fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca

Analysis

max time kernel
266s
max time network
1737s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AnyDesk.exe
Size

5.3MB
MD5

0a269c555e15783351e02629502bf141
SHA1

8fefa361e9b5bce4af0090093f51bcd02892b25d
SHA256

fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca
SHA512

b1784109f01d004f2f618e91695fc4ab9e64989cdedc39941cb1a4e7fed9032e096190269f3baefa590cc98552af5824d0f447a03213e4ae07cf55214758725a
SSDEEP

98304:Uc9HTcGO0ImBimas54Ub5ixTStxZi/l9K0+zLVasSe4JnzMpm+Gq:UcpYGO0IOqs57bUwxG9CVaskJIYE

Score

6^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	AnyDesk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	AnyDesk.exe

Drops file in System32 directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\COMDLG32.OCX	TMACv6.0.7_Setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\MSCOMCTL.OCX	TMACv6.0.7_Setup.exe
File opened for modification	C:\Windows\SysWOW64\TABCTL32.OCX	TMACv6.0.7_Setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\MSCHRT20.OCX	TMACv6.0.7_Setup.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Technitium\TMACv6.0\CLIHelp.txt	TMACv6.0.7_Setup.exe
File opened for modification	C:\Program Files (x86)\Technitium\TMACv6.0\Default.tpf	TMACv6.0.7_Setup.exe
File opened for modification	C:\Program Files (x86)\Technitium\TMACv6.0\EULA.txt	TMACv6.0.7_Setup.exe
File opened for modification	C:\Program Files (x86)\Technitium\TMACv6.0\logo.gif	TMACv6.0.7_Setup.exe
File opened for modification	C:\Program Files (x86)\Technitium\TMACv6.0\normal_back_blue_w800.jpg	TMACv6.0.7_Setup.exe
File opened for modification	C:\Program Files (x86)\Technitium\TMACv6.0\oui.db	TMACv6.0.7_Setup.exe
File opened for modification	C:\Program Files (x86)\Technitium\TMACv6.0\Installer.exe	TMACv6.0.7_Setup.exe
File opened for modification	C:\Program Files (x86)\Technitium\TMACv6.0\index.css	TMACv6.0.7_Setup.exe
File opened for modification	C:\Program Files (x86)\Technitium\TMACv6.0\normal_footer_back_h30.jpg	TMACv6.0.7_Setup.exe
File opened for modification	C:\Program Files (x86)\Technitium\TMACv6.0\normal_logo_back.jpg	TMACv6.0.7_Setup.exe
File opened for modification	C:\Program Files (x86)\Technitium\TMACv6.0\Read Me.txt	TMACv6.0.7_Setup.exe
File opened for modification	C:\Program Files (x86)\Technitium\TMACv6.0\TMAC.exe	TMACv6.0.7_Setup.exe
File opened for modification	C:\Program Files (x86)\Technitium\TMACv6.0\help.html	TMACv6.0.7_Setup.exe

