Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

20/02/2024, 02:25

240220-cwmtlshd8t 3

20/02/2024, 02:22

240220-ctjzyahd5t 8

Analysis

  • max time kernel
    262s
  • max time network
    266s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/02/2024, 02:22

General

  • Target

    bcbe12e2ee6689afeb3d473a86ebe879.jpg

  • Size

    160KB

  • MD5

    d2e5dbcadc018f6674fbb45d458bc82c

  • SHA1

    f76bdf0e422a936127c731e9a92164d2f65dbaed

  • SHA256

    fb73e03e2c16a08c7d41c1987102168af9995b16657f681dd927751b3424bd84

  • SHA512

    fb25223f95dfa8f60c7720ac9f4f500a8fa70bbf6742f77adb5835f06a82045c34c37c32a138415bd21b5ee391d371111e98b7baa5fb12836fcdfa5b0faa8454

  • SSDEEP

    3072:Zu6amBV8MwHzmkUApalmq7DRhgjxIJm2O56ekFwKDhG9gIkGm7e5:3aq8M6zX6hNmnkFw2hG9gIk97e5

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\bcbe12e2ee6689afeb3d473a86ebe879.jpg
    1⤵
      PID:2316
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:704
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        2⤵
        • Checks processor information in registry
        • Modifies registry class
        • NTFS ADS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1048
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.0.233889091\967309278" -parentBuildID 20221007134813 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 20671 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd955204-f8ae-4330-a4a5-b5922a780364} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 1988 1bb9d6d6d58 gpu
          3⤵
            PID:2356
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.1.1438163636\1949239187" -parentBuildID 20221007134813 -prefsHandle 2380 -prefMapHandle 2376 -prefsLen 20707 -prefMapSize 233414 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4cb534fa-5db5-4f41-950e-7314a8cf918c} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 2392 1bb9d5fa258 socket
            3⤵
              PID:4196
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.2.639807313\57709823" -childID 1 -isForBrowser -prefsHandle 2964 -prefMapHandle 2960 -prefsLen 20810 -prefMapSize 233414 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6a4e37e-bd7c-4111-bcd3-30fbc0d2ffbf} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 3132 1bba16b2658 tab
              3⤵
                PID:3656
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.3.278796975\685683372" -childID 2 -isForBrowser -prefsHandle 3572 -prefMapHandle 3568 -prefsLen 25988 -prefMapSize 233414 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a60c3e42-9e18-48fd-8346-825136c73ccb} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 3580 1bba24f9f58 tab
                3⤵
                  PID:884
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.4.1959960563\314257271" -childID 3 -isForBrowser -prefsHandle 4376 -prefMapHandle 4372 -prefsLen 26047 -prefMapSize 233414 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8097649e-b315-43a9-af32-edb0c09342ac} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 4364 1bba2dea958 tab
                  3⤵
                    PID:3328
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.7.1612532041\1443634507" -childID 6 -isForBrowser -prefsHandle 5452 -prefMapHandle 5456 -prefsLen 26047 -prefMapSize 233414 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {763917c8-40ac-4855-8b86-3b0b9fe6aac7} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 5444 1bba1ab5e58 tab
                    3⤵
                      PID:3776
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.6.1894103479\637498857" -childID 5 -isForBrowser -prefsHandle 5260 -prefMapHandle 5264 -prefsLen 26047 -prefMapSize 233414 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d160e770-8f9b-4452-b112-b6df67ce66c3} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 5252 1bb9ea8ff58 tab
                      3⤵
                        PID:1484
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.5.1692081890\1575013924" -childID 4 -isForBrowser -prefsHandle 5104 -prefMapHandle 5096 -prefsLen 26047 -prefMapSize 233414 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a72e7d5b-8d99-4a8b-b125-23b6863df023} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 5116 1bb9d6d7c58 tab
                        3⤵
                          PID:2116
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.8.1548327019\1988579049" -childID 7 -isForBrowser -prefsHandle 6068 -prefMapHandle 6080 -prefsLen 26285 -prefMapSize 233414 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {19c15164-987a-4459-ad81-348319373073} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 4444 1bba31f6058 tab
                          3⤵
                            PID:2336
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.9.803054004\20958520" -parentBuildID 20221007134813 -prefsHandle 4816 -prefMapHandle 5880 -prefsLen 26460 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {103c2b75-cb42-455f-8812-2cdb8eb6237f} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 5856 1bba31f7858 rdd
                            3⤵
                              PID:1020
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.10.1269238195\173420138" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5860 -prefMapHandle 9832 -prefsLen 26460 -prefMapSize 233414 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {860e1e8d-0551-46e9-93b5-b3ec8f991880} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 9828 1bba3510d58 utility
                              3⤵
                                PID:4948
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.11.543751090\711534600" -childID 8 -isForBrowser -prefsHandle 9428 -prefMapHandle 9476 -prefsLen 26500 -prefMapSize 233414 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f07406ec-c41c-423d-b0f3-a397873d59a9} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 9416 1bb90e66258 tab
                                3⤵
                                  PID:2628
                                • C:\Users\Admin\Downloads\AnyDesk.exe
                                  "C:\Users\Admin\Downloads\AnyDesk.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Checks processor information in registry
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5340
                                  • C:\Users\Admin\Downloads\AnyDesk.exe
                                    "C:\Users\Admin\Downloads\AnyDesk.exe" --local-service
                                    4⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:5544
                                  • C:\Users\Admin\Downloads\AnyDesk.exe
                                    "C:\Users\Admin\Downloads\AnyDesk.exe" --local-control
                                    4⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    PID:5556

