesk Protocol"	AnyDesk.exe
Key created	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings	mspaint.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\DefaultIcon\ = "\"C:\\Program Files (x86)\\AnyDesk\\AnyDesk.exe\",0"	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\DefaultIcon	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open	AnyDesk.exe
Key created	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\main.exe:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1740	AnyDesk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3392	AnyDesk.exe
3392	AnyDesk.exe
3392	AnyDesk.exe
3392	AnyDesk.exe
3392	AnyDesk.exe
3392	AnyDesk.exe
4852	AnyDesk.exe
4852	AnyDesk.exe
2140	AnyDesk.exe
2140	AnyDesk.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2036	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	3392	AnyDesk.exe
Token: 33	4028	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4028	AUDIODG.EXE
Token: SeAuditPrivilege	1100	svchost.exe
Token: SeSecurityPrivilege	1100	svchost.exe
Token: SeDebugPrivilege	2036	taskmgr.exe
Token: SeSystemProfilePrivilege	2036	taskmgr.exe
Token: SeCreateGlobalPrivilege	2036	taskmgr.exe
Token: SeDebugPrivilege	4552	firefox.exe
Token: SeDebugPrivilege	4552	firefox.exe
Token: SeDebugPrivilege	6048	main.exe
Token: SeDebugPrivilege	6092	main.exe
Token: SeDebugPrivilege	4552	firefox.exe
Token: SeDebugPrivilege	4552	firefox.exe
Token: SeDebugPrivilege	4552	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1740	AnyDesk.exe
1740	AnyDesk.exe
1740	AnyDesk.exe
4416	AnyDesk.exe
1740	AnyDesk.exe
900	AnyDesk.exe
900	AnyDesk.exe
900	AnyDesk.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
4552	firefox.exe
4552	firefox.exe
4552	firefox.exe
4552	firefox.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1740	AnyDesk.exe
1740	AnyDesk.exe
1740	AnyDesk.exe
1740	AnyDesk.exe
900	AnyDesk.exe
900	AnyDesk.exe
900	AnyDesk.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
4552	firefox.exe
4552	firefox.exe
4552	firefox.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe
2036	taskmgr.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1708	AnyDesk.exe
1708	AnyDesk.exe
4552	firefox.exe
4552	firefox.exe
4552	firefox.exe
4552	firefox.exe
4848	mspaint.exe
4464	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 3392	4416	AnyDesk.exe	86
PID 4416 wrote to memory of 3392	4416	AnyDesk.exe	86
PID 4416 wrote to memory of 3392	4416	AnyDesk.exe	86
PID 4416 wrote to memory of 1740	4416	AnyDesk.exe	85
PID 4416 wrote to memory of 1740	4416	AnyDesk.exe	85
PID 4416 wrote to memory of 1740	4416	AnyDesk.exe	85
PID 4416 wrote to memory of 1172	4416	AnyDesk.exe	99
PID 4416 wrote to memory of 1172	4416	AnyDesk.exe	99
PID 4416 wrote to memory of 1172	4416	AnyDesk.exe	99
PID 4416 wrote to memory of 1364	4416	AnyDesk.exe	105
PID 4416 wrote to memory of 1364	4416	AnyDesk.exe	105
PID 4416 wrote to memory of 1364	4416	AnyDesk.exe	105
PID 4416 wrote to memory of 3604	4416	AnyDesk.exe	107
PID 4416 wrote to memory of 3604	4416	AnyDesk.exe	107
PID 4416 wrote to memory of 3604	4416	AnyDesk.exe	107
PID 1100 wrote to memory of 1036	1100	svchost.exe	109
PID 1100 wrote to memory of 1036	1100	svchost.exe	109
PID 1036 wrote to memory of 2044	1036	DrvInst.exe	110
PID 1036 wrote to memory of 2044	1036	DrvInst.exe	110
PID 2708 wrote to memory of 4552	2708	firefox.exe	114
PID 2708 wrote to memory of 4552	2708	firefox.exe	114
PID 2708 wrote to memory of 4552	2708	firefox.exe	114
PID 2708 wrote to memory of 4552	2708	firefox.exe	114
PID 2708 wrote to memory of 4552	2708	firefox.exe	114
PID 2708 wrote to memory of 4552	2708	firefox.exe	114
PID 2708 wrote to memory of 4552	2708	firefox.exe	114
PID 2708 wrote to memory of 4552	2708	firefox.exe	114
PID 2708 wrote to memory of 4552	2708	firefox.exe	114
PID 2708 wrote to memory of 4552	2708	firefox.exe	114
PID 2708 wrote to memory of 4552	2708	firefox.exe	114
PID 4552 wrote to memory of 4404	4552	firefox.exe	115
PID 4552 wrote to memory of 4404	4552	firefox.exe	115
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116
PID 4552 wrote to memory of 4024	4552	firefox.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"
1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1740
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3392
- - C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
    "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend
    3⤵
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    PID:1708
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --install "C:\Program Files (x86)\AnyDesk" --start-with-win --create-shortcuts --create-taskbar-icon --create-desktop-icon --install-drv --update-auto --svc-conf "C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf"
  2⤵
  - Drops file in Program Files directory
  - Modifies registry class
  PID:1172
- C:\Windows\SysWOW64\expand.exe
  expand -F:* "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver\v4.cab" "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver"
  2⤵
  - Drops file in Windows directory
  PID:1364
- C:\Windows\SysWOW64\rundll32.exe
  "rundll32" printui.dll, PrintUIEntry /if /b "AnyDesk Printer" /f "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver\AnyDeskPrintDriver.inf" /r "AD_Port" /m "AnyDesk v4 Printer Driver"
  2⤵
  - Drops file in Windows directory
  PID:3604

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x46c 0x4f0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4028

C:\Program Files (x86)\AnyDesk\AnyDesk.exe
"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --service
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4852

C:\Program Files (x86)\AnyDesk\AnyDesk.exe
"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --control
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:900

