fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca

Analysis

max time kernel
622s
max time network
624s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
12-12-2024 00:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AnyDesk.exe
Size

5.3MB
MD5

0a269c555e15783351e02629502bf141
SHA1

8fefa361e9b5bce4af0090093f51bcd02892b25d
SHA256

fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca
SHA512

b1784109f01d004f2f618e91695fc4ab9e64989cdedc39941cb1a4e7fed9032e096190269f3baefa590cc98552af5824d0f447a03213e4ae07cf55214758725a
SSDEEP

98304:Uc9HTcGO0ImBimas54Ub5ixTStxZi/l9K0+zLVasSe4JnzMpm+Gq:UcpYGO0IOqs57bUwxG9CVaskJIYE

Score

8^/10

discovery

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CA38CF219C8E9782A8CBBD76643D24E4F2D74B03\Blob = 030000000100000014000000ca38cf219c8e9782a8cbbd76643d24e4f2d74b03040000000100000010000000e4e34304f4315a15a0bc0e413363721e190000000100000010000000c87364a1df5cfaa973f544a5206e8194140000000100000014000000573133394358b8d9f870ed67cd50374f92d3ff710f000000010000002000000092cfeddb8485b879cf9232fde30df21fd200fa56712c8c92908b447e1a1d33af20000000010000007a070000308207763082055ea0030201020210030e330a8ed28347bda3bb478e410d7c300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3234303231323030303030305a170d3235303231323233353935395a307e310b3009060355040613024445311b301906035504080c12426164656e2d57c3bc727474656d626572673112301006035504071309537475747467617274311e301c060355040a1315416e794465736b20536f66747761726520476d6248311e301c06035504031315416e794465736b20536f66747761726520476d624830820222300d06092a864886f70d01010105000382020f003082020a0282020100972d1d652b2ae50cac2c1e499b38c5c561134e6348ecab72337b67dfd1f7bad70054193e2252007751d9ce92967b0454f8a1957870034b465b41f478e60ff6c92c7fd735506ef2b7a81c18acc3729f8ce22cd1caa429bdbe5d5f0ac942344a3ef4bd5fb1048c47ccd25c2c4e315caa2686d3c1c469cd3793f5be068c00b91d7c673741cdaf4a05c1a782e8cc5eee6c09dd927eb31f1eca0c6cab4350196024ab28f5a59f2cbde92850042aaa6798deb5989495ba9224d22b3afe20aa721a379265049ed9d9bc86884dc7c16611e2f784c456d199760ce5d8debd916e68ffcd77c15d71dd1bd4f0ab4aeeafd2e4850c35e6e7109c58dd068e50d5ad9e3d9439e95e007aa2a06222ae6bbebf54f30953f6479fea4d566e4b73ca023ee32cae31f3d59fbeb1f99e218809971def0d1dfd019620c7b251445b6a450137c8831fec87497c7e54533845eb7705a46950a314c78212b079a36dd6353e3b1c1a93b664c2e69f3a1c339dbaaec468c32ac73a48e43daa2d5b66930cfd6ec9ebea031bd3ec04f561ff760bc7d3f713fe9b3e9ec38718750fc452df6ab65548bce5def71ff17c7ed1889165cd03602599f3851b247003f09c896300f23cca788100ce263f66a4ef827e8a718cca76e0d6fcf93e95ce359efc329217f88938b29213a5789bfaa9b471c24b5bc9aab23b68796c185dbbb840b7a074944a6960b134c7b25ed6f50203010001a3820203308201ff301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414573133394358b8d9f870ed67cd50374f92d3ff71303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f435053300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c30819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63727430090603551d1304023000300d06092a864886f70d01010b050003820201009bc3d91cb63175cffbc813b2b5814e77c9940d5e0c2d10fdac84edc784495ddfcb2e4f2719af9843101e70abe1eb54300a715573ccd0433b0dd8ee13efd79eece380f233e18a82ef7b50c2e4f7cf2167e8122a01a8474bd1d3e93c20193f3a45db0afedf99b51460c0e0e8b62b82d56b57e22b9bba3a07696a2799a3fee38dee6a5308d0d429a7c64d59031e0a0e37d91febb3f2fdfa34c9b931d0ba00aa1c9438db280424c8958ef86297c18093c66fb8ac5a2922a97447eb566195def497706a8650fcd7ca6b58ae2cef3315ad47766b35045f419963564448bf06b90094a691de78716c87d58a366bc8e239066e99a81639c03f99c96c68e54aee17af02052b8e8d399499bc03646b44c675f98cba4e86a1130ddbff1d9a78221d5217c95a9fa3587c43d9fda62693aabd448814380e0c7e8a1a32d0a0d3334d33b86eeac1de3828a8b513f8279984e9aeec85544c0d5a3e9c57dfd5641a0598af756de93089c007744baf14b15bb28265ba9aa8088c3753a9c099daa36d8ce4a304e803e8728c5411dcbd182b7ba9caf83499cf3e0ac836a789f8fb26a543e438ac16b3ed277ceb0df5df6e0d0ec8634d8a4b3bbf30a96da5113c10623122820c6b316fcf6fda942642003cc09e658ce6548d55a719e85f6d76b5152c9df8efdd83f090a7ae5acbe7430ae395dcae7b8dd8e859fb7a48c5556a046bd89e2a9c68c9fe2dba	DrvInst.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0057ee48-c97b-6f46-9d70-15459741f3bd}	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	AnyDesk.exe
File created	C:\Windows\System32\DriverStore\Temp\{0057ee48-c97b-6f46-9d70-15459741f3bd}\SETF687.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_c69295146af7a90e\AnyDeskPrintDriverRenderFilter.dll	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	AnyDesk.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0057ee48-c97b-6f46-9d70-15459741f3bd}\SETF666.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_c69295146af7a90e\AnyDeskPrintDriver.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_c69295146af7a90e\AnyDeskPrintDriver-manifest.ini	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_c69295146af7a90e\AnyDeskPrintDriver.gpd	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	AnyDesk.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0057ee48-c97b-6f46-9d70-15459741f3bd}\AnyDeskPrintDriver.gpd	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0057ee48-c97b-6f46-9d70-15459741f3bd}\SETF69A.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0057ee48-c97b-6f46-9d70-15459741f3bd}\SETF689.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_c69295146af7a90e\AnyDeskPrintDriverRenderFilter-PipelineConfig.xml	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	AnyDesk.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0057ee48-c97b-6f46-9d70-15459741f3bd}\SETF677.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0057ee48-c97b-6f46-9d70-15459741f3bd}\AnyDeskPrintDriver-manifest.ini	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	AnyDesk.exe
File created	C:\Windows\System32\DriverStore\Temp\{0057ee48-c97b-6f46-9d70-15459741f3bd}\SETF69A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_c69295146af7a90e\anydeskprintdriver.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	AnyDesk.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0057ee48-c97b-6f46-9d70-15459741f3bd}\AnyDeskPrintDriverRenderFilter.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0057ee48-c97b-6f46-9d70-15459741f3bd}\SETF677.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	AnyDesk.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0057ee48-c97b-6f46-9d70-15459741f3bd}\SETF689.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0057ee48-c97b-6f46-9d70-15459741f3bd}\anydeskprintdriver.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0057ee48-c97b-6f46-9d70-15459741f3bd}\SETF688.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0057ee48-c97b-6f46-9d70-15459741f3bd}\AnyDeskPrintDriverRenderFilter-PipelineConfig.xml	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0057ee48-c97b-6f46-9d70-15459741f3bd}\SETF687.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0057ee48-c97b-6f46-9d70-15459741f3bd}\AnyDeskPrintDriver.cat	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	AnyDesk.exe
File created	C:\Windows\System32\DriverStore\Temp\{0057ee48-c97b-6f46-9d70-15459741f3bd}\SETF666.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0057ee48-c97b-6f46-9d70-15459741f3bd}\SETF688.tmp	DrvInst.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\AnyDesk\AnyDesk.exe	AnyDesk.exe
File opened for modification	C:\Program Files (x86)\AnyDesk\AnyDesk.exe	AnyDesk.exe
File created	C:\Program Files (x86)\AnyDesk\gcapi.dll	AnyDesk.exe
File opened for modification	C:\Program Files (x86)\AnyDesk\gcapi.dll	AnyDesk.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	rundll32.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe

