55e4ce3fe726043070ecd7de5a74b2459ea8bed19ef2a36ce7884b2ab0863047

Analysis

max time kernel
170s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22-02-2024 12:33

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

AnyDesk.exe
Size

5.0MB
MD5

a21768190f3b9feae33aaef660cb7a83
SHA1

24780657328783ef50ae0964b23288e68841a421
SHA256

55e4ce3fe726043070ecd7de5a74b2459ea8bed19ef2a36ce7884b2ab0863047
SHA512

ca6da822072cb0d3797221e578780b19c8953e4207729a002a64a00ced134059c0ed21b02572c43924e4ba3930c0e88cd2cdb309259e3d0dcfb0c282f1832d62
SSDEEP

98304:NzTZ3cINQscs0m++LNkT6OpwDGUUH57yvZ/49Mr8EO3QhA9Kq:Nzt3cINQscNmvLCwDkHEvZ/4R79x

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	AnyDesk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AnyDesk.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "50"	LogonUI.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1840	AnyDesk.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2072	AnyDesk.exe
2072	AnyDesk.exe
2072	AnyDesk.exe
2072	AnyDesk.exe
2072	AnyDesk.exe
2072	AnyDesk.exe
3420	AnyDesk.exe
3420	AnyDesk.exe
1840	AnyDesk.exe
1840	AnyDesk.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2072	AnyDesk.exe
Token: 33	1372	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1372	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
1840	AnyDesk.exe
1840	AnyDesk.exe
1840	AnyDesk.exe
1840	AnyDesk.exe
1840	AnyDesk.exe
1840	AnyDesk.exe
1840	AnyDesk.exe
1840	AnyDesk.exe
1840	AnyDesk.exe
1840	AnyDesk.exe

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
1840	AnyDesk.exe
1840	AnyDesk.exe
1840	AnyDesk.exe
1840	AnyDesk.exe
1840	AnyDesk.exe
1840	AnyDesk.exe
1840	AnyDesk.exe
1840	AnyDesk.exe
1840	AnyDesk.exe
1840	AnyDesk.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2060	AnyDesk.exe
2060	AnyDesk.exe
1232	LogonUI.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 2072	3420	AnyDesk.exe	91
PID 3420 wrote to memory of 2072	3420	AnyDesk.exe	91
PID 3420 wrote to memory of 2072	3420	AnyDesk.exe	91
PID 3420 wrote to memory of 1840	3420	AnyDesk.exe	90
PID 3420 wrote to memory of 1840	3420	AnyDesk.exe	90
PID 3420 wrote to memory of 1840	3420	AnyDesk.exe	90

C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1840
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2072
- - C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
    "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend
    3⤵
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    PID:2060

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8 0x154
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1372

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa397f855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gcapi.dll

Filesize
385KB

MD5
1ce7d5a1566c8c449d0f6772a8c27900

SHA1
60854185f6338e1bfc7497fd41aa44c5c00d8f85

SHA256
73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf

SHA512
7e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
7KB

MD5
32310de364bbcec9bbf49a646a2ee2c9

SHA1
6bff4f4f5ad8d2e87dde00fd173eb5cf2435601a

SHA256
0196ac776e70f8a74c6d6736b8ed0f2438b2fc4e2d5a823427962bbc90ff800e

SHA512
99d4fceafbe83f11aef8ad1b34694c44314cee598beb1e1b2b74c87acbd2d0186195ba878ba0ffbe0d5c5b88c77ff7e317d793db7be3d69e9d5d702be37d6e24

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
36KB

MD5
7baafd43a792562775019748a93108ec

SHA1
04866fb55be7f1c369e3882d5a4b7390e19503ab

SHA256
178494b34cc228f091b0c111423ab2b53bff65e897befdb5e0a3a47b8fe67c45

SHA512
5be455eb2e09991301e1e3810a3ae77674686eb122af4be971186e6663dcbe7b435e9ba6e157d2c95cfb1a1c100fa9cf18ae43bc6f3cbb93a1de2397fe87043a