C:\Program Files (x86)\AnyDesk\AnyDesk.exe
"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --new-install
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{47789576-9f83-7e44-914e-6b7556b4d73e}\anydeskprintdriver.inf" "9" "49a18f3d7" "000000000000014C" "WinSta0\Default" "0000000000000158" "208" "c:\users\admin\appdata\roaming\anydesk\printer_driver"
  2⤵
  - Manipulates Digital Signatures
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{f7d31e4a-d5f7-104f-9126-232b60f6df65} Global\{ed744025-3361-3946-a0cc-6d79652b5706} C:\Windows\System32\DriverStore\Temp\{6c05513e-0aa9-fc42-822f-5b7e888ddb99}\anydeskprintdriver.inf C:\Windows\System32\DriverStore\Temp\{6c05513e-0aa9-fc42-822f-5b7e888ddb99}\AnyDeskPrintDriver.cat
    3⤵
    PID:2044

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2036

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.0.85631664\1355100174" -parentBuildID 20221007134813 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 20671 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecf5baaf-2d67-49cf-92be-1836dffc6419} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 1964 25b31ad9158 gpu
    3⤵
    PID:4404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.1.1182585738\1310598535" -parentBuildID 20221007134813 -prefsHandle 2336 -prefMapHandle 2332 -prefsLen 20707 -prefMapSize 233414 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f645676-f4f7-4a23-8569-2ffcf3e57d5f} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 2364 25b31431a58 socket
    3⤵
    PID:4024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.2.1092142389\1319526982" -childID 1 -isForBrowser -prefsHandle 3300 -prefMapHandle 3268 -prefsLen 20810 -prefMapSize 233414 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {164be0ea-8cad-4406-9b44-74430c276eb1} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 3384 25b35aa1258 tab
    3⤵
    PID:1580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.3.1016699155\249148955" -childID 2 -isForBrowser -prefsHandle 1080 -prefMapHandle 3020 -prefsLen 25988 -prefMapSize 233414 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5882a2b6-3724-43bb-8ce2-df9dead79225} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 3060 25b25062858 tab
    3⤵
    PID:1572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.4.1754836279\311297760" -childID 3 -isForBrowser -prefsHandle 4360 -prefMapHandle 4364 -prefsLen 26047 -prefMapSize 233414 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59875d41-2e19-442b-adba-d8fb690771e8} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 4336 25b37494e58 tab
    3⤵
    PID:1688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.7.2089523147\396580218" -childID 6 -isForBrowser -prefsHandle 5488 -prefMapHandle 5492 -prefsLen 26047 -prefMapSize 233414 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0165727-2971-47e8-b9a3-d21548b8ecf8} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 5480 25b3789ce58 tab
    3⤵
    PID:5172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.6.1870440236\1354799719" -childID 5 -isForBrowser -prefsHandle 5296 -prefMapHandle 5300 -prefsLen 26047 -prefMapSize 233414 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0969a766-4be1-4358-a07d-3517d79d89ad} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 5288 25b3789fb58 tab
    3⤵
    PID:5164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.5.256516191\53974711" -childID 4 -isForBrowser -prefsHandle 5144 -prefMapHandle 5140 -prefsLen 26047 -prefMapSize 233414 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7935780c-6458-4b96-97dd-cd1e98e542c8} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 5156 25b3605e258 tab
    3⤵
    PID:5156
- - C:\Users\Admin\Downloads\main.exe
    "C:\Users\Admin\Downloads\main.exe"
    3⤵
    - Executes dropped EXE
    PID:5840
  - - C:\Users\Admin\Downloads\main.exe
      "C:\Users\Admin\Downloads\main.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:6048

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5660

C:\Users\Admin\Downloads\main.exe
"C:\Users\Admin\Downloads\main.exe"
1⤵
- Executes dropped EXE
PID:5744
- C:\Users\Admin\Downloads\main.exe
  "C:\Users\Admin\Downloads\main.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:6092

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ConvertFromUpdate.jpe" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4848

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:3800

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4464

C:\Windows\System32\ghlptw.exe
"C:\Windows\System32\ghlptw.exe"
1⤵
PID:5676

C:\Windows\System32\ghlptw.exe
"C:\Windows\System32\ghlptw.exe"
1⤵
PID:6116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\AnyDesk\AnyDesk.exe

Filesize
3.0MB

MD5
eb80f7bddb699784baa9fbf2941eaf4a

SHA1
df6abbfd20e731689f3c7d2a55f45ac83fbbc40b

SHA256
b9ad79eaf7a4133f95f24c3b9d976c72f34264dc5c99030f0e57992cb5621f78

SHA512
3a1162e9fef849cb7143dc1898d4cfcfd87eb80ced0edb321dfa096686b25ae8a9a7f3ae8f37a09724d94f96d64e08940fc23c0b931ddd8a1e70e2792cb3fe47

Download Submit
C:\ProgramData\AnyDesk\service.conf

Filesize
2KB

MD5
fb383763c14d4e83ad6452843e03e226

SHA1
d22d75a001dea40eaee6fc74de2685df3e763216

SHA256
8eb35fca89a898df6f83e763472b661512e26b9bfaa00a31e8dc55df79b41edf

SHA512
02f55d60e8c32965293e021624cac74f58c3d135251035d87d8d51db0d80de6bbd3715829556138286e9199e2a80ef762de7189b599e18f7465dc2ddff5dc4cc

Download Submit
C:\ProgramData\AnyDesk\system.conf

Filesize
60B

MD5
25e71767a94343d45dd3e066c05784bf

SHA1
901ae90156458e9b91f29cb0789964a5bfbc1127

SHA256
1b7467f3f2b0a63dc29701aa97c9e7b76757e4aa6c44d61e48e067068ca88525

SHA512
ae538706623ced39a44622e9fd0f0422c4824bf9e8cc2ef6b143458873d142230ad949efeb8651fdba70f9488be935ace6bf40a8da842d74ca7895c85abb4bd6