Executes dropped EXE 4 IoCs

pid	Process
4844	AnyDesk.exe
4956	AnyDesk.exe
3848	AnyDesk.exe
564	AnyDesk.exe

Loads dropped DLL 4 IoCs

pid	Process
4624	AnyDesk.exe
2156	AnyDesk.exe
4956	AnyDesk.exe
4844	AnyDesk.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe

Checks SCSI registry key(s) 3 TTPs 32 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AnyDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AnyDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowShiftLock = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\CachedLanguageName = "@Winlangdb.dll,-1121"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\KeyboardLayout = "67699721"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\Profile = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language\00000000 = "00000409"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Substitutes	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\0409:00000409 = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload\1 = "00000409"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowCasing = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "209"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\Languages = 65006e002d005500530000000000	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\LANGUAGE	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload	LogonUI.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk-Assist\shell\open\command\ = "\"C:\\Program Files (x86)\\AnyDesk\\AnyDesk.exe\" \"%1\""	AnyDesk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell	AnyDesk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\DefaultIcon	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\DefaultIcon	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\DefaultIcon\ = "AnyDesk.exe,0"	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk-Assist\shell\open	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk-Assist\ = "URL:AnyDesk Assist Protocol"	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk-Assist\URL Protocol	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk-Assist\DefaultIcon	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\DefaultIcon\ = "\"C:\\Program Files (x86)\\AnyDesk\\AnyDesk.exe\",0"	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\ = "URL:AnyDesk Protocol"	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open\command\ = "\"C:\\Program Files (x86)\\AnyDesk\\AnyDesk.exe\" \"%1\""	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk-Assist\shell\open\command	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open\command	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\URL Protocol	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open\command	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk-Assist	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk-Assist\DefaultIcon\ = "AnyDesk.exe,0"	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open\command\ = "\"C:\\Program Files (x86)\\AnyDesk\\AnyDesk.exe\" --play \"%1\""	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk-Assist\shell	AnyDesk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4956	AnyDesk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3980	AnyDesk.exe
3980	AnyDesk.exe
3980	AnyDesk.exe
3980	AnyDesk.exe
3980	AnyDesk.exe
3980	AnyDesk.exe
3980	AnyDesk.exe
3980	AnyDesk.exe
3980	AnyDesk.exe
3980	AnyDesk.exe
3980	AnyDesk.exe
3980	AnyDesk.exe
3980	AnyDesk.exe
3980	AnyDesk.exe
3980	AnyDesk.exe
3980	AnyDesk.exe
3980	AnyDesk.exe
3980	AnyDesk.exe
3980	AnyDesk.exe
3980	AnyDesk.exe
4844	AnyDesk.exe
4844	AnyDesk.exe
4844	AnyDesk.exe
4844	AnyDesk.exe
4844	AnyDesk.exe
4844	AnyDesk.exe
4844	AnyDesk.exe
4844	AnyDesk.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
4900	Taskmgr.exe
4900	Taskmgr.exe
4900	Taskmgr.exe
4900	Taskmgr.exe
4900	Taskmgr.exe
4900	Taskmgr.exe
4900	Taskmgr.exe
4900	Taskmgr.exe
4900	Taskmgr.exe
4900	Taskmgr.exe
4900	Taskmgr.exe
4900	Taskmgr.exe
4900	Taskmgr.exe
4900	Taskmgr.exe
4900	Taskmgr.exe
4900	Taskmgr.exe
4900	Taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
564	AnyDesk.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeAuditPrivilege	952	svchost.exe
Token: SeSecurityPrivilege	952	svchost.exe
Token: SeDebugPrivilege	4844	AnyDesk.exe
Token: SeDebugPrivilege	4844	AnyDesk.exe
Token: SeDebugPrivilege	4844	AnyDesk.exe
Token: SeAssignPrimaryTokenPrivilege	4844	AnyDesk.exe
Token: 33	560	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	560	AUDIODG.EXE
Token: SeShutdownPrivilege	3572	LogonUI.exe
Token: SeCreatePagefilePrivilege	3572	LogonUI.exe
Token: SeDebugPrivilege	3040	Taskmgr.exe
Token: SeSystemProfilePrivilege	3040	Taskmgr.exe
Token: SeCreateGlobalPrivilege	3040	Taskmgr.exe
Token: 33	3040	Taskmgr.exe
Token: SeIncBasePriorityPrivilege	3040	Taskmgr.exe
Token: SeDebugPrivilege	4900	Taskmgr.exe
Token: SeSystemProfilePrivilege	4900	Taskmgr.exe
Token: SeCreateGlobalPrivilege	4900	Taskmgr.exe
Token: 33	4900	Taskmgr.exe
Token: SeIncBasePriorityPrivilege	4900	Taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4624	AnyDesk.exe
4624	AnyDesk.exe
4624	AnyDesk.exe
4624	AnyDesk.exe
3368	AnyDesk.exe
3368	AnyDesk.exe
3368	AnyDesk.exe
4624	AnyDesk.exe
3368	AnyDesk.exe
4956	AnyDesk.exe
4956	AnyDesk.exe
4956	AnyDesk.exe
4956	AnyDesk.exe
4956	AnyDesk.exe
4956	AnyDesk.exe
4956	AnyDesk.exe
4956	AnyDesk.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
4900	Taskmgr.exe
4900	Taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4624	AnyDesk.exe
4624	AnyDesk.exe
4624	AnyDesk.exe
4624	AnyDesk.exe
3368	AnyDesk.exe
3368	AnyDesk.exe
3368	AnyDesk.exe
4624	AnyDesk.exe
3368	AnyDesk.exe
4956	AnyDesk.exe
4956	AnyDesk.exe
4956	AnyDesk.exe
4956	AnyDesk.exe
4956	AnyDesk.exe
4956	AnyDesk.exe
4956	AnyDesk.exe
4956	AnyDesk.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
3040	Taskmgr.exe
4900	Taskmgr.exe
4900	Taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
564	AnyDesk.exe
564	AnyDesk.exe
3572	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 2156	3368	AnyDesk.exe	77
PID 3368 wrote to memory of 2156	3368	AnyDesk.exe	77
PID 3368 wrote to memory of 2156	3368	AnyDesk.exe	77
PID 3368 wrote to memory of 4624	3368	AnyDesk.exe	78
PID 3368 wrote to memory of 4624	3368	AnyDesk.exe	78
PID 3368 wrote to memory of 4624	3368	AnyDesk.exe	78
PID 3368 wrote to memory of 3980	3368	AnyDesk.exe	81
PID 3368 wrote to memory of 3980	3368	AnyDesk.exe	81
PID 3368 wrote to memory of 3980	3368	AnyDesk.exe	81
PID 3980 wrote to memory of 2112	3980	AnyDesk.exe	87
PID 3980 wrote to memory of 2112	3980	AnyDesk.exe	87
PID 3980 wrote to memory of 2112	3980	AnyDesk.exe	87
PID 3980 wrote to memory of 2104	3980	AnyDesk.exe	89
PID 3980 wrote to memory of 2104	3980	AnyDesk.exe	89
PID 3980 wrote to memory of 2104	3980	AnyDesk.exe	89
PID 952 wrote to memory of 3184	952	svchost.exe	92
PID 952 wrote to memory of 3184	952	svchost.exe	92
PID 3184 wrote to memory of 1708	3184	DrvInst.exe	93
PID 3184 wrote to memory of 1708	3184	DrvInst.exe	93
PID 4844 wrote to memory of 564	4844	AnyDesk.exe	96
PID 4844 wrote to memory of 564	4844	AnyDesk.exe	96
PID 4844 wrote to memory of 564	4844	AnyDesk.exe	96
PID 4856 wrote to memory of 3040	4856	launchtm.exe	113
PID 4856 wrote to memory of 3040	4856	launchtm.exe	113
PID 240 wrote to memory of 2872	240	launchtm.exe	125
PID 240 wrote to memory of 2872	240	launchtm.exe	125
PID 4788 wrote to memory of 4900	4788	launchtm.exe	126
PID 4788 wrote to memory of 4900	4788	launchtm.exe	126
PID 1176 wrote to memory of 3864	1176	msedge.exe	128
PID 1176 wrote to memory of 3864	1176	msedge.exe	128
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129
PID 1176 wrote to memory of 2972	1176	msedge.exe	129

