586431b613beb35df78653909e4cf25db717f1dc4b4d928e0e71f4453f9b4671

Analysis

max time kernel
985s
max time network
512s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
22-11-2024 14:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Screenshot 2024-11-22 220626.png
Size

462KB
MD5

bed6dd625e3a7e838bcea5f3dce698b0
SHA1

1254f3fdf4d78815c449d166b1c8f356f220d7c6
SHA256

586431b613beb35df78653909e4cf25db717f1dc4b4d928e0e71f4453f9b4671
SHA512

29c460e57c7e47fdf7f886bb1bc72b23079c1627619c6caaad3be003f76c937e9145e29f2ea109cab08802704a9ee01f6591ac65989a06a8bfab6d14809d70d6
SSDEEP

12288:TknyRH3dbRMqql/tHX9Usc3HOLR5JTr7MrRW4E2rOKQ:TknudbQFX9c3HONXTPMcn2rOKQ

Score

10^/10

defense_evasion discovery evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0"	SystemPropertiesComputerName.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SystemPropertiesComputerName.exe

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
6360	AnyDesk.exe
6652	AnyDesk.exe
3220	AnyDesk.exe
4904	AnyDesk.exe

Loads dropped DLL 2 IoCs

pid	Process
3220	AnyDesk.exe
6652	AnyDesk.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	AnyDesk.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\rescache\_merged\425634766\999040353.pri	LogonUI.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\AnyDesk.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AnyDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AnyDesk.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133767594254661307"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "179"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 611062.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\AnyDesk.exe:Zone.Identifier	msedge.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 5 IoCs

pid	Process
2164	WINWORD.EXE
2164	WINWORD.EXE
3220	AnyDesk.exe
2556	WINWORD.EXE
2556	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2844	chrome.exe
2844	chrome.exe
4164	msedge.exe
4164	msedge.exe
1544	msedge.exe
1544	msedge.exe
5744	msedge.exe
5744	msedge.exe
6020	identity_helper.exe
6020	identity_helper.exe
6100	msedge.exe
6100	msedge.exe
6652	AnyDesk.exe
6652	AnyDesk.exe
6652	AnyDesk.exe
6652	AnyDesk.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
952	SystemPropertiesComputerName.exe
4904	AnyDesk.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
6548	Process not Found
6644	Process not Found
5432	Process not Found
6012	Process not Found
6360	Process not Found
7064	Process not Found
7108	Process not Found
7032	Process not Found
2224	Process not Found
6224	Process not Found
6212	Process not Found
6184	Process not Found
6120	Process not Found
3564	Process not Found
6032	Process not Found
6992	Process not Found
6468	Process not Found
5804	Process not Found
7100	Process not Found
5288	Process not Found
2164	Process not Found
3776	Process not Found
3504	Process not Found
2604	Process not Found
2264	Process not Found
5140	Process not Found
5864	Process not Found
6828	Process not Found
4088	Process not Found
6508	Process not Found
5780	Process not Found
3944	Process not Found
6340	Process not Found
6964	Process not Found
6684	Process not Found
5620	Process not Found
5728	Process not Found
5348	Process not Found
5696	Process not Found
6472	Process not Found
6256	Process not Found
5144	Process not Found
3512	Process not Found
2588	Process not Found
1268	Process not Found
1368	Process not Found
2076	Process not Found
3500	Process not Found
4588	Process not Found
5396	Process not Found
4684	Process not Found
4608	Process not Found
1876	Process not Found
2348	Process not Found
7068	Process not Found
1520	Process not Found
4132	Process not Found
4268	Process not Found
3200	Process not Found
5828	Process not Found
7044	Process not Found
7000	Process not Found
6536	Process not Found
5652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
3220	AnyDesk.exe
3220	AnyDesk.exe
3220	AnyDesk.exe
3220	AnyDesk.exe
3220	AnyDesk.exe
3220	AnyDesk.exe
3220	AnyDesk.exe
3220	AnyDesk.exe
3220	AnyDesk.exe
3220	AnyDesk.exe

Suspicious use of SetWindowsHookEx 33 IoCs

pid	Process
1744	MiniSearchHost.exe
2164	WINWORD.EXE
2164	WINWORD.EXE
2164	WINWORD.EXE
2164	WINWORD.EXE
2164	WINWORD.EXE
2164	WINWORD.EXE
2164	WINWORD.EXE
2164	WINWORD.EXE
2164	WINWORD.EXE
2164	WINWORD.EXE
2164	WINWORD.EXE
2164	WINWORD.EXE
2164	WINWORD.EXE
2164	WINWORD.EXE
2164	WINWORD.EXE
2164	WINWORD.EXE
4904	AnyDesk.exe
4904	AnyDesk.exe
2556	WINWORD.EXE
2556	WINWORD.EXE
2556	WINWORD.EXE
2556	WINWORD.EXE
2556	WINWORD.EXE
2556	WINWORD.EXE
2556	WINWORD.EXE
2556	WINWORD.EXE
2716	LogonUI.exe
2556	WINWORD.EXE
2556	WINWORD.EXE
2556	WINWORD.EXE
2556	WINWORD.EXE
2716	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 4668	544	control.exe	98
PID 544 wrote to memory of 4668	544	control.exe	98
PID 4668 wrote to memory of 952	4668	rundll32.exe	99
PID 4668 wrote to memory of 952	4668	rundll32.exe	99
PID 2164 wrote to memory of 2124	2164	WINWORD.EXE	101
PID 2164 wrote to memory of 2124	2164	WINWORD.EXE	101
PID 2844 wrote to memory of 544	2844	chrome.exe	118
PID 2844 wrote to memory of 544	2844	chrome.exe	118
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2352	2844	chrome.exe	119
PID 2844 wrote to memory of 2072	2844	chrome.exe	120
PID 2844 wrote to memory of 2072	2844	chrome.exe	120
PID 2844 wrote to memory of 3164	2844	chrome.exe	121
PID 2844 wrote to memory of 3164	2844	chrome.exe	121
PID 2844 wrote to memory of 3164	2844	chrome.exe	121
PID 2844 wrote to memory of 3164	2844	chrome.exe	121
PID 2844 wrote to memory of 3164	2844	chrome.exe	121
PID 2844 wrote to memory of 3164	2844	chrome.exe	121
PID 2844 wrote to memory of 3164	2844	chrome.exe	121
PID 2844 wrote to memory of 3164	2844	chrome.exe	121
PID 2844 wrote to memory of 3164	2844	chrome.exe	121
PID 2844 wrote to memory of 3164	2844	chrome.exe	121
PID 2844 wrote to memory of 3164	2844	chrome.exe	121
PID 2844 wrote to memory of 3164	2844	chrome.exe	121
PID 2844 wrote to memory of 3164	2844	chrome.exe	121
PID 2844 wrote to memory of 3164	2844	chrome.exe	121
PID 2844 wrote to memory of 3164	2844	chrome.exe	121
PID 2844 wrote to memory of 3164	2844	chrome.exe	121
PID 2844 wrote to memory of 3164	2844	chrome.exe	121
PID 2844 wrote to memory of 3164	2844	chrome.exe	121
PID 2844 wrote to memory of 3164	2844	chrome.exe	121
PID 2844 wrote to memory of 3164	2844	chrome.exe	121
PID 2844 wrote to memory of 3164	2844	chrome.exe	121
PID 2844 wrote to memory of 3164	2844	chrome.exe	121
PID 2844 wrote to memory of 3164	2844	chrome.exe	121
PID 2844 wrote to memory of 3164	2844	chrome.exe	121

