b9ad79eaf7a4133f95f24c3b9d976c72f34264dc5c99030f0e57992cb5621f78

Resubmissions

12-02-2024 14:18

240212-rmqw8she34 9

12-02-2024 14:14

240212-rkfngshd56 6

12-02-2024 14:08

240212-rflzpsfe9x 8

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 14:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AnyDesk.exe
Size

3.0MB
MD5

eb80f7bddb699784baa9fbf2941eaf4a
SHA1

df6abbfd20e731689f3c7d2a55f45ac83fbbc40b
SHA256

b9ad79eaf7a4133f95f24c3b9d976c72f34264dc5c99030f0e57992cb5621f78
SHA512

3a1162e9fef849cb7143dc1898d4cfcfd87eb80ced0edb321dfa096686b25ae8a9a7f3ae8f37a09724d94f96d64e08940fc23c0b931ddd8a1e70e2792cb3fe47
SSDEEP

98304:6aJXyQTrRGlSMoIuORmKBQielvZlpkiSti:3olMcR9BTY3WS

Score

6^/10

discovery pyinstaller

Malware Config

Signatures

Downloads MZ/PE file

Legitimate hosting services abused for malware hosting/C2 1 TTPs 36 IoCs

Web Service

T1102

flow	ioc
89	discord.com
101	discord.com
105	discord.com
144	discord.com
86	discord.com
92	discord.com
102	discord.com
113	discord.com
135	discord.com
87	discord.com
99	discord.com
109	discord.com
132	discord.com
133	discord.com
100	discord.com
112	discord.com
114	discord.com
126	discord.com
147	discord.com
108	discord.com
123	discord.com
125	discord.com
149	discord.com
90	discord.com
124	discord.com
148	discord.com
98	discord.com
107	discord.com
111	discord.com
127	discord.com
136	discord.com
88	discord.com
106	discord.com
115	discord.com
134	discord.com
146	discord.com

Drops file in System32 directory 37 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\{b86bce4f-60db-db4e-9073-82a117af441c}\SET7BE1.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b86bce4f-60db-db4e-9073-82a117af441c}\AnyDeskPrintDriver.gpd	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b86bce4f-60db-db4e-9073-82a117af441c}\SET7BCD.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{b86bce4f-60db-db4e-9073-82a117af441c}\SET7BCF.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	AnyDesk.exe
File created	C:\Windows\System32\DriverStore\Temp\{b86bce4f-60db-db4e-9073-82a117af441c}\SET7BE0.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	AnyDesk.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b86bce4f-60db-db4e-9073-82a117af441c}\AnyDeskPrintDriverRenderFilter.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b86bce4f-60db-db4e-9073-82a117af441c}\SET7BE0.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	AnyDesk.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b86bce4f-60db-db4e-9073-82a117af441c}\SET7BCF.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b86bce4f-60db-db4e-9073-82a117af441c}\AnyDeskPrintDriver.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{b86bce4f-60db-db4e-9073-82a117af441c}\SET7BE2.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	AnyDesk.exe
File created	C:\Windows\System32\DriverStore\Temp\{b86bce4f-60db-db4e-9073-82a117af441c}\SET7BCD.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	AnyDesk.exe
File opened for modification	C:\Windows\System32\GroupPolicy	mmc.exe
File created	C:\Windows\System32\DriverStore\Temp\{b86bce4f-60db-db4e-9073-82a117af441c}\SET7BCE.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	AnyDesk.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b86bce4f-60db-db4e-9073-82a117af441c}\AnyDeskPrintDriver-manifest.ini	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	AnyDesk.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b86bce4f-60db-db4e-9073-82a117af441c}\AnyDeskPrintDriverRenderFilter-PipelineConfig.xml	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b86bce4f-60db-db4e-9073-82a117af441c}\SET7BE2.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b86bce4f-60db-db4e-9073-82a117af441c}\anydeskprintdriver.inf	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	AnyDesk.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b86bce4f-60db-db4e-9073-82a117af441c}\SET7BCE.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	mmc.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b86bce4f-60db-db4e-9073-82a117af441c}\SET7BE1.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b86bce4f-60db-db4e-9073-82a117af441c}	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	AnyDesk.exe
File opened for modification	C:\Windows\system32\secpol.msc	mmc.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\AnyDesk\AnyDesk.exe	AnyDesk.exe
File opened for modification	C:\Program Files (x86)\AnyDesk\AnyDesk.exe	AnyDesk.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Executes dropped EXE 17 IoCs

pid	Process
4048	main.exe
5628	main.exe
4012	main.exe
5608	main.exe
5768	main.exe
5884	main.exe
4024	main.exe
5464	main.exe
3436	main.exe
4424	main.exe
5600	main.exe
5820	main.exe
5916	main.exe
5692	main.exe
5740	AnyDesk.exe
2140	AnyDesk.exe
1064	AnyDesk.exe

Loads dropped DLL 64 IoCs

pid	Process
5628	main.exe
5628	main.exe
5628	main.exe
5628	main.exe
5628	main.exe
5628	main.exe
5628	main.exe
5628	main.exe
5628	main.exe
5628	main.exe
5628	main.exe
5628	main.exe
5628	main.exe
5628	main.exe
5628	main.exe
5628	main.exe
5628	main.exe
5628	main.exe
5628	main.exe
5628	main.exe
5628	main.exe
5628	main.exe
5628	main.exe
5628	main.exe
5628	main.exe
5628	main.exe
5628	main.exe
5628	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5608	main.exe
5884	main.exe
5884	main.exe
5884	main.exe
5884	main.exe
5884	main.exe
5884	main.exe
5884	main.exe

Detects Pyinstaller 3 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000900000002322b-256.dat	pyinstaller
behavioral1/files/0x000900000002322b-257.dat	pyinstaller
behavioral1/files/0x000900000002322b-294.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 13 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AnyDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AnyDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AnyDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AnyDesk.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	AnyDesk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe

Modifies registry class 17 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open\command\ = "\"C:\\Program Files (x86)\\AnyDesk\\AnyDesk.exe\" \"%1\""	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open\command	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\ = "URL:AnyDesk Protocol"	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\DefaultIcon	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell	AnyDesk.exe
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open\command\ = "\"C:\\Program Files (x86)\\AnyDesk\\AnyDesk.exe\" --play \"%1\""	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open\command	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\DefaultIcon\ = "\"C:\\Program Files (x86)\\AnyDesk\\AnyDesk.exe\",0"	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\DefaultIcon	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\URL Protocol	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\DefaultIcon\ = "AnyDesk.exe,0"	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk	AnyDesk.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\main.exe:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4464	AnyDesk.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
5048	AnyDesk.exe
5048	AnyDesk.exe
5048	AnyDesk.exe
5048	AnyDesk.exe
5048	AnyDesk.exe
5048	AnyDesk.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
5740	AnyDesk.exe
5740	AnyDesk.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5328	mmc.exe
5436	AnyDesk.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	2796	firefox.exe
Token: SeDebugPrivilege	2796	firefox.exe
Token: SeDebugPrivilege	5048	AnyDesk.exe
Token: 33	5684	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5684	AUDIODG.EXE
Token: SeDebugPrivilege	5628	main.exe
Token: SeDebugPrivilege	5608	main.exe
Token: SeDebugPrivilege	5884	main.exe
Token: SeDebugPrivilege	5464	main.exe
Token: SeDebugPrivilege	4424	main.exe
Token: SeDebugPrivilege	5820	main.exe
Token: 33	5328	mmc.exe
Token: SeIncBasePriorityPrivilege	5328	mmc.exe
Token: 33	5328	mmc.exe
Token: SeIncBasePriorityPrivilege	5328	mmc.exe
Token: SeDebugPrivilege	5692	main.exe
Token: SeDebugPrivilege	6032	taskmgr.exe
Token: SeSystemProfilePrivilege	6032	taskmgr.exe
Token: SeCreateGlobalPrivilege	6032	taskmgr.exe
Token: SeDebugPrivilege	2796	firefox.exe
Token: SeDebugPrivilege	2796	firefox.exe
Token: SeDebugPrivilege	2796	firefox.exe
Token: SeAuditPrivilege	3556	svchost.exe
Token: SeSecurityPrivilege	3556	svchost.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
4464	AnyDesk.exe
2796	firefox.exe
4464	AnyDesk.exe
2796	firefox.exe
2796	firefox.exe
2796	firefox.exe
4464	AnyDesk.exe
4464	AnyDesk.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
2140	AnyDesk.exe
2140	AnyDesk.exe
6032	taskmgr.exe
2140	AnyDesk.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe