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\SoftwareSASGeneration = "1"	AnyDesk.exe

C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2156
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4624
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --install "C:\Program Files (x86)\AnyDesk" --start-with-win --create-shortcuts --create-taskbar-icon --create-desktop-icon --install-driver:mirror --install-driver:printer --update-main --svc-conf "C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf" --sys-conf "C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\SysWOW64\expand.exe
    expand -F:* "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver\v4.cab" "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2112
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" printui.dll, PrintUIEntry /if /b "AnyDesk Printer" /f "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver\AnyDeskPrintDriver.inf" /r "AD_Port" /m "AnyDesk v4 Printer Driver"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2104

C:\Program Files (x86)\AnyDesk\AnyDesk.exe
"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --service
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4844
- C:\Program Files (x86)\AnyDesk\AnyDesk.exe
  "C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --backend
  2⤵
  - Drops file in System32 directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:564

C:\Program Files (x86)\AnyDesk\AnyDesk.exe
"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --control
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4956

C:\Program Files (x86)\AnyDesk\AnyDesk.exe
"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --new-install
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{a97e2bb6-c709-3742-b214-72383fe6068e}\anydeskprintdriver.inf" "9" "49a18f3d7" "0000000000000150" "WinSta0\Default" "0000000000000160" "208" "c:\users\admin\appdata\roaming\anydesk\printer_driver"
  2⤵
  - Manipulates Digital Signatures
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:3184
- - C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{31888EA1-F6BB-4F73-A849-FDC63B6C05D2} Global\{33F0D966-3E44-4443-800A-771678E745B6} C:\Windows\System32\DriverStore\Temp\{0057ee48-c97b-6f46-9d70-15459741f3bd}\anydeskprintdriver.inf C:\Windows\System32\DriverStore\Temp\{0057ee48-c97b-6f46-9d70-15459741f3bd}\AnyDeskPrintDriver.cat
    3⤵
    PID:1708

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004BC 0x000000000000046C
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1620

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:3304

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:2336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:2244

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3a18855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3572

C:\Windows\system32\launchtm.exe
launchtm.exe /3
1⤵
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\System32\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe" /3
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3040

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:4752

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:2088

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:1912

C:\Windows\system32\launchtm.exe
launchtm.exe /2
1⤵
- Suspicious use of WriteProcessMemory
PID:240
- C:\Windows\System32\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe" /2
  2⤵
  PID:2872

C:\Windows\system32\launchtm.exe
launchtm.exe /2
1⤵
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\System32\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe" /2
  2⤵
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffdc8df3cb8,0x7ffdc8df3cc8,0x7ffdc8df3cd8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,5266686889181362046,7421768056402632207,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,5266686889181362046,7421768056402632207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,5266686889181362046,7421768056402632207,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5266686889181362046,7421768056402632207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5266686889181362046,7421768056402632207,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5266686889181362046,7421768056402632207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5266686889181362046,7421768056402632207,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5266686889181362046,7421768056402632207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5266686889181362046,7421768056402632207,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5266686889181362046,7421768056402632207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,5266686889181362046,7421768056402632207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4624 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,5266686889181362046,7421768056402632207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1952 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5266686889181362046,7421768056402632207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5266686889181362046,7421768056402632207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5266686889181362046,7421768056402632207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5266686889181362046,7421768056402632207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1896,5266686889181362046,7421768056402632207,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3404 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1896,5266686889181362046,7421768056402632207,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5266686889181362046,7421768056402632207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,5266686889181362046,7421768056402632207,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6124 /prefetch:2
  2⤵
  PID:2968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\AnyDesk\AnyDesk.exe

Filesize
5.3MB

MD5
0a269c555e15783351e02629502bf141

SHA1
8fefa361e9b5bce4af0090093f51bcd02892b25d

SHA256
fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca

SHA512
b1784109f01d004f2f618e91695fc4ab9e64989cdedc39941cb1a4e7fed9032e096190269f3baefa590cc98552af5824d0f447a03213e4ae07cf55214758725a

Download Submit
C:\ProgramData\AnyDesk\service.conf

Filesize
2KB

MD5
7ef83278c5f1efbc7eb684c7c6328d0d

SHA1
45c5954d8824bbae6307bb3324aedbe8dc038f48

SHA256
7a8317a61cfbf460d84963ae5cc3f07062c6cc5e5ece49ec796f8b111187bbc4

SHA512
bd403243b15ddac8ec7dee9db6e769ffa80cf099eb26e6ded4839d9b809e12ec35d9fb73a75131b31e8b629dd197141b8bc9dad35291d9e825644d74bfe3b3a8

Download Submit
C:\ProgramData\AnyDesk\system.conf

Filesize
950B

MD5
f6918fc07e131544b4677212cb910d94

SHA1
25b4e56ee333b72188f372347a7665ec804889bf

SHA256
1f45e85c5d02ae305aaf349d6075d287d281f3b2946238681c4f229ee0e60d91

SHA512
0f2a178ea74a069b3001383f974f85e38fdf896a18f39b742f67614ebb4b6d10c913a83f57bd55c19e9230b8b1b8c7b5e3b98d20f3304dccd8cb27dc8a76be96

Download Submit
C:\ProgramData\AnyDesk\system.conf

Filesize
950B

MD5
94493fdbf0b3d7993675fa1d52f9b749

SHA1
722f0e2c9894ae126be7ee14e668ab2321ba8479

SHA256
58139a56538cb0af59ecae2003ed4700c7626ededf1b03960e89fcc776189122

SHA512
142ffb073a847325afcac20ee192d58922a919495541fc634ce41fbccad30ad28c4f23c07a041fe0a2988aae13ed9106e8c00a72eb3dad6a0aba5bf69020b8a6

Download Submit
C:\ProgramData\AnyDesk\system.conf

Filesize
950B

MD5
83cd47ede31a54cceb6a4e4f72810e22

SHA1
c35fb1f6725fc39ccff9853b6617bba88864e464

SHA256
15a6233050e4b44f9535ef0c53eb272456d005da6b1bb5dffe7ece901aa9bb0a

SHA512
ac2ce7ad27f35ec9de07e9c411e537022bbc0687355f4dd42013205e97fe81c68e31b61e11cca9fc77c46da9ec9029988c208eec3ad4ebd104e03a71e806bb6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fc959921446fa3ab5813f75ca4d0235

SHA1
0aeef3ba7ba2aa1f725fca09432d384b06995e2a

SHA256
1b1e89d3b2f3da84cc8494d07cf0babc472c426ccb1c4ae13398243360c9d02c

SHA512
899d1e1b0feece25ac97527daddcaaeb069cb428532477849eba43a627502c590261f2c26fef31e4e20efd3d7eb0815336a784c4d2888e05afcf5477af872b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e9a2c784e6d797d91d4b8612e14d51bd

SHA1
25e2b07c396ee82e4404af09424f747fc05f04c2

SHA256
18ddbb93c981d8006071f9d26924ce3357cad212cbb65f48812d4a474c197ce6

SHA512
fc35688ae3cd448ed6b2069d39ce1219612c54f5bb0dd7b707c9e6f39450fe9fb1338cf5bd0b82a45207fac2fbab1e0eae77e5c9e6488371390eab45f76a5df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
236KB