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Screenshot 2024-11-22 220626.png"
1⤵
PID:4908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3736

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1744

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\New Microsoft Word Document.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2124

C:\Windows\System32\control.exe
"C:\Windows\System32\control.exe" "C:\Windows\System32\sysdm.cpl",
1⤵
- Suspicious use of WriteProcessMemory
PID:544
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\System32\sysdm.cpl",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Windows\System32\SystemPropertiesComputerName.exe
    "C:\Windows\System32\SystemPropertiesComputerName.exe"
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Suspicious behavior: GetForegroundWindowSpam
    PID:952

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:3216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1192

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4856

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3648

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:5008

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\srchadmin.dll ,
1⤵
PID:596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:4632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffeccc1cc40,0x7ffeccc1cc4c,0x7ffeccc1cc58
  2⤵
  PID:544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1872,i,8218625984106498736,9012305457857193185,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1840 /prefetch:2
  2⤵
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2024,i,8218625984106498736,9012305457857193185,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2012 /prefetch:3
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2252,i,8218625984106498736,9012305457857193185,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2272 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3140,i,8218625984106498736,9012305457857193185,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3180,i,8218625984106498736,9012305457857193185,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3580,i,8218625984106498736,9012305457857193185,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4856,i,8218625984106498736,9012305457857193185,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4668,i,8218625984106498736,9012305457857193185,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4892,i,8218625984106498736,9012305457857193185,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5104,i,8218625984106498736,9012305457857193185,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1036

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffec7fa3cb8,0x7ffec7fa3cc8,0x7ffec7fa3cd8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4404 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:6368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7376 /prefetch:1
  2⤵
  PID:6556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:6804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:6932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7888 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:6100
- C:\Users\Admin\Downloads\AnyDesk.exe
  "C:\Users\Admin\Downloads\AnyDesk.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6360
- - C:\Users\Admin\Downloads\AnyDesk.exe
    "C:\Users\Admin\Downloads\AnyDesk.exe" --local-service
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:6652
  - - C:\Users\Admin\Downloads\AnyDesk.exe
      "C:\Users\Admin\Downloads\AnyDesk.exe" --backend
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:4904
- - C:\Users\Admin\Downloads\AnyDesk.exe
    "C:\Users\Admin\Downloads\AnyDesk.exe" --local-control
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SendNotifyMessage
    PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,892771394828453439,17937011169296006579,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7640 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5368

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004C0
1⤵
PID:3148

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\ConvertFromSkip.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2556

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:6356
- C:\Windows\system32\net.exe
  net user Dog /add
  2⤵
  PID:4608
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user Dog /add
    3⤵
    PID:3664
- C:\Windows\system32\net.exe
  net localgroups Administrators Dog /add
  2⤵
  PID:3740
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroups Administrators Dog /add
    3⤵
    PID:5912
- C:\Windows\system32\net.exe
  net localgroup Administrators Dog /add
  2⤵
  PID:6348
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators Dog /add
    3⤵
    PID:5596

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3988855 /state1:0x41c64e6d
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Privilege Escalation

Account Manipulation

T1098

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
471B

MD5
b4644e8af259cf578fcefda2a469e921

SHA1
1ef1b29c7fc958961577ec1232a2cd7c731eea31

SHA256
a91cc8090b0ab84aefb39e730c62893994c1bfd6edcc025c715ca6f240e71acf

SHA512
f372a8d37249ea7deb0b281898f7fa9956c5a06588b45c33081c7a41ee4998d41b48e309d9f04f7fa234bc64afe19ebc4288184b5d8169a7e7576ad5f27fa6b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
412B

MD5
f4c69aad4ad6c2415290c0b53c362edb

SHA1
1202beb1ae937d84f13ccbaf27aab48aeae2ee9b

SHA256
2e45c85a9170e0d6fd2c4c1cc4bbb0e1b723488b9ff5bb1e24c9b4245812fc04

SHA512
5c75cc9e164d8eba384b8cced4b531271ec98e058e65c051af5bf2890415bfa9a826b1d2f10ae4e6332daf272df0018a517f9c2191f2b4a02a102399df227cdd

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1e810203-3f80-48af-b4eb-2725d7c9b93e.tmp

Filesize
234KB

MD5
3f5f3f6c91dd6fb788172619e0708fec

SHA1
17826b0e9a7c93a9a9d9c0dc8625d207aa019083

SHA256
12bf3b1b9383dd0dbf03849004ccd5cc5dbc6437f35c68aabe0e210f62e7ef60

SHA512
3ba729a397e64cac3a1e11ddff88b8fee44ef60cf940cdd0a281ed95766e80dba451a1ca2bc63c9c74bdce345924a6c96d85c14e30843071ed76679b95e7bfd1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\844ae469-2685-47a7-b1a1-5833e8563b85.tmp

Filesize
9KB

MD5
eb19d8d1b3578c3408122def68a404b4

SHA1
48f3517654c06916766cba60b3526f7d33557bcd

SHA256
1782dfb1019a3de70e8869ab75767ff342089ee5cf9d2506f7a29c2810841b2c

SHA512
1cbc0f35d1f43c857a71ab2314f637c3e75429b74447332cd88442701493917b1797d2e30f0e004b341e2c1543fffcfb581e0bd32a49c2bfad67b3c8d3c045ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
f8b5bb2785d3b61636a2c95fa7a52959

SHA1
287cfc8c31e69038f2eec5186ca3414cd2046c14

SHA256
ce925f7fc53d52e382704db219dff01fbd1ee33cb3df0632db24c398fddc23a8

SHA512
0fe1d6261556bbda9201c265bb1b3d8f9a9202427f354aafd2b44de4f4dae6f4ee23bf9a4f856205a65a74d9ce37be2d6bda4bff18f530b02e743f2f64f05fbd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
215KB

MD5
e579aca9a74ae76669750d8879e16bf3

SHA1
0b8f462b46ec2b2dbaa728bea79d611411bae752

SHA256
6e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf

SHA512
df22f1dff74631bc14433499d1f61609de71e425410067fd08ec193d100b70d98672228906081c309a06bcba03c097ace885240a3ce71e0da4fdb8a022fc9640

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
6432069ea1ac6d8ab1944aeeaa9f7a88

SHA1
cc7f40180f5be82009d943477a1d07811f0eb4b1

SHA256
1e2bf7ae644f9294d8e45418734386911be53544777d2e3b0f9342ffa5bfd0f0

SHA512
56926865444c038664240e87847ccbe4731a283b01e58426f16c8ce9f58e314ed886d58fd0a4523a8f98607f5e385eb0cf443c3f83c62513f08bee0b81d7980c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
52a71ecb943ed9326c977927db7d288f