Download Submit
C:\ProgramData\AnyDesk\system.conf

Filesize
165B

MD5
a0729d8e8f86d868a176cc7dfae2d838

SHA1
315dc26e637ffff33255eae114b68004e3e70710

SHA256
ef0dd944be1b8a720694ca9df218f719e5366527fd75e2bd898c7035a6ce8f84

SHA512
aedec46ba8d3b77f87987a01682926b1786e0ac1aa629d99ae99a930c7665e76736e3747628efeb36ec52e718ed64daa49402970c41546f60f6cf0344f294c0d

Download Submit
C:\ProgramData\AnyDesk\system.conf

Filesize
415B

MD5
6e02966532aced50f14712591665e77b

SHA1
9033b3b4ca8970c0b291532f58b3eee529043672

SHA256
199b52f6ddb2e0422cd429e02a68b579454e705f663a188d485780869f7f82f9

SHA512
2021b8d7335484958b6d53482dfc35fb312b9b124e19c24d14466213da1b9e33262b5319243ef97d80b52fc655be225b3e87df311a0504917bb4f4c4670910bb

Download Submit
C:\ProgramData\AnyDesk\system.conf

Filesize
415B

MD5
80b31648673275092cdbbe1f54a9b6ee

SHA1
305cdaaff81f54076f31625192f2f871d192eea3

SHA256
0e75cd8d89bab3ce5199880462c3826cffd0a7ab0d11229a8be5fb0fa612b58a

SHA512
793e44d8d73283bed9f25e03221f7fa37c8578f5837c91cd8e7caaf05f7b460e88e8a231bafb0d6017e5c6fe87784e5a3d791f6381effefa88cf3650a6ed8f9a

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AnyDesk.lnk

Filesize
1KB

MD5
8a934de70bec442048f7fc3be8095993

SHA1
8640c61b2f00a921020565aaa20b35e118bd04e2

SHA256
b2d9d9d4f22cce97d81f8891055d21fe6da6131484246cd7884c8be5d4b27aee

SHA512
be5f68b1ad01ebad36f3427d54daeb19f411c655d294133d3a44904734c64a2db0d87546391091dc15a24eea647c6613a68905b641ae3a4a2ffd08050971b2f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\_bz2.pyd

Filesize
82KB

MD5
59d60a559c23202beb622021af29e8a9

SHA1
a405f23916833f1b882f37bdbba2dd799f93ea32

SHA256
706d4a0c26dd454538926cbb2ff6c64257c3d9bd48c956f7cabd6def36ffd13e

SHA512
2f60e79603cf456b2a14b8254cec75ce8be0a28d55a874d4fb23d92d63bbe781ed823ab0f4d13a23dc60c4df505cbf1dbe1a0a2049b02e4bdec8d374898002b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\_ctypes.pyd

Filesize
122KB

MD5
2a834c3738742d45c0a06d40221cc588

SHA1
606705a593631d6767467fb38f9300d7cd04ab3e

SHA256
f20dfa748b878751ea1c4fe77a230d65212720652b99c4e5577bce461bbd9089

SHA512
924235a506ce4d635fa7c2b34e5d8e77eff73f963e58e29c6ef89db157bf7bab587678bb2120d09da70594926d82d87dbaa5d247e861e331cf591d45ea19a117

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\_lzma.pyd

Filesize
155KB

MD5
b71dbe0f137ffbda6c3a89d5bcbf1017

SHA1
a2e2bdc40fdb83cc625c5b5e8a336ca3f0c29c5f

SHA256
6216173194b29875e84963cd4dc4752f7ca9493f5b1fd7e4130ca0e411c8ac6a

SHA512
9a5c7b1e25d8e1b5738f01aedfd468c1837f1ac8dd4a5b1d24ce86dcae0db1c5b20f2ff4280960bc523aee70b71db54fd515047cdaf10d21a8bec3ebd6663358

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\base_library.zip

Filesize
1.3MB

MD5
630153ac2b37b16b8c5b0dbb69a3b9d6

SHA1
f901cd701fe081489b45d18157b4a15c83943d9d

SHA256
ec4e6b8e9f6f1f4b525af72d3a6827807c7a81978cb03db5767028ebea283be2

SHA512
7e3a434c8df80d32e66036d831cbd6661641c0898bd0838a07038b460261bf25b72a626def06d0faa692caf64412ca699b1fa7a848fe9d969756e097cba39e41

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\libcrypto-3.dll

Filesize
5.0MB

MD5
e547cf6d296a88f5b1c352c116df7c0c

SHA1
cafa14e0367f7c13ad140fd556f10f320a039783

SHA256
05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de

SHA512
9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\libssl-3.dll

Filesize
768KB

MD5
19a2aba25456181d5fb572d88ac0e73e

SHA1
656ca8cdfc9c3a6379536e2027e93408851483db

SHA256
2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006

SHA512
df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\pyexpat.pyd

Filesize
194KB

MD5
f179c9bdd86a2a218a5bf9f0f1cf6cd9

SHA1
4544fb23d56cc76338e7f71f12f58c5fe89d0d76

SHA256
c42874e2cf034fb5034f0be35f7592b8a96e8903218da42e6650c504a85b37cc

SHA512
3464ece5c6a0e95ef6136897b70a96c69e552d28bfedd266f13eec840e36ec2286a1fb8973b212317de6fe3e93d7d7cc782eb6fc3d6a2a8f006b34f6443498de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\python3.dll

Filesize
66KB

MD5
6271a2fe61978ca93e60588b6b63deb2

SHA1
be26455750789083865fe91e2b7a1ba1b457efb8

SHA256
a59487ea2c8723277f4579067248836b216a801c2152efb19afee4ac9785d6fb

SHA512
8c32bcb500a94ff47f5ef476ae65d3b677938ebee26e80350f28604aaee20b044a5d55442e94a11ccd9962f34d22610b932ac9d328197cf4d2ffbc7df640efba