Executes dropped EXE 4 IoCs

pid	Process
1092	TMAC.exe
1092	TMAC.exe
1092	TMAC.exe
1092	TMAC.exe

Loads dropped DLL 36 IoCs

pid	Process
4796	AnyDesk.exe
4736	AnyDesk.exe
2572	regsvr32.exe
3500	regsvr32.exe
2316	regsvr32.exe
3940	regsvr32.exe
1092	TMAC.exe
1092	TMAC.exe
1092	TMAC.exe
4796	AnyDesk.exe
4736	AnyDesk.exe
2572	regsvr32.exe
3500	regsvr32.exe
2316	regsvr32.exe
3940	regsvr32.exe
1092	TMAC.exe
1092	TMAC.exe
1092	TMAC.exe
4796	AnyDesk.exe
4736	AnyDesk.exe
2572	regsvr32.exe
3500	regsvr32.exe
2316	regsvr32.exe
3940	regsvr32.exe
1092	TMAC.exe
1092	TMAC.exe
1092	TMAC.exe
4796	AnyDesk.exe
4736	AnyDesk.exe
2572	regsvr32.exe
3500	regsvr32.exe
2316	regsvr32.exe
3940	regsvr32.exe
1092	TMAC.exe
1092	TMAC.exe
1092	TMAC.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TMACv6.0.7_Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TMAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AnyDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AnyDesk.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 48 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{DD9DA666-8594-11D1-B16A-00C0F0283628}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDD1F04B-858B-11D1-B16A-00C0F0283628}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\AlternateCLSID = "{CCDB0DF2-FD1A-4856-80BC-32929D8359B7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1EFB6596-857C-11D1-B16A-00C0F0283628}\AlternateCLSID = "{9A948063-66C3-4F63-AB46-582EDAA35047}"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{7DC6F291-BF55-4E50-B619-EF672D9DCC58}\Compatibility Flags = "1024"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{DD9DA666-8594-11D1-B16A-00C0F0283628}\AlternateCLSID = "{87DACC48-F1C5-4AF3-84BA-A2A72C2AB959}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2C247F23-8591-11D1-B16A-00C0F0283628}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F91CAF91-225B-43A7-BB9E-472F991FC402}\Compatibility Flags = "1024"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{996BF5E0-8044-4650-ADEB-0B013914E99C}\AlternateCLSID = "{CCDB0DF2-FD1A-4856-80BC-32929D8359B7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{979127D3-7D01-4FDE-AF65-A698091468AF}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8E3867A3-8586-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{7DC6F291-BF55-4E50-B619-EF672D9DCC58}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2C247F23-8591-11D1-B16A-00C0F0283628}\AlternateCLSID = "{556C2772-F1AD-4DE1-8456-BD6E8F66113B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F91CAF91-225B-43A7-BB9E-472F991FC402}\AlternateCLSID = "{556C2772-F1AD-4DE1-8456-BD6E8F66113B}"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{979127D3-7D01-4FDE-AF65-A698091468AF}\Compatibility Flags = "1024"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F08DF954-8592-11D1-B16A-00C0F0283628}\AlternateCLSID = "{0B314611-2C19-4AB4-8513-A6EEA569D3C4}"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C74190B6-8589-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{996BF5E0-8044-4650-ADEB-0B013914E99C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{35053A22-8589-11D1-B16A-00C0F0283628}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8E3867A3-8586-11D1-B16A-00C0F0283628}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8E3867A3-8586-11D1-B16A-00C0F0283628}\AlternateCLSID = "{585AA280-ED8B-46B2-93AE-132ECFA1DAFC}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{24B224E0-9545-4A2F-ABD5-86AA8A849385}\AlternateCLSID = "{9A948063-66C3-4F63-AB46-582EDAA35047}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{66833FE6-8583-11D1-B16A-00C0F0283628}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C74190B6-8589-11D1-B16A-00C0F0283628}\AlternateCLSID = "{95F0B3BE-E8AC-4995-9DCA-419849E06410}"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2C247F23-8591-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{35053A22-8589-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{627C8B79-918A-4C5C-9E19-20F66BF30B86}\AlternateCLSID = "{585AA280-ED8B-46B2-93AE-132ECFA1DAFC}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1EFB6596-857C-11D1-B16A-00C0F0283628}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{66833FE6-8583-11D1-B16A-00C0F0283628}\AlternateCLSID = "{8B2ADD10-33B7-4506-9569-0A1E1DBBEBAE}"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{996BF5E0-8044-4650-ADEB-0B013914E99C}\Compatibility Flags = "1024"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{627C8B79-918A-4C5C-9E19-20F66BF30B86}\Compatibility Flags = "1024"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{7DC6F291-BF55-4E50-B619-EF672D9DCC58}\AlternateCLSID = "{8B2ADD10-33B7-4506-9569-0A1E1DBBEBAE}"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}\Compatibility Flags = "1024"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{979127D3-7D01-4FDE-AF65-A698091468AF}\AlternateCLSID = "{CCDB0DF2-FD1A-4856-80BC-32929D8359B7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{627C8B79-918A-4C5C-9E19-20F66BF30B86}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{24B224E0-9545-4A2F-ABD5-86AA8A849385}\Compatibility Flags = "1024"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}\AlternateCLSID = "{95F0B3BE-E8AC-4995-9DCA-419849E06410}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F91CAF91-225B-43A7-BB9E-472F991FC402}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{35053A22-8589-11D1-B16A-00C0F0283628}\AlternateCLSID = "{A0E7BF67-8D30-4620-8825-7111714C7CAB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F08DF954-8592-11D1-B16A-00C0F0283628}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F08DF954-8592-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{24B224E0-9545-4A2F-ABD5-86AA8A849385}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{66833FE6-8583-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C74190B6-8589-11D1-B16A-00C0F0283628}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}	regsvr32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCDB0DF2-FD1A-4856-80BC-32929D8359B7}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD9DA660-8594-11D1-B16A-00C0F0283628}\ = "IComboItem"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9E074F4-BA0A-11D1-B137-0000F8753F5D}\ = "IVcPlotBase"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9E0750E-BA0A-11D1-B137-0000F8753F5D}\TypeLib\ = "{65E121D4-0C60-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A948063-66C3-4F63-AB46-582EDAA35047}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F08DF952-8592-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9E0750A-BA0A-11D1-B137-0000F8753F5D}\TypeLib\Version = "2.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TabDlg.SSTab\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C247F24-8591-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC5D0DE5-BD4C-11D1-B137-0000F8753F5D}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9E07515-BA0A-11D1-B137-0000F8753F5D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0E7BF67-8D30-4620-8825-7111714C7CAB}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE37-8596-11D1-B16A-00C0F0283628}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSCOMCTL.OCX"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FE4-8583-11D1-B16A-00C0F0283628}\ = "IToolbar"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9E0751F-BA0A-11D1-B137-0000F8753F5D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A2B370A-BA0A-11D1-B137-0000F8753F5D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.Toolbar	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FE4-8583-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9E074D3-BA0A-11D1-B137-0000F8753F5D}\TypeLib\ = "{65E121D4-0C60-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9E074DA-BA0A-11D1-B137-0000F8753F5D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0B314611-2C19-4AB4-8513-A6EEA569D3C4}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}\2.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC5D0DE5-BD4C-11D1-B137-0000F8753F5D}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSCHRT20.OCX"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{996BF5E0-8044-4650-ADEB-0B013914E99C}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE3F-8596-11D1-B16A-00C0F0283628}\ = "ListView Sort Property Page Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9E074FA-BA0A-11D1-B137-0000F8753F5D}\ = "IVcWeighting"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A2B370A-BA0A-11D1-B137-0000F8753F5D}\TypeLib\ = "{65E121D4-0C60-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A2B370B-BA0A-11D1-B137-0000F8753F5D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9E074DE-BA0A-11D1-B137-0000F8753F5D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9E074DE-BA0A-11D1-B137-0000F8753F5D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A2B370B-BA0A-11D1-B137-0000F8753F5D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\MSCOMCTL.OCX, 2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{556C2772-F1AD-4DE1-8456-BD6E8F66113B}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{87DACC48-F1C5-4AF3-84BA-A2A72C2AB959}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSCOMCTL.OCX"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C74190B5-8589-11D1-B16A-00C0F0283628}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9E074D8-BA0A-11D1-B137-0000F8753F5D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{979127D3-7D01-4FDE-AF65-A698091468AF}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C247F26-8591-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA662-8594-11D1-B16A-00C0F0283628}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9043C87-F6F2-101A-A3C9-08002B2F49FB}\TypeLib\Version = "1.2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9E074DE-BA0A-11D1-B137-0000F8753F5D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9E074E6-BA0A-11D1-B137-0000F8753F5D}\ = "IVcFootnote"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9E07506-BA0A-11D1-B137-0000F8753F5D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9E0751B-BA0A-11D1-B137-0000F8753F5D}\ = "IVcAxisGrid"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95F0B3BE-E8AC-4995-9DCA-419849E06410}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.Toolbar\CLSID\ = "{66833FE6-8583-11D1-B16A-00C0F0283628}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{585AA280-ED8B-46B2-93AE-132ECFA1DAFC}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\TypeLib\ = "{F9043C88-F6F2-101A-A3C9-08002B2F49FB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9E07502-BA0A-11D1-B137-0000F8753F5D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9E074CD-BA0A-11D1-B137-0000F8753F5D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9E074D1-BA0A-11D1-B137-0000F8753F5D}\TypeLib\ = "{65E121D4-0C60-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ListViewCtrl\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\ToolboxBitmap32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FE7-8583-11D1-B16A-00C0F0283628}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{95F0B3BE-E8AC-4995-9DCA-419849E06410}\CONTROL	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC5D0DE0-BD4C-11D1-B137-0000F8753F5D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{979127D3-7D01-4FDE-AF65-A698091468AF}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9E074D6-BA0A-11D1-B137-0000F8753F5D}\TypeLib	regsvr32.exe