MD5
a185a4d5f4041fac6ab0feb5984e1305

SHA1
f0ed3f93e8638190432117506df6c96e658fa27d

SHA256
7d951177c6b43a2169567effc310aeb2bbd1da2ae4661d55079529eadbd802e1

SHA512
b3e0372ae8801bdb99fad3abadf896b5cbe9eecf887a2ea70efe633d5e3cfd2b8d0043d05bd84439532e39119864f424ec4b1136778c2fd474499e8fdfa02dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
49KB

MD5
c107c51cfe4528231af0bd0b65d14fb0

SHA1
14d634538d16493d43a33785290171bc9c336d78

SHA256
ce331329395cb1ac9c29271b6d3e3f38f1fa53b04c9c576ce40044b74fc1fe3e

SHA512
888e676c2aa461c4b7aea8cd4391d7ce50a9c73d2f14afd088f648f89ba47e4bfe14b7ae641fddec93a619f42d6b0fa9c20bb5ff68896082121354c81d7e6c70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
34KB

MD5
7e98dbb6f7b679fecc60238cb5e0cf91

SHA1
e031ff5267169dba7887072ad612584595d42df8

SHA256
a017204ca0669cf160dd395ed85be44e016dac620bd23cfb44f08d20cbc9fd98

SHA512
57d8c5849ec2ac575278ca85a329ffa0acb509781ee668834d7f1db0b9cb5ca7cf35063b4bb2b2b785ff09bf832455cd3b6f4314c9b130b3d12fa9f047b13d77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
33KB

MD5
216e22b494d300b6b57a83ed835a3746

SHA1
718bdb6a659bd63bfaa83e60a72e5c43af4f7331

SHA256
1b9ceb889ac5c7fe46842ee257fc6073139140e98e9f63bf33a5876f9902b608

SHA512
75e852045dbb2fcbb363d0967007f11aa3ba272efdfe4a593d8c41258379d76de3aad72a6bb3b1059d2414a40b87a66428f73195d65ae3d001b1bae5b4083a20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
67dc5b773e34e3b4deec6ade03c8bd2a

SHA1
ab06283e9bcd2ee546efa7194dfb612fb8407b6f

SHA256
9152adf02abec542526686f2f53c6f2b73d5175e2aaa3857f27c0da0aa0cb151

SHA512
6382224ec193517df3af587b8fb7856e5fee218f8e17dc3bdf4dce7896fa62f366c3e985b3793cb901fa4b84225c55e3b1142bc65aabd6ddcd5693a2ad2a6e8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
1e4bceb2dbaf6ad95668eb50b07f66e8

SHA1
3a4047050ef480d55bd03a434a9573da13712bbf

SHA256
441fb602bcbfb17d6e94f4eba0a629f4fa10a1efe302193f570d13eb4973152c

SHA512
c953b98a778f700f1da751d13713ee1a9dbf317869906a4e04b76753b477bd6c183d583eb91dc197f3ce30b667bde99a4a139e245b348dbeefd2c02000059380

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ade53f337c69c00d9b8fd528996bfb5c

SHA1
4bcdd943218dc26f50565a9f914ac0f843e625be

SHA256
07a0e7dc6534c9f07265705906f27933ce3d4beb1ffb387b6ae252899a761975

SHA512
e89951d625e2f4d7d1cc1d8ffaa0775c216df582b26a893d83670378308dfcdc1d6be55a1f69f3266ebbbd33ed12f2e79b6af83e8df9c9576682218c37770b80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f594838ba38a8457b4ef1e7aa06f45ee

SHA1
41012a4fcd704943e8551c9988c6a66de1785be3

SHA256
e0fbb3cf17de725025883859d72c1a77c38e7d5cdc11eaac31158d3b9d5deeda

SHA512
d55287ff74567817c8bcc65f3ccd1083bb62c98bfac946fc6fc2cca581a9b0c7cb187d520a0c024c6e361f4d4610665e43078004bcbd05ef8b6d7ed8bee936ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f26eb7130df1876586d539d4a8231b99

SHA1
ccc1d7fbf9fb964418f6358b2201601468bf8758

SHA256
5a9ee6119ce70afe79c9addf66df5f03d2c223062f44423c7d7c1105046a9304

SHA512
2a90b0119ef6a2f1f6db849bef88ec7924c5fe933860abe867eeeaa9226aabc8dfc97f17fa1a5c283df654fb8cfb2e25929e31fa9b05fe0c81f9b2be924ded84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5506c892e3dc6c713766c0a2ca52a2ba

SHA1
29e5d48dbe3a109e63c36e50bf23c9d932620f89

SHA256
f84581319556f8465ba1ccce063b445fd5e9c7e3016375d7a061ec872681e0c8

SHA512
c12983caa176a1215a759c344f7b99484beb4c25b19a3b76608778d654227720ab8e0f83bc7d3467d18a47e649775c90b651b10cf1e55c5be6bd74127e9b870d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fb549c6516d95e01d1fd063c09a97c72

SHA1
f2b36c0de2de856ec646a2bfbabc8a4992bb158f

SHA256
9fb85977c84c4599ade617c84876c66cfc69e680c3114f7affc8489542c281c9

SHA512
dc623038c5ca04d1a7857d0c4a548ae1f2a419d3f095fce9e0e5fc3428f7d9886b5b93605f7082148964f80c73a9072e5713e6c1a55f8656706da457f41867fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\4574568f-37de-4632-9a5b-76cdfb93ae0a\index-dir\the-real-index

Filesize
3KB

MD5
98840c37c16813f38d02e5d2aa94b924

SHA1
42804498c4a3d4ede80e585258298fed7351c6e2

SHA256
6b4bc83ed8151c463d4e62bb30ea1a89bf887c867ca33383ec0ef835a04b99a7

SHA512
c1b199c7087c54eaa2efa3c03e49c49cd67984389bab2d264a8bd9c2504844bd093c14f20ca331116c9842f9cacc195f80af39971cc2f53f7f962f1a50f907cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\4574568f-37de-4632-9a5b-76cdfb93ae0a\index-dir\the-real-index

Filesize
2KB

MD5
974ef12e99bad2afc9e571f87641692d

SHA1
589711d7a922122d2673e83c0126ef7e5a35da3b

SHA256
b6f10a9bb6d65b8e2f6e860190ced231c8f7cb128413a910f55f2c2294ba7d2d

SHA512
5780cbc419f6f3fb4110d6b09b2bb549c3c8a42e74d1c948d7d0157b376f951100723b4d1c9fd01e0aa59c6583cb8663641574fa29b9ce93966712419cef143f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\4574568f-37de-4632-9a5b-76cdfb93ae0a\index-dir\the-real-index~RFe6017e1.TMP

Filesize
48B

MD5
66df47f4c1191696e0995ecaeb0dcf15

SHA1
7b7ebf0af8881118cdc826e1063b6eecf4ada903

SHA256
1371beeeea1dd15480b6e13311e2bb553d8b2adb8b0f616f79b7a1810246e12a

SHA512
96bec08f14caa8cb9d55154c69b3afc25899f2c8224f84f048f83c721f242d573b522e2cd7fc63ee6956f489e7929829fe40dca9a40c2ace57bbd62aabfcc725

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\adfcfad3-12cf-4630-b413-e480820e50a8\index-dir\the-real-index

Filesize
624B

MD5
72f1db91c66c67eecadc703ed339a0d9

SHA1
8af36628395e8d485df66c001366fb7babb4a5e0

SHA256
ad73d859a3d54252141d927206682bdf5cc0c70129d586901476cd08bfd9a328

SHA512
8fd1d1659b5d0c9e131696babcf29b22618c11f90e090777c90e39e5581f87199d1b9c15031879840c126bb4207553b4cb3c0c06f62715981ba32aec6ea20b9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\adfcfad3-12cf-4630-b413-e480820e50a8\index-dir\the-real-index~RFe607524.TMP