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\59q4zd6z.default-release\cache2\doomed\8468

                              Filesize

                              7KB

                              MD5

                              dbf372113320f24a3f8fc7954820bc90

                              SHA1

                              72de2d805a0d2120559a222c938fd161ebfd2f2a

                              SHA256

                              6a552388663230a50aaf4bb4d6ab5bec1701cad360a9aa0b9db48d16e9931a82

                              SHA512

                              58ef5e234512cc247cb8bc0185ace1c55381fcd224356183b5654cbeb9ca52e501a2e7919cc0a434a639bb557e2a0f606a741201d7bad7e5d3d740d9e24a2d5f

                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                              Filesize

                              442KB

                              MD5

                              85430baed3398695717b0263807cf97c

                              SHA1

                              fffbee923cea216f50fce5d54219a188a5100f41

                              SHA256

                              a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                              SHA512

                              06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                              Filesize

                              8.0MB

                              MD5

                              a01c5ecd6108350ae23d2cddf0e77c17

                              SHA1

                              c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                              SHA256

                              345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                              SHA512

                              b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                            • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

                              Filesize

                              7KB

                              MD5

                              81ad58ddc62f32528678f9b41424e35c

                              SHA1

                              c6851d0f4e19b9110d7417402b291d07f7daf71b

                              SHA256

                              1c7d8186ea32f4f167087c1e1a14fa4de66d9940b5703704e0234f16853c04e0

                              SHA512

                              8adb61d1b5e6b60d6a2b4a44c8b8d541dbbb455c67b3bea4ec040fc8e9717e30d6a00eaaf6a7b00486060f0fc250249094eb71c7213b52e297adbcf850d699ea

                            • C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

                              Filesize

                              2KB

                              MD5

                              2c1918ef9e8d85d20c173eace569e768

                              SHA1

                              1e1e4fa475289ffbcbabc00c25870142b80d99ec

                              SHA256

                              96b7504f0807e3cc6eea1b174d61053a0479525676d0110f158d36e7d5723f31

                              SHA512

                              71853e2f31558917a244fe7b689f58a44c31a878d023aa025f0dcb83ac33e08e6e5b73e06da322491e0e7ac69674bce8f9e2d9da4ee8cd2a43553a8c5cbe6ab6