Suspicious use of SendNotifyMessage 51 IoCs

pid	Process
4464	AnyDesk.exe
2796	firefox.exe
4464	AnyDesk.exe
2796	firefox.exe
2796	firefox.exe
4464	AnyDesk.exe
4464	AnyDesk.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
2140	AnyDesk.exe
2140	AnyDesk.exe
6032	taskmgr.exe
2140	AnyDesk.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
2796	firefox.exe
2796	firefox.exe
2796	firefox.exe
2796	firefox.exe
5436	AnyDesk.exe
5436	AnyDesk.exe
2796	firefox.exe
2796	firefox.exe
2796	firefox.exe
2796	firefox.exe
2796	firefox.exe
2796	firefox.exe
2796	firefox.exe
2796	firefox.exe
2796	firefox.exe
2796	firefox.exe
2796	firefox.exe
2796	firefox.exe
5328	mmc.exe
5328	mmc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 5048	1136	AnyDesk.exe	87
PID 1136 wrote to memory of 5048	1136	AnyDesk.exe	87
PID 1136 wrote to memory of 5048	1136	AnyDesk.exe	87
PID 1136 wrote to memory of 4464	1136	AnyDesk.exe	86
PID 1136 wrote to memory of 4464	1136	AnyDesk.exe	86
PID 1136 wrote to memory of 4464	1136	AnyDesk.exe	86
PID 3988 wrote to memory of 2796	3988	firefox.exe	89
PID 3988 wrote to memory of 2796	3988	firefox.exe	89
PID 3988 wrote to memory of 2796	3988	firefox.exe	89
PID 3988 wrote to memory of 2796	3988	firefox.exe	89
PID 3988 wrote to memory of 2796	3988	firefox.exe	89
PID 3988 wrote to memory of 2796	3988	firefox.exe	89
PID 3988 wrote to memory of 2796	3988	firefox.exe	89
PID 3988 wrote to memory of 2796	3988	firefox.exe	89
PID 3988 wrote to memory of 2796	3988	firefox.exe	89
PID 3988 wrote to memory of 2796	3988	firefox.exe	89
PID 3988 wrote to memory of 2796	3988	firefox.exe	89
PID 2796 wrote to memory of 404	2796	firefox.exe	90
PID 2796 wrote to memory of 404	2796	firefox.exe	90
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92
PID 2796 wrote to memory of 3236	2796	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4464
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5048
- - C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
    "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:5436
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --install "C:\Program Files (x86)\AnyDesk" --start-with-win --create-shortcuts --create-taskbar-icon --create-desktop-icon --install-drv --update-auto --svc-conf "C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf"
  2⤵
  - Drops file in Program Files directory
  - Modifies registry class
  PID:4644
- C:\Windows\SysWOW64\expand.exe
  expand -F:* "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver\v4.cab" "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver"
  2⤵
  - Drops file in Windows directory
  PID:5864
- C:\Windows\SysWOW64\rundll32.exe
  "rundll32" printui.dll, PrintUIEntry /if /b "AnyDesk Printer" /f "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver\AnyDeskPrintDriver.inf" /r "AD_Port" /m "AnyDesk v4 Printer Driver"
  2⤵
  - Drops file in Windows directory
  PID:5184

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2796.0.584956882\318921498" -parentBuildID 20221007134813 -prefsHandle 1852 -prefMapHandle 1844 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca8cb2c8-3b2a-4483-a83d-2aaa12bf2c5a} 2796 "\\.\pipe\gecko-crash-server-pipe.2796" 1944 21a41ad4b58 gpu
    3⤵
    PID:404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2796.1.1409563811\605542054" -parentBuildID 20221007134813 -prefsHandle 2360 -prefMapHandle 2356 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {426bff09-e963-46ef-879c-5edf22fed1cb} 2796 "\\.\pipe\gecko-crash-server-pipe.2796" 2396 21a41a05358 socket
    3⤵
    PID:3236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2796.2.8872963\2058878304" -childID 1 -isForBrowser -prefsHandle 3016 -prefMapHandle 2928 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {efe48ad3-3b4b-4cf2-8db2-758e521098f8} 2796 "\\.\pipe\gecko-crash-server-pipe.2796" 2964 21a45a9a458 tab
    3⤵
    PID:5076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2796.3.179705668\1608045597" -childID 2 -isForBrowser -prefsHandle 1000 -prefMapHandle 1268 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d15dfef9-198a-42f7-8e44-c46620d7d369} 2796 "\\.\pipe\gecko-crash-server-pipe.2796" 3572 21a35069c58 tab
    3⤵
    PID:4500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2796.4.544106372\1509686766" -childID 3 -isForBrowser -prefsHandle 4288 -prefMapHandle 4268 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d93093be-b5b4-47cf-81ca-0a07fa2b3f00} 2796 "\\.\pipe\gecko-crash-server-pipe.2796" 4292 21a46ae7958 tab
    3⤵
    PID:3004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2796.7.870010293\1775945216" -childID 6 -isForBrowser -prefsHandle 5404 -prefMapHandle 5408 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c091f3f1-80b3-4a28-b788-94ea86fe6f0a} 2796 "\\.\pipe\gecko-crash-server-pipe.2796" 5396 21a47898a58 tab
    3⤵
    PID:3784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2796.6.1423430232\806909187" -childID 5 -isForBrowser -prefsHandle 5212 -prefMapHandle 5216 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4ca9cdf-f441-43d9-8fc3-74f4f87ae4be} 2796 "\\.\pipe\gecko-crash-server-pipe.2796" 5204 21a47897858 tab
    3⤵
    PID:4560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2796.5.1766229579\1249805920" -childID 4 -isForBrowser -prefsHandle 5064 -prefMapHandle 5088 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74532084-84bd-467e-ab4c-7368729da0d7} 2796 "\\.\pipe\gecko-crash-server-pipe.2796" 5020 21a3502ed58 tab
    3⤵
    PID:5116
- - C:\Users\Admin\Downloads\main.exe
    "C:\Users\Admin\Downloads\main.exe"
    3⤵
    - Executes dropped EXE
    PID:4048
  - - C:\Users\Admin\Downloads\main.exe
      "C:\Users\Admin\Downloads\main.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:5628

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x320 0x2d8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5684

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4024

C:\Users\Admin\Downloads\main.exe
"C:\Users\Admin\Downloads\main.exe"
1⤵
- Executes dropped EXE
PID:4012
- C:\Users\Admin\Downloads\main.exe
  "C:\Users\Admin\Downloads\main.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:5608

C:\Users\Admin\Downloads\main.exe
"C:\Users\Admin\Downloads\main.exe"
1⤵
- Executes dropped EXE
PID:5768
- C:\Users\Admin\Downloads\main.exe
  "C:\Users\Admin\Downloads\main.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:5884

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:6028
- C:\Users\Admin\Downloads\main.exe
  main.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- - C:\Users\Admin\Downloads\main.exe
    main.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5464
- C:\Users\Admin\Downloads\main.exe
  main.exe
  2⤵
  - Executes dropped EXE
  PID:5916
- - C:\Users\Admin\Downloads\main.exe
    main.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5692