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
4736	AnyDesk.exe
4736	AnyDesk.exe
4736	AnyDesk.exe
4736	AnyDesk.exe
812	msedge.exe
812	msedge.exe
512	msedge.exe
512	msedge.exe
5080	identity_helper.exe
5080	identity_helper.exe
3596	msedge.exe
3596	msedge.exe
4736	AnyDesk.exe
4736	AnyDesk.exe
4736	AnyDesk.exe
4736	AnyDesk.exe
812	msedge.exe
812	msedge.exe
512	msedge.exe
512	msedge.exe
5080	identity_helper.exe
5080	identity_helper.exe
3596	msedge.exe
3596	msedge.exe
4736	AnyDesk.exe
4736	AnyDesk.exe
4736	AnyDesk.exe
4736	AnyDesk.exe
812	msedge.exe
812	msedge.exe
512	msedge.exe
512	msedge.exe
5080	identity_helper.exe
5080	identity_helper.exe
3596	msedge.exe
3596	msedge.exe
4736	AnyDesk.exe
4736	AnyDesk.exe
4736	AnyDesk.exe
4736	AnyDesk.exe
812	msedge.exe
812	msedge.exe
512	msedge.exe
512	msedge.exe
5080	identity_helper.exe
5080	identity_helper.exe
3596	msedge.exe
3596	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 56 IoCs