                            • C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

                              Filesize

                              2KB

                              MD5

                              22d592480c9ffcb3a76010e37291d316

                              SHA1

                              c44574de70904961d8df387197f5de6855304956

                              SHA256

                              5654099f2be417b26eee2575d8f0b1e9f5a85c71e56bda7bfdc84c609d1a9ab0

                              SHA512

                              934df3e43462bd1c089af146ba53a554fd7f2c31c572a7a5579a52b4557dd32e6bb18ec60e6d740256bed864945f7886cf3d6ac08af5572be9e3cd455f83efa5

                            • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

                              Filesize

                              312B

                              MD5

                              0c04ad1083dc5c7c45e3ee2cd344ae38

                              SHA1

                              f1cf190f8ca93000e56d49732e9e827e2554c46f

                              SHA256

                              6452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0

                              SHA512

                              6c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492

                            • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

                              Filesize

                              424B

                              MD5

                              78d0a8ea101239d81b4f3ab2e4588cd6

                              SHA1

                              7ec0b642aa5e8b55c685a1415af1fedd64529b8e

                              SHA256

                              cc98b3847e8ec57865cbc6adef7fc5fd37d2f2aa710878b6af353e02a8c5692b

                              SHA512

                              cafe92557aa02d37bb484d1557416a380961e6ea1bc7e32aac6cc4b5ff4f7d9ae046d0ffdc621638c13329ca4c12105e333df27516f216536a0c1ab8e6e6585d

                            • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

                              Filesize

                              681B

                              MD5

                              24d37de006e8dab00b56b5a3314e8bcc

                              SHA1

                              efcd7b717613d3bde5c2b8d503caaa23b6d29415

                              SHA256

                              86f4d80867725ca8b9b4cf94c69ef2867806d74c258616b6b4db2dde2bae4bb6

                              SHA512

                              bf47a5aeab0c28531a965f98cd6ec30bc41fede3be778012a8ec125afe60d0e3d6a2205def6be214773a5f5636d498998d63e390c6466e36152b6265c327967e

                            • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

                              Filesize

                              802B

                              MD5

                              020005731b394fafb3081a5c7063cd9e

                              SHA1

                              8ee9a4974a9e569b23e907bd0ce3b723efedd4bf

                              SHA256

                              9ffe59fc8a5cd9d95d1aca4614ceb07c334be0e5f995edc014d968a000f6783d

                              SHA512

                              3d85b74e0c24c0c4964c58b68ba52d8765f456f04dcd9a3965864a38fcea006eee19b5e49ee525fe4756e97c1c3c82da01e49cc03a984c94d8d98011477d5353

                            • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                              Filesize

                              1KB

                              MD5

                              989558f2b3ee558efa84f76c4327ed59

                              SHA1

                              0324a13b5e71039f7264727396f7f846ad728011

                              SHA256

                              f7511b9a2808e8bfaa9ba8c22b6a44bfce2178b9a2d6b819cf7b3f974bf1f562

                              SHA512

                              a750d7e09ab2d56b28d66f06b31502674f143286ee44dcb95610e64ad93b30ff733f4a50d6858b99d9f20bd0cf4ac00d1cb22c13c9e5f78e5e17ea545c0bea37

                            • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                              Filesize

                              1KB

                              MD5

                              deb9b80f930b42fb6d1a1a56233cb38b

                              SHA1

                              69c13fd6c8d32cc7c9ee65ed677ab2560380fea4

                              SHA256

                              8505449688b984f67423124b36f6dd003f9b09f53723f6f9596a1a0b0efcb22b

                              SHA512

                              f374148f559cb118637193034899595430a628300d3e06de6dd52f085b480ab312b390abc7e2287aebeae90ac3afd6127a7b7f625a4d86047c3519cd1ac61bb2

                            • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                              Filesize

                              1KB

                              MD5

                              916dd7d5cd28ccfafb20c03df0f789a6

                              SHA1

                              9eb291b0bf83917f442f8bd58a3fcafeac3c6d82

                              SHA256

                              2ec770d428b67a1409217b747c85f396f996c9a5ae89982fc5ca111b30e058e1

                              SHA512

                              a2fbd44b64c3ae7b1fbce84904d3cf644c6fbaa305989f0f6036a1351de522bc4e56802db31da74bb9a4a1d0e73717324de0cd6caffe6c8e57f432ff7928dff7