SHA1
9719bdae9413bf5df6096ff8f8e504c79ec0e4bf

SHA256
b1b8ea3644a2fdaec4feb237cb56de88fbebbb312a562bb1852a8ed4b7f66e71

SHA512
e51d88a1f68161abb27b4cec72d6503f9305c475e7a1fba37b1506486bedcba996276634cfd562f192534dbd6032f9647a63a28596f20dc348774d883b98dec8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
0ede35cfe08b21eee61db2452368e0f4

SHA1
8bb653aee6ac39c3985a6aa96f5032f9067fce61

SHA256
d1ce7855296fdb8b84f577040fe2e2c1587c0753ee81dc33f591ac2ef46ec849

SHA512
d8bcf50692cc872403cc9c7a24a5ebf333cf6d21a6739360ab319cc831469d02fe112f21b53eefe5fcbcd92da2c940fb1d2aca8f11ea0537c8ec6a285c8bbde8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
3b36dceb162ea49c373a493680d0d88d

SHA1
a9da53ce1c5f19e865d90040a9624eb655121cf6

SHA256
8b44166c1b2458cb965d27ac64e039b98dd47739684b0411f7553389f55b38c1

SHA512
2fd5d8bb06abf9d5672ba0dc45a4910ecc2c88bbd253b5857470d186ef4ce20ddc1c6148a50b24c3ae34bb417e3b64b117ba238aafefcf0ef322690e2123d443

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
add1a192bb61a53f4b4127434d9bbcea

SHA1
a0ec02a14dcd256fc0fc4974316d76e08c6b8cfb

SHA256
b4a473c4c8b645a54bccbfa82b0dc76f160d3009b572682fdbbdf486f5c757f9

SHA512
58bc21073afb69489bd745ad7b5f9b323238176c1dda0aba8d90861d3c276e0a0135ac3a71e033ddf4c9a4ee2940f311596a73df08f5d9389a043fa8a3e3483a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
a9707da5b538146268840d5509dd26ea

SHA1
c2a26c7aca191aab7ab58ab237c715c3c310efe1

SHA256
f3dac7d161b04880cafa5003b9d858297b6321eb63526fa05ad5f47bbbb4d605

SHA512
813fc87db497f24aecb0a92008163eace14349cc84bc2ff5ee410788e42f52fdff42e2cdc1180fb9797be52e62076e8e43f0367a2fff0ebf5871470cd3fa931b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
4c6001e0e9ddf03be0fe1a24dc875d79

SHA1
d2f2a2e39632843838416cf24dfd465533a4c981

SHA256
1dec68fcb8a579ced7c64d7ca69256e0cdfa9310e6178c949a92ffacdeee139d

SHA512
5b801a0f554d66892f32c971d5a9c7d971ba6b2ac9a561a7b4211af17926919d9fa670f9b8d35fdb1d266d1183d78fe1ba2c95f6a42e16ccf8135d4041a3ffee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d8e7d7dd3b853c4936f19bd7e1b3e0a6

SHA1
7a8a00610bcb4866885d1346e90097f493ff259d

SHA256
c3be11a9aa2697202effb11c5ec6536b6dbac243e634e8ffbe670009c9dc7321

SHA512
e6ee1438cd013bb6a7a053f454663089dabeb6ce1fe91e623ab03ce6534cfee26b7770d7c78749ca87455df7eea43575ecbe8b6f4aaf44f58ee1a46b18f84558

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
efba6d16e178f1292f8a4bbe06807e3c

SHA1
cb4709c365ed5ed304ee16c4a8a7f32416c9ec4f

SHA256
bee5f532caed8feb0b239f525b9129a9bdc231f18c3e5fe7803bf2948430d30d

SHA512
3ea426f95f2a8816941328871b8bc366d7d424aafe762219a8590ab0f966a351a0e05bd4acc034f8ae0a0fc373c7e3f29301c7634bf8bed30a1a9c2c5843ffce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
cc2b2cc0d21002223d09d28124d97e49

SHA1
dde583f1aa5e871db643e0d22655dca50a4ef678

SHA256
da6391bdc25f1741350a6af06305602daf95477d3a0d729acde306d24a58c178

SHA512
5bd61803681dafad99a064d392d078d04ed8cd66aeae025ff3917ea0c29a2dfe1982bbcba15b3a9212adc167ebc24da7dd59f0b93387dd8b2b380104a5ce7ffa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
5a5a2515ecdefff678ea58d7533996ce

SHA1
285949b4f9786f3f725ce62a7db3e05af486a971

SHA256
df61fdd6c19326bf17cf490e4d5501d1055608e1debb2321185ba5927123e59e

SHA512
1a1e0e625d1acef0ec7ab24df3a7ffa247f6f629c85f41d6e6cf851271992a71f724a601814a449fd76316e32990ec35da980ae03cbc4a96e11029e4938efbdf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8b413330666e1023b66cc2bc83662021

SHA1
78869fdd762020c7a55da08404543131c74af6f1

SHA256
0ad6501dac20b59ac64ad6f6c9f1e524c0bf1f8b9c9fd5a388ad35dbb16e4713

SHA512
202078fc8741740538237990dcfac58b82be1a5a10e64dae9f6665264e09de58a06b6a85f2028aca24d9f88801e4663caa0e9e87c58e41379924de3cd850be9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a83e9c58af976b4461329b4bc463f3f6

SHA1
9bb003942abb4e8d3fd731609595ebad74c9aa14

SHA256
2b558c713657398dc442691129c43be9b6f36582ab49537ee3c047d2e9d4f445

SHA512
d8d878631809d8d365ea6d8175832160289bd0999ccb2b9e8263fbb23805c14069dfd20b636d903ebb1f616843df432a63996214e0bd7ea703c2f190d2e279c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
cbf0b4f095a020d71dc1f2513dacd893

SHA1
ed1203bc520e03cf80cb77ea4d24f75365d384c5

SHA256
e975f67d95a7dc2be7c3b78dd5c8c6988d1d1e5ce093b4580599416c7149548c

SHA512
14f8d60218b74e0243bfd2c3790f0b8763150e7782e5877d0b41e57aa81b4ae744aee1a2774e69f5381a3e79cf85906f234fbdefa8087705549ec2f582cc1ec3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
bf2edd21d3b41ef99fd6564f9f18d11e

SHA1
3f968f6f75834e51dcecfa633b1f3b687fecab37

SHA256
52e1ee1769e4f339f7dab8d67890d065690b25acfa2ec99b97de380cb30648fb

SHA512
40b674058f9f59981e713fc7fff81a11c1fcfdd5e8a92e9b9cf0909f973b4d87b8e949a87f95ebbff1fc64a8354861c80485c4f314100cdcaa99ad7440101fe9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0d17c896eaccf8f271168441e99120ed

SHA1
ec8bb2fc2e0182cd3c2fad3b37648af4f2d83a77

SHA256
8773e36b0d425937b86f4578a0cc02a57051fdf62c51015dc46e2889579db9f9

SHA512
1b90c551079cad98781a3e66256999e769c41f859dd0bdc987026fb1ce84ba757c503c0f73cf8105478c0d65f8f35c9f9d0ded900dd9391f477ec759be99d942