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\python312.dll

Filesize
4.8MB

MD5
3603969cf7874c582586f5e88cb645b5

SHA1
b066d9ff4a91ad56bc795468e4925c2737e5a984

SHA256
a4d79e3e31004baafcd0806220199e10404a34fe1bab94d330f95be72989fdb0

SHA512
30fda112aa719bc70485d747de5c2f7ec9654a5b3158b3f4fc6f97607261c63ececc1a1e7aa562155133e0f3f1a65db7d8afa375bbd3730ea4a2a5e7e27b50a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\python312.dll

Filesize
4.7MB

MD5
20318643103279f6973c1c392e36989a

SHA1
08b912126ebde8617b1ec19aa2b9dd74e9a34a9e

SHA256
6fefbb1e11fbb8ec81800998e5d2aca8c54533400387ab00cc5464dd03a37ae2

SHA512
087c747d8fcf1361f5460ada74605a194e0b8a21084ff7f4c7546ba8232ef639e7f3ed8e9275d921a32e83bb997ac1d0c3a87e77afba95662c9d425920f4975c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\select.pyd

Filesize
29KB

MD5
8a273f518973801f3c63d92ad726ec03

SHA1
069fc26b9bd0f6ea3f9b3821ad7c812fd94b021f

SHA256
af358285a7450de6e2e5e7ff074f964d6a257fb41d9eb750146e03c7dda503ca

SHA512
7fedae0573ecb3946ede7d0b809a98acad3d4c95d6c531a40e51a31bdb035badc9f416d8aaa26463784ff2c5e7a0cc2c793d62b5fdb2b8e9fad357f93d3a65f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\{47789576-9f83-7e44-914e-6b7556b4d73e}\SET4DDD.tmp

Filesize
277KB

MD5
1e4faaf4e348ba202dee66d37eb0b245

SHA1
bb706971bd21f07af31157875e0521631ecf8fa5

SHA256
3aa636e7660be17f841b7f0e380f93fb94f25c62d9100758b1d480cbb863db9d

SHA512
008e59d645b30add7d595d69be48192765dac606801e418eeb79991e0645833abeacfc55aa29dae52dc46aaf22b5c6bc1a9579c2005f4324bece9954ebb182ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\{47789576-9f83-7e44-914e-6b7556b4d73e}\SET4DDE.tmp

Filesize
584B

MD5
b76df597dd3183163a6d19b73d28e6d3

SHA1
9f7d18a7e09b3818c32c9654fb082a784be35034

SHA256
cba7c721b76bb7245cd0f1fbfdf85073d57512ead2593050cad12ce76886ac33

SHA512
6f74ad6bbbb931fe78a6545bb6735e63c2c11c025253a7cb0c4605e364a1e3ac806338bb62311d715bf791c5a5610ee02942ff5a0280282d68b93708f1317c69

Download Submit
C:\Users\Admin\AppData\Local\Temp\{47789576-9f83-7e44-914e-6b7556b4d73e}\SET4DDF.tmp

Filesize
271B

MD5
0d7876b516b908aab67a8e01e49c4ded

SHA1
0900c56619cd785deca4c302972e74d5facd5ec9

SHA256
98933de1b6c34b4221d2dd065715418c85733c2b8cb4bd12ac71d797b78a1753

SHA512
6874f39fff34f9678e22c47b67f5cd33b825c41f0b0fd84041450a94cc86cc94811293ba838f5267c9cd167d9abcf74e00a2f3c65e460c67e668429403124546

Download Submit
C:\Users\Admin\AppData\Local\Temp\{47789576-9f83-7e44-914e-6b7556b4d73e}\SET4DF0.tmp

Filesize
11KB

MD5
e0d32d133d4fe83b0e90aa22f16f4203

SHA1
a06b053a1324790dfd0780950d14d8fcec8a5eb9

SHA256
6e996f3523bcf961de2ff32e5a35bcbb59cb6fe343357eff930cd4d6fa35f1f4

SHA512
c0d24104d0b6cb15ff952cbef66013e96e5ed2d4d3b4a17aba3e571a1b9f16bd0e5c141e6aabac5651b4a198dbd9e65571c8c871e737eb5dcf47196c87b8907b

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
52KB

MD5
fc9ade92e650d39984667bd45df33334

SHA1
41cf8e1e539f51ec689307fbbdfd6630d8a67cb7

SHA256
5ed98bf056709a60b879d7f1a9737fbd8ac7662ab9bb136307aed72436208886

SHA512
8352af89e9c643784dbf2848d393ccc120190b89011e82712b94bcd0c48b80f0ad3a2865f2dda6b70f2a803000e26eeccc10b0b38238cea41d3235e5a96a3fa4

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
58KB

MD5
7d921a411b44d16caef95182cfcf869a

SHA1
fc0416271b76a4669569f9881a575528eaaf0d1a

SHA256
0aefc580f16b601f9bc92734bff84ba3aca3a1e7eb4b0148413a5d2852e406b3

SHA512
931af5d56f4987a2174b962f90d0657bdbd4a3a893aa166e44985dd4be4bb8811abfc10f062dde037b9f4599e29a723e96de08a0945d8cf56d7d4669d261c6e0

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
6KB

MD5
bab6f3d4522c94a6010fd4a1a17496b4

SHA1
f08e6ff137b9308cfffe3a9447895a69e3fbe581

SHA256
7c406fc5f91f3ae0a43de39c9a68efd3b5632b747c52b24b5916c9812682e7de

SHA512
87a6b37c93f9476a132af83847c8a6c39d6cf200408c1f5b5ca51dced2e9e8487f66574b2f447b9fdea1178a972338afea7f53640eba332cc896f30842864b29