C:\Users\Admin\Downloads\main.exe
"C:\Users\Admin\Downloads\main.exe"
1⤵
- Executes dropped EXE
PID:3436
- C:\Users\Admin\Downloads\main.exe
  "C:\Users\Admin\Downloads\main.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4424

C:\Users\Admin\Downloads\main.exe
"C:\Users\Admin\Downloads\main.exe"
1⤵
- Executes dropped EXE
PID:5600
- C:\Users\Admin\Downloads\main.exe
  "C:\Users\Admin\Downloads\main.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5820

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\secpol.msc" /s
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5328

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6032

C:\Program Files (x86)\AnyDesk\AnyDesk.exe
"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --service
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5740

C:\Program Files (x86)\AnyDesk\AnyDesk.exe
"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --control
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2140

C:\Program Files (x86)\AnyDesk\AnyDesk.exe
"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --new-install
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3556
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{366a34e8-e50d-2249-84cb-1ef7cbb1753a}\anydeskprintdriver.inf" "9" "49a18f3d7" "000000000000013C" "WinSta0\Default" "0000000000000158" "208" "c:\users\admin\appdata\roaming\anydesk\printer_driver"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:5760
- - C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{6ab5bcb7-c4b5-c74b-b96b-294d129b5a9c} Global\{26aaa635-e8a7-eb43-b735-ea5c44a00abf} C:\Windows\System32\DriverStore\Temp\{b86bce4f-60db-db4e-9073-82a117af441c}\anydeskprintdriver.inf C:\Windows\System32\DriverStore\Temp\{b86bce4f-60db-db4e-9073-82a117af441c}\AnyDeskPrintDriver.cat
    3⤵
    PID:5152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\AnyDesk\AnyDesk.exe

Filesize
3.0MB

MD5
eb80f7bddb699784baa9fbf2941eaf4a

SHA1
df6abbfd20e731689f3c7d2a55f45ac83fbbc40b

SHA256
b9ad79eaf7a4133f95f24c3b9d976c72f34264dc5c99030f0e57992cb5621f78

SHA512
3a1162e9fef849cb7143dc1898d4cfcfd87eb80ced0edb321dfa096686b25ae8a9a7f3ae8f37a09724d94f96d64e08940fc23c0b931ddd8a1e70e2792cb3fe47

Download Submit
C:\ProgramData\AnyDesk\system.conf

Filesize
165B

MD5
bffa051d00459136d4ab153b6a984c95

SHA1
efb1b888a66148b8d9d0f576b4d2ce31b7b5c9e2

SHA256
d92c1c2088b3f3c7638a0de24ed5357e2e64ffa7d9f5ecc1e375e82303b7099c

SHA512
8b471c49220517966bcdcd4fe310e29ee6b0a6222089b341c24d62ccfa9c06863d3243a96b15e29b3ee0d01ad6f11225edffbc14b30f8ef9db0660e5edf380d9

Download Submit
C:\ProgramData\AnyDesk\system.conf

Filesize
414B

MD5
8d57ae11f4ca8c91b42832b39a33029e

SHA1
f66af354f303b50ea4176f18ace5dcf195168f23

SHA256
0e276f9914ef5c89116c1ef6eca10bec1575015914cf1464de460177dbabbda5

SHA512
57b359c43c3190c1c711844ad867c13fbcfe97e3a6c32ce436b41e60a5aa9bf1fbec6d8e2bf48b54f759376db9821e68e69652e21041fe4d5b7d17c1e4ab73a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34362\attrs-23.2.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34362\attrs-23.2.0.dist-info\METADATA

Filesize
9KB

MD5
e32d387a89f0114b8f9b9a809905299d

SHA1
a055c9fbf5416c83d5150d49ca16c58762b8b84a

SHA256
5b0bc6ece1f22a310fa72154642098b759f413f09ca9d45bedb96218475c9be0

SHA512
6eee3e19af46a79e2110678f8d3d15ea4b2eb1355d0fc9581da2c8e91d28926a2771394ea447e15cbc311a9dd9de2a20e2ac0e0abf9db6d4d51982199a12e881

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34362\attrs-23.2.0.dist-info\RECORD

Filesize
3KB

MD5
8829cd6bcf32a2b07fc3bca9942a0f19

SHA1
76ff04de50eb13c6b875a292dc68c80f7031d8f8

SHA256
8d2ee3b85635dc1c0367f021196cf128f22d08a3afb8209b638e1c109ecc0398

SHA512
39052963d68872b26072a2c70aff6ad5ca805d341207e8b7f5d5449238bf2ca6cb36bf5080b4cdfcea441c44bc5b8074f264dc7c122e1a515efd957780ea540d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34362\attrs-23.2.0.dist-info\WHEEL

Filesize
87B

MD5
c58f7d318baa542f6bfd220f837ab63f

SHA1
f655fc3c0eb1bf12629c5750b2892bd896c3e7d9

SHA256
99161210bdc887a8396bf095308730885fffd007b8fe02d8874d5814dc22ab59

SHA512
3da6980a39c368ab7f7527fcd5fcdaa9d321060174baae163bf73f8052a2ac1a73f476c3882855965dfc2cb13c7c3ec1a012882201389dac887f9be59540c80f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34362\attrs-23.2.0.dist-info\licenses\LICENSE

Filesize
1KB

MD5
5e55731824cf9205cfabeab9a0600887

SHA1
243e9dd038d3d68c67d42c0c4ba80622c2a56246

SHA256
882115c95dfc2af1eeb6714f8ec6d5cbcabf667caff8729f42420da63f714e9f

SHA512
21b242bf6dcbafa16336d77a40e69685d7e64a43cc30e13e484c72a93cd4496a7276e18137dc601b6a8c3c193cb775db89853ecc6d6eb2956deee36826d5ebfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34362\frozenlist\_frozenlist.cp312-win_amd64.pyd

Filesize
84KB

MD5
d7193bea71087b94502c6b3a40120b04

SHA1
51aa3825a885a528356ba339f599c557e9973ec3

SHA256
886375bc6f0ff2bbd1e8280f8f1cb29c93f94b8e25b5076043cd796654c3a193

SHA512
c65cef39362a75814d40132f4f54f25f258c484dd011b12ae7051fa52865f025c960e4a3130c699b7eb1be375a3d2c3c3b733d6543338d7e40aad0488d305056

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34362\psutil\_psutil_windows.pyd

Filesize
65KB

MD5
3cba71b6bc59c26518dc865241add80a

SHA1
7e9c609790b1de110328bbbcbb4cd09b7150e5bd

SHA256
e10b73d6e13a5ae2624630f3d8535c5091ef403db6a00a2798f30874938ee996

SHA512
3ef7e20e382d51d93c707be930e12781636433650d0a2c27e109ebebeba1f30ea3e7b09af985f87f67f6b9d2ac6a7a717435f94b9d1585a9eb093a83771b43f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\_asyncio.pyd

Filesize
69KB

MD5
209cbcb4e1a16aa39466a6119322343c

SHA1
cdcce6b64ebf11fecff739cbc57e7a98d6620801

SHA256
f7069734d5174f54e89b88d717133bff6a41b01e57f79957ab3f02daa583f9e2

SHA512
5bbc4ede01729e628260cf39df5809624eae795fd7d51a1ed770ed54663955674593a97b78f66dbf6ae268186273840806ed06d6f7877444d32fdca031a9f0da