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ac6c409654efeca0fc97bea3c8bb1c2f

SHA1
7ff3e1e7c836e948cfb66b85b6282e8a9d091b4d

SHA256
d63dd747831e936dd823f122f3653bf60c6538ef20e95f5e69cc433df3470833

SHA512
9243d3d7fccd20bc3c8f2a4583a59b6426e15bb3741523292b8360ece43de9013c43a592bca72b4a4f749cb529c1bb9db145b78a3103faf03fa297e0d1cf6936

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
fac6ca5bd32065540f02c53d6b6064ea

SHA1
de297d87b122a1c58e49d67559e1765b85958c7e

SHA256
da2eb2113a8e4cc7ce0331eae596f472e9db354a208cfcaebb3caccb13bd9692

SHA512
54a55ef6974071dff665ca6ccb49e101624d5fa5f0ff8e307f2a65eb70dd7fea0fea8aed4e6d7327a6f5e2adbe6a2ae736511550c5ed4e69757bef6fa008e4c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
20351a772acdfc1b30d45cf2fd1cec80

SHA1
a1869f13c7976b9d25265316015785c6afa9f2d0

SHA256
8a9e025d3295c09b25caef6dc5d69f400a9972ee508fa853bf4c28111fbb6be3

SHA512
5bee636b31e2f46c6c1083ff564c1f4640090758477616bd99fbdd34edfd5f6b191497a52f837859b7a7af6d031a9cf7af3edb96d9fc2c6bb29bcc15b68d9127

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
9e85529d7b0b05730137abe21245c0e0

SHA1
1ea67b514c6e3d4c3d7ad6f779ec248742abea76

SHA256
d5070b2ffdc49aab21459a6e6ee4a8d2cecfdb28e1b06eaf1f09f044ded8a8d5

SHA512
2ed7e82c8f06e595b2d12935b1deae3e9fac3809e512bad6ed0670941d605678bb5873f6ccd52d5f98d14c7f0ede37ab3e528607b162ba7e7c34355e43d7ade3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
b88bdc1e49c75f8f5920adb0594882b9

SHA1
b509376e925943c5511a0b1e1deb0571963cb93f

SHA256
2867039036df0b3653b3582af12fcdbf4530b745d1b2c734940097a54c7d023a

SHA512
882d27895dee5ce9e3e827dfcc2b08c4565c7d529ff4b5e87d59720115d2d1b8060af8da68a37880f0a0ab53178f4563886bcb760b70114de5028dc6cdc46c6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
02a4b762e84a74f9ee8a7d8ddd34fedb

SHA1
4a870e3bd7fd56235062789d780610f95e3b8785

SHA256
366e497233268d7cdf699242e4b2c7ecc1999d0a84e12744f5af2b638e9d86da

SHA512
19028c45f2e05a0cb32865a2554513c1536bf9da63512ff4e964c94a3e171f373493c7787d2d2a6df8012648bbefab63a9de924f119c50c39c727cf81bdc659f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
826c7cac03e3ae47bfe2a7e50281605e

SHA1
100fbea3e078edec43db48c3312fbbf83f11fca0

SHA256
239b1d7cc6f76e1d1832b0587664f114f38a21539cb8548e25626ed5053ea2ab

SHA512
a82f3c817a6460fd8907a4ac6ab37c2129fb5466707edcfb565c255680d7f7212a5669fe2a42976150f16e4e549ea8310078f22ed35514ee1b7b45b46d8cc96e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000068

Filesize
41KB

MD5
e319c7af7370ac080fbc66374603ed3a

SHA1
4f0cd3c48c2e82a167384d967c210bdacc6904f9

SHA256
5ad4c276af3ac5349ee9280f8a8144a30d33217542e065864c8b424a08365132

SHA512
4681a68a428e15d09010e2b2edba61e22808da1b77856f3ff842ebd022a1b801dfbb7cbb2eb8c1b6c39ae397d20892a3b7af054650f2899d0d16fc12d3d1a011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006a

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e6a6a3dea80504b4f6f2c4805a73fd5a

SHA1
fe4cb399836d9636feb2191b8d2870188aa1283b

SHA256
ef70907f04497311d57dd53db419ec10fa58bf41e7b0dde32fdc62b6f2b6623a

SHA512
917c93b94d94607cf068ae7408761509833f992569cd05487617fc7526732d03c353f09ff8446637ebf88829daa6d9ffbb6666b028dc489aba8bc5f54b0e9f76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
88cf18f69dfb450c1fb8e6ff1fc93b1a

SHA1
4fc274011f0ca98911036194a7dcc2d8866c9c20

SHA256
0b05c0f9a2e058ab8febaf9e86ff9d2fd0f7d2d1520b576b8253921e5095e8aa

SHA512
a08d6ac125b4695324b657e0c3dbe3b66a4c87a981f9815b90e05d9dd458fa539f8b367814dd6d65cc77d543aa282ce728e10e22506a815e766031c737fde0a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
7369ef4816419244ad594f32d8385052

SHA1
ad0f8e5c1510a6f4f76efe5d1cc55ccbe6a35516

SHA256
f0dce5fef0f6026de134d9d097845f6d5539caaf9753b84cd8ccf9ca9368ff8d

SHA512
322528a19621b55f18fcdeaf08158f8e5cc60401b512a20d576ff6636cd1bfcb8ce526a43cf4d5c0a30da41590407ea6d38d2181c2a7eec315adb870db994498

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
37596ecc42dbf5179fdb565fb2361a31

SHA1
781940bde4584de0f2c56719db7e7b816f1df7b4

SHA256
1595ba230a38017f65b54de829143a07e656315d9761fd2f35670db62a0d397b

SHA512
e432d215a925b227b25d90b35eaf57abc54f1b7cc79fe49fd2927b98ed43b096b6149b3f790e72cd2f8b8f11a9942600cc7c6727396900bd4955f0033acf18fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f2a88b4fcac0ae0640d3ba7bce90ff24

SHA1
7487740080666e626687c38a86fdb33a77cd4261

SHA256
c249b20457d1b1d89e89a4f45c352ff8bfbf4b525395decb49feb8016d5e7a78

SHA512
8c83cc48d89003c417796c28d887709474e43c432b8ce977005da0b1fb94b0fae3512d7489af3d0598dc83f6aced5fbff8e9b83907bd9eeb8ac58f659748c2b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
1aeff0db1b5c959ba6e2d94c274be659

SHA1
516f1802f30a9fd0959b9e3e9c6024c70c14118e

SHA256
b8a153718565822b23d1c9aa89bcf58bd5c05df3c4d572f039553aba8c61f9cf

SHA512
5e476c21188039f68c2c5b773da6bd5c033d4847f3fbd9513da2691e317b5835d9f09eafba70206bfa4241d0ede1ccfb0d0d123e03722ba2e9faab5546c7c2ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
34bc91f2fca320a0dd8caa8556ac6782

SHA1
7a5470463d4e28490e85a3d2ec40d5b7928d8d84

SHA256
129578065c810901b9ec5dd12116f616f2e53c168bb38e3acb587793fd1172e3

SHA512
e6443185c2243669fba4dd405b690768ae283db0be81cad16800185f72ff0ea727d59328e2e601b8fce610294d9b453899d03e70765a881437a5e23d69f445e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\ae689a2144e9e24bc49282f4757ca91c0bf7f5f1\index.txt