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
37KB

MD5
88cf82d1e65e1059968afc34853c64d4

SHA1
dec67381f8d292dbafdd246cf1b26d7c6c7cbf0c

SHA256
025f6cdfe80b69535ff7ccdc58350056a7546d522a86aff3eb8e0dff9fd997a2

SHA512
e16ae7774c92d5e763628d03e5f92b5b7f193233b0f8440afbb8c2e1ed00cb9f0bd633eb5f081edc1b3d0935b3c1af25c81d3f6f276b5a838c7155858749f9da

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
b538e97c38a770f0dc4d3ca053237561

SHA1
4eb967c06147371346c37bd061ac1fab13b445a8

SHA256
fc1a78b78853e9d1970a053077ca5da313968dcd7f8bb68b246cf372dfbc5083

SHA512
4645e282de2334c7414710ba3660e488129d364d428d192aa072ae4f735241abc4eb7342912402bf4a5a5fa9f03e4847238abb4901e24e9accda6a6f82cc21f8

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
105B

MD5
1144b3bedc34af5d8e61437c350330c9

SHA1
352f8e3662195be305891327fdfcc669ab8e6547

SHA256
47f54a2ff3c7944d1810c207b359d979888f1c42150612c3018307e00a971a24

SHA512
8626924a9009d813da6be3c95288df032cc0c3d5ec86e13400e906334b76f19afd0a5a3c96611c5e2a4c7274cdf416ae581818ce3dc50416baf0b3115dda34b2

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
330B

MD5
1e2471ace5f8439032f702f52465df5c

SHA1
87c402e93a68ac670c06cf026f0d947260809a09

SHA256
74de680c529c3c65bb410b6ec75e9c644fb9721388edebd1a91ef82edb3ebcd0

SHA512
98725879eeb815e8b98fe888ab8e910c86ae03355489e44a8eebc367aee43192d46be002cf51868c4a75611ea74d51df3d647d4f3a299c75ee90d72f3df9ebf5

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
222B

MD5
45746c5407e7689edca88f651d16b90f

SHA1
cd5fdbe383522dd1c134f3a17c4a4d3f416f859d

SHA256
b6c2d1d011c979e1ec2b6f0bb5e87e5d6862745d3bbce62866133265cdda3d72

SHA512
87a1f8536943806a5bc5d30a398f8f5ddad8703357129c83aa3bdea61b821901417423165ebb3d1f08de42fb034403a8dae2cd64a095fe52f75d25ea9c592227

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
245B

MD5
f3b82bd5b0fa26a5a729e2922130841b

SHA1
e283e592d0d89983041cda583014cdff70394474

SHA256
dede089b8a77cd7d9515662fd6d6d56fc1757475df29272ecc8c15e4cc90ebc1

SHA512
3822ce15b0015a8e1d97a28f62f32a49bc222ea97117929647273d1dc0a567d273ea2542dbf0b575accfb751117185f5f2adcdabd469fe77ca62aee931532110

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
205B

MD5
59352c2b0c590c5fd96365d3168d723b

SHA1
53ab571639cc3e3a38032c1095985f7f4278d8fc

SHA256
079db0d18cb8ca55e8653f3d67608c5e445d32e368feb874ed3fa1d797c7c286

SHA512
2d21bcd26ef934095ca5b37aa1e66091547870f5e09c2d203dfd75923d2575f93f1a42f31e4fb7b2423b766984464ed65b048f49519837918de246a892c82828

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
3KB

MD5
f28e06a1c66d1ae44ae1367c42e062f5

SHA1
398dcb144a7372535cdca884d630a8eef0cbabb7

SHA256
0d574d320fc992f42c93bd7eda0852878f9feb16bc05727094b405c39e787553

SHA512
f7473439774c6f4716d7ffecdfa456b2a1eda04d8fe15ec2d467f21ca7007d4e15e422ae66b8e5dd6937d7ed8b13d3f1197e6ce912374a09f897224e171bfba4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
3KB

MD5
adae527b77aa955f30133576c41eb2df

SHA1
578787018c567e4dbaaf66f2891449b3aab3ad84

SHA256
ce9d15956cadc48fe7863daf8f266b1341b105122184f62b3456f7e0e097cdab

SHA512
b5e0163ce92177b92d699a02d59131b848359ab760b7df8e36534578b8d1586776752de508436bf3698a683b6d6321047430d2281705b1e4bdb515a0c6acd0a1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
3KB

MD5
c24a852be1dcf7b91924896ac9aeed14

SHA1
ac7c7c49cb8fa93356937924b60fd660264915f0

SHA256
28f41d7531922b3845663e93d052872d6c8fb4316163c0cd389c3f0333bbe1b0

SHA512
7427e8560326ea20ba432b5e126ae954f9c282101d83cf20f4c2302d488751c07df450717b7789bd26018804b5c3b32949ada317e61c92d44168d52b481e85d8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
75e81346b33221538b9ceae2719abb3d

SHA1
6e42d6a4304365b6ab5118cc617591fa2f0fcdfb

SHA256
7e7f1a9c59073479c5472a7b8750e34dbda0f6b2ffc9bb3395b191706e6f1f66

SHA512
cf469fbff33d67cb5b587e1b57735cbbac52c469a46621a40967ac39bc0e687edf17c652d73c75e993168982945aad4a37afee62ab6bc235426b7758a11538f0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\datareporting\glean\pending_pings\bb55ba17-f6e0-43b3-b2a9-1f640f521b3e

Filesize
746B

MD5
47c443581eb581ef4cf492b35b440916

SHA1
f70850dc14ad04d9c7643a0c8e7775ea0175f252

SHA256
ee3f1f45c0d7d75b1ea941b21c65374c23369269258fd4279911313f0eed13c4

SHA512
6cf802ba9c073a614470c233c189692e617a22172b66354706e70b0b74f35d5d69996b6843d500c3f7b11937a4a3f2bd98b8c165ae2901649da79a7d606c785d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\datareporting\glean\pending_pings\d8ac8c9a-63fa-4d70-9c6e-794bdfbdf042