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\_bz2.pyd

Filesize
82KB

MD5
59d60a559c23202beb622021af29e8a9

SHA1
a405f23916833f1b882f37bdbba2dd799f93ea32

SHA256
706d4a0c26dd454538926cbb2ff6c64257c3d9bd48c956f7cabd6def36ffd13e

SHA512
2f60e79603cf456b2a14b8254cec75ce8be0a28d55a874d4fb23d92d63bbe781ed823ab0f4d13a23dc60c4df505cbf1dbe1a0a2049b02e4bdec8d374898002b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\_ctypes.pyd

Filesize
122KB

MD5
2a834c3738742d45c0a06d40221cc588

SHA1
606705a593631d6767467fb38f9300d7cd04ab3e

SHA256
f20dfa748b878751ea1c4fe77a230d65212720652b99c4e5577bce461bbd9089

SHA512
924235a506ce4d635fa7c2b34e5d8e77eff73f963e58e29c6ef89db157bf7bab587678bb2120d09da70594926d82d87dbaa5d247e861e331cf591d45ea19a117

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\_decimal.pyd

Filesize
246KB

MD5
f930b7550574446a015bc602d59b0948

SHA1
4ee6ff8019c6c540525bdd2790fc76385cdd6186

SHA256
3b9ad1d2bc9ec03d37da86135853dac73b3fe851b164fe52265564a81eb8c544

SHA512
10b864975945d6504433554f9ff11b47218caa00f809c6bce00f9e4089b862190a4219f659697a4ba5e5c21edbe1d8d325950921e09371acc4410469bd9189ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\_hashlib.pyd

Filesize
64KB

MD5
b0262bd89a59a3699bfa75c4dcc3ee06

SHA1
eb658849c646a26572dea7f6bfc042cb62fb49dc

SHA256
4adfbbd6366d9b55d902fc54d2b42e7c8c989a83016ed707bd7a302fc3fc7b67

SHA512
2e4b214de3b306e3a16124af434ff8f5ab832aa3eeb1aa0aa9b49b0ada0928dcbb05c57909292fbe3b01126f4cd3fe0dac9cc15eaea5f3844d6e267865b9f7b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\_lzma.pyd

Filesize
155KB

MD5
b71dbe0f137ffbda6c3a89d5bcbf1017

SHA1
a2e2bdc40fdb83cc625c5b5e8a336ca3f0c29c5f

SHA256
6216173194b29875e84963cd4dc4752f7ca9493f5b1fd7e4130ca0e411c8ac6a

SHA512
9a5c7b1e25d8e1b5738f01aedfd468c1837f1ac8dd4a5b1d24ce86dcae0db1c5b20f2ff4280960bc523aee70b71db54fd515047cdaf10d21a8bec3ebd6663358

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\_multiprocessing.pyd

Filesize
34KB

MD5
4ccbd87d76af221f24221530f5f035d1

SHA1
d02b989aaac7657e8b3a70a6ee7758a0b258851b

SHA256
c7bbcfe2511fd1b71b916a22ad6537d60948ffa7bde207fefabee84ef53cafb5

SHA512
34d808adac96a66ca434d209f2f151a9640b359b8419dc51ba24477e485685af10c4596a398a85269e8f03f0fc533645907d7d854733750a35bf6c691de37799

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\_overlapped.pyd

Filesize
54KB

MD5
61193e813a61a545e2d366439c1ee22a

SHA1
f404447b0d9bff49a7431c41653633c501986d60

SHA256
c21b50a7bf9dbe1a0768f5030cac378d58705a9fe1f08d953129332beb0fbefc

SHA512
747e4d5ea1bdf8c1e808579498834e1c24641d434546bffdfcf326e0de8d5814504623a3d3729168b0098824c2b8929afc339674b0d923388b9dac66f5d9d996

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\_queue.pyd

Filesize
31KB

MD5
f3eca4f0b2c6c17ace348e06042981a4

SHA1
eb694dda8ff2fe4ccae876dc0515a8efec40e20e

SHA256
fb57ee6adf6e7b11451b6920ddd2fb943dcd9561c9eae64fdda27c7ed0bc1b04

SHA512
604593460666045ca48f63d4b14fa250f9c4b9e5c7e228cc9202e7692c125aacb0018b89faa562a4197692a9bc3d2382f9e085b305272ee0a39264a2a0f53b75

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\_socket.pyd

Filesize
81KB

MD5
9c6283cc17f9d86106b706ec4ea77356

SHA1
af4f2f52ce6122f340e5ea1f021f98b1ffd6d5b6

SHA256
5cc62aac52edf87916deb4ebbad9abb58a6a3565b32e7544f672aca305c38027

SHA512
11fd6f570dd78f8ff00be645e47472a96daffa3253e8bd29183bccde3f0746f7e436a106e9a68c57cc05b80a112365441d06cc719d51c906703b428a32c93124

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\_ssl.pyd

Filesize
173KB

MD5
ddb21bd1acde4264754c49842de7ebc9

SHA1
80252d0e35568e68ded68242d76f2a5d7e00001e

SHA256
72bb15cd8c14ba008a52d23cdcfc851a9a4bde13deee302a5667c8ad60f94a57

SHA512
464520ecd1587f5cede6219faac2c903ee41d0e920bf3c9c270a544b040169dcd17a4e27f6826f480d4021077ab39a6cbbd35ebb3d71672ebb412023bc9e182a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\_uuid.pyd

Filesize
24KB

MD5
7a00ff38d376abaaa1394a4080a6305b

SHA1
d43a9e3aa3114e7fc85c851c9791e839b3a0ee13

SHA256
720e9b68c41c8d9157865e4dd243fb1731f627f3af29c43250804a5995a82016

SHA512
ce39452df539eeeff390f260c062a0c902557fda25a7be9a58274675b82b30bddb7737b242e525f7d501db286f4873b901d94e1cd09aa8864f052594f4b34789

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\_wmi.pyd

Filesize
35KB

MD5
c1654ebebfeeda425eade8b77ca96de5

SHA1
a4a150f1c810077b6e762f689c657227cc4fd257

SHA256
aa1443a715fbf84a84f39bd89707271fc11a77b597d7324ce86fc5cfa56a63a9

SHA512
21705b991e75efd5e59b8431a3b19ae5fcc38a3e7f137a9d52acd24e7f67d61758e48abc1c9c0d4314fa02010a1886c15ead5bca8dca1b1d4ccbfc3c589d342e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\aiohttp\_helpers.cp312-win_amd64.pyd

Filesize
54KB

MD5
6769b44017870dab45a324b157928d22

SHA1
84f51bb078ddba1f1e36b6abb6f88160979990e7

SHA256
eefdd52e7737fd43c67577fd577f7a0654007dd4d5233314f3cff152d49aca61

SHA512
4bcd53449f4de96603ee0b7861158ac0d62b7fd1af1c3f8e45ae6ce77a349c87f163a5db1d28fde22c2992a5910bd0d1d389a158000be9e9cbf871b880d06d62

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\aiohttp\_http_parser.cp312-win_amd64.pyd

Filesize
249KB

MD5
67339c5db48e3a9ff19a41e4a65726ee

SHA1
5fa5361df31c6e42aa3ef4ffd0b2f2a94df300fa

SHA256
e68d72016fc9f47850302c7ee2488920cb9b0755b28d9fb807614a37028f23db

SHA512
debc1e83c17abbf276d073f28dd2c26cfb445769bc4c3966d5c5669efa5452b0b14cba1a4d84cdb8c7ed373e2b4b5028b673447c360079b7e4dcbff3b88cdd48

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\aiohttp\_http_writer.cp312-win_amd64.pyd

Filesize
49KB

MD5
e4a9b45460d2f1514c132c926ae3f80a

SHA1
c4cd93157406169914211053b0fd78c6fc334a0f

SHA256
4a58ba33286d64e994219b34d29582bb261c8a4d72e6ec0076c1b93ecf378752

SHA512
f029e7ffc0dbc914c47b9fe348761c3ed298b2463f8b3aa74d3f94910f33afd062061fa20cd7e0c784d03d7c0cefbeb5e50f5c962e8224218ccc3723251924de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\aiohttp\_websocket.cp312-win_amd64.pyd