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
10KB

MD5
07c5cbee311726db216938e19078e98b

SHA1
0e04b59fa9747d69c7eafac8173a05762b591cdd

SHA256
1b3bc6908d7cf6deb493f8e7b74f2c3e2ccf47bd086f80d0399dfe6682eeb6d3

SHA512
be40be2ee7d486cea3b7c6e76c678706cc6c0753fc36cf004e1be569c465fda71673f9c6a749d0adc7a4a700f4a72817dd486e8a69e3feb6973639f83de3d9a5

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
9ec74c90d0ac498d7f647ace05bf8a4c

SHA1
6673ecec4253ecbc150f4fa720cf3f452a6d27be

SHA256
31c32a56d75dcda209cb775a1c75a66dfbf509f0972788c97055bedf70e517a1

SHA512
1633a5bbdb7ea10761aa8d01ab970e4a8716243523c51b27d6fd49b8ee1a330d05b07d565c2b948dfc3e02320df5ac02d009b19f6d5aa1b6955b52422a189214

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
3e38fa2fdd6c9e679a783240ad8668c1

SHA1
e2814d4953b61387ec5d81ed6c08652f27194424

SHA256
cf873d11049359c3c3994106f1cdcd73e1cfb634187ee83ab6c688f79ffba5f2

SHA512
5de83ffc225f087e4044814cf87b1160991b618aaf116f677167bbd06b16dea003b2ea9654ce6194d12bf58bfc69883210908dc4ddc792684023d233d3162528

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
681B

MD5
c02e0b7c606f2b89d9ec0da055a6ed46

SHA1
b2f378aa8125496f2f74ade1e18c18603066ec03

SHA256
3fee5f6e606ccb686998970e81cde511649c5dd62a9e4292359799ebdc24630d

SHA512
8eb8d2e4de12ec5b98dec0b534bcb85c76a25d3e5396c26654d96c49ac744f7985dd1df7efc6c0f9bf796839857ace6dc7a7d07d91e836bc4f318c9d2ade53b4

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
802B

MD5
0ca0f70e47165f81f8f84fb4519b85ae

SHA1
fef3cdd9ee4d0f1a990c3efb50330841436283de

SHA256
5581d28fc0f90904e6af1838e96a8f41f4ac46d637d372bffc88ba393695a8e0

SHA512
8f0d3dbda2e3daa4f48c97b088d6135ff0730ef658c50b1841566750e6b22960511cb1c2e0c1b91673a3a8a46ec889fd89d5723f6ebf582b5bb37976c27d2abf

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
424B

MD5
943fe49ca142e44be0f66882c7a7beed

SHA1
f352ad6d2de1823a976384ae7b9626fae6ba9398

SHA256
8281b2a19404e38dfa98f7e577b68ca896ef23517e9b100a13610eecefd85c1c

SHA512
38146a49ae57b469cf119fee49aa46d4c64357fa050ad896d2c87ce695c57d5eaddb10d9bcd2a8640c753191501d5e769432feb505bf903162faf2d53d7329a5

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
2KB

MD5
334625c2d789dab5987eb55e26cd68df

SHA1
d146a7991030e726d418f1986b906d18e14b43d9

SHA256
9894604571f8676f867d15b8e2fa08cf577703e1ff3677782de95abc714854fc

SHA512
aaf69ac480556ef7f60ffe6f2edc71ea2947056e1475336ea0bb536160b43e46b1a5b82c56479f65ec073041d4ca975b5b7e9785ce5f5035de3cce3285964433

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
3KB

MD5
cf72a77dab888992192d705f2d5cf909

SHA1
272ad70f4a040a031671602009663ab438d15535

SHA256
2a855bb7e3ea3c9771928bb59f7082bb0c7bdc7f8585da2d7eb6b2757df1b5c9

SHA512
9bbe0e897c6a73de25ceeaef64c4e7966ac12966146dd268bedd4de8d94a029834b9dc56b7f5ef412c56f22fefd5729ac6436e88cab210922d710ce32151a484