Filesize
48B

MD5
8ccc0255cd87ab5bf62132657c390a27

SHA1
9673faf2e53075def100bc919f2c07ebf5b1102c

SHA256
dae9ef164ff7ec468d1e895a5081ed15fe87c1f741c2b3af9ea9d42910bcd410

SHA512
c4e463b2ab55317c912dadb5e30ffa24fae33337314bcb28a76e793bf4d9ec2ae4d438b2c442ac60a389cb219f399d8db59f20e87287d99792a6967426bb97f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
c31d215181a7193d33756dcd4cd1c1a4

SHA1
e226f05449726cfdb7637ef280d2197deab8a6da

SHA256
20009f84833445c3923d4f93b0540bca7f523c39ae306d8ae28618b34183cdad

SHA512
8e1ed07fda3a1cdecadc68ac2f1d1354a846c62d2e158e0e034d317597f1c3dac8b4826ed936e40b98fdd77be08493885e7c728b1f4772001e2a3973f39e5b3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
157B

MD5
7092b364944b94febf8b8d056da835fa

SHA1
49a1896487ad895d4b1ea6043392f99bb54f1c32

SHA256
7ac6cd0b7163d5a1ec4092858dee8e2078a44b104a47d9b5571985dfa6324e51

SHA512
256c5eeaa856a871e3cd1e77ef5693ea6a0aa5115bf5f163a517be631164c0bc2493e2ce94d93a54c15f417fd0c7334a6e5a95e6fdf49198384c3ac26c7dd142

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
6635a979d4913cc7d0ec9cf0f791a99d

SHA1
0bcaba0ff5db2d759d2c0be4860d4eca50c3ae79

SHA256
5e4c36bdef2e292354f9effb5b4dae7a39a3e799d3457eacd1269f7db52173b4

SHA512
6e3f47fdbb33f88e31496ff05d805ffaa8213f3b13ae5adeef042edb7d18b315536380ebb440fcf1dfdcb9e483a15f9b5063672f5304fcbc801021831cfaeb1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
ecce56762ff894c7501da408de4c95a9

SHA1
9ac00ee67bbd49c7844f3cc68c5d656eb933b9e8

SHA256
c7635890f02270bf17200bdeb3f205b35d0ec551a163196577f362f5034bbf08

SHA512
f878eb87054cda7e14d4991d7ef41e3363e7a38cb7d53515414e040e3b69a24ba188934ca0c1bc57e95329748f25c31e54c79806020bd4dcba4f0f639d92045e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
decedc84efc3e83dfe7e6069768c4dec

SHA1
2b931e59b41ffd1448e567090e23903635f2bf66

SHA256
738672be189d888dac58d2609f61ccc62a4754b9dc22eeffba48fb6a5cfe554c

SHA512
3b1d01bb205856fb0645ca1f7d8b3869f1924355c9586de7187dcbe153adf44c22aeeb9d3a9c6f88a3fc49d85a805008d3c901697d74ca8412b30e1a666ed469

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
26B

MD5
2892eee3e20e19a9ba77be6913508a54

SHA1
7c4ef82faa28393c739c517d706ac6919a8ffc49

SHA256
4f110831bb434c728a6895190323d159df6d531be8c4bb7109864eeb7c989ff2

SHA512
b13a336db33299ab3405e13811e3ed9e5a18542e5d835f2b7130a6ff4c22f74272002fc43e7d9f94ac3aa6a4d53518f87f25d90c29e0d286b6470667ea9336ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
ecf589056e1c9254176cf339aea52eb8

SHA1
5220ffb45d624630a06aef5bd87bfc4958b3bd80

SHA256
53660a5216cb722d715eeda607333e0614500337513f30a0542261d97809718d

SHA512
72f4661b42b8d9e9711009d355e51e33922d2b752af13a2c35bc8725aaeda582378d68607291dee038cddc989bc99f1b43669934237cee28baefd32700b5ea69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
3a6c0117e5d03b878a2018154faa6e0d

SHA1
843f96401e825283af61048268e670846efd4465

SHA256
aa0d815c3da5e440ba2267ac5135e6e8b7a7c1425aa4ae61b77568bf70a47967

SHA512
9c74b88261388cd2e65d163147eb79848139f9c2acae6dd12fea136a6e837ae3ec3cf27456d053bf428754445cc88f99190abf66149581da62e371983e74be8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
ac1b2c757dd6d2770bd53028a934285c

SHA1
760e66c9929b57831ce5ae362a25d16a8ce9b4d4

SHA256
3a3396cac11b3d3db3c01ea3ae29c1a995f886311919cbce812ef1e5ed8377f0

SHA512
802aeee5b543a4f13457a40f50f6fba5d6e8f0e8f048b15922e359f4c2075cf1a689ef610af8fa26dbef32e55ee28cb909dfd9a74161151e13eb4ea63ed9223f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
8a70a8cdbc089959039fb1b5cb00e088

SHA1
6b2fa1d4ee0e387ac21799f243b1b9b15a468939

SHA256
7cd170d7addfc786c6fa121434c08d3f3b812a93f4d2997f58e03aa150ab8e13

SHA512
d319790a4c4b38a74a2bf15519c406a82a21c137ee0d6258f83265b1b494d2a394dc1bbfc89e5b00e34cba176bfb7d8dd42f55983185dd38e906520504aa24dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe606b70.TMP

Filesize
48B

MD5
42873eefd92582722d36539662d3c24f

SHA1
c86fdf8954b65248860a98499e5bd4048294b4c0

SHA256
1c879ca33d0a6da208b7628b4ce374af60993bacde1a0b9b1afd17b242db763f

SHA512
752cc90f6a812859db87fa86223b05ef1fbb1351775b3eec647d0ef185cde3930a24fb2cfda07c6c640f0888b665dfd823a76f9c8d1d9e0c55ec341bee50dc4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
4c6cae2f9514ff60410ca94cff8d93f6

SHA1
1ccbee8ad5421e96ce29d7d4ab2e9660c56781fe

SHA256
060e341661c1757387bfef5d7334c9456b944fd69d1ad8be01526ba91dc70a67

SHA512
743bfe5d368f63dd6407b2ffa349b28e4a7c0080aef2ee874a4f88545cf72ad7f13a5f432d4b909cb769cd33adc05b9f71585d22e5a2088431acc3a0e79aec0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe603e65.TMP

Filesize
706B

MD5
54b4bfc59a30f6cc783eb8a94c0c1608

SHA1
48b9ccd87af0ac81a089726d4b4cf77188a10672

SHA256
913fd2324884ded17a5459f99bfe826b0ca7e46526a379b542ad481b28c9ff03

SHA512
b63de74da12446436c669b9007e4f6e2fe1000f4e180e344bfd5e15a61f9d18a3f35deff11a7366f02c426dc2979171e99849d06905e833998b152db4d7d5a82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e12d87151de98c92bab3ce40606ec5d2

SHA1
ba6f22940af34d091a8596437e7d3d32d04d7c6a

SHA256
e8565e5b815ed8abc7dc2c3c07631de8ff759ec3a62d1ab80aba3bb6955e8cf9

SHA512
d208f16866ac4e6bc14eb9987f6fcce54176681fd77838c97da6709560d0d1143d52728e6b06596575f75fb78eece3d8a51a5228237a03df87c97a631eed46f1

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\1cf4a232-3567-4183-a5e7-75201bfe232a.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\gcapi.dll

Filesize
385KB

MD5
1ce7d5a1566c8c449d0f6772a8c27900

SHA1
60854185f6338e1bfc7497fd41aa44c5c00d8f85

SHA256
73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf

SHA512
7e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753

Download Submit
C:\Users\Admin\AppData\Local\Temp\{a97e2bb6-c709-3742-b214-72383fe6068e}\SETF482.tmp