Filesize
10KB

MD5
3d838882e9124e1ce0f9e509a0085100

SHA1
bda76bf6ffb7b8ad7bff751fdee59129f97e2872

SHA256
df13d9dd974a0a20f535e81616bb9da23a261f9bffd0d4e2e7d93065d70e80e1

SHA512
6e6b032e51c2882172bccc04bba853e7a193fa21b1c330916bb3ca32e75842962d31b34ebbce0e02ae0ac3c96eea8c2583e24b0a7c37be51ddec215708c00007

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\prefs-1.js

Filesize
6KB

MD5
7d0995030c43257c298991cd2281ae01

SHA1
08de32454023f8fa01b71411117692101d44d7b0

SHA256
6fd1e0198b1250c46d0c621dbc4ea174a318e825ac7ebb6e3ffe91f607741dc2

SHA512
ecbc5e17706051ccc4c7bbef4132b68bd70d6e2946c50432b0c64b7e315a8f9ee687ce8f18627241c8c4480b767c282f315d54a01d11cd706f8727c2e41d5144

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\prefs.js

Filesize
5KB

MD5
49b08a8e030e8f0dd2ea3323d905e411

SHA1
9835f081a473fd93aaed8a141d5dd1fb1dd91129

SHA256
61431e2c5b685a7eaebc851e8b173f4963f4b127f0e3aff66716a324a07d522e

SHA512
d0a519465d438ca9ea5b12fe80010e1e84aa2b67be04be3a4e9cb60808d842dfe92b5e9f31e44faaa0b5c418300d286988a189e11b18038f8cf49572a7c9a728

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\prefs.js

Filesize
5KB

MD5
8e95f3b2dbd78c71085f95246d647ac1

SHA1
0bbdddc3a60ea99df496734b5ce7511c35dd1772

SHA256
af89e85d1f9806d05eaa5934fb2463056e12abb982722e3194b7628a508f4414

SHA512
669773146b13192a1f5d8fd4479178ad2efe28bdf71d090af55dedfdb8afdecb6e2f334437129f74f753511f0cf89389906f544fb14daa191f16ab9f6ce1db9d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
998792a10bcc0c9c006b836ad246f0ea

SHA1
9730855a452f4040808e027f8db4b7f2e6df6eb2

SHA256
e6160ab994f23a0fcd912d03b4947fe8c7d7c029b9fe3d221eba60ce69c92dee

SHA512
a55910443699d62e390732c8efbaee7c26d60837ede3a6d36d51bcd8ad44e4a8b6502b0edd828a4c7bce87d9fa50415dc6abbb0696641cfd832c49dc1f20232a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
2507e5961a423212f3ee3a3b0218bc4f

SHA1
7e9099455ccb9245e02e7a8ff40aea5b83c1ab08

SHA256
c7841e914d8e83c36fa0f3affe85e5eb3cb591c4121749e2f0cd07c1e79007e7

SHA512
7edda950b2d1d39d99a2a2dd5f09cde11c125c25095ac4e15101033641ec83b427a70edbed4e5fddb0141735d3500d8335f69f27673838572fa0d6a463ccf387

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
d45112043b8107bbf1f8dc6da1a51a67

SHA1
08a23d281107ec94713d3b40b4266e98685a0086

SHA256
58064f9b3273d5de6bd15163dac6a09fc10d6818f40f875eb33da4d4a39f1375

SHA512
b254f39751cd31730b241cf2372a90538043cd0724723a2ae0d32aa70f211e56ac42cc5c1d81341bbeb1ee0329f6010774dcb3c8dd1351e05693a29a124e322c

Download Submit
C:\Users\Admin\Downloads\main.2eNovqB_.exe.part

Filesize
3.1MB

MD5
a55ce9b7711d3b82ef9f5d8edb029383

SHA1
044f16f4870442baa34432143f777a481d3d638f

SHA256
776e683f6cb735316b4566b6169fe5cb8d9e444c81be1da2c8186749193d5cee

SHA512
a9c6f8fd2030ae484d0a6d5b261f5fb2c39608a942a92a446c4a4767f9649524d37c424f6fcf31ec492de995e61f97e8f065173732cb65600cd15bca71405b90

Download Submit
C:\Users\Admin\Downloads\main.exe

Filesize
9.2MB

MD5
895df35bcdd2b83097433f6ac38b0db8

SHA1
96dbe6581faf3d17ef434d98b7f32503055a3cca

SHA256
4a0e7277b656598050dd86d77467d8bb520a55b95aa5561c50e348245f6ffa4f

SHA512
32764b0bd22268b1320327bc3769eedbdd6ce304447556a67cf948095e5dcb5b91e04bb27e49fd647652efc905eaf7189270800d3f9d903cac1b04a32a794929

Download Submit
C:\Users\Admin\Downloads\main.exe

Filesize
7.1MB

MD5
a19df3ee498c8a501af545f0be2d27ba

SHA1
c82e9527da2d0fd7ab4e9896bd447be46f0264ae

SHA256
16ec948e8cc3fb8f74bcfa719d0b79f151dc90d8ab73926bea30c416a3b25921

SHA512
37efd4456e8f1ef51ce213d42b86bc36b521afe189494f3ee406e263112a52c8fb085328c42c70bea5579e196701af83fc86c1e754c0c2a1a1cacf995971ac27

Download Submit
C:\Users\Admin\Downloads\main.exe

Filesize
5.2MB

MD5
57a4e096f0d9c4f8fee1bd5ee3847d5a

SHA1
eade4ec4f6da1aca472c67d4f227cca61342506d

SHA256
5e5937f1289ebbd3e6da72c1a1d76e4fc0c6ef8f43cc1c6306593bbde7783af2

SHA512
d56c37121d5529cd009c97f858614f38dde76e0270d311ae38ec97424413d3049745d2063dc0bfa5f9dcf9ec8556ac448212820996c91d954a3633bc8679b5f7

Download Submit
\??\c:\users\admin\appdata\roaming\anydesk\printer_driver\AnyDeskPrintDriver.cat