Filesize
36KB

MD5
fb5ff970246a5524337027e03fdcbe8d

SHA1
6c83c29f27c0ca7408ab0d046ddf037b8d8e001c

SHA256
a64cf62a7c7f2af733aa240de69f68eeef712c56adacad8df94e59cecfae8992

SHA512
f1cf45979bb0cb5ca1f2e76eebd82e05015f4d6b4e96b38d7d8498137d7feb61082f197924126fa7f34e5ec1c5ac2033779b59ce4fe55315b2588ed0b3a81125

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\base_library.zip

Filesize
1.3MB

MD5
630153ac2b37b16b8c5b0dbb69a3b9d6

SHA1
f901cd701fe081489b45d18157b4a15c83943d9d

SHA256
ec4e6b8e9f6f1f4b525af72d3a6827807c7a81978cb03db5767028ebea283be2

SHA512
7e3a434c8df80d32e66036d831cbd6661641c0898bd0838a07038b460261bf25b72a626def06d0faa692caf64412ca699b1fa7a848fe9d969756e097cba39e41

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\libcrypto-3.dll

Filesize
5.0MB

MD5
e547cf6d296a88f5b1c352c116df7c0c

SHA1
cafa14e0367f7c13ad140fd556f10f320a039783

SHA256
05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de

SHA512
9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\libssl-3.dll

Filesize
768KB

MD5
19a2aba25456181d5fb572d88ac0e73e

SHA1
656ca8cdfc9c3a6379536e2027e93408851483db

SHA256
2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006

SHA512
df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\multidict\_multidict.cp312-win_amd64.pyd

Filesize
45KB

MD5
ab3685f651c7821bbf03baf1d436b617

SHA1
f6306217ecaf5fa1dc8c78260d02dd2716903316

SHA256
1ef9e6eaff88cdcc0a32346b7b266a0e1d19716ecac07f16a189a7057ce971f9

SHA512
08e4d615ce5f9c565d54a16b1f475b6ad746b5d8e7f17248d235b5acd474333036bb33671c887bb64794b56ec910af28efbb7bed8bdea2eddd4bcd81c1b1fb70

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\pyexpat.pyd

Filesize
194KB

MD5
f179c9bdd86a2a218a5bf9f0f1cf6cd9

SHA1
4544fb23d56cc76338e7f71f12f58c5fe89d0d76

SHA256
c42874e2cf034fb5034f0be35f7592b8a96e8903218da42e6650c504a85b37cc

SHA512
3464ece5c6a0e95ef6136897b70a96c69e552d28bfedd266f13eec840e36ec2286a1fb8973b212317de6fe3e93d7d7cc782eb6fc3d6a2a8f006b34f6443498de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\python3.DLL

Filesize
66KB

MD5
6271a2fe61978ca93e60588b6b63deb2

SHA1
be26455750789083865fe91e2b7a1ba1b457efb8

SHA256
a59487ea2c8723277f4579067248836b216a801c2152efb19afee4ac9785d6fb

SHA512
8c32bcb500a94ff47f5ef476ae65d3b677938ebee26e80350f28604aaee20b044a5d55442e94a11ccd9962f34d22610b932ac9d328197cf4d2ffbc7df640efba

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\python312.dll

Filesize
1024KB

MD5
09db19b2b8e6e9aeff1f8a0a9cbab33b

SHA1
fb7dc88c3d5d5ac713413b2598fa785ef53aa056

SHA256
494cfa7f15b60ca360fb5fce0a2374c6735ef19f0ce0b1fb277c51ec7e01e066

SHA512
7717965d99161cf9ef180a06cc9451fb4b02a882531688550372afc96a32c0f185caed3376db6318c04050309198c00db3b54f052ef7461a42915368ae53c1b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\python312.dll

Filesize
6.7MB

MD5
550288a078dffc3430c08da888e70810

SHA1
01b1d31f37fb3fd81d893cc5e4a258e976f5884f

SHA256
789a42ac160cef98f8925cb347473eeeb4e70f5513242e7faba5139ba06edf2d

SHA512
7244432fc3716f7ef27630d4e8fbc8180a2542aa97a01d44dca260ab43966dd8ac98b6023400b0478a4809aace1a128f1f4d6e544f2e591a5b436fd4c8a9d723

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\select.pyd

Filesize
29KB

MD5
8a273f518973801f3c63d92ad726ec03

SHA1
069fc26b9bd0f6ea3f9b3821ad7c812fd94b021f

SHA256
af358285a7450de6e2e5e7ff074f964d6a257fb41d9eb750146e03c7dda503ca

SHA512
7fedae0573ecb3946ede7d0b809a98acad3d4c95d6c531a40e51a31bdb035badc9f416d8aaa26463784ff2c5e7a0cc2c793d62b5fdb2b8e9fad357f93d3a65f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\unicodedata.pyd

Filesize
1.1MB

MD5
04f35d7eec1f6b72bab9daf330fd0d6b

SHA1
ecf0c25ba7adf7624109e2720f2b5930cd2dba65

SHA256
be942308d99cc954931fe6f48ed8cc7a57891ccbe99aae728121bcda1fd929ab

SHA512
3da405e4c1371f4b265e744229dcc149491a112a2b7ea8e518d5945f8c259cad15583f25592b35ec8a344e43007ae00da9673822635ee734d32664f65c9c8d9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40482\yarl\_quoting_c.cp312-win_amd64.pyd

Filesize
94KB

MD5
44eb05d3c409e626ad417ed117068160

SHA1
dc0c4446e0601a2d341a09cda68ce6d2e466c040

SHA256
f306e375e186c011585dea2bc875530fb7d734861db388764a2aa307b1b68df3

SHA512
51194721d5ed968d40394f784a4708e6282d7c28b45b387165ae44eb5798f58432e85f743f798dae2c79722c88f5e8bb61c31ea37110781aa2368c6b4a4a45a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\{366a34e8-e50d-2249-84cb-1ef7cbb1753a}\SET7B70.tmp

Filesize
277KB

MD5
1e4faaf4e348ba202dee66d37eb0b245

SHA1
bb706971bd21f07af31157875e0521631ecf8fa5

SHA256
3aa636e7660be17f841b7f0e380f93fb94f25c62d9100758b1d480cbb863db9d

SHA512
008e59d645b30add7d595d69be48192765dac606801e418eeb79991e0645833abeacfc55aa29dae52dc46aaf22b5c6bc1a9579c2005f4324bece9954ebb182ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\{366a34e8-e50d-2249-84cb-1ef7cbb1753a}\SET7B71.tmp

Filesize
584B

MD5
b76df597dd3183163a6d19b73d28e6d3

SHA1
9f7d18a7e09b3818c32c9654fb082a784be35034

SHA256
cba7c721b76bb7245cd0f1fbfdf85073d57512ead2593050cad12ce76886ac33

SHA512
6f74ad6bbbb931fe78a6545bb6735e63c2c11c025253a7cb0c4605e364a1e3ac806338bb62311d715bf791c5a5610ee02942ff5a0280282d68b93708f1317c69

Download Submit
C:\Users\Admin\AppData\Local\Temp\{366a34e8-e50d-2249-84cb-1ef7cbb1753a}\SET7B81.tmp

Filesize
271B

MD5
0d7876b516b908aab67a8e01e49c4ded

SHA1
0900c56619cd785deca4c302972e74d5facd5ec9

SHA256
98933de1b6c34b4221d2dd065715418c85733c2b8cb4bd12ac71d797b78a1753

SHA512
6874f39fff34f9678e22c47b67f5cd33b825c41f0b0fd84041450a94cc86cc94811293ba838f5267c9cd167d9abcf74e00a2f3c65e460c67e668429403124546