Filesize
299KB

MD5
a4e4b05588899d7dc1d70c651cfce2d2

SHA1
c280c7f97e02eb582f09805451e5b17c34d0e119

SHA256
76a784f5561994bf302f0d65576efc676866429497a16a611ea38f8fc8939396

SHA512
428bd7da6d77af8413227ae3382f707436dbd494e9ead7a3d002a175ba64ceab71f76fcd94581c3f2532809fa69af1eb29a56e48a61d37fe42dfddbe4fef0278

Download Submit
C:\Users\Admin\AppData\Local\Temp\{a97e2bb6-c709-3742-b214-72383fe6068e}\SETF483.tmp

Filesize
567B

MD5
8accaa9aa32148aa2bcd72ff14880618

SHA1
a1226a1c5c92e41ba22b382debc0f9a754b92c05

SHA256
aa0b5f757b3d83d19c973fddc4e82722b530d9aedec51f6a540a91126e4cc0dd

SHA512
026e07faf75a5be8c96ae59a93302a487a18b193b5d915aba5822cc27d2fd1f70fafb9239b34df8280b060f85bcf3316d1d4d5f1b21c8557b187affaf490a3bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\{a97e2bb6-c709-3742-b214-72383fe6068e}\SETF493.tmp

Filesize
252B

MD5
5cda10b02df931ebbad3d0fc9d9509b7

SHA1
f04b7885bfac4bee938d047f6703c58d4087facd

SHA256
ca33091bbdfd87bb3acca1a3eec96d3948a0830d9bc7bef3c40e15055e4c9a03

SHA512
99cfc18278eb4726b44caac07f1cec7f877791290cecd003417f1ab06716c5d4c004f2dea767676895db0e96dfa2023661d44684bfe990d5a97fc03e60dfc6bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\{a97e2bb6-c709-3742-b214-72383fe6068e}\SETF495.tmp

Filesize
11KB

MD5
ddf4ac6ecd52467516b31e0939b8a030

SHA1
bd452adc22223981b67dc4d665e3a0e8cf470c09

SHA256
019677297ae01db991a5c122ae582424e51d41ef7bb81fdf26269afaaaf5ae22

SHA512
a63b7dc23f8a8ae697aadc564e947fa5a8d3429f319ea72f5b0cbb77c51bd4f7d15450218360d6a742e2f2e3187745eff71f237079bc01fa1fa5cb6fb3c7402b

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
9KB

MD5
0d99520383ea8cd5627a980ddd1888f0

SHA1
a27a479feab7201709ed0e83c3ea03663bdd7fe4

SHA256
3ea515693fcb74dea23d75123dc009fa9b85111645b5219303cc6646b5f9754b

SHA512
a1b6527a013f5e758446e5dc6fec76ae035dc84f26a264e2679971838d03aedfa6ac9a3bf3d0f5c91856553f0089a456aa301bbca444e544ca9766360509984f

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
31KB

MD5
b611be58e9139ba6875ab5f866ae1950

SHA1
1eb96104773d7b31fc286a15bfd28122a83890c3

SHA256
4eb51cc529278fc962ed7e6bccdc746b73e4253c7e2ab3463f09f0fc0a3064e0

SHA512
797120d47876ea6aef4fe4033b8ae12400136cae3f6784272bb2ded21d9a3613138a522e02e0591e9402a776684fe2696eec16b56d2181acdfcc645b85721a71

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
41KB

MD5
ee64ad25b62fa8a1221bcd9a62dac30e

SHA1
f2e7e46e2eac5a8df6ea56f5045d96b43429eb8c

SHA256
971ef452478f5bd11aed27d6f0860d8587e15c9b5f634bac648f493ac1c52994

SHA512
5f0fd66db5760dd178e88925a27013c23c70690376f6fa8002e38bb5dff66af0439b534f29faa2ad9ef232d30297d00c2c90b34a31be1c39a1f7d5318e3d64f4

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
ca8ce07289c5fa3f1b7f81c1fafc2ab4

SHA1
6bf2b2caea9c9fc29f781f3ff297dfc192adb7ff

SHA256
4282d75b9277480309b6309fade6e92577548b321ec70df9e6b4e1f39504c73a

SHA512
02ba517b653cf897ca4ce6a9343b953df03c165b5ed5970a4c91987fc4452d7434c30c6462673b05b88e8cd9c6dcb60a6188d2aaa008c91f80907fab80a53dee

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
9a217f5bbbce30148a74253b92cf7954

SHA1
14e1ace07d9c1e63782fb317902911d616cb97fc

SHA256
8ee44255d91f53ef6b2accbedc53f543314e0ff850fd433d6cd5ad29d65c455b

SHA512
40a06a1359c3ab3354be57d9f05c7439f942808a8b34f54d110ba54e59af0a4f3dfc4a8b0aa3d84f0c92874a5074022ddc1e5e2099989d2ebb12187abd2393a5

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
745B

MD5
cd92151a07b34c7205ea56a99220221d

SHA1
f37d6fa31d9474bec44d13bed94116833ad7bcde

SHA256
d23f6c82692bb210423e2deaba1d13fcc41ea0ba1ccb88bb4ad229fac72f0e05

SHA512
f1fcc028c4bdaae677ed61f0a4b998fc6e0b898cf0170d1276c129b45246c28119dbfa0f95694d31b3322dc572d70344115448ba33c3791383a1e5ee840fe384

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
766B

MD5
bf4b39b0119339956e51b3f48d1ffefc

SHA1
9bc6d32ded8336d27a55faf17415a900a0bb58c0

SHA256
cdbc3d9379ab566c5fc741800b7e61ffd098c5dd2e8e6dc61edf818f813343a7

SHA512
c4945eae42e50817f7c16b97067f41d964ccce1b174734187c3170653d19ba79a7f1335c742a00aae12a32864d3b04c0e9ceae876a8265fd7b49b7a761967f04

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
774B

MD5
f17574c215c492aa63d55fc2382d525a

SHA1
54d352c1e9c9b611bdf035ccb25c7d0988345dd1

SHA256
f2e995152e46b60d2131fc4bc6e6767abc2f5f019fd9675b58f3ef9700cc237e

SHA512
4a68652148f82961001b904c711cf0bb1ab6f483fdfac66f2cb7b0cb7d0b09ebc2362705f77248c761454f1e244306209118806a817ccb9d2abb4c6375e6ba7e

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
831B

MD5
0ae6bc09f857072c7acd4b38d8b23022

SHA1
ef1d9b54a678fff4182046da341180d4e20f2472

SHA256
a62263ac7749128d9870af4aa3629823a03d71e054c2465c3194664352eac5a7

SHA512
c71f8e6a894b36519ff8ca86ea776b2ebdb0dc68d05b3b28540bdf36fc8d088517fddd38fccb379b7c2ab0c075fade3949a92272cec516f622ce1a42fbf36cd7

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
312B

MD5
0c04ad1083dc5c7c45e3ee2cd344ae38

SHA1
f1cf190f8ca93000e56d49732e9e827e2554c46f

SHA256
6452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0

SHA512
6c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
468B

MD5
26caa0f9407b3de33fda7ca0c51ae065

SHA1
cef08824973acff56dc994897da688851b301073

SHA256
73afb6e72f1b1b496133661a9bf8fccbf3249f3b4cc4c15d3f764fe318d10da3

SHA512
985afef49658c96ef7d66ef379d65e4379e14e777cbb749e2ec1a88f1376e4a072db08fc0267236d88dc16375013e2ec4485c627f54f930e5efeb708872fa6c8

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
468B

MD5
d39be51335059ee32ad1537e1d4c7028

SHA1
4dea49300cb2be4187908096e54ab5c31dfe0233

SHA256
4e05e52404999fb391aef0defe9eeed879aec20f28999a3acb45e9d153f0007c

SHA512
8e03ead67e5fb71a323d6804c440a4bdbc7177137ab02366fb42eb1c6b837194cc062401ddae64b35e89e97f1d1c872952b26feb565ce231a0d4820a7c828c50