Filesize
9KB

MD5
6d1663f0754e05a5b181719f2427d20a

SHA1
5affb483e8ca0e73e5b26928a3e47d72dfd1c46e

SHA256
12af5f4e8fc448d02bcfd88a302febe6820a5a497157ef5dca2219c50c1621e3

SHA512
7895f6e35591270bfa9e373b69b55389d250751b56b7ea0d5b10ab770283b8166182c75dca4ebbecdd6e9790dbbfda23130fb4f652545fd39c95619b77195424

Download Submit
\??\c:\users\admin\appdata\roaming\anydesk\printer_driver\anydeskprintdriver.inf

Filesize
2KB

MD5
d4ca3f9ceeb46740c6c43826d94aba18

SHA1
d863cb54ad2fa0cfc0329954cbe49f70f49fdb87

SHA256
494e4351b85d2821e53a22434f51a4186aa0f7be5724922fc96dfb16687ad37c

SHA512
be08bc144ee2a491fbc80449b4339c01871c6e7d2ddc0e251475d8e426220c6ef35f67698b0586156f0a62b22db764c43842f577b82c3f9e4e93957f9d617db4

Download Submit
\??\c:\users\admin\appdata\roaming\anydesk\printer_driver\v4.cab

Filesize
127KB

MD5
5a4f0869298454215cccf8b3230467b3

SHA1
924d99c6bf1351d83b97df87924b482b6711e095

SHA256
5214e8ff8454c715b10b448e496311b4ff18306ecf9cbb99a97eb0076304ce9a

SHA512
0acf25d5666113ce4b39aa4b17ce307bef1a807af208560471a508d1ecadfa667d80f97c191e187b8ea6af02128d55685a4dd0ddc6dd5aabe8b460f6bc727eee

Download Submit
memory/900-204-0x0000000000C00000-0x0000000001812000-memory.dmp

Filesize
12.1MB

Download
memory/1172-210-0x0000000000AB0000-0x00000000016C2000-memory.dmp

Filesize
12.1MB

Download
memory/1172-144-0x0000000000AB0000-0x00000000016C2000-memory.dmp

Filesize
12.1MB

Download
memory/1708-106-0x0000000007300000-0x0000000007301000-memory.dmp

Filesize
4KB

Download
memory/1708-373-0x0000000000AB0000-0x00000000016C2000-memory.dmp

Filesize
12.1MB

Download
memory/1708-110-0x00000000073C0000-0x00000000073C1000-memory.dmp

Filesize
4KB

Download
memory/1708-111-0x00000000073E0000-0x00000000073E1000-memory.dmp

Filesize
4KB

Download
memory/1708-114-0x00000000073A0000-0x00000000073A1000-memory.dmp

Filesize
4KB

Download
memory/1708-113-0x0000000007320000-0x0000000007321000-memory.dmp

Filesize
4KB

Download
memory/1708-112-0x0000000007400000-0x0000000007401000-memory.dmp

Filesize
4KB

Download
memory/1708-115-0x0000000007420000-0x0000000007421000-memory.dmp

Filesize
4KB

Download
memory/1708-116-0x0000000007430000-0x0000000007431000-memory.dmp

Filesize
4KB

Download
memory/1708-117-0x0000000007440000-0x0000000007441000-memory.dmp

Filesize
4KB

Download
memory/1708-93-0x0000000004D20000-0x0000000004D21000-memory.dmp

Filesize
4KB

Download
memory/1708-122-0x0000000007450000-0x0000000007451000-memory.dmp

Filesize
4KB

Download
memory/1708-124-0x000000000A3C0000-0x000000000A3C1000-memory.dmp

Filesize
4KB

Download
memory/1708-123-0x000000000A3B0000-0x000000000A3B1000-memory.dmp

Filesize
4KB

Download
memory/1708-125-0x0000000000AB0000-0x00000000016C2000-memory.dmp

Filesize
12.1MB

Download
memory/1708-126-0x000000000AA80000-0x000000000AA81000-memory.dmp

Filesize
4KB

Download
memory/1708-109-0x0000000007380000-0x0000000007381000-memory.dmp

Filesize
4KB

Download
memory/1708-94-0x0000000004C90000-0x0000000004C91000-memory.dmp

Filesize
4KB

Download
memory/1708-88-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/1708-400-0x0000000000AB0000-0x00000000016C2000-memory.dmp

Filesize
12.1MB

Download
memory/1708-85-0x0000000000AB0000-0x00000000016C2000-memory.dmp

Filesize
12.1MB

Download
memory/1708-108-0x0000000007360000-0x0000000007361000-memory.dmp

Filesize
4KB

Download
memory/1708-84-0x0000000000AB0000-0x00000000016C2000-memory.dmp

Filesize
12.1MB

Download
memory/1708-107-0x0000000007340000-0x0000000007341000-memory.dmp

Filesize
4KB

Download
memory/1708-95-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Filesize
4KB

Download
memory/1708-92-0x0000000004C80000-0x0000000004C81000-memory.dmp

Filesize
4KB

Download
memory/1708-105-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

Filesize
4KB

Download
memory/1708-104-0x0000000004D80000-0x0000000004D81000-memory.dmp

Filesize
4KB

Download
memory/1708-103-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Filesize
4KB

Download
memory/1708-91-0x0000000004C70000-0x0000000004C71000-memory.dmp

Filesize
4KB

Download
memory/1708-96-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

Filesize
4KB

Download
memory/1708-102-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Filesize
4KB

Download
memory/1708-98-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/1708-99-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download
memory/1708-101-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/1708-97-0x0000000004D30000-0x0000000004D31000-memory.dmp