Download Submit
C:\Users\Admin\AppData\Local\Temp\{366a34e8-e50d-2249-84cb-1ef7cbb1753a}\SET7B82.tmp

Filesize
9KB

MD5
6d1663f0754e05a5b181719f2427d20a

SHA1
5affb483e8ca0e73e5b26928a3e47d72dfd1c46e

SHA256
12af5f4e8fc448d02bcfd88a302febe6820a5a497157ef5dca2219c50c1621e3

SHA512
7895f6e35591270bfa9e373b69b55389d250751b56b7ea0d5b10ab770283b8166182c75dca4ebbecdd6e9790dbbfda23130fb4f652545fd39c95619b77195424

Download Submit
C:\Users\Admin\AppData\Local\Temp\{366a34e8-e50d-2249-84cb-1ef7cbb1753a}\SET7B83.tmp

Filesize
11KB

MD5
e0d32d133d4fe83b0e90aa22f16f4203

SHA1
a06b053a1324790dfd0780950d14d8fcec8a5eb9

SHA256
6e996f3523bcf961de2ff32e5a35bcbb59cb6fe343357eff930cd4d6fa35f1f4

SHA512
c0d24104d0b6cb15ff952cbef66013e96e5ed2d4d3b4a17aba3e571a1b9f16bd0e5c141e6aabac5651b4a198dbd9e65571c8c871e737eb5dcf47196c87b8907b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{366a34e8-e50d-2249-84cb-1ef7cbb1753a}\SET7B84.tmp

Filesize
2KB

MD5
d4ca3f9ceeb46740c6c43826d94aba18

SHA1
d863cb54ad2fa0cfc0329954cbe49f70f49fdb87

SHA256
494e4351b85d2821e53a22434f51a4186aa0f7be5724922fc96dfb16687ad37c

SHA512
be08bc144ee2a491fbc80449b4339c01871c6e7d2ddc0e251475d8e426220c6ef35f67698b0586156f0a62b22db764c43842f577b82c3f9e4e93957f9d617db4

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
38KB

MD5
f113370e52ddf84576716793bc664304

SHA1
8c0c4f2193b752a64054017d330eaf325bde5fcd

SHA256
6726e94267d11591573fd430fa72e3b6a79f932a876e4436c4696e1605e41c0c

SHA512
c120475ca1015310c7c529c2c40fd8b22824aedb36c3a28e8af147d8f861a9cc40eba1b67ef0b5c532bb98da2ed491bd6e4af1420c8ad1a1a869d4aed50d6bb0

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
4KB

MD5
751497185b1dcbbfc4ead5309d3bb7fe

SHA1
fd4069ff6b2325260bf27eece285e346788691e0

SHA256
58313ab88f67e77981fded810111a38d659bf6caf2852e1f0ec8bee04c7aba9f

SHA512
fba36b90a0af51cd96e85fae0e962582ef1b8f2ae6d2c4c922974149f91ce5f468a4b871d8dcf0a722fb1b578a998c5ac59310514ef057e78bd732a7abaf9c29

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
8KB

MD5
9b84a4281c3834fdb68f445d025fa482

SHA1
8cae33292e5977e34b2bc8cedc2d5fce8032f415

SHA256
f6e19d611466b8494344e69ff62789f63689d808be67faebaa716ff3493eb52c

SHA512
3c58a0f2f5112db6362664a51011700ec7ea4b0d60f6652ceaba23ae7bdfc504e60b7c319e193404b3251245aaf40a1fd34b3b961c3294ba21273060fb50ba98

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
f93ce41d8d30452ae9f5651d9e4bc4cf

SHA1
638f3f635ff06db3dcdb35414159a99ea63722ee

SHA256
8217f847cdb343615548fd12142873dd9229be670946fea57ccd75ec6e549eb6

SHA512
0dd662aee6078a54ad51e4740ccfd08717f38bf9b1314527da607f83f2aa41b0f521d3c188aab90b7eb699f9516712d044da0ac793963847912969983a7ee5c6

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
105B

MD5
54b186ed5f233821ca760b139c84ef9a

SHA1
c5e4d7b577cd0a702bbac9613676ce4aeabb85f3

SHA256
6e27d066fd6349a33174979642ca7b63c86ddb728ee9b81367634c6470fb73e6

SHA512
42e84c244117b04edcde12db2fc1d63c546fad0b0cfb21c6d3bb746c8f4b011fa2a12b023fab003d3668aa3507746013dc03e245711533d1392a4e15ac9236bd

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
329B

MD5
445d2668c4e3dc321e44e66c70474c3f

SHA1
2ce7da4eb706113cde88cad0c2ff9a43ae043fc2

SHA256
0ce1942416327f9c97936c8eec65ff4f90796120a4237c6aeb422acb7e9eca36

SHA512
f46dac59b86f7d62c7fb74a14975b4175d24b8d7f76de6701be6b604a6a5f852fef6ec43eb9192a1d5aee0621a850f6e0b79ef960b282337aca84c025fe3a68f

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
107B

MD5
f25e48e1d9e1e1398bc5fbc6885570b8

SHA1
46557c8ebb9236af6c28c9bdd317d1d25749e710

SHA256
0379e6a5dff30a991e0acdb9932cac828eb3e30ca8cc23447a2bc73ae78181db

SHA512
41e61480f5141b6950d7b96f3e4dfcca19bc480e0b11eeebdedaeb266c6e525f41f3d29a3c1c0bf8f17a3c30111d8fba7e269d5fcf84b336bee916e21881acb7

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
205B

MD5
59352c2b0c590c5fd96365d3168d723b

SHA1
53ab571639cc3e3a38032c1095985f7f4278d8fc

SHA256
079db0d18cb8ca55e8653f3d67608c5e445d32e368feb874ed3fa1d797c7c286

SHA512
2d21bcd26ef934095ca5b37aa1e66091547870f5e09c2d203dfd75923d2575f93f1a42f31e4fb7b2423b766984464ed65b048f49519837918de246a892c82828

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
245B

MD5
22b9e4e628573bdac8cb04791f575ad2

SHA1
2446b2c4343ca89d1aa687718c7734d695784ccf

SHA256
c5968aa38c37ee9e4956d04bae2e1334535f171259efacaa914ddfe587f81059

SHA512
c4f7b0387d64cd67d0a452d25bd737e1f69af73f010510eb33d8278335e44a25b882eaae95d85535fbde69081b88a0044ce642dcc149a68aa9d1eea061f1b730

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
3KB

MD5
f6a594ad7906e5d8e2336340bf7084fb

SHA1
e06a2b25ede221cb2575faa07c35aac0eed727e0

SHA256
26c110efc449dee7ab71fee1f02dda4316414c985347fd4a94455a83bee4439e

SHA512
17db744a1d89fe0ae0b6cf3aa38f331ea6e7991ede45d19a35f56105f10c5358f6543a0b565fa90029c32532b56e927b8bef4fe751742f9a3faac6fa6738a7de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
3KB

MD5
245013568dfe03d3774d1bc8681d72aa

SHA1
6e61130b06de895d1cb44ec348401b3307e409cc

SHA256
84cbd04d77f9379c1bf3fd5545d6d6c949d1483f7e06cdabf7c927c53bf336ab

SHA512
e2d4b73f6e88c7bfe05089f13f2c6f4f0129c02c274394ef5df6964f5e6bb801f12266e3ef21a44d1632d8c38f523769afb26d8bf3d0d5c97bdb6a9c3cd8835b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
8a1f3654aea41a8986829b8cd88df938