                            • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                              Filesize

                              2KB

                              MD5

                              775f04b477e0a1718479a32665cd7ba2

                              SHA1

                              b972295716cb2ab87d37271a1ff6828de9fbc30a

                              SHA256

                              4a094b88cb934d773060891a327951ca6ddc700b803ff74e3c3f7847f1ab2dfc

                              SHA512

                              6330cd745a2f96c2bea8d0ad1f9c7eb54cf80c2c2c94f84562eaf7c468317bffa193a6e956d052d282f989b25da81753ffef358b2a6bfc65fcfd5d0880a47959

                            • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                              Filesize

                              3KB

                              MD5

                              fe6c1d98b4bff00b5bb6c30985187556

                              SHA1

                              b9f639d129623fd0802b7116e8e6eecfbcf37403

                              SHA256

                              043e27fa3f8c882300df0c700de2f718b1a2b43880f5a46ac3aeecace9c75975

                              SHA512

                              30c71f8d49bb191bee856218b98977d7fb757091d671a948946873b20f3ac002a10cc1cf1736401e6eff99013a4198eabd7afa997535fd23620c008551bbb752

                            • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                              Filesize

                              3KB

                              MD5

                              345d041b85373182a78b86b7198c44c8

                              SHA1

                              9efba3d859f23b8bd3b2ac34ca34f8528409be1b

                              SHA256

                              93d8ae716910eafb379a3a3efd7c671eb463b4a910bdc8a7565089fdc70a2559

                              SHA512

                              8f7726d44421ffc34112c0148f010875ec1c8ba78766b0647f9cc27ae792306e9f2e4ec2013f0954439ed0c208310c7d0b56d6299856c88acdf4acb36c643e74

                            • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                              Filesize

                              3KB

                              MD5

                              c0d54211c510e554467c5da9a1c6f156

                              SHA1

                              9ec3b583c2652d5148098824be12b8cd4b5d68c0

                              SHA256

                              2292abd80b991fa0e71118032d57be24166577482a8a99bc7febed93b9ff131e

                              SHA512

                              feb55eeaae98ecb08aafc790940cd4f2680dbd527d6b6f7f2bd2b2c251da6d0d6f848c0ebd2df512c771d5fde760f865ae556331a28abf7bc09a4df91f2e9b81

                            • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                              Filesize

                              3KB

                              MD5

                              431f680d7023f5afbc58509014ef941a

                              SHA1

                              da720d25f4ba41dcb304146f452281321023b6b8

                              SHA256

                              36159bb679aba65b9d368a0574bd78f62db7ac4d61c9815d49dd9dae8b615f8d

                              SHA512

                              0fa4cc124297413294926fa6156b95b6b2ec178ddafb56512837fb410d46315eae9b4742a2a001b7ecbfe486b360553b3717de88f508ddb1707eeea586f3def3

                            • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                              Filesize

                              3KB

                              MD5

                              ea7685474c6c98a242ec77261a832746

                              SHA1

                              805d1cd201f7a307dde378f68ff5874d38e34388

                              SHA256

                              a1d69b8e526df6ab2646f0d4794d9903df7778c7dccb380c10af2ef870cc3b7e

                              SHA512

                              6abccb06aa4c225fa81e6310e39c3b57244c07d152bc0c5658cc3911f0c7c1833306e74891ef896619209e0e15dfc0de7fe05779d2e7c5a85efe491913805fac

                            • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                              Filesize

                              6KB

                              MD5

                              3d69dbe843c77fa9ea8f636f03a80015

                              SHA1

                              845babb2167211053b79493247cc279e3148e3f8

                              SHA256

                              0acf2b98450d8ef6cd644c9a781de79e686af729958ffdf0790dc9dce0c6c861

                              SHA512

                              862552ff57ed52db9b100569877f8e05d0038670b70f5a8d2b6ee6be2745c48d0228d478d8e2421a3d5cfa29f85085d25e927d8070fd07f2ee9e39f4d98a7407