Filesize
4KB

Download
memory/1708-100-0x0000000004D70000-0x0000000004D71000-memory.dmp

Filesize
4KB

Download
memory/1708-89-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

Filesize
4KB

Download
memory/1708-90-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

Filesize
4KB

Download
memory/1740-30-0x0000000000AB0000-0x00000000016C2000-memory.dmp

Filesize
12.1MB

Download
memory/1740-35-0x0000000000AB0000-0x00000000016C2000-memory.dmp

Filesize
12.1MB

Download
memory/1740-38-0x0000000003680000-0x0000000003681000-memory.dmp

Filesize
4KB

Download
memory/1740-74-0x0000000000AB0000-0x00000000016C2000-memory.dmp

Filesize
12.1MB

Download
memory/2036-409-0x00000234CF780000-0x00000234CF781000-memory.dmp

Filesize
4KB

Download
memory/2036-410-0x00000234CF780000-0x00000234CF781000-memory.dmp

Filesize
4KB

Download
memory/2036-418-0x00000234CF780000-0x00000234CF781000-memory.dmp

Filesize
4KB

Download
memory/2036-417-0x00000234CF780000-0x00000234CF781000-memory.dmp

Filesize
4KB

Download
memory/2036-416-0x00000234CF780000-0x00000234CF781000-memory.dmp

Filesize
4KB

Download
memory/2036-415-0x00000234CF780000-0x00000234CF781000-memory.dmp

Filesize
4KB

Download
memory/2036-419-0x00000234CF780000-0x00000234CF781000-memory.dmp

Filesize
4KB

Download
memory/2036-411-0x00000234CF780000-0x00000234CF781000-memory.dmp

Filesize
4KB

Download
memory/2036-420-0x00000234CF780000-0x00000234CF781000-memory.dmp

Filesize
4KB

Download
memory/2036-421-0x00000234CF780000-0x00000234CF781000-memory.dmp

Filesize
4KB

Download
memory/2140-405-0x0000000000C00000-0x0000000001812000-memory.dmp

Filesize
12.1MB

Download
memory/2140-394-0x0000000000C00000-0x0000000001812000-memory.dmp

Filesize
12.1MB

Download
memory/3392-120-0x0000000000AB0000-0x00000000016C2000-memory.dmp

Filesize
12.1MB

Download
memory/3392-389-0x0000000000AB0000-0x00000000016C2000-memory.dmp

Filesize
12.1MB

Download
memory/3392-79-0x0000000000AB0000-0x00000000016C2000-memory.dmp

Filesize
12.1MB

Download
memory/3392-73-0x0000000000AB0000-0x00000000016C2000-memory.dmp

Filesize
12.1MB

Download
memory/3392-31-0x0000000000AB0000-0x00000000016C2000-memory.dmp

Filesize
12.1MB

Download
memory/3392-33-0x0000000000AB0000-0x00000000016C2000-memory.dmp

Filesize
12.1MB

Download
memory/4416-128-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

Filesize
4KB

Download
memory/4416-24-0x0000000006EC0000-0x0000000006EC1000-memory.dmp

Filesize
4KB

Download
memory/4416-131-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Filesize
4KB

Download
memory/4416-1-0x0000000000AB0000-0x00000000016C2000-memory.dmp

Filesize
12.1MB

Download
memory/4416-129-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Filesize
4KB

Download
memory/4416-3-0x00000000036D0000-0x00000000036D1000-memory.dmp

Filesize
4KB

Download
memory/4416-130-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Filesize
4KB

Download
memory/4416-132-0x0000000004C00000-0x0000000004C01000-memory.dmp

Filesize
4KB

Download
memory/4416-133-0x0000000004C10000-0x0000000004C11000-memory.dmp

Filesize
4KB

Download
memory/4416-281-0x0000000000AB0000-0x00000000016C2000-memory.dmp

Filesize
12.1MB

Download
memory/4416-72-0x0000000000AB0000-0x00000000016C2000-memory.dmp

Filesize
12.1MB

Download
memory/4416-40-0x0000000000AB0000-0x00000000016C2000-memory.dmp

Filesize
12.1MB

Download
memory/4416-134-0x0000000004C20000-0x0000000004C21000-memory.dmp

Filesize
4KB

Download
memory/4416-135-0x0000000004C30000-0x0000000004C31000-memory.dmp

Filesize
4KB

Download
memory/4416-23-0x0000000006EB0000-0x0000000006EB1000-memory.dmp

Filesize
4KB

Download
memory/4416-0-0x0000000000AB0000-0x00000000016C2000-memory.dmp

Filesize
12.1MB

Download
memory/4416-29-0x0000000004B30000-0x0000000004B31000-memory.dmp

Filesize
4KB

Download
memory/4416-25-0x0000000006ED0000-0x0000000006ED1000-memory.dmp

Filesize
4KB

Download
memory/4416-28-0x0000000006F30000-0x0000000006F31000-memory.dmp

Filesize
4KB

Download
memory/4416-26-0x0000000006EE0000-0x0000000006EE1000-memory.dmp

Filesize
4KB

Download
memory/4416-27-0x0000000006F10000-0x0000000006F11000-memory.dmp

Filesize
4KB

Download
memory/4416-19-0x0000000006E50000-0x0000000006E51000-memory.dmp

Filesize
4KB

Download
memory/4416-20-0x0000000006E70000-0x0000000006E71000-memory.dmp

Filesize
4KB

Download
memory/4416-21-0x0000000006E80000-0x0000000006E81000-memory.dmp

Filesize
4KB

Download
memory/4416-22-0x0000000006E90000-0x0000000006E91000-memory.dmp

Filesize
4KB

Download
memory/4416-15-0x00000000047A0000-0x00000000047A1000-memory.dmp

Filesize
4KB

Download
memory/4416-14-0x0000000004B60000-0x0000000004B61000-memory.dmp

Filesize
4KB

Download
memory/4416-13-0x0000000004790000-0x0000000004791000-memory.dmp

Filesize
4KB

Download
memory/4852-165-0x0000000000C00000-0x0000000001812000-memory.dmp

Filesize
12.1MB

Download
memory/4852-422-0x0000000000C00000-0x0000000001812000-memory.dmp

Filesize
12.1MB

Download