SHA1
78a0ac4d1ffbc75d1592bc0e5cfd47733cb44ed5

SHA256
3540a44a984ec7a366bf628a8bdc75b0847ca5b70a8f1f8fe91fdb6182bd7632

SHA512
9279415da2f521676c25200aba947a2b475b193526ab95fc4f5d59560a1ea405ff45aa474fe54d812c1a8c33e8f41baa00a8ba3f94e16b48afc41fda6a78e38e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\datareporting\glean\pending_pings\49c0085b-3284-42f9-815a-4d284bd13a5f

Filesize
11KB

MD5
9c3d1d25942ff0e66488fe6c2adb2dda

SHA1
c695fe0eaefb4f50e08712a5b8ba57bc891f9d5b

SHA256
e6b5bcd3cf3b508ce68e2ec0b38698e4936cce780fa6c8adb937fe25416f7b10

SHA512
fedfd127bd276874c29bc59f809b18c3fcd431a114cbf3cc9b5eeb08ae9eab916fc9d6e4252677fd62293435fdfba6d7b86303586dc6a04b55f061cbe9491757

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\datareporting\glean\pending_pings\c529a1de-56b4-42b3-9ba1-bc1d93a0b700

Filesize
746B

MD5
93253aba539fd257870e62a1e92d85b6

SHA1
738771adec71d8e4d6c1bc5ddd90384ff90d406b

SHA256
ea94dcb5affd7deffd171c822098659a5b12f892900cb332c51c8b53d4415d1e

SHA512
17072eeb3de9846227b9381032f99c3315b516e308c6523d8b55344cffdefec4af98835c183f5050a530b131bf2bc5deacd3fd0f02d8a136d399e01f6effca4b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\prefs-1.js

Filesize
6KB

MD5
915bffac5f098e2ccad1b8fecb8bfc4b

SHA1
f027a423253a30d57ca4a996010a00128d654c6c

SHA256
d4f8a2986133ac4e6ee43a44097688aa903d3701fa492122926077258381f6e9

SHA512
16e8a3e7e37401f9a48c1e26c19f647380c90d5f29aeaed211bb275f798c1864edfa12e39c85726230f6fed908352fdefaeeb70388d7f4eeaacf7442f62842aa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\prefs.js

Filesize
6KB

MD5
4b0b9a81e02a42f7349fcc092e9dbcfb

SHA1
b815b5384581a3569c3c98f4bcb3d48482d84e2b

SHA256
0aa5c1be0fbec543ad9d471df5234f1f53820eb8bed192cfef369b7a67e3fa3a

SHA512
39200bd78d31b0108aa84c1904581a5a3d3fb3f070c67511648291c903d99b2b2eea60e11be9d3744fbcdd900d0f60ecf260224e40e743de63b670e1f1e18fba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
596f9f4349d1983bcba8a26b404620d7

SHA1
cab7e80e85698ee0ee4e506aaa43db3a97a08729

SHA256
785d1e543d0645ad474ca61fc8aeb883823a534b3380a58d5e9cc83ceb38be86

SHA512
c723a3aa3144f04c401748fdd944f98e07228d7102373b20c34fdf40c82a5b9e3fa4a6ca55efd3ba1812ece719057c5ee071e02f7c29af85b6c578c3960336da

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
e321534d882d519934ddbd0e8ecb6e74

SHA1
acfa4c84b60f8a05d8eadf1989b3a0592e07499c

SHA256
f1b379f78ce516a15bf74dcc71cedf1a633c42b0c80879e087fe5c6fcec466ed

SHA512
847dcda196975035d7fa7b9435f9f8d84cba797e31c17ead26ab79b57c6e4d1e7532a12ec5f8b617a1a1c4cf08acd0d215f687ea39233ea551daff15ade91958

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
1ef7ba87efc43a51014169e3257b978f

SHA1
1fe3ae81cab6866424bed865e7210700f3de8711

SHA256
cb7c9fcba2bdc4880c9d9e91fb287bf3476bb72c321026ddd54de1ccb0d6470b

SHA512
4f984e9216efd32dc7fa4d850f610377e52f9c7b02c53905fb0233a531ecc8e0040ee97e8dffa39caf0322e2904d06d6632fa8bbc10758455ae51818eb81e266

Download Submit
C:\Users\Admin\Downloads\main.PDtuoQw4.exe.part

Filesize
70KB

MD5
9e2c48da96f5a6e485510739d09cca23

SHA1
f09bd76d5c69d6e0f796f9a03ddfdb429a0d9e10

SHA256
f2749fb16a4e1b562a2ce3c83e55fc437e9b826e652038daf966ed7583725ec1

SHA512
5ac2b34d1f59c1ae093d925aeb1cb396a3c078e6c688cc25080c5c3f52945441f9ca1ef18ebfd3ac24cd50b77edda0a53f231bbaa9b56ece67003494a8bf4bf6

Download Submit
C:\Users\Admin\Downloads\main.exe

Filesize
2.6MB

MD5
562a7ae6258173f7c7a260a0e9645b33

SHA1
0f72f74eff7407acd24e85a0465b97761af6c6fd

SHA256
177762672d0ca38490b7355e890d077209769994a975bcf0eaf92b4bc306598a

SHA512
631d46c670d428a484fc3aa94ee4574ac6d4c46449a33133332ebad87d6f4a665ad134eceec054f67591762a47a023d141f070e942933ed0260864751a4d21d4

Download Submit
C:\Users\Admin\Downloads\main.exe

Filesize
1.5MB

MD5
6c0c9452b19a1caef01cd1526b5fa3fa

SHA1
cd7ac1a0fe764dc8f6c411fc27b1757b120e5386

SHA256
8434c05ffad2b72d181fc8b3943f90a5733ec7010ba8f6b14db54e6e879e23fa

SHA512
02ec87f9190c9be042387949b468ec2b9fd9999e3e4f2e745fd4d4343433e17f7da607c4f715d43dbe5cec7fa3bef92d34f1a79bfe0c7692196383b03dcbf24b

Download Submit
C:\Users\Admin\Downloads\main.exe

Filesize
591KB

MD5
fc7387ec54a45612c09d30f3f89d90dd

SHA1
f092972bfc831a74ed4f17bfec5082d83e8e8721

SHA256
0d7d3a804c893b066bc4d58245d9b6ab1aa2bd028fb59a026ce35b90d783239e

SHA512
d591423fda8171901f4dc9c1daaa90e088f23e5073ba3d784f7362792b74af8cb6479f26f8bc960b52670c78307bea79181a0b9b950d679fc9a6078d6ed640d2

Download Submit
memory/1136-15-0x0000000004500000-0x0000000004501000-memory.dmp

Filesize
4KB

Download
memory/1136-28-0x0000000006B50000-0x0000000006B51000-memory.dmp

Filesize
4KB

Download
memory/1136-24-0x0000000006AE0000-0x0000000006AE1000-memory.dmp

Filesize
4KB

Download
memory/1136-23-0x0000000006AD0000-0x0000000006AD1000-memory.dmp

Filesize
4KB

Download
memory/1136-20-0x0000000006A90000-0x0000000006A91000-memory.dmp

Filesize
4KB

Download
memory/1136-21-0x0000000006AA0000-0x0000000006AA1000-memory.dmp

Filesize
4KB

Download
memory/1136-1-0x0000000000A00000-0x0000000001612000-memory.dmp

Filesize
12.1MB

Download
memory/1136-22-0x0000000006AB0000-0x0000000006AB1000-memory.dmp

Filesize
4KB

Download
memory/1136-3-0x0000000001B60000-0x0000000001B61000-memory.dmp

Filesize
4KB

Download
memory/1136-690-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/1136-0-0x0000000000A00000-0x0000000001612000-memory.dmp