Filesize
79B

MD5
0adf8cc746a070732539068adb025194

SHA1
397ce775b0513d0b1f816d72ad4e68091abc1105

SHA256
71b26e77a281302ac5ff843c5696ab16c959ff7f18a4b2ad4da8057370fcf6e2

SHA512
f2073276247f3421dff4edc1d6e0ce5a1bcafa450c783094c1baf364734cd619e4122c34e161a17acd462f264ab373d1196e85256aeaa9bc49ce0bb2c4fb19e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\ae689a2144e9e24bc49282f4757ca91c0bf7f5f1\index.txt~RFe5cc3e4.TMP

Filesize
86B

MD5
fe7181adfc4a4fa1492e2bab883c7a9d

SHA1
732ae39e6124c5a3d7cd3e82f942595de89bd885

SHA256
cd2286defbe98a50004f522bae355ab7f07cd778abcfd262a29c234eb5b78be5

SHA512
d825a13cbe0c2017cdc79fba79d885ae19cce792b09c5bc2a704c24dd1c6fcc199efa46e3a2c2a335f5c79568a8824bee689d855b5c17ed24d4e2117ae129aa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
fa15d8f9e1edf5ad117a2216a10d142c

SHA1
edc0960dd7cd998299908116d84e763c65c40b58

SHA256
f21b04a3fc2b15401103e933aaefd5a7e6d2442b37ca180b220bcf26d820aa8e

SHA512
7e59e46f0d0ddc9d99dac643de21376fd14717f0a861db2df5f76f1bee7137c5ea73f926ae656b7a1c9be65dcb4b8c2e3183d35f2e9d096edb755717946fb97f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5cc0c7.TMP

Filesize
48B

MD5
df164b06016cde3d07df2ab963a52113

SHA1
009cf05e4fd48f5a35b5a476ef38d0196212eba0

SHA256
543e7c914ceac4ded0ba48d6d7c0243bee8a401aa02add0a2bb622042e0d8b09

SHA512
ae4daad5459bc5d54f7a96c5e736d9e3164d6819d7c2bb612aca73548660117a7ececc51fccb01d11c1e4b9cfada8079d4f26a0171aabd1164dcc11da7bd3380

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
cc304d5abe70928c1aa72fa258448174

SHA1
81526cac3adf0cdf354765b807a4f56130ef8f95

SHA256
4efc1604028c09b127cd463bedf54ae42d79cdfb3d21a6b62cec0475b713a570

SHA512
44030004da90aa554cb4222f4165b170140eaf9b8da82652e9ddb5ef397fabcb47d17e10463c2cb87db4b2a13acc1a1517cc29a39b36b42420d501c921e05df4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
68add6e17d510098a19b22aea2452e6b

SHA1
b8c45a80084601be0d6d322de4bd81b697720583

SHA256
2410718c0c407f0a5922c626b60961f5abc570a5adf74b1f28a292bbd0ea192d

SHA512
98a25a10cdc08a9fd6960b2ad72156dc6680db95cc1a1a1800f0b091697be8e8bf47fbcb8c92a28fc078719878a663b8dae77ab69b2360a7010f539e07af01f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
3bc39aa8b4dc26cf75e4b8e9c368c609

SHA1
d9990254ae888b98e2cd49b957842cf88dec079e

SHA256
6a414d7ab44bb1af21ed816d08899c636c31d8bc840fc84b43d3006005e48ebb

SHA512
52aed40de9f68685991fa1806d7e861c31c3b675cfed34ee89564975369d1d7b903715a26bf65b0a61f1c1e3389eb10f3aff704f3eae046a60adcb453014257f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
99fd8d410ba85d252a325540905cd71e

SHA1
8ba648095817cdab1efca81ee635d7fc23c2f58f

SHA256
578b6565b75c5c273c268cac733c82d020d7d5264e09b66f61cbd4b2a0051199

SHA512
f218236a0655cfb226f457ca3f2294de00ed3ee413f405edb190ac57d73cb1ff40e751756704635cda0a06dbdca041e025c4ed47a3c13e9838961e94c18b188b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
cab309396ee6212712a0e8e75078d700

SHA1
b62d4be5de3b598915252a068f187738e2d193c7

SHA256
d7a37f166befd189d085dea8381e293edbb8d6e94c6273f7483666211abc036a

SHA512
07de6a3a2731f6738991e12009c3eb94f0bbf73ac144f0096142ed44188313ebe70628bac08221c45c63affaf705464ddf00a575f523380b99900f56f97030f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
b90479e4d297ae9156c7c48f6169e17a

SHA1
f04fdb26b2c226fe77d651e44a2a5209ac496be4

SHA256
253342af8c0b1b0436a7474f19acd955b2abb67f0478f04942cb10f9fb52d21d

SHA512
4525c6269f97460b8521ab77427db66a5029bb9be298440680e719340aabb49bc5b3d101522b26bbddc7f8a74799cedd333990763519d0e8983d0e5b0ea30559

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
9e9697a612cc5d080ff2446b61750e5e

SHA1
5dba730c2a91675127f3afb0fd416953aae51cee

SHA256
ad049bcbc8de5cfb8ae7b01150a05ce7152c60c5b404b3f03e1f0f33c1bfc6ce

SHA512
2cb494eef926b062e140acde2d023e89d183d7fb68385177890fe7590395f693f036176146224d0506d676231f110a936c1f68bf00849dfb90bc9522ab85d68b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5c9ad0.TMP

Filesize
2KB

MD5
a97a18e6703ce929a80ba02e9dbcd1d4

SHA1
5f7b96fda152ed70231cef3284a6ef9a0336a983

SHA256
f6183d3af92aaae390ef0d7f669a3cc701933941d2a7140e083e29cc33c27a6c

SHA512
21b210db8cfe05167ccf66963efbd721f5fa5880cf23e43ca99ed93da6f3b8b025ff551700549516f1f561b1c8b414fa931b91f3856052a1e3f181ed70d36cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
de514dab2c20c8d582fd132be5251337

SHA1
5d98b537ac3327e38dc7f18ac66f6badfa1b270e

SHA256
9b651eee953c3309a8a37a3d276225c38c13509bb92d258c6dac28dde62da9dd

SHA512
deeaf83707ac3c80b598e2e3411ea752b1ffa3a406804d217a95ffc6ffb6c6eda22402571c8b2b40e51bfbb03830ca4c102d0510c7cc10456398c2b13cd348b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
30393576f0e8d6587559f14e91318eab

SHA1
d086b7a5374f121ec8552c3427e097828c631026

SHA256
f12487b9b36797ddbd1007f73fe9ec72090dbba218486717f38a1a7ca0452bdb

SHA512
99c38e093e2b181dfb3e4a14bdf1ca8a356730d54e8a31673539b31100a159653a0f6d1a9ee5c9d153ee3e7c7e44da3e7a88b4a554371e0b7f787639c212001a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0f40ff084d5ceb94614638d11a608961