                            • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                              Filesize

                              6KB

                              MD5

                              6c1e56d30c656a3f86f7134f87a18c60

                              SHA1

                              899fac2fe3c45f539e965b58678bf70b0f48bc2b

                              SHA256

                              3625708331f338bd5657b10f9eaa99bdc2508fa162567878cbbb790227e72ca9

                              SHA512

                              4eed41e99fdc767e690aa55c570283ab6318f6beacdfb9a9d87221374facc456971593c197ad959bfda4ad54e1bd0ca261821f865bfc40360330c90fc56c9788

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\datareporting\glean\db\data.safe.bin

                              Filesize

                              9KB

                              MD5

                              555a67b0125d209567742e9e9095e42a

                              SHA1

                              92f096b005047dc615d12be213572678b9dda1f1

                              SHA256

                              8a6dfd8883ceb23593b2c7f6a4c914212e4324d740a99704e24f608dbec5e0fd

                              SHA512

                              6c950072a2e826ac02971bb6b72ab0a910ac17ced26b84846732f516a4fde0dbbaf8cb710130037f0de8d5743b595f0a8f521b4f3c5e44f29b2a35ac6afbc6db

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\datareporting\glean\pending_pings\d7e5b433-e0da-4af7-b297-a81144b53771

                              Filesize

                              734B

                              MD5

                              9644b46d376806024fa60eec17e8880c

                              SHA1

                              ba158c7192c507f04872deee07063700816e7590

                              SHA256

                              06d06d1229b74718866ecd573ce30375250507fdd73b45cb71e1cefc1fbcec5a

                              SHA512

                              33052757df3ca41152f96605c248a2fdf4338a90eebbb7c377fde1516b0b1ed13b7eb7c462a60f0d1be6f08cdf51d7edce98f7645e0eca50ff92608e79728752

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                              Filesize

                              997KB

                              MD5

                              fe3355639648c417e8307c6d051e3e37

                              SHA1

                              f54602d4b4778da21bc97c7238fc66aa68c8ee34

                              SHA256

                              1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                              SHA512

                              8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                              Filesize

                              116B

                              MD5

                              3d33cdc0b3d281e67dd52e14435dd04f

                              SHA1

                              4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                              SHA256

                              f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                              SHA512

                              a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                              Filesize

                              479B

                              MD5

                              49ddb419d96dceb9069018535fb2e2fc

                              SHA1

                              62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                              SHA256

                              2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                              SHA512

                              48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                              Filesize

                              372B

                              MD5

                              8be33af717bb1b67fbd61c3f4b807e9e

                              SHA1

                              7cf17656d174d951957ff36810e874a134dd49e0

                              SHA256

                              e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                              SHA512

                              6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                              Filesize

                              11.8MB

                              MD5

                              33bf7b0439480effb9fb212efce87b13

                              SHA1

                              cee50f2745edc6dc291887b6075ca64d716f495a

                              SHA256

                              8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                              SHA512

                              d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                              Filesize

                              1KB

                              MD5

                              688bed3676d2104e7f17ae1cd2c59404

                              SHA1

                              952b2cdf783ac72fcb98338723e9afd38d47ad8e

                              SHA256

                              33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                              SHA512

                              7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                              Filesize

                              1KB

                              MD5

                              937326fead5fd401f6cca9118bd9ade9

                              SHA1

                              4526a57d4ae14ed29b37632c72aef3c408189d91

                              SHA256

                              68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                              SHA512

                              b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\prefs-1.js

                              Filesize

                              7KB

                              MD5

                              b24fd3494b4e7c2bf915778fec195cb6

                              SHA1

                              445d8628744cd409ec7f4802ef68d78b7cc4c64a

                              SHA256

                              2e3ef8e63804037088d9044e0f8fb111a6fc047092b0202a1b135601d9293194

                              SHA512

                              4571d7d63d5de0c30b7a65a126f3d3c77daa7b61a17e5ad8f263224dfda8f0c15b05ba69720b07e741cb61d0d7c414b4788b98fbd2f3d99a86015f5c82a024aa

