55e4ce3fe726043070ecd7de5a74b2459ea8bed19ef2a36ce7884b2ab0863047

Analysis

max time kernel
150s
max time network
151s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
05-03-2024 12:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AnyDesk.exe
Size

5.0MB
MD5

a21768190f3b9feae33aaef660cb7a83
SHA1

24780657328783ef50ae0964b23288e68841a421
SHA256

55e4ce3fe726043070ecd7de5a74b2459ea8bed19ef2a36ce7884b2ab0863047
SHA512

ca6da822072cb0d3797221e578780b19c8953e4207729a002a64a00ced134059c0ed21b02572c43924e4ba3930c0e88cd2cdb309259e3d0dcfb0c282f1832d62
SSDEEP

98304:NzTZ3cINQscs0m++LNkT6OpwDGUUH57yvZ/49Mr8EO3QhA9Kq:Nzt3cINQscNmvLCwDkHEvZ/4R79x

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	AnyDesk.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\4183903823\810424605.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	taskmgr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AnyDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3956	AnyDesk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2764	AnyDesk.exe
2764	AnyDesk.exe
2764	AnyDesk.exe
2764	AnyDesk.exe
2764	AnyDesk.exe
2764	AnyDesk.exe
2764	AnyDesk.exe
2764	AnyDesk.exe
2764	AnyDesk.exe
2764	AnyDesk.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	AnyDesk.exe
Token: 33	3808	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3808	AUDIODG.EXE
Token: SeDebugPrivilege	2764	AnyDesk.exe
Token: SeDebugPrivilege	4732	taskmgr.exe
Token: SeSystemProfilePrivilege	4732	taskmgr.exe
Token: SeCreateGlobalPrivilege	4732	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3956	AnyDesk.exe
3956	AnyDesk.exe
3956	AnyDesk.exe
3956	AnyDesk.exe
3956	AnyDesk.exe
3956	AnyDesk.exe
3956	AnyDesk.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3956	AnyDesk.exe
3956	AnyDesk.exe
3956	AnyDesk.exe
3956	AnyDesk.exe
3956	AnyDesk.exe
3956	AnyDesk.exe
3956	AnyDesk.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1036	AnyDesk.exe
1036	AnyDesk.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 2764	4596	AnyDesk.exe	73
PID 4596 wrote to memory of 2764	4596	AnyDesk.exe	73
PID 4596 wrote to memory of 2764	4596	AnyDesk.exe	73
PID 4596 wrote to memory of 3956	4596	AnyDesk.exe	74
PID 4596 wrote to memory of 3956	4596	AnyDesk.exe	74
PID 4596 wrote to memory of 3956	4596	AnyDesk.exe	74

C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2764
- - C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
    "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend
    3⤵
    - Drops file in System32 directory
    PID:756
- - C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
    "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend
    3⤵
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    PID:1036
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3956

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0xf8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3808

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gcapi.dll

Filesize
385KB

MD5
1ce7d5a1566c8c449d0f6772a8c27900

SHA1
60854185f6338e1bfc7497fd41aa44c5c00d8f85

SHA256
73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf

SHA512
7e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
5KB

MD5
3a877e8e73ce777c6679a77520b054a1

SHA1
be02d12302fcfcc252133a34cdb62e56d75e1489

SHA256
b60085ba89b4f981757132c5d07d301d4b3e2b3d00f58e26e3559a3389752943

SHA512
22ad09d47b75f7e66051b739e64f86ee233aa620955a3d48f5c9c4ea92dc93a219091878a8f04db390473f8f64d40cc863bf8e54458cb2f3565e221df880d379

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
36KB

MD5
719f834ae5e3ab6ea9cea0ed7c0cc1a1

SHA1
1811f77c596d8babdf210b6ce503d7ca6f42e062

SHA256
ea2aab0f99f7e35f0b464a5f2fcecde7e228926ef1820c175f3478fb8cafd42b

SHA512
613f7c887fdbf97ce3e01140a960ce15ac5fee5ead2df7a97eb11744ed5f13e594e4b715987f856b29a37380dea5bd761ce6ad34a4704a843276c211928fcfc9