SHA1
ae8195f5f70e4bf7b09db5ee1db39a4876b513d2

SHA256
2f37ddb544e82d0815adcff11ed785642ebfd7edb4aefb121385bec18f3da6df

SHA512
9cc97bf6084002e7b5e14ad6cc3c1e124c7ce4bfe1dbec0f78f2f8b2df2c4b98e73374ec17cce401222539164207b45ee985ca2a3b4d217b7724a7c6d32f035c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db

Filesize
24B

MD5
419a089e66b9e18ada06c459b000cb4d

SHA1
ed2108a58ba73ac18c3d2bf0d8c1890c2632b05a

SHA256
c48e42e9ab4e25b92c43a7b0416d463b9ff7c69541e4623a39513bc98085f424

SHA512
bbd57bea7159748e1b13b3e459e2c8691a46bdc9323afdb9dbf9d8f09511750d46a1d98c717c7adca07d79edc859e925476dd03231507f37f45775c0a79a593c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
7KB

MD5
1d61103a7b42a4b914d84b8e0696b4ae

SHA1
08c15c74d10d1671c9a67776c16fe755c8532aab

SHA256
61d6fc92203178438ce4eb05f34e0e1718153f23fab711ee25380d209fb1dd0c

SHA512
6c9f6375e3d5af29dde5496a7833486c0ad11439d5d61295f7ee06e5b22304c55330946793954dc2af04a7332d5e85e2423eaece60c9c446701c5ca712d73afb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRD0000.docx

Filesize
11KB

MD5
4f1eb8d2838a4459a15f1d2b851647b1

SHA1
b34b8cafd0174d82545dc96177edbd2d373dbc4b

SHA256
98299ff87b15716c523acb7d2dcc0fa9bb662ba34ac02ae0a19c23c82596c93d

SHA512
2ae9c308a100848b6406610a50dffc736ade4b774562570951ab33e2d4ec9b1deee38266502ccf7d92d5d92837c23c0fb1f82d6d6c5e211b3c44463bdc169f3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRD0002.docx

Filesize
11KB

MD5
6b8c3466e44564f2e4fa96a720ffa6de

SHA1
7d3bdfbe8fe2dac85eeee4487f9997c157edcdc4

SHA256
06750a710ef04858630eeaf61702e2c8802ef859c44fce5c5b914595ef10a25a

SHA512
4455018e3c7b017a61a9c14b92f30a2f566ec5af21f8af0df690cb8c5c36170db86bbe59837fa899b747b57fa348b4ca50b82d4af5f91c9a34d766a98f2805f5

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
71a6b59e08e25451e52675c842fae23c

SHA1
565a97673954a9209c7a05fba20b89d10b88025f

SHA256
5b96212d3d1347b76c8c1c64b2f7ef981242bedd3b84b766b543d56dbbf8dbd6

SHA512
5cc98eb2aa02e2e69165170451d89dd880893e6b07440bb84fbab6cf92cb558bd58c2235d8d64ff43d380c5e9869827800d310ee67950bb21b498d89fbb5aab3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCDB5CF.tmp\sist02.xsl

Filesize
245KB

MD5
f883b260a8d67082ea895c14bf56dd56

SHA1
7954565c1f243d46ad3b1e2f1baf3281451fc14b

SHA256
ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

SHA512
d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
9KB

MD5
7acbb44520f1b966335a991f424b44a4

SHA1
8a71aaa7d3a845e67e0b3fb6ecfe6c74bdaa8582

SHA256
a4bdb4b95b75538547e0706da5d6c9f63a7f51c26152f22d291df914502ccbfb

SHA512
361c03909a4cc48ac00b71e963e704dcf1bc455d58d8135f4333549bfdfcfab79b154e22c2184634fd0895234273c9d258946ebd86973c80428035a286648011

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
9KB

MD5
c595af7f92db224e5329cee955291f69

SHA1
d6128edaf1f9a1dfea46e72f8430c44745da8ba6

SHA256
7386a6b550d57eb3f67a45fbd5108dc4b9eafb62dd26e9b37647c134d3c7de73

SHA512
c4eb5a8ea314eea21611afd9e41e5e80a7fdfbe5108d4463aebd47f8319d9c984000715fb1b6c6b36cacc68063aaa73e3340e8675b92d859e19468f0a519f8a2

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
821fbf01a448fe8e1419e0b501f401d1

SHA1
b76fb47b25b141f366ce664ea20c3cd5aa88d0a8

SHA256
5720eaa170772def28a1689c4511b4a7093b75967b23651b5c90f85922145e35

SHA512
0267aae39f1413abf134639cf346373dcf451257628361e9f3b829ae7916d32308980f3b7b5ffddddf5c8eca361bc845d1d3f337404d9b491f03694c13adbba9

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
312B

MD5
0c04ad1083dc5c7c45e3ee2cd344ae38

SHA1
f1cf190f8ca93000e56d49732e9e827e2554c46f

SHA256
6452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0

SHA512
6c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
468B

MD5
60c854d900ee93a4ac04e87d67c9191e

SHA1
d8b4594d77088a3a1b02aab2afd24576c499b9e8

SHA256
032a4603ce06ce9065c22d88f6f59b2f4fb7b5d81125c7ab501bace9286d9c35

SHA512
bcf02673225028ad069932bcdff3757729504286b2a8959cfa9491ad2facde2341eb3d99a8fc78ca3eb979b96b6df93262d9e722f7c1862ccca74dee7411d190

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
468B

MD5
fe55eba4dc49bfb9095dde6e9c136344

SHA1
d897b113063f91155cc13e8d5203efc6192a476c

SHA256
97b2fa9532b4a663487b8983cc84e12bb051e61e238be93d6462d1663eec1272

SHA512
a2b3b4333235021f64c70d868ee4a7558fac5a2d7e7fa58d00f74306176cf19b50ddede9db67b5782a27a07c5902a9094d3677913b289a790a5fbb6b630a51a7

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
745B

MD5
2af6b4575d457090e409fc039db4b43f

SHA1
d2bc4b8f11e95683708168c233cddf0ac41a429a

SHA256
84d3429dbf3c15c49240997d775cb7ca6430ca3deac191b20117efc3220eb7af

SHA512
c4078e2a6fed3f5278233a1f47fbcbb844a5fd348b098f749cf837a615b70908b25560705d4bb595e7fd8ff29de89efaaf21bbf3cdf8c6a6751e52bbb9f06a8e

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
766B

MD5
d218b606d3a1c7b13b2134a6d26c69c6

SHA1
a7d16f1dbbcbc8059e592493dafa5a6cf7510647

SHA256
37fcff2ef73ef3133a6acf0dd801d407cfb479a5b3b1e619dd9b6c31024e67f2

SHA512
8a66e52f2430c52a59f6d9000e1ac383f6a274bb2fec1a41cb51cc029de0c7c2fe50976ee32b435c1bc714bf675c5917ac695539a069004ca056e09acc0d4477

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
823B

MD5
1bd24450c8283a6108e0d5e414c606a6

SHA1
e8bec1bda9d392e1982781f196ab774dd17e1070

SHA256
4c164032c90be6671adc6fa7103011c0dcefda4d1a37765f4e8d891924c87aae

SHA512
70a9e559188db2a4f4fe0a0b6906442b70d7371097fac4e8c93826e4fad597fb8bdee5ffb39c4cc444fcf8d9c5134e135df93bff099312944849f80192a0683c