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
3KB

MD5
d510522958e785826c8b4e8a52995cc5

SHA1
a544af38ef74d12d1074d98328c8eeb7bb0402a8

SHA256
34c66129c58b40b6c0391ac72102b6af4172c6133a397eca96479e40c76ed206

SHA512
e907a0b75d58ccbe0c9c41fb7fd30d1d6184d19d40f7f6ced7c9f7a7c7a987bbcb17287a554848cd39b9d8b85728f0b1238b1a2b7aa4cab7e5678edd61bf97cd

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
d74d9831f2760b978f5da094511b110e

SHA1
5e41df4b656fcaaf42fedb4f563a104f796a9892

SHA256
625bee27e7fcdfa8f2e0a57f0c778f05f0890f88d3645e190387779bcec80c9d

SHA512
96469c33485c775bbbc9856510e1477eb0621df960dea57c7f6bef3361327be12a9e8397441394a10f2d704c17105723e73d4368c798c75a44eec0f31cb11775

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
91025f9eb0fa4b8bd8b18c5c4a5ef98f

SHA1
201f660616e24f1d8e89c65d41e52f98d840b916

SHA256
20efa57edda5aca194c567b6578f54d18986fd2ef71f0819056c84d46ce8f672

SHA512
853d5292bf41c0c788a4b244e15b02b0f0273d1c667d02d938bf5c9950a952f4ddda9858f6af6814197f52332979ec08fda6e585e262e17e907951e13a9ac614

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
ad70bfe782b3d5c55075df2dad1b38d3

SHA1
84d1db88c3e7c823ef31fc69202439ddfc5a8d4a

SHA256
89d361c5dcd6deb9cb4c3e95e7ae3a69cf7461efdc4323ed850713492f0e5c03

SHA512
1f21944045ced6b99cd226e3314b8c581307a77c99c01a972cbc6e297484903488ac6e3c7bc88b92de5c68c81b19a8b442eed616cdd4f8a76021145c83509d8d

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
72244ed7fc0834554b453e76965405f8

SHA1
ddf05bec5fe02f833b2bb5bcf0d91bbbaf4c1f9d

SHA256
55eab1a34d2addd520d65e432665b2a0729e6a9d93411c99af704000ef323b7d

SHA512
cce294e5388337444743675ea688536e72cc198db323b58dd9f47d88cfdefdd3ccc87cffb97c52eccf3d954ef2e697dc98d23a5b2a5df6ca2f3f4118c5f0c070

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
42c0e70b4a43e701819b0ea40b1b647a

SHA1
b980fbc74690e332e7fa3a84f03951ac3d88efc4

SHA256
b416b118ee538455340e617e5e397f4200eb8d6beb72df756c85f0b4cceaff87

SHA512
3e1d6b9fe11cd2aae131ba8e986edbfc847665f805f7d49f93403a31b79fcd6745ffef1b2d925dbfc0309596b96451414ee44cb3614095e1e8a654d1c548ddea

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
c4cc3ccba978edb7670755ca58bf3bcc

SHA1
77cc35ba2c945a0fc47e463657493fe8034cb749

SHA256
778341e40496491261900b39e4d528471fc98c8ff754c45e201f5b830338bd35

SHA512
fe98e2fd3bb787290344ca179f5279e858594bcb39c24f72aad31c6e1a452fd7e16307236215dc12221bc48b4b7682d82cb9f1400f1588ddd601befec694f74e

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
6a4050b9dc055b40c24940eb32d08818

SHA1
79cb55d5f86f3d1e4e8f469642ba43448bb0763b

SHA256
981861989aba8160a77b5cd7d7581fae0174113504f3cefe2be178ddada80ec9

SHA512
087d5f28d6f7c15c95723eabc6b698fec998af2de3446913c3eb6978fa7c53297ec2fae6adb08922969c7740bd1f71205bcd87186b75870ca4f93baba5c5127e