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
9KB

MD5
ee46ba7b95d18d7ad879117985e79e84

SHA1
a07e785044aa989ab1e1a6742a775114705e2b09

SHA256
c2df615defadb70a3e5b6f89e51500dd1a8c938d7bf4854f359b1fa529f2492e

SHA512
db9d5ae18bfd7f6aa6e21a93623274afd266984b6a16d80eb4c532aa1efccb501e52f89dcd18c5b905ed9aa92b485ed7a9e2f5b97b6f9abce591b6f7ac4a5058

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
58KB

MD5
6c14c572e285757cdd3f3686d05bf019

SHA1
fe311e9cc078daa224627150912afc673c682b2f

SHA256
03fd8b4a16b5e2ccbeabdaa785572f4a5eaef4bb8c323c407e02a89c78219080

SHA512
cf76c38b7816e8b5d72c94664174b177620d6c184bc63af3aca55f2b286968599dc9774ea60671f6ff76f590a55fe56c95c20a0f1e79b5858c9e108af8c4f02d

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
e75c2aa8e8f5297435f23cf9e284f9f7

SHA1
4cce40f70f2a5a8bf328fb505dfbdcb698f9e5ed

SHA256
841ce2982076315e3e4551ec9aeac4d4066355c891558fdbef9416d27e26fdbc

SHA512
46efff996b826e66f4609b7a9c2942aac3896aafa42b5e0983040d3600b30603db68ce34a5ad98fb33f0549a370d5bc15dde39b07e1c18aab0bdcd1d7f950186

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
aa86134f587102c7d1413e2c97b9a256

SHA1
1d8206ed73cb6f738d18b34594209fc4e2ca8856

SHA256
95d50608ba0ec4fb4afe3e7050ae9b5e5f45f5a6d75066d795d1d6cd2f79cf7a

SHA512
a26362f1d351379d6d18476bdc49000fb8154aaa5fb3b9aeb3921e74b873fc5b850d61b95eaf28a784bcf68a48564e42adffbc4c42d14b7122a4ee16f4000eaa

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
612B

MD5
ff2e9a6d173143d244cfd367816d84ce

SHA1
e80fd1eabe70b176b835f10122a57e29e462bcfc

SHA256
77d3c1a905c14f24d767c9f21d2edf64eab09b621dc54286daeae9a1f60e91e7

SHA512
0b64a8bfc3bce536d7b79559ca059e4119985c78893f95b50a793b91fa0770bf170fa677f4d47d5ccafbdbd2fe955d4472a73b4f093f71ecb2f46fc7bb355bc5

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
681B

MD5
5af94fab1b5d03bea206aee5c42b162e

SHA1
6d7fb083ee07dc9ba6d1124aac4d373d14151d05

SHA256
74a70ee766cf7bea971f10303f3cf4ad08cc2b84303d64bca168566d7529ba34

SHA512
5ec21e36b38857dffce2265bb57ae4b93f0df54d03cda44a6f3d3ed8aa9432beee9d0c88cbde5fa1f92641ed7f91e0bca188dba806337c0d7aa696e857023a3c

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
802B

MD5
807b77f04f3cee63c26bf68ccb6eb6eb

SHA1
970f23c52b1de4e3b5822637df4cba924fa2c5e9

SHA256
86ab8a6342abf5a0dcc5092f10c33a2c2e90972a9f8cde22723b22e281080e09

SHA512
c24365a049926d8c3761fcb547cac8956cfcfe12a846b1534b9363e65494c2371d1c09ed59edccdb8c38315c3e11afedc678a19f854be58298c53c32a2d42eac