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
2KB

MD5
9a3850bb43917ed196cb371dd1cc7dda

SHA1
d4e122efbc78acd613a56892b2a0b2937e46c4d7

SHA256
a58a92685843bf60a6c5168d7e79b16b1acebff6f0cea7d2085cf498d8ddd1cd

SHA512
5911b01271f7a2fa02f7045877cdef85a7f4279bc1cf3729eb3fe74feb1b81e1f5ea811935f4dae898399c562c7ca73d7a419ec3480854a42baeae75762a1551

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
2KB

MD5
f46a5b6dc2c14f0c84d34d81e1cc831f

SHA1
692bed7600c0616656064ab416f71cd3df568122

SHA256
a099962c9ae3aa2d53aa8ad7c0f5bebf83f36d08faf707bc9ea435f0c98c01ee

SHA512
e09d26ccb86e44ada33c6a82647219a879ca7dddc7f1e5ee5c6f70872100227876e1738d6717edcebf62ac0364d8526da0edb32ceaf9f64cfca6c30191454915

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
2KB

MD5
2b42c290df6b1fa6b89da730a3c3d21e

SHA1
520624d7828ab8a653d2c63c01512609557342af

SHA256
7f3905fdd869d94fdbca450dab1040212a56bcaab981ebad7fd67c64f843343e

SHA512
096d21c74a4cf8ebd52a0a5f6d73728a239e67e901fb29327f840d709f818709935b52c8ed79395678d70bdba1758bef8f4cdd7d9918c77f3f0062a7622d2d0d

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
a9520fda3016e940829371985e08497e

SHA1
880df66008f7cd1aa3befbb7a2fccedd4b08fcf1

SHA256
31728da8b5028a64d83f7c3f357ed1c298bad292abff4cc04dbf6c9dfe761793

SHA512
07c0e3ab601e9a7f6b0cacff6d68d1413f20ed057728d914bfa551cf265a6d271cb17e6dd475397d64d82af2bc032bba7f7f48637d3caeafe00147e3b2c2be02

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
20dffa7efdde08d71e9e0dd7dd9b46b7

SHA1
8e8805b854a05c600cace26c6f3efd80d681d74e

SHA256
c8509496ea5f0cc668d620d60ec60817903ccfd86cf9898befa691181cef0555

SHA512
1d211529ef6e6d3c1a83efdc4a8793428af18b7bf5ea485ebadcdee2a9c889898d671ebec206a4757cee3aa317406cd99ade159e917ab5c9d1106e9621988dc1

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
15f11c500f1339a9aeaf62b9d817ec45

SHA1
e0cb3c32dc8fd208874453646a009b3da6823625

SHA256
8a7bf37f3fbea6fe288e97362292a7b4957e3926a5f0e8b39a315d42f1cc1024

SHA512
cad1465781e825c8b681e4dd4cf717e2b1f99317214a2a30d7b1d2b9632129237f49ad89048b6f0fd650368daad49a5c8f4276e37057c8fad17da268fa9d6926

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
5KB

MD5
1bebf2b441eecf397751c47f3e8ae940

SHA1
e6b9b57b3af38670616a9727393507d978d3254d

SHA256
007b2fa5856872e9052ecd5247fbe772c1315c3ec22b902b2c74cfde2fb45048

SHA512
92bd357067d4f44929992f7b1e1fc67c85ef5a83deca519f3a560601761e4af0df6720db1638ddf7f0dbf13c3f5290f54afd32232614d919ea03a86c67d257ee

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
bf206db0b8abf76cf1c325374f07de04

SHA1
89fd4eb1a978698abf94e94c35f472c6b684a5d3

SHA256
1b3e37a8bc7d874eea27aa3fe9f8f0007c226889d7fd06496fc6967befbb01b7

SHA512
b769feae52c84babe254dd887635cb053219053c8fbd02026072941ae5397aa74a9d17048f4c587a82fb898c9f3127fb17ac27fda15076ff5d489d04f87dcbf1

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
68c55aa8c609a354e98814cc4f0b3863

SHA1
ea3e648d60fc432d5321038d8fc5c090491efd26

SHA256
447160f59285caaf26b2a95f773744d1382fee7f0a4a1e5455a174c1b6243d95

SHA512
9a7049070c78d6560005cb9339bbda383f6f70e742a0a2066aa7110212902c158f6932cca1f2cff32c1476548f530af3de90aff921219a6ed516c87733339ecc

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
a6c2ef1d6130fdab76fbbdd9177b97da

SHA1
05b3e1932880459f53d87f6438ea4d36c350e0e6

SHA256
7cc2dc312a89bd985669b5fe6bc4522a3a78d3449db5e653bae4409b831f8192

SHA512
0e563bac6391311ec3f5f99ff9b90641bbb0cf907a83474bea069a69b27c185c425ce2fd48a8ff9887c92facac8b721fc0dc76e14ffc0958b13effac39dc4c3b

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
05bc8257252dfc40bfbcf5b1ea1ee6ef

SHA1
e49f0ecf6e78d9f1178f5d0a710ca17a1edbf78f

SHA256
526be18d2760776e360d78fea29cc9268ccbc1a3a92682ffca3e168a37af9e4c

SHA512
cb5fcce7d9eff2666b80a35cebce5f1050e1c3c34f9d0d412b7e414c5f29f92508b86a91cea9b4a5efeb4f7cc215a24b139fff859c7f98e149ad6d8d932d437a

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
5KB

MD5
a8bce4b0d60cf7cfe84323c0a0d91651

SHA1
b72d7551a35d6a0a7f091948c92f05503eca69af

SHA256
368283b26908ba6290b02a7089fc99c67d1241a2f602e8da68f843d55fc29b91

SHA512
ad33fe98632bd2040b11a8215127c6dce38d72b4bf8ce5235eb7992c893db53ce0091922411a2a8a591bee1099cd3bf147dd6b99834bccbbfd96ece5770fcffd

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
a88a68407ec97e489cab4db89c4ec826

SHA1
d9dda82f338e4b5666c9fde9b971ce3bda3835a5

SHA256
0788fddb6f5c00fabc4fe1f1bffbd4e116c376062dcc8965157aaff4c1850d1b

SHA512
edab63af0893bffcc24ff3893a34df04a1c398f9539b58fbedfc2ba27942dbddf9b80efd82262e30dff76759da60147c77d31eeb43af12948f7c3727a008feef

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
80c051e4184ce2981497f66a4cd74437

SHA1
bf5894eec340c4c3488ee8e12be0fd5c13b42deb

SHA256
c7705f48b9e0d8aa8d1f943089d5003a736c039f00bae80bcc1d9ecf87c06626

SHA512
91620366d175c3005723c562791480d753bebb40bf744878ef29a6de3c4dd75e22726fba6e6f2f950679ee0f05f404a9044625d9036f87b545800b49e9206246

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
c08e5e5e4c15da4b9f07fe6e7594a323

SHA1
e6c92df053be398e9a703d1beae82e9507cea8ed

SHA256
22fa79d756ffa4b1f88ea8b3f0ffb127d59b76df83be2a4f93e06069ff0561ef

SHA512
c0f0478e1c9ad2e465c645dd598cac93d21fef4b33779625698ac068f0e1a19b28581ab95fd56962683138f042ec22282375f62bed14b5a770dffc31e1fab813

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
55a00033a077828374b097a5b8bbcadf

SHA1
4650096d03ac9658f8256c7f56651c8283d2d2df

SHA256
066be9cf219a4cd4c483db95faa420c5e9ca33b7e1d4b52acb3a27289996e6c7

SHA512
7a394bf2a9d5d42dc0981b38b5034a0e06c916adfd2179daefc6850e041114957a352a2c221c9e7133a64d619fbd4f059961fc3eecd0a6dcb8487af8a5a4467e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
3KB

MD5
7dc3973bfaf45ee72e9b7ce9f2161273

SHA1
7bdef506ef980f2f6e9fa1e5874840f2e0e27f65

SHA256
10d9426c9a085c7dce45d041e7326d9c55a52d69652c1f3238c25a7ae5283223

SHA512
64322849f8a2521fe8b66e55e4eeaa6fef202a809f8c89b03f74aa7f63abf0ae2b6d622493994df4c83b454da55993180c864aac8a45df89f2ba56612f4a68e7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
3KB