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
7KB

MD5
42322e8078460d53256f9d3edd8dde85

SHA1
84a2ebe7705288625ad4d2e72f878dc33bcccc8e

SHA256
2745dfcb88160d41c4af4d1cd1008ac5ab2e14b73c85402dc73fee22ee17f8d8

SHA512
61618814a32477520c5ac3f29e372a4d24c63773dcd4e94e3618248ea75299345fd3b7324579bc875e73dd5c62636a5f434b53875e1b696d1a335b6e4625b97b

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
7KB

MD5
d13ce68b6c784851dbd02ca8e6ffbd44

SHA1
cb4ac8c9a46b61eff554b861a05dc5872dc4356d

SHA256
655f264b86886b2ead3e6bcd0741387bad38847ff406596cfa942f18c9585de9

SHA512
3a138df56ee580608704463a638d53794aaf40af7130aae00e801f7d67c263283be345e11ab1b4ee5c8f3f357f4cad0bda8c5f3102bce76b8b0e031a494fd207

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
7KB

MD5
508ccb9a5a731528ec643b9347be6d68

SHA1
ac9041f3f0ebec2d54d6facf0f1801e7cbaac015

SHA256
c32f6e089c93a39f3b1d631bb00fdd1303b7a79f6d8f06e76b54b86160cfe926

SHA512
b2d6c3b5f0d71f12b2a0f86679b7403d16ea09c5d36507c3399d5ac39da968a80ecaa8182de20a48569cb5447fbb3c8c45e80d26fedf633aa72137a677206030

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
7KB

MD5
160cd0f19af11f15fddff552ea484e92

SHA1
c7331b963e23d140e3b013f12e8c8cad27739bd5

SHA256
6155e1e1125cb8fc563395fd609089e0ef6e05309cc0a1f29efe1ae48a36cee8

SHA512
3668e2a765f26e2885427b4791ba39414e6085211059969f29f4045f891ecf4f9b3b0fd9cce4c4f0678f7a0739f4a12d4ca7ff53ed1d47bc6325f6c790553286

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
7KB

MD5
f42807ce6db16db7bf43ffc6889e61b9

SHA1
4939216dba3f4d8a4692ef694172c02018f2346b

SHA256
738ba01366b582cefd1e7e54a53205e5a09314a9f94bad613f1ed6dc0486db7f

SHA512
1eab82313e62d94cc2cc24f180f9ac246b4e9537bfec16258093efc122a3465ad122ad2c204aeb2bdfd0d9f02014947369d031fef433328ce10835fe12f70291

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
7KB

MD5
ee5fad776a29309f48cc11f5342ce419

SHA1
ba56245f4ccc028bc8184ec6cc04a4371f3ef81a

SHA256
eca40b610a6284ec0f98a3b0c6ce0c17ee83d8c8b6d1daa5fcb21dd3de39432d

SHA512
6fefa38c327bef21e51b09d7fcab4fdcfba543776770b66118d3d0c66923de572a585cd8d942831e52df2e80a80dba59b6d76ed695c9ae3b3d46beeba323485c

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
524ddb820ea17efd4fefb815a0719345

SHA1
7ff16d3810cf63b05a44330a0c69c1fc36e4b16c

SHA256
6f6e7f9cda1104e74ad711d034db400951c7015f4a116bd788830c645f790def

SHA512
4395af6eba26e8c5be654c437ced0848f00e4eca1a1dc380136880021ae2fd6524cd931333cd5ebd49fc26d8de2275415872a478b4f1276ba83a9eb31692cd94

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
6ce2b40a70c6b47a37438c2c4c260c12

SHA1
53aa57048cfe7a06c435b4e04fd964f8a78e7833

SHA256
b367774a36cfc10afa80b08fc1cb3007a70886a747231b7685cc94336bdaec0a

SHA512
83ac53f862d70206151edc0b2d52b48b28daffc48a5d9ffcd7be4fe59144c3362d424b88b1962d18928e31ea6ac3d8cbaa4787f3769670ea8ce8d3e8ddf1d79c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
3KB