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
312B

MD5
0c04ad1083dc5c7c45e3ee2cd344ae38

SHA1
f1cf190f8ca93000e56d49732e9e827e2554c46f

SHA256
6452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0

SHA512
6c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
424B

MD5
2c69fec83cad1fa196f5da5b9fccdabf

SHA1
0dc74104992455b246c4ccadbdedd2250be66369

SHA256
50dba17c0395c43b4ab6fa512b6d47f94f82a3eb7fbba61cbf02fd52ff249540

SHA512
920accde3f166ccb87c6da5f56a7197ad73064c2f63144bb9cdf3d0fa33719d35005c8ae288e9f9bedf394705c30caf516d856c42904902a11c69055277f2365

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
424B

MD5
ac0d2ab2bee45ce8c255a4a1eb829df2

SHA1
e00595c86e02f4a8732e91cf641368f6c9648547

SHA256
9103642afb94a78dacfe0a5fe21d6a06e9d5bca5649697a4f119eaa232f02366

SHA512
07d311c34b655083a8db590d9958be7e3c89f3652fe17434874395d8a0b9feddb70c4484aef64406139da68dbd0329ec1b4ad51882f3687f27737e6800169608

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
2KB

MD5
13216d09198e7167ca978275914c9d40

SHA1
d4ad59639a8f2bbfe8e770e670be3188c65ee3b0

SHA256
ff3305beb0bceb5689c808e7cff4fa85f394bd8107260b47e2d8dd5ea695e16e

SHA512
dd20dd77ec6890121c3fd1e4e2baca2cc15ff4f9750f8dfbed13ee6cce638d124111260f6434c88521321d3605e97163acebeab951555725654edcbb9dbb9f55

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
2KB

MD5
3d71b262c90fe0d1925d9768f51e61b2

SHA1
d09e1dd750780578cd11d713308bf52992de3534

SHA256
1467fa99b03532c8c36448e08d8ae5d25c98b33582af77f025efe5f080dad883

SHA512
dc554d837ca5cf27472ee42c34dedbc887cdcabc5600c7a934889f674782b24840c7b746215db7a143133ce2e78492f3ac77f460b6cb83d4fad5a405f049c86e

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
2KB

MD5
fc5398c166769908640b241a1b3a6781

SHA1
77192080cf96c923b0e1b3be00220442e9d8f333

SHA256
6ab87e45682174cbb151994011dd107853ac8e76fbabc6c8cbb29cbb2b855391

SHA512
f7336c6124f3856fd0253df07781287c1488d71e9e836d9b7d017f19b1d288d707cef58fb601c56c7df219e1845706436178d0dc20f23153133c154dc195c808

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
5KB

MD5
6718dd4f9e44b3cb50d52f2cf57a5424

SHA1
f49c78f06417081ec606cae6cc6b0dbd0a3eec66

SHA256
03feeee7d0843defa737a89fe87e4ee1f6deabb77bf9f77b5d13e1d5df3c0102

SHA512
5ad373f70e7cd5a5336469e2a4785582939028dde5d55c28334e3f0e4bfb912678c07ec7d60255fcd54be86a80108c04a1c9ed2f9e3c95cf79c4b1130bdfcec2

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
5KB

MD5
6815c3b4c5094d8271c7a2b7e02da545

SHA1
c104840204590d29700ebc5ca61ace0681883529

SHA256
1d5064a395c58cc3bb3913bd7ecc27dc803315e83c8dc84fee566976ab72d564

SHA512
6394326910eaf934fc3e19ff32272fc7ad4acde4c7c28f87cac08ad40983ada6dc9e865eda8cf3f6dde52fd3cc853c587a62644d9a5fcf67bf185870b1ff7ba2

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
d571c99b692e0ddb21ee56e87038699f

SHA1
01d3be4d6bcccbd3f33e3d97f456e9975a0d18e2

SHA256
8c6cc417d73721718130162881e3b5e2d21cf4a92662317d634136b5a97b44ef

SHA512
ec4f15aae4b00564e5d5ecffc0e51576cd7c914003f2da4a2c9f7b91ba6ffb903288c70a4a5794b3eccbd589ce662c3c28c473a93cab9592aa8b4a2922ea03a1