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\prefs-1.js

                              Filesize

                              6KB

                              MD5

                              3a7d2cc037970110fb5f8643f45fee46

                              SHA1

                              e6861f88e24b2e1f965d30a2f1decc3c5aa122ef

                              SHA256

                              b36d7e1544bf26675213037c0de709221d830ca0db7d7d142c22745b257322a0

                              SHA512

                              0cf94e2cd3dc6b43d09e190285c1cc29accd977bf6cb1298b3992a26596aee8e0e548f953ea7fdb01c93fc0431588be622f1e8bc1608856544de46e99d18af67

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\sessionstore-backups\recovery.jsonlz4

                              Filesize

                              5KB

                              MD5

                              cdedfd38f001802a26ad4fd673503a24

                              SHA1

                              9283dff7436b7d4829364042a5a416bf235148f7

                              SHA256

                              aaaa86f3253c7107f93f47aa2c034cf80026798fe56d5aaed1bcba5f401f94d9

                              SHA512

                              78e1ebdf150cc6d1a8f8d1eeca922c420da4701a1095e12a62fa3fd0bbc3d5f7924a468f669b2c13dab409e8458adafc226893dfe4e7727059645ae52b30e37b

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\sessionstore-backups\recovery.jsonlz4

                              Filesize

                              1KB

                              MD5

                              3e9706998962c43607e01b7a0ca9a579

                              SHA1

                              1db7a49fb8fda0a9a67f8823967b109a32384072

                              SHA256

                              eee8f9491c4a1711f484a8e5177c2f10f9f9d3b56e5f5efa52806c8a595f06fc

                              SHA512

                              f522285476f9cee569a7c0a8099120f570813139e96e2e85b2ce44f390dc280df07b11b4369aa611d23bd2e3321e5220f157f2a7ffe69ea78eade77567968984

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\sessionstore-backups\recovery.jsonlz4

                              Filesize

                              5KB

                              MD5

                              91a132534058fef2409a08d400337406

                              SHA1

                              9c8d6338c84f11e2b76bece00a4c59ee5d3cc710

                              SHA256

                              d03084a2248547a371e20fa82c9d7c7302c07117afd7a9aa1e9874ee971caada

                              SHA512

                              6e67d6904e1c69139ad4862e81e9cef8491f3f193f2e274a7fcf61fa12c08e2737e2869fa267d6ca94261cd3bd22d263fce3d46b205a82eedeb260cbe7abde7f

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                              Filesize

                              184KB

                              MD5

                              d45112043b8107bbf1f8dc6da1a51a67

                              SHA1

                              08a23d281107ec94713d3b40b4266e98685a0086

                              SHA256

                              58064f9b3273d5de6bd15163dac6a09fc10d6818f40f875eb33da4d4a39f1375

                              SHA512

                              b254f39751cd31730b241cf2372a90538043cd0724723a2ae0d32aa70f211e56ac42cc5c1d81341bbeb1ee0329f6010774dcb3c8dd1351e05693a29a124e322c

                            • C:\Users\Admin\Downloads\AnyDesk.Cg1Ntkoo.exe.part

                              Filesize

                              32KB

                              MD5

                              1a491ad762ce7466ad5f387074ee7492

                              SHA1

                              430797104a9f35de68c316baacd8abfdb005e4b2

                              SHA256

                              77b8fee35710e36b6e733474558326f316ecf6e488b32d6399bf82dd2d05aa31

                              SHA512

                              5b0d41dce4cc95500d8b9c5b1c1a356749ad8f13248279c8f60296107e5375ca40955a2a2f785eb7031029244acf2742827ae5d20977a5192a3513b5332e45fd