Filesize
12.1MB

Download
memory/1136-13-0x00000000044F0000-0x00000000044F1000-memory.dmp

Filesize
4KB

Download
memory/1136-19-0x0000000006A70000-0x0000000006A71000-memory.dmp

Filesize
4KB

Download
memory/1136-25-0x0000000006AF0000-0x0000000006AF1000-memory.dmp

Filesize
4KB

Download
memory/1136-29-0x0000000004890000-0x0000000004891000-memory.dmp

Filesize
4KB

Download
memory/1136-26-0x0000000006B00000-0x0000000006B01000-memory.dmp

Filesize
4KB

Download
memory/1136-689-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/1136-688-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/1136-27-0x0000000006B30000-0x0000000006B31000-memory.dmp

Filesize
4KB

Download
memory/1136-159-0x0000000000A00000-0x0000000001612000-memory.dmp

Filesize
12.1MB

Download
memory/1136-14-0x00000000048C0000-0x00000000048C1000-memory.dmp

Filesize
4KB

Download
memory/4464-247-0x0000000000A00000-0x0000000001612000-memory.dmp

Filesize
12.1MB

Download
memory/4464-163-0x0000000000A00000-0x0000000001612000-memory.dmp

Filesize
12.1MB

Download
memory/4464-36-0x0000000001930000-0x0000000001931000-memory.dmp

Filesize
4KB

Download
memory/4464-30-0x0000000000A00000-0x0000000001612000-memory.dmp

Filesize
12.1MB

Download
memory/5048-244-0x0000000000A00000-0x0000000001612000-memory.dmp

Filesize
12.1MB

Download
memory/5048-432-0x0000000000A00000-0x0000000001612000-memory.dmp

Filesize
12.1MB

Download
memory/5048-31-0x0000000000A00000-0x0000000001612000-memory.dmp

Filesize
12.1MB

Download
memory/5048-214-0x0000000000A00000-0x0000000001612000-memory.dmp

Filesize
12.1MB

Download
memory/5048-162-0x0000000000A00000-0x0000000001612000-memory.dmp

Filesize
12.1MB

Download
memory/5048-171-0x0000000000A00000-0x0000000001612000-memory.dmp

Filesize
12.1MB

Download
memory/5048-615-0x0000000000A00000-0x0000000001612000-memory.dmp

Filesize
12.1MB

Download
memory/5328-609-0x00007FF85B060000-0x00007FF85BB21000-memory.dmp

Filesize
10.8MB

Download
memory/5328-607-0x00007FF408850000-0x00007FF408860000-memory.dmp

Filesize
64KB

Download
memory/5328-606-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/5328-605-0x00007FF857840000-0x00007FF857871000-memory.dmp

Filesize
196KB

Download
memory/5328-604-0x000000001DB60000-0x000000001DB91000-memory.dmp

Filesize
196KB

Download
memory/5328-603-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/5328-602-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/5328-601-0x00007FF85B060000-0x00007FF85BB21000-memory.dmp

Filesize
10.8MB

Download
memory/5436-202-0x0000000007540000-0x0000000007541000-memory.dmp

Filesize
4KB

Download
memory/5436-211-0x000000000A2F0000-0x000000000A2F1000-memory.dmp

Filesize
4KB

Download
memory/5436-248-0x0000000000A00000-0x0000000001612000-memory.dmp

Filesize
12.1MB

Download
memory/5436-201-0x0000000007520000-0x0000000007521000-memory.dmp

Filesize
4KB

Download
memory/5436-200-0x0000000007500000-0x0000000007501000-memory.dmp

Filesize
4KB

Download
memory/5436-196-0x0000000007460000-0x0000000007461000-memory.dmp

Filesize
4KB

Download
memory/5436-199-0x00000000074E0000-0x00000000074E1000-memory.dmp

Filesize
4KB

Download
memory/5436-434-0x0000000000A00000-0x0000000001612000-memory.dmp

Filesize
12.1MB

Download
memory/5436-178-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Filesize
4KB

Download
memory/5436-503-0x0000000000A00000-0x0000000001612000-memory.dmp

Filesize
12.1MB

Download
memory/5436-179-0x0000000004C10000-0x0000000004C11000-memory.dmp

Filesize
4KB

Download
memory/5436-180-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/5436-181-0x0000000004E60000-0x0000000004E61000-memory.dmp

Filesize
4KB

Download
memory/5436-182-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download
memory/5436-183-0x0000000004E10000-0x0000000004E11000-memory.dmp

Filesize
4KB

Download
memory/5436-185-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Filesize
4KB

Download
memory/5436-194-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

Filesize
4KB

Download
memory/5436-197-0x0000000007480000-0x0000000007481000-memory.dmp

Filesize
4KB

Download
memory/5436-198-0x00000000074A0000-0x00000000074A1000-memory.dmp

Filesize
4KB

Download
memory/5436-195-0x0000000007440000-0x0000000007441000-memory.dmp

Filesize
4KB

Download
memory/5436-204-0x0000000000A00000-0x0000000001612000-memory.dmp

Filesize
12.1MB

Download
memory/5436-205-0x0000000007570000-0x0000000007571000-memory.dmp

Filesize
4KB

Download
memory/5436-207-0x0000000007560000-0x0000000007561000-memory.dmp

Filesize
4KB

Download
memory/5436-206-0x0000000007580000-0x0000000007581000-memory.dmp

Filesize
4KB

Download
memory/5436-209-0x0000000007590000-0x0000000007591000-memory.dmp

Filesize
4KB

Download
memory/5436-203-0x00000000074C0000-0x00000000074C1000-memory.dmp

Filesize
4KB

Download
memory/5436-216-0x0000000000A00000-0x0000000001612000-memory.dmp

Filesize
12.1MB

Download
memory/5436-212-0x000000000A650000-0x000000000A651000-memory.dmp

Filesize
4KB

Download
memory/5436-172-0x0000000000A00000-0x0000000001612000-memory.dmp

Filesize
12.1MB

Download
memory/5436-210-0x000000000A2E0000-0x000000000A2E1000-memory.dmp

Filesize
4KB

Download
memory/5436-176-0x0000000000A00000-0x0000000001612000-memory.dmp

Filesize
12.1MB

Download
memory/5436-177-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/5436-184-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download
memory/5436-186-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Filesize
4KB

Download
memory/5436-187-0x0000000004E70000-0x0000000004E71000-memory.dmp

Filesize
4KB

Download
memory/5436-188-0x0000000004E90000-0x0000000004E91000-memory.dmp

Filesize
4KB

Download
memory/5436-193-0x0000000004F20000-0x0000000004F21000-memory.dmp

Filesize
4KB

Download
memory/5436-192-0x0000000004F00000-0x0000000004F01000-memory.dmp

Filesize
4KB

Download
memory/5436-191-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

Filesize
4KB

Download
memory/5436-189-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

Filesize
4KB

Download
memory/5436-190-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Filesize
4KB

Download
memory/6032-673-0x0000021206060000-0x0000021206061000-memory.dmp

Filesize
4KB

Download
memory/6032-677-0x0000021206060000-0x0000021206061000-memory.dmp

Filesize
4KB

Download
memory/6032-679-0x0000021206060000-0x0000021206061000-memory.dmp

Filesize
4KB

Download
memory/6032-678-0x0000021206060000-0x0000021206061000-memory.dmp

Filesize
4KB

Download
memory/6032-676-0x0000021206060000-0x0000021206061000-memory.dmp

Filesize
4KB

Download
memory/6032-675-0x0000021206060000-0x0000021206061000-memory.dmp

Filesize
4KB

Download
memory/6032-674-0x0000021206060000-0x0000021206061000-memory.dmp

Filesize
4KB

Download
memory/6032-668-0x0000021206060000-0x0000021206061000-memory.dmp

Filesize
4KB

Download
memory/6032-669-0x0000021206060000-0x0000021206061000-memory.dmp

Filesize
4KB

Download
memory/6032-667-0x0000021206060000-0x0000021206061000-memory.dmp

Filesize
4KB

Download