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
0b2421e4b35cd8fa1253facf1025b4a6

SHA1
5b7bbdd435289faecb105e805a5e0eb1de546a78

SHA256
7535778d32ed82e8d95e223ee94590279e77b689e7f398aefe37aee1deecb785

SHA512
9fa6836f74e4b52798a2da39a20ed9931e624b513cec2935a63b51bb515356a6c57ada3ab186d1d4438f494d6955b0b36b2a3b96568d8ef30b7a7271db97ef90

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
8eeec2555093e96a60030e1ecc2560e6

SHA1
bb5eccd66c7b38c742f361df412495c6525ae7ef

SHA256
c960e35521fe32a4f19b40418b500cc440f507b9abef0120babddcf9bba18756

SHA512
9bdcd9a6a3dbbd86d52aace2e01af2d74b0f081636094a2ff9d28ad6e22bbe7ecdef658dda2496a23d84c53dfaace38e19f5bbfb0332bf9d2fb30ff8e2fa7db4

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
a8fd8ef3e4c37b46ccc6961cad2b3245

SHA1
9816daa7ff03c5228dd3ff43494449ff48118a59

SHA256
3238c5f88147e05b997b968122f15701bff90660ee14de9cd75a5d8991b39050

SHA512
1d5c9ff8a56b6442ccbcb995d67fc77a3bb6338e2f2dedd59885389907c9c14410bc6f18f9172b6bdc258ddbcd9f7ff7334d2c623e0cc1863fc40274ba337026

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
3719312794498f25db4fb73270154e68

SHA1
dda3235ac21b478b02e94c4c1228133ede650893

SHA256
3a65c65f3ef6cddb35ac40547ac6d8f2917a73c5bf6a130ce0e1ec5e9dc86d31

SHA512
3b430db3b0c2f0ee25ea7b73aab465223a666216372476f2faa7b397e6180963110811f55631893b668aabc1dd97a174198f7790531e0990d3b0444fd651f93d

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
aa5ae811c2dc9a7d08e5cf064c080008

SHA1
994fab86aeeaa1f65419344f53110cc2bc9d2a3f

SHA256
81aa1f986fe1489f77526ed4d05208b7382d174ede5309cec6e8e68d863d7040

SHA512
27aca1c6bc38dbb88841782124b3393cf0e94a7054eb1f16dd1be8a4fb3ea1d95cde713333fdd9bded0ed83035b6a08311673572fe2c92c23302e7cd0b525ac8

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
d000a85aa5cf3cbdf2b8102b8de5c29e

SHA1
2f4851dd04420c550f5dfedd8da14bf26019c0b5

SHA256
382568a42279858a35cfc7f169f37f79759ae2d2c447627eb8405054cb6ba9b5

SHA512
02f82884385ea14f1082c1b2bac112cac0f62277a39e18764e9dd119d2195ecf0ca36af0a0d0c93e4eb78794032caefd47d95bb1ae933e01f6881a335e3c10e5

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
0c7c73d3c938d18a1807398a67c96f45

SHA1
6fc183e23f0fa5c76182d410ee8133d576ab8cb3

SHA256
27a7222dcaf5ca5ef4546de2fad0dbe309d44274c48f83335abd3ec4713234c1

SHA512
8ec73d822e9dd9be4ee61676da10fcdf3999fd0a89f33020c5d83d28de4dfbcaef0e93247adb365a8c3d37756f90178ed707178d832e6c6388d4ee2c22d6dc04

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
5beaa65485dcdc470a8f4a53ad266e2e

SHA1
581a89391b9b70a3cfa71051a458a455b65cd2f9

SHA256
f05618be833c6fd417ebfbb49102e5440112ab974c78ce132ed5b31646e2d322

SHA512
cc3300c6b0545858f2c176f39526fc3ca3b3d571ade908f01f633707db33b28db31aec6b5ee5af277f7611608203a922056ec7d6fab022c39f002592af42ab66