MD5
33fe3b5f190b12a6ae5304b21bc00a9b

SHA1
ca43496d2083b85ac57edae8c2beaaab6425b7f3

SHA256
27fe6d55b80a70ea1d7b35909b93e9fc6f5f72bdb06b0d208437227e974f1993

SHA512
9796684747e0ffd0f777fc3b4bbde661423c3c4746a1915a257f05f11490faf82df3a25b6c2240b593fd1f825afeb8912613b854d9972cfbeb50a8cbc3ca6d57

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
3KB

MD5
53f6b518d08c13ddceedd6c824e427d7

SHA1
c5b1b8aaf641a041947cb1cc8d62bdb96bde7ba8

SHA256
5e9161019af926a43d783bb42750b737fd0079ce77c5648c4d2c588f09173d7d

SHA512
60489d0cc29184fd0c437af30cc9a0d86d87a3f283c4488308efdd86783ac5d714ec183e1861d2993b0298d2e04cfb1916ad9b0536cbf2e840aba006b9bdfcfd

Download Submit
memory/1840-32-0x0000000001F40000-0x0000000001F41000-memory.dmp

Filesize
4KB

Download
memory/1840-13-0x0000000000380000-0x0000000001AB7000-memory.dmp

Filesize
23.2MB

Download
memory/1840-406-0x0000000000380000-0x0000000001AB7000-memory.dmp

Filesize
23.2MB

Download
memory/1840-414-0x0000000000380000-0x0000000001AB7000-memory.dmp

Filesize
23.2MB

Download
memory/1840-11-0x0000000000380000-0x0000000001AB7000-memory.dmp

Filesize
23.2MB

Download
memory/1840-314-0x0000000000380000-0x0000000001AB7000-memory.dmp

Filesize
23.2MB

Download
memory/1840-246-0x0000000000380000-0x0000000001AB7000-memory.dmp

Filesize
23.2MB

Download
memory/1840-363-0x0000000000380000-0x0000000001AB7000-memory.dmp

Filesize
23.2MB

Download
memory/2060-303-0x0000000005EC0000-0x0000000005EC1000-memory.dmp

Filesize
4KB

Download
memory/2060-299-0x0000000005E80000-0x0000000005E81000-memory.dmp

Filesize
4KB

Download
memory/2060-285-0x0000000005BE0000-0x0000000005BE1000-memory.dmp

Filesize
4KB

Download
memory/2060-286-0x0000000005C00000-0x0000000005C01000-memory.dmp

Filesize
4KB

Download
memory/2060-292-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/2060-294-0x0000000005E30000-0x0000000005E31000-memory.dmp