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
831B

MD5
58de07741f35884f55ed289039c05f49

SHA1
85dfb8c4bf8695ad296ed17a3c3ef111d03766f3

SHA256
15b1fc18b2e33a78b68c6be60e35120bd4333f91666dbc8f221d05296d90ceb3

SHA512
93520bb90051c0902c018a7ef82eca348f601cb3fda371973752a02a146e3741280bdbd3d10a7585b745b292d58c0c3466065eb3bbc1ecc35893f32994b5e336

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
7a5f4b4a60c44624381ae755daa489f6

SHA1
70e2ccfc51ada6673b7d443c7f7e2589b5bfb743

SHA256
73b4eebe2720932cb752a15a932df5427bf2ba51f91d617bae152b498262a7f7

SHA512
5c4b7ff1c8ac43903213a509535218fc4162d76be21665a973edd87cdc44d93115086c2e08bdcd3661566bee53dfc69cfcab075ed476cbc4e83f7b868b1a5a92

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
dbb45f6c513d45d6258a388e6820ca33

SHA1
5e9692ebb969b4a1eaa10301a9cb96a9ed8d378d

SHA256
6d7d64fa2e1f1d50d92e7eef0413c735555efad0e13d6940ea08b952166ca223

SHA512
1aca593913795895919f13024abbb927ac7a074f44545ce2c050acd1024d1bc85023781ad234e67bd23ccc4d2585d214dfeb09776f17fc17c1be9f16cea6bd1c

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
ae6817e5a77f25ea4b43a18281e08fb5

SHA1
13dd3b4cf8a18dbb21b25c58d569117173fae78b

SHA256
6fd56506aa70d33815d16b94bfe83a2c4729b102d73d5c6bc0ae4078320181eb

SHA512
d099715d040172db54f11501b8d1b477cdcf5203cadf587f7089747e626e0413c80963b8692ff4806d7cc45c4ec079dbfb6c4ea1443886c1d0c86de1a4467b0c

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
2KB

MD5
d1ca4c4d4740ae300499e94bfb3d0bf4

SHA1
2c4cf9cff8d699aac147bcfa78e88e12449359f4

SHA256
cc022910ea68fe0c096a1911f1f0c2ddec66cf1428c12740f15c96e8a7021fb7

SHA512
72892d7cd51f73c21cc8187176ec1c91be7202998b9ef59f09ac1dab36c8f62eac8a302343f52749f96f079b3119a844431f6be039809c9d75d0e242fe0242c2

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
2KB

MD5
23d65a0ca258341834f5b0a7b32dc3ec

SHA1
e97b2d9135a4d06240d4c2715224740f7a76ee3e

SHA256
e713e2d7db5cd9ec15c2d02f560b73e51281c68d46d9c655fb4e43c2fc4807ae

SHA512
41042f71edb0cf9bb368d06c3c2795023d6b87b8b3f6adbef88ab96fb7942d09f9dce490fa3ee10f32147b465e167546b6397b352255dc496b16d2bb89c0437f

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
3KB

MD5
7f97c80f45c4e2d759e26a95ba5f9559

SHA1
579b4d77c1514207b1f215853782894dedffccda

SHA256
a3100fd838983a9511749f59e5cc43ee2a8e2e69d10e78218a5a5b70458b667b

SHA512
5487549b846e88cfd6f99a0f7ada3f1132fbef30e83814b000e3d37ed76fceab205d9ae2c78fde597c29459478d1b40e6ed5c12803e8b4fe65bd9c34a1595183

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
7KB

MD5
53a3f077a66fd7db10f697f02eebd2de

SHA1
4bf41f20483dd95d48dd017858ba89a491ff4fb2

SHA256
6659cdc96e64b4fd23925a605a0f6b72d4ccbcf52543119c50d4ea8ca178b4e5

SHA512
c26139d21b46c11cbc51083869ea5bcba6302fecc0d870c3b029187c038ac864b94c6978bc96a90b27027bab33747dff54fc3fc28a486a4ee7bbb1b2ae038311

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
408B

MD5
511f3bf3d4593cd04cad78538889bd7a

SHA1
e0cc34463bd167939beb1a8b5d50e12b4b3578c0

SHA256
fd7b5c0e0002f892f0563b5fdbe752f17f72f14e0b2050b144ccb897ce7510aa

SHA512
0ffa9e6e833c24425ffdf0d0bd18d5f48dda8bbd4d1762323f2a1c37b596c4d0768b5bab808eaa5706ca4773e2c3d5d86c274a6a638ee65d4052ea4cecb492b5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
404B

MD5
bdf0d230075cf6c785be60ca51c1074e

SHA1
c4dc0d66635f42bf19ee27ebb40a9a4080170569

SHA256
116f206ad9ddf6eee9ee7a56ee8f7832e1b4078fd39e30688d166d3dd9285896

SHA512
711576be6e6189440a72c1d7c968ba648af7b11fbc68d34e0e102e1cd32852a07adf3d8c730b5606207c92daffff33969c219400b9884d8404bd9ea57b7d69c9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
3KB

MD5
42efb5d303f7a72c9db0b87152b68f59

SHA1
a924450ad0531166305d66b3362b3732805884a1

SHA256
896c4dc090207f316de35bca454aca203409e4a14694f2385b0670460d8ff153

SHA512
05f0bfe7c997d25820e5de89ca73b60a091022d077b022fb02ef5d69b86956aa3ededfee0b622cb6b2bece5c5dc9fe87d400dda7958e097399a4214dc5ebeaf3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
3KB

MD5
62a5a219ae6af7678517b60904ceec16

SHA1
8c2f3f856d79e1b368a1cc8aa60c24949db56a88

SHA256
78ac63a7a491393be00860e1c82099817dba305cf36a31928ee909d1ea9ccf12

SHA512
c3abf2cee289b7fa3e591177df03a766cf99daed8b559f7c788b87ec98c3b7373563cb2f09699bdd7c0bcafb3bbafcf37c45a0254495a50e2977a0a89b1f48de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
1KB

MD5
436b5f8f7735681de1714438a669cb7b

SHA1
70ab8ebd5bf0a0dcbb0cc7870da93a62402adde5

SHA256
ab02f23319edaef7c6efb0762b433a0c6b84279ddc8554e8e445b7e4834ba1c7

SHA512
a6a7c6d0e2a5903987fa2aab3cf214faf1e849d04efe9a87fec52c96e6a8e0cf94952a138c4a1c99a504c37859fbc1a5334d680a817849e70e4a299148f98f78

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
2KB

MD5
6f587c0af9ef10eed8657ada8f11dc85

SHA1
01fd2104f008128394973972e27397b399f0d022

SHA256
8036e9f04c9f0f94d4789f393ed4d10f3b1ae85b60b53a52d288634ffe33bdd1

SHA512
bdb6b960a98f4d50cbc624f12dce198593ece2211d6a829a96eab5a858c6ceadbd49e414140b97abc5714607fbe474de4d2e38a9072bde07e139781826edc95a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
2KB