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db

Filesize
1024KB

MD5
5120931921bffd1031ce80023e6bacca

SHA1
14f04720e68c9feb3c9bedfaaf2b44e33994f358

SHA256
766cec83331fb9a964881dba8a4d6f764e7fbb05f73d1f6ba73257ec9bfc8312

SHA512
ccd7bd8e8eaa6afba4caf95056d29ec4716aa7870384da4b56c81a2ecfc378bb106677d0bec937adf9cd43502f746090b82f2e3bd5b6ae3cc3aa0b553fa52df3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
7KB

MD5
9385436b541bd2770e1cad7f380e1657

SHA1
f71e91579ef3970f8eb3c1a8d655c6985f5e485c

SHA256
496ad253be624953aa28e5a1a29af0d8d83f87bba26c59e5d8403822aeee5309

SHA512
482c6d9c1379c4827967511f6de583d91922890d44b27ea9be1594df9c114513f875e63aac7c32bf5d6bea6f6d49685cd7aaa84c69c499630f253f658a43690a

Download Submit
memory/756-264-0x00000000058E0000-0x00000000058E1000-memory.dmp

Filesize
4KB

Download
memory/756-269-0x0000000005930000-0x0000000005931000-memory.dmp

Filesize
4KB

Download
memory/756-320-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/756-281-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/756-277-0x00000000059B0000-0x00000000059B1000-memory.dmp

Filesize
4KB

Download
memory/756-275-0x0000000005990000-0x0000000005991000-memory.dmp

Filesize
4KB

Download
memory/756-276-0x00000000059A0000-0x00000000059A1000-memory.dmp

Filesize
4KB

Download
memory/756-271-0x0000000005950000-0x0000000005951000-memory.dmp

Filesize
4KB

Download
memory/756-274-0x0000000005980000-0x0000000005981000-memory.dmp

Filesize
4KB

Download
memory/756-273-0x0000000005970000-0x0000000005971000-memory.dmp

Filesize
4KB

Download
memory/756-243-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/756-244-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/756-272-0x0000000005960000-0x0000000005961000-memory.dmp

Filesize
4KB

Download
memory/756-265-0x00000000058F0000-0x00000000058F1000-memory.dmp

Filesize
4KB

Download
memory/756-248-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/756-256-0x0000000005850000-0x0000000005851000-memory.dmp

Filesize
4KB

Download
memory/756-254-0x0000000005680000-0x0000000005681000-memory.dmp

Filesize
4KB

Download
memory/756-255-0x00000000056C0000-0x00000000056C1000-memory.dmp

Filesize
4KB

Download
memory/756-257-0x0000000005860000-0x0000000005861000-memory.dmp

Filesize
4KB

Download
memory/756-258-0x0000000005880000-0x0000000005881000-memory.dmp

Filesize
4KB

Download
memory/756-261-0x0000000005890000-0x0000000005891000-memory.dmp

Filesize
4KB

Download
memory/756-260-0x00000000056A0000-0x00000000056A1000-memory.dmp

Filesize
4KB

Download
memory/756-259-0x00000000058A0000-0x00000000058A1000-memory.dmp

Filesize
4KB

Download
memory/756-262-0x00000000058C0000-0x00000000058C1000-memory.dmp

Filesize
4KB

Download
memory/756-263-0x00000000058D0000-0x00000000058D1000-memory.dmp

Filesize
4KB

Download
memory/756-266-0x0000000005900000-0x0000000005901000-memory.dmp

Filesize
4KB

Download
memory/756-267-0x0000000005910000-0x0000000005911000-memory.dmp

Filesize
4KB

Download
memory/756-268-0x0000000005920000-0x0000000005921000-memory.dmp

Filesize
4KB

Download
memory/756-270-0x0000000005940000-0x0000000005941000-memory.dmp

Filesize
4KB

Download
memory/1036-353-0x00000000058A0000-0x00000000058A1000-memory.dmp

Filesize
4KB

Download
memory/1036-358-0x00000000056F0000-0x00000000056F1000-memory.dmp

Filesize
4KB

Download
memory/1036-384-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/1036-368-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/1036-356-0x00000000058E0000-0x00000000058E1000-memory.dmp