pid	Process
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4736	AnyDesk.exe
Token: SeDebugPrivilege	4736	AnyDesk.exe
Token: SeDebugPrivilege	4736	AnyDesk.exe
Token: SeDebugPrivilege	4736	AnyDesk.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
2740	TMACv6.0.7_Setup.exe
1092	TMAC.exe
1092	TMAC.exe
1092	TMAC.exe
1092	TMAC.exe
1092	TMAC.exe
1092	TMAC.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
1092	TMAC.exe
1092	TMAC.exe
1092	TMAC.exe
1092	TMAC.exe
1092	TMAC.exe
1092	TMAC.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
4796	AnyDesk.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
3672	AnyDesk.exe
3672	AnyDesk.exe
2740	TMACv6.0.7_Setup.exe
2740	TMACv6.0.7_Setup.exe
1092	TMAC.exe
1092	TMAC.exe
3672	AnyDesk.exe
3672	AnyDesk.exe
2740	TMACv6.0.7_Setup.exe
2740	TMACv6.0.7_Setup.exe
1092	TMAC.exe
1092	TMAC.exe
3672	AnyDesk.exe
3672	AnyDesk.exe
2740	TMACv6.0.7_Setup.exe
2740	TMACv6.0.7_Setup.exe
1092	TMAC.exe
1092	TMAC.exe
3672	AnyDesk.exe
3672	AnyDesk.exe
2740	TMACv6.0.7_Setup.exe
2740	TMACv6.0.7_Setup.exe
1092	TMAC.exe
1092	TMAC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 4736	1048	AnyDesk.exe	83
PID 1048 wrote to memory of 4736	1048	AnyDesk.exe	83
PID 1048 wrote to memory of 4736	1048	AnyDesk.exe	83
PID 1048 wrote to memory of 4796	1048	AnyDesk.exe	84
PID 1048 wrote to memory of 4796	1048	AnyDesk.exe	84
PID 1048 wrote to memory of 4796	1048	AnyDesk.exe	84
PID 512 wrote to memory of 3340	512	msedge.exe	110
PID 512 wrote to memory of 3340	512	msedge.exe	110
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 2372	512	msedge.exe	111
PID 512 wrote to memory of 812	512	msedge.exe	112
PID 512 wrote to memory of 812	512	msedge.exe	112
PID 512 wrote to memory of 3392	512	msedge.exe	113
PID 512 wrote to memory of 3392	512	msedge.exe	113
PID 512 wrote to memory of 3392	512	msedge.exe	113
PID 512 wrote to memory of 3392	512	msedge.exe	113
PID 512 wrote to memory of 3392	512	msedge.exe	113
PID 512 wrote to memory of 3392	512	msedge.exe	113
PID 512 wrote to memory of 3392	512	msedge.exe	113
PID 512 wrote to memory of 3392	512	msedge.exe	113
PID 512 wrote to memory of 3392	512	msedge.exe	113
PID 512 wrote to memory of 3392	512	msedge.exe	113
PID 512 wrote to memory of 3392	512	msedge.exe	113
PID 512 wrote to memory of 3392	512	msedge.exe	113
PID 512 wrote to memory of 3392	512	msedge.exe	113
PID 512 wrote to memory of 3392	512	msedge.exe	113