MD5
d4c07cb9e276ac86ec14ae85f229c8ae

SHA1
53ce4f441a616237353226cc247b29c113935e8f

SHA256
92699976e8ac16f848d3e3120fc37dd9982932a5fc7c7939777828a77aa973c9

SHA512
b42480d38fb0b365a49e69cdfcbd5c729325befb84939472fdb32d9e87fa6b7f75518d24a79c389ad2927103ff84239061e438f618ecc60f619f399010ea5b47

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
2KB

MD5
870404d780166e7a9c65924aa8ed01fe

SHA1
8fe251ba7760abbfc4f98685fe73ed68daf832d2

SHA256
75e0458d535b08ee11bd5c484820dc2ad4d6073fb8a5450637e95e559d6925ed

SHA512
16c59066388322504f66f8f03a321f004df278f01bb5b915334c57196213900b1cb5f88f8b84219447339a6fca326a0fddf1aae1a075a704dd1cae4492978c2f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Word\AutoRecovery save of New Microsoft Word Document.asd

Filesize
27KB

MD5
8644638bb8feaf25d6031ec1abd037cc

SHA1
0d221db229b6aa66c053d4cae1860bf730fc3784

SHA256
9dffa925ac37a8eeb6d68b3f4ffe587d4380741fca124d677c3d31f84af76afb

SHA512
22ccb4c7f3c7769e63ba109c3bc3ddb85e1e02cdbc69983bb940b75fa9c5899e06bf39350fdb292f322dc2f9e5ddab577b19a37a79db448642f80ef508c900a0

Download Submit
C:\Users\Admin\Downloads\AnyDesk.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 611062.crdownload

Filesize
4.8MB

MD5
ecae8b9c820ce255108f6050c26c37a1

SHA1
42333349841ddcec2b5c073abc0cae651bb03e5f

SHA256
1a70f4eef11fbecb721b9bab1c9ff43a8c4cd7b2cafef08c033c77070c6fe069

SHA512
9dc317682d4a89351e876b47f57e7fd26176f054b7322433c2c02dd074aabf8bfb19e6d1137a4b3ee6cd3463eaf8c0de124385928c561bdfe38440f336035ed4

Download Submit
C:\Users\Admin\Downloads\gcapi.dll

Filesize
64KB

MD5
ecb9969b560eabbf7894b287d110eb4c

SHA1
783ded8c10cc919402a665c0702d6120405cee5d

SHA256
eb8ba080d7b2b98d9c451fbf3a43634491b1fbb563dbbfbc878cbfd728558ea6

SHA512
d86faac12f13fcb9570dff01df0ba910946a33eff1c1b1e48fb4b17b0fb61dded6abf018574ac8f3e36b9cf11ec025b2f56bb04dd00084df243e6d9d32770942

Download Submit
memory/2164-567-0x00007FFEAEE10000-0x00007FFEAEE20000-memory.dmp

Filesize
64KB

Download
memory/2164-13-0x00007FFEAC2E0000-0x00007FFEAC2F0000-memory.dmp

Filesize
64KB

Download
memory/2164-565-0x00007FFEAEE10000-0x00007FFEAEE20000-memory.dmp

Filesize
64KB

Download
memory/2164-12-0x00007FFEAC2E0000-0x00007FFEAC2F0000-memory.dmp

Filesize
64KB

Download
memory/2164-7-0x00007FFEAEE10000-0x00007FFEAEE20000-memory.dmp

Filesize
64KB

Download
memory/2164-566-0x00007FFEAEE10000-0x00007FFEAEE20000-memory.dmp

Filesize
64KB

Download
memory/2164-11-0x00007FFEAEE10000-0x00007FFEAEE20000-memory.dmp

Filesize
64KB

Download
memory/2164-9-0x00007FFEAEE10000-0x00007FFEAEE20000-memory.dmp

Filesize
64KB

Download
memory/2164-8-0x00007FFEAEE10000-0x00007FFEAEE20000-memory.dmp

Filesize
64KB

Download
memory/2164-10-0x00007FFEAEE10000-0x00007FFEAEE20000-memory.dmp

Filesize
64KB

Download
memory/2164-564-0x00007FFEAEE10000-0x00007FFEAEE20000-memory.dmp

Filesize
64KB

Download
memory/2556-1964-0x00007FFEAEE10000-0x00007FFEAEE20000-memory.dmp

Filesize
64KB

Download
memory/2556-1969-0x00007FFEAC2E0000-0x00007FFEAC2F0000-memory.dmp

Filesize
64KB

Download
memory/2556-1968-0x00007FFEAC2E0000-0x00007FFEAC2F0000-memory.dmp

Filesize
64KB

Download
memory/2556-1963-0x00007FFEAEE10000-0x00007FFEAEE20000-memory.dmp

Filesize
64KB

Download
memory/2556-1965-0x00007FFEAEE10000-0x00007FFEAEE20000-memory.dmp

Filesize
64KB

Download
memory/2556-1966-0x00007FFEAEE10000-0x00007FFEAEE20000-memory.dmp

Filesize
64KB

Download
memory/2556-1967-0x00007FFEAEE10000-0x00007FFEAEE20000-memory.dmp

Filesize
64KB

Download
memory/3220-1378-0x0000000000120000-0x00000000015CF000-memory.dmp

Filesize
20.7MB

Download
memory/3220-1742-0x0000000000120000-0x00000000015CF000-memory.dmp

Filesize
20.7MB

Download
memory/4904-1816-0x0000000000120000-0x00000000015CF000-memory.dmp

Filesize
20.7MB

Download
memory/4904-1646-0x0000000000120000-0x00000000015CF000-memory.dmp

Filesize
20.7MB

Download
memory/6360-1813-0x0000000000120000-0x00000000015CF000-memory.dmp

Filesize
20.7MB

Download
memory/6360-1679-0x0000000000120000-0x00000000015CF000-memory.dmp

Filesize
20.7MB

Download
memory/6360-1360-0x0000000000120000-0x00000000015CF000-memory.dmp

Filesize
20.7MB

Download
memory/6652-1814-0x0000000000120000-0x00000000015CF000-memory.dmp

Filesize
20.7MB

Download
memory/6652-1435-0x0000000005860000-0x000000000587B000-memory.dmp

Filesize
108KB

Download
memory/6652-1432-0x0000000005860000-0x000000000587B000-memory.dmp

Filesize
108KB

Download
memory/6652-1436-0x0000000005860000-0x000000000587B000-memory.dmp

Filesize
108KB

Download
memory/6652-1984-0x0000000000120000-0x00000000015CF000-memory.dmp

Filesize
20.7MB

Download
memory/6652-1706-0x0000000000120000-0x00000000015CF000-memory.dmp

Filesize
20.7MB

Download
memory/6652-1376-0x0000000000120000-0x00000000015CF000-memory.dmp

Filesize
20.7MB

Download
memory/6652-1955-0x0000000000120000-0x00000000015CF000-memory.dmp

Filesize
20.7MB

Download
memory/6652-1729-0x0000000000120000-0x00000000015CF000-memory.dmp

Filesize
20.7MB

Download