Filesize
4KB

Download
memory/1036-357-0x00000000056B0000-0x00000000056B1000-memory.dmp

Filesize
4KB

Download
memory/1036-336-0x0000000001270000-0x0000000001271000-memory.dmp

Filesize
4KB

Download
memory/1036-337-0x00000000055D0000-0x00000000055D1000-memory.dmp

Filesize
4KB

Download
memory/1036-338-0x00000000055F0000-0x00000000055F1000-memory.dmp

Filesize
4KB

Download
memory/1036-339-0x0000000005680000-0x0000000005681000-memory.dmp

Filesize
4KB

Download
memory/1036-347-0x0000000005840000-0x0000000005841000-memory.dmp

Filesize
4KB

Download
memory/1036-354-0x00000000058B0000-0x00000000058B1000-memory.dmp

Filesize
4KB

Download
memory/1036-355-0x00000000058C0000-0x00000000058C1000-memory.dmp

Filesize
4KB

Download
memory/1036-349-0x0000000005860000-0x0000000005861000-memory.dmp

Filesize
4KB

Download
memory/1036-352-0x0000000005890000-0x0000000005891000-memory.dmp

Filesize
4KB

Download
memory/1036-351-0x0000000005880000-0x0000000005881000-memory.dmp

Filesize
4KB

Download
memory/1036-325-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/1036-324-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/1036-350-0x0000000005870000-0x0000000005871000-memory.dmp

Filesize
4KB

Download
memory/1036-348-0x0000000005850000-0x0000000005851000-memory.dmp

Filesize
4KB

Download
memory/1036-346-0x0000000005830000-0x0000000005831000-memory.dmp

Filesize
4KB

Download
memory/1036-345-0x0000000005820000-0x0000000005821000-memory.dmp

Filesize
4KB

Download
memory/1036-332-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/1036-342-0x00000000056D0000-0x00000000056D1000-memory.dmp

Filesize
4KB

Download
memory/1036-341-0x00000000056C0000-0x00000000056C1000-memory.dmp

Filesize
4KB

Download
memory/1036-340-0x0000000005690000-0x0000000005691000-memory.dmp

Filesize
4KB

Download
memory/1036-344-0x0000000005810000-0x0000000005811000-memory.dmp

Filesize
4KB

Download
memory/1036-343-0x0000000005800000-0x0000000005801000-memory.dmp

Filesize
4KB

Download
memory/2764-386-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/2764-241-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/2764-403-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/2764-398-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/2764-390-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/2764-322-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/2764-84-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/2764-12-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/2764-364-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/2764-282-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/2764-394-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/2764-382-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/2764-193-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/2764-371-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/2764-32-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/3956-13-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/3956-194-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/3956-27-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/3956-365-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/3956-323-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/4596-195-0x0000000007320000-0x0000000007321000-memory.dmp

Filesize
4KB

Download
memory/4596-23-0x0000000005CA0000-0x0000000005CA1000-memory.dmp

Filesize
4KB

Download
memory/4596-82-0x0000000008160000-0x0000000008161000-memory.dmp

Filesize
4KB

Download
memory/4596-192-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/4596-22-0x0000000005CB0000-0x0000000005CB1000-memory.dmp

Filesize
4KB

Download
memory/4596-83-0x0000000007310000-0x0000000007311000-memory.dmp

Filesize
4KB

Download
memory/4596-4-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/4596-87-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/4596-0-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download
memory/4596-1-0x0000000001280000-0x00000000029B7000-memory.dmp

Filesize
23.2MB

Download