MD5
707138e444f4b17bb90b79e8a74eedb5

SHA1
b1e82740910d9745663888ba0aa40782e6f3405a

SHA256
298ba6b4644b4c1af6054da690e27c671c54cffb529f4f1432dee6ea89d36f65

SHA512
8cdc9348f19a8abe343b03b3e4767de733bba2ec980a38dc8edd0ad1a20bfb1473f3b3772a5c377ffe32545733501c3fa3d3774c375484673b478e34078caf51

Download Submit
\??\c:\users\admin\appdata\roaming\anydesk\printer_driver\AnyDeskPrintDriver.cat

Filesize
22KB

MD5
24479253cf8300bc751fcf1b599b11ff

SHA1
070e03f6a607c07468332189a2af82b1258f611f

SHA256
b7ed09e5141965dd3f058e87513a778d6b76905a98299a44a96303f89f76f877

SHA512
7eab3f61b4dcfcc4e80efb90078b5c306eb5240711ee07379626e77e50009a77aab79feff43a2b85e7bf7f2fc2f62205fc2ce095e99582170aa89134efd7b92c

Download Submit
\??\c:\users\admin\appdata\roaming\anydesk\printer_driver\anydeskprintdriver.inf

Filesize
1KB

MD5
4fd72ea7caab0a5701ae754ff971977c

SHA1
6a432aa100f0214cfb0578140882e0a8a6ca473f

SHA256
9ebbdb3a72bc8f74f71559ce9b069f46e362ffb506cef791f1e40bf624856cfd

SHA512
7003d768d51b46c979924e02ebfabdc56b465865751914ae42fa1fcc5e3f25560fc2ed851c5c19a8768f64b9df5949b8c45cde65bee4321227eac1307467a4b7

Download Submit
\??\c:\users\admin\appdata\roaming\anydesk\printer_driver\v4.cab

Filesize
140KB

MD5
493064af94247b271eecca1b9ae654dd

SHA1
95f32d864f6f6913aa435cb53f88016093c53648

SHA256
510b7fb3af6c02f71a20c10fe8be8c2d42054f93cd1bd01a58aee31760655a1a

SHA512
5b3f0643426ef4544e35315affacc1af4da45d9c9d99b61b6ce0a387ecaf6a752f0e7e145698f3f2320fd9a1b53bf99b0661f2d3d852d858d3481cbd790cf496

Download Submit
memory/564-544-0x0000000000570000-0x0000000001BB2000-memory.dmp

Filesize
22.3MB

Download
memory/564-540-0x0000000000570000-0x0000000001BB2000-memory.dmp

Filesize
22.3MB

Download
memory/564-498-0x0000000000570000-0x0000000001BB2000-memory.dmp

Filesize
22.3MB

Download
memory/564-711-0x0000000000570000-0x0000000001BB2000-memory.dmp

Filesize
22.3MB

Download
memory/564-705-0x0000000000570000-0x0000000001BB2000-memory.dmp

Filesize
22.3MB

Download
memory/2156-10-0x0000000000F40000-0x0000000002582000-memory.dmp

Filesize
22.3MB

Download
memory/2156-43-0x00000000052E0000-0x00000000052FB000-memory.dmp

Filesize
108KB

Download
memory/2156-240-0x0000000000F40000-0x0000000002582000-memory.dmp

Filesize
22.3MB

Download
memory/2156-40-0x00000000052E0000-0x00000000052FB000-memory.dmp

Filesize
108KB

Download
memory/2156-252-0x0000000000F40000-0x0000000002582000-memory.dmp

Filesize
22.3MB

Download
memory/2156-42-0x00000000052E0000-0x00000000052FB000-memory.dmp

Filesize
108KB

Download
memory/2156-182-0x0000000000F40000-0x0000000002582000-memory.dmp

Filesize
22.3MB

Download
memory/3368-7-0x0000000000F40000-0x0000000002582000-memory.dmp

Filesize
22.3MB

Download
memory/3368-0-0x0000000000F44000-0x0000000002046000-memory.dmp

Filesize
17.0MB

Download
memory/3368-236-0x0000000000F44000-0x0000000002046000-memory.dmp

Filesize
17.0MB

Download
memory/3368-237-0x0000000000F40000-0x0000000002582000-memory.dmp

Filesize
22.3MB

Download
memory/3368-108-0x0000000000F40000-0x0000000002582000-memory.dmp

Filesize
22.3MB

Download
memory/3368-2-0x0000000000F40000-0x0000000002582000-memory.dmp

Filesize
22.3MB

Download
memory/3368-251-0x0000000000F44000-0x0000000002046000-memory.dmp

Filesize
17.0MB

Download
memory/3368-250-0x0000000000F40000-0x0000000002582000-memory.dmp

Filesize
22.3MB

Download
memory/3848-539-0x0000000000570000-0x0000000001BB2000-memory.dmp

Filesize
22.3MB

Download
memory/3848-702-0x0000000000570000-0x0000000001BB2000-memory.dmp

Filesize
22.3MB

Download
memory/3848-490-0x0000000000570000-0x0000000001BB2000-memory.dmp

Filesize
22.3MB

Download
memory/3848-493-0x0000000000570000-0x0000000001BB2000-memory.dmp

Filesize
22.3MB

Download
memory/3848-390-0x0000000000570000-0x0000000001BB2000-memory.dmp

Filesize
22.3MB

Download
memory/3980-363-0x0000000000F40000-0x0000000002582000-memory.dmp

Filesize
22.3MB

Download
memory/3980-247-0x0000000000F40000-0x0000000002582000-memory.dmp

Filesize
22.3MB

Download
memory/4624-14-0x0000000000F40000-0x0000000002582000-memory.dmp

Filesize
22.3MB

Download
memory/4624-238-0x0000000000F40000-0x0000000002582000-memory.dmp

Filesize
22.3MB

Download
memory/4624-183-0x0000000000F40000-0x0000000002582000-memory.dmp

Filesize
22.3MB

Download
memory/4624-11-0x0000000000F40000-0x0000000002582000-memory.dmp

Filesize
22.3MB

Download
memory/4844-535-0x0000000000570000-0x0000000001BB2000-memory.dmp

Filesize
22.3MB

Download
memory/4844-545-0x0000000000570000-0x0000000001BB2000-memory.dmp

Filesize
22.3MB

Download
memory/4844-289-0x0000000004BF0000-0x0000000004C0B000-memory.dmp

Filesize
108KB

Download
memory/4844-275-0x0000000000570000-0x0000000001BB2000-memory.dmp

Filesize
22.3MB

Download
memory/4844-293-0x0000000004BF0000-0x0000000004C0B000-memory.dmp

Filesize
108KB

Download
memory/4844-464-0x0000000000570000-0x0000000001BB2000-memory.dmp

Filesize
22.3MB

Download
memory/4844-706-0x0000000000570000-0x0000000001BB2000-memory.dmp

Filesize
22.3MB

Download
memory/4844-292-0x0000000004BF0000-0x0000000004C0B000-memory.dmp

Filesize
108KB

Download
memory/4844-541-0x0000000000570000-0x0000000001BB2000-memory.dmp

Filesize
22.3MB

Download
memory/4956-388-0x0000000000570000-0x0000000001BB2000-memory.dmp

Filesize
22.3MB

Download
memory/4956-489-0x0000000000570000-0x0000000001BB2000-memory.dmp

Filesize
22.3MB

Download
memory/4956-538-0x0000000000570000-0x0000000001BB2000-memory.dmp

Filesize
22.3MB

Download
memory/4956-713-0x0000000000570000-0x0000000001BB2000-memory.dmp

Filesize
22.3MB

Download
memory/4956-701-0x0000000000570000-0x0000000001BB2000-memory.dmp

Filesize
22.3MB

Download