                            • C:\Users\Admin\Downloads\AnyDesk.exe

                              Filesize

                              3.6MB

                              MD5

                              e88d9e25beb0bb2e9eee01b98ae31445

                              SHA1

                              fe3d1ec7284b68f72ca8d5c34c0be629c21f4a76

                              SHA256

                              09d15de62c85f4b0b8f487fda9e32ddb97b17cc00a298556e69afe1f763c0d3b

                              SHA512

                              41b454f536004459aed1cf84e8862422c1a7eddaa85a748dffcac130744e164164ba0e412c1d85b795b58a8b3f8b90c673d7ae1b41b51306694193e110d12bff

                            • C:\Users\Admin\Downloads\AnyDesk.exe

                              Filesize

                              3.1MB

                              MD5

                              bb032c4d5e0140fa3cb9c12d8f12d7dc

                              SHA1

                              59d3fae8037162d139a6e9e5d5d048b6fb1c07e1

                              SHA256

                              91aea26723578c1f0788ca753205e31ce2dd9437eefddbc1a6044d5ead76d539

                              SHA512

                              a3bc01628ea7889a86c887b867bfd5f4f4ff6c388d7a61affa6caad3d89874954482d7c45cfcaf4cb1546285fd72d6c8899a60be1d0dfbdc85dcc614eba10adc

                            • C:\Users\Admin\Downloads\AnyDesk.exe

                              Filesize

                              1.9MB

                              MD5

                              3258e08dc7c7b6f366bc05fdb69307dc

                              SHA1

                              41de296b8e34d0880825bf1b59d4680545a4fc28

                              SHA256

                              6e93e5aed26b918d93f475f8b81b9604fb53892da6cf579c487c3866efec6550

                              SHA512

                              717ff7b52545eee2a7cd6076ddf9e5c26cb4236830c2abd40dea82546cb93ec02a0e80a74aa4d40ec779efce84978370d724eeddf9a5f36d9363b9acc0e61144

                            • C:\Users\Admin\Downloads\gcapi.dll

                              Filesize

                              385KB

                              MD5

                              1ce7d5a1566c8c449d0f6772a8c27900

                              SHA1

                              60854185f6338e1bfc7497fd41aa44c5c00d8f85

                              SHA256

                              73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf

                              SHA512

                              7e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753

                            • memory/5340-514-0x00000000088D0000-0x00000000088D1000-memory.dmp

                              Filesize

                              4KB

                            • memory/5340-453-0x0000000006300000-0x0000000006301000-memory.dmp

                              Filesize

                              4KB

                            • memory/5340-415-0x0000000000990000-0x00000000020C7000-memory.dmp

                              Filesize

                              23.2MB

                            • memory/5340-414-0x0000000000990000-0x00000000020C7000-memory.dmp

                              Filesize

                              23.2MB

                            • memory/5340-663-0x0000000007A90000-0x0000000007A91000-memory.dmp

                              Filesize

                              4KB

                            • memory/5340-517-0x0000000007A80000-0x0000000007A81000-memory.dmp

                              Filesize

                              4KB

                            • memory/5340-456-0x00000000062F0000-0x00000000062F1000-memory.dmp

                              Filesize

                              4KB

                            • memory/5340-675-0x0000000000990000-0x00000000020C7000-memory.dmp

                              Filesize

                              23.2MB

                            • memory/5340-418-0x00000000029D0000-0x00000000029D1000-memory.dmp

                              Filesize

                              4KB

                            • memory/5544-459-0x00000000024D0000-0x00000000024D1000-memory.dmp

                              Filesize

                              4KB

                            • memory/5544-435-0x0000000000990000-0x00000000020C7000-memory.dmp

                              Filesize

                              23.2MB

                            • memory/5544-676-0x0000000000990000-0x00000000020C7000-memory.dmp

                              Filesize

                              23.2MB

                            • memory/5556-444-0x0000000000990000-0x00000000020C7000-memory.dmp

                              Filesize

                              23.2MB

                            • memory/5556-457-0x00000000026B0000-0x00000000026B1000-memory.dmp

                              Filesize

                              4KB

                            • memory/5556-677-0x0000000000990000-0x00000000020C7000-memory.dmp

                              Filesize

                              23.2MB