Filesize
4KB

Download
memory/2060-404-0x0000000000380000-0x0000000001AB7000-memory.dmp

Filesize
23.2MB

Download
memory/2060-302-0x0000000005EB0000-0x0000000005EB1000-memory.dmp

Filesize
4KB

Download
memory/2060-307-0x0000000005F00000-0x0000000005F01000-memory.dmp

Filesize
4KB

Download
memory/2060-308-0x0000000005F10000-0x0000000005F11000-memory.dmp

Filesize
4KB

Download
memory/2060-306-0x0000000005EF0000-0x0000000005EF1000-memory.dmp

Filesize
4KB

Download
memory/2060-305-0x0000000005EE0000-0x0000000005EE1000-memory.dmp

Filesize
4KB

Download
memory/2060-304-0x0000000005ED0000-0x0000000005ED1000-memory.dmp

Filesize
4KB

Download
memory/2060-301-0x0000000005EA0000-0x0000000005EA1000-memory.dmp

Filesize
4KB

Download
memory/2060-300-0x0000000005E90000-0x0000000005E91000-memory.dmp

Filesize
4KB

Download
memory/2060-364-0x0000000000380000-0x0000000001AB7000-memory.dmp

Filesize
23.2MB

Download
memory/2060-298-0x0000000005E70000-0x0000000005E71000-memory.dmp

Filesize
4KB

Download
memory/2060-297-0x0000000005E60000-0x0000000005E61000-memory.dmp

Filesize
4KB

Download
memory/2060-295-0x0000000005E40000-0x0000000005E41000-memory.dmp

Filesize
4KB

Download
memory/2060-296-0x0000000005E50000-0x0000000005E51000-memory.dmp

Filesize
4KB

Download
memory/2060-293-0x0000000005E20000-0x0000000005E21000-memory.dmp

Filesize
4KB

Download
memory/2060-291-0x0000000005DF0000-0x0000000005DF1000-memory.dmp

Filesize
4KB

Download
memory/2060-290-0x0000000005DE0000-0x0000000005DE1000-memory.dmp

Filesize
4KB

Download
memory/2060-289-0x0000000005DC0000-0x0000000005DC1000-memory.dmp

Filesize
4KB

Download
memory/2060-288-0x0000000005DB0000-0x0000000005DB1000-memory.dmp

Filesize
4KB

Download
memory/2060-287-0x0000000005C20000-0x0000000005C21000-memory.dmp

Filesize
4KB

Download
memory/2060-275-0x0000000000380000-0x0000000001AB7000-memory.dmp

Filesize
23.2MB

Download
memory/2060-279-0x0000000003B60000-0x0000000003B61000-memory.dmp

Filesize
4KB

Download
memory/2060-370-0x0000000000380000-0x0000000001AB7000-memory.dmp

Filesize
23.2MB

Download
memory/2060-315-0x00000000087A0000-0x00000000087A1000-memory.dmp

Filesize
4KB

Download
memory/2060-316-0x0000000000380000-0x0000000001AB7000-memory.dmp

Filesize
23.2MB

Download
memory/2060-317-0x0000000000380000-0x0000000001AB7000-memory.dmp

Filesize
23.2MB

Download
memory/2072-313-0x0000000000380000-0x0000000001AB7000-memory.dmp

Filesize
23.2MB

Download
memory/2072-31-0x0000000003A10000-0x0000000003A11000-memory.dmp

Filesize
4KB

Download
memory/2072-409-0x0000000000380000-0x0000000001AB7000-memory.dmp

Filesize
23.2MB

Download
memory/2072-12-0x0000000000380000-0x0000000001AB7000-memory.dmp

Filesize
23.2MB

Download
memory/2072-405-0x0000000000380000-0x0000000001AB7000-memory.dmp

Filesize
23.2MB

Download
memory/2072-245-0x0000000000380000-0x0000000001AB7000-memory.dmp

Filesize
23.2MB

Download
memory/2072-362-0x0000000000380000-0x0000000001AB7000-memory.dmp

Filesize
23.2MB

Download
memory/3420-85-0x0000000007340000-0x0000000007341000-memory.dmp

Filesize
4KB

Download
memory/3420-234-0x0000000007350000-0x0000000007351000-memory.dmp

Filesize
4KB

Download
memory/3420-361-0x0000000000380000-0x0000000001AB7000-memory.dmp

Filesize
23.2MB

Download
memory/3420-322-0x0000000001F10000-0x0000000001F11000-memory.dmp

Filesize
4KB

Download
memory/3420-22-0x0000000005BB0000-0x0000000005BB1000-memory.dmp

Filesize
4KB

Download
memory/3420-244-0x0000000000380000-0x0000000001AB7000-memory.dmp

Filesize
23.2MB

Download
memory/3420-23-0x0000000005BC0000-0x0000000005BC1000-memory.dmp

Filesize
4KB

Download
memory/3420-80-0x0000000005CB0000-0x0000000005CB1000-memory.dmp

Filesize
4KB

Download
memory/3420-1-0x0000000000380000-0x0000000001AB7000-memory.dmp

Filesize
23.2MB

Download
memory/3420-320-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

Filesize
4KB

Download
memory/3420-321-0x0000000001BB0000-0x0000000001BB1000-memory.dmp

Filesize
4KB

Download
memory/3420-323-0x0000000001F00000-0x0000000001F01000-memory.dmp

Filesize
4KB

Download
memory/3420-4-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

Filesize
4KB

Download
memory/3420-0-0x0000000000380000-0x0000000001AB7000-memory.dmp

Filesize
23.2MB

Download