C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4736
- - C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
    "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend
    3⤵
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3672
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x78,0x128,0x7ffc4be446f8,0x7ffc4be44708,0x7ffc4be44718
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,1521608844463043743,5316859715123227188,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,1521608844463043743,5316859715123227188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,1521608844463043743,5316859715123227188,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1521608844463043743,5316859715123227188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1521608844463043743,5316859715123227188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1521608844463043743,5316859715123227188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1521608844463043743,5316859715123227188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2060 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,1521608844463043743,5316859715123227188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,1521608844463043743,5316859715123227188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1521608844463043743,5316859715123227188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1521608844463043743,5316859715123227188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1521608844463043743,5316859715123227188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1521608844463043743,5316859715123227188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1521608844463043743,5316859715123227188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1521608844463043743,5316859715123227188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1521608844463043743,5316859715123227188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1521608844463043743,5316859715123227188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1521608844463043743,5316859715123227188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,1521608844463043743,5316859715123227188,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1521608844463043743,5316859715123227188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,1521608844463043743,5316859715123227188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2700

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1732

C:\Users\Admin\AppData\Local\Temp\Temp1_TMACv6.0.7_Setup.zip\TMACv6.0.7_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_TMACv6.0.7_Setup.zip\TMACv6.0.7_Setup.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2740
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s "C:\Windows\system32\MSCOMCTL.OCX"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:2572
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s "C:\Windows\system32\COMDLG32.OCX"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:3500
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s "C:\Windows\system32\MSCHRT20.OCX"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2316
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s "C:\Windows\system32\TABCTL32.OCX"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:3940

C:\Program Files (x86)\Technitium\TMACv6.0\TMAC.exe
"C:\Program Files (x86)\Technitium\TMACv6.0\TMAC.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Technitium\TMACv6.0\Installer.exe

Filesize
189KB

MD5
9473840ec1c2981e805da17c0b700c49

SHA1
fdd826931c215717861254b099dba057b740e242

SHA256
00cb5fee0ba2ac509195187df7d97d9ff08ffcb7df2a3af076a739e0c29781f4

SHA512
8ba9ef5cc94e75d48aaa1440ae45841a4b002c5a64584b6a6dd7e4bc2f0ede8d576537d8f14dfd2d76f6e2f6de847102ec4f6755d4a1314b4dd891919ee8cce9

Download Submit
C:\Program Files (x86)\Technitium\TMACv6.0\TMAC.exe

Filesize
712KB

MD5
230b4c45774e95dd75241068c68aeb0d

SHA1
ef46dd76a8c6d4a7d6882469015a07a9bf660a50

SHA256
6c3d76c9a4d1652ce25ae8c2ba1907167cfaa0054b8e1325f370c52eafa74c97

SHA512
fc08d219e1023d7929250ecab81f640e4114f51b184d9004da0887c93b24a6026931a71da4ef0e95caa2a416d858496b5e174bcd0dd3bd3a76bca6582283e90c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ead8f8288900f78ad2deeedff6ced488

SHA1
9ddc573562bc102867dbd9de180ce1655e41630f

SHA256
1e5ed633e79cc1985828e8ed93ceb1eceab35f1f09665410a9ec8b02ea6d8b29

SHA512
07d98cb112afb29e6caa7b1024dcf72151ceb3c239080431f80e55e15c608ff3a0845fcfab75a1c204b3179641ebd8f9c047675457bfef4c330c658e823cabe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7a3cc95452a9ad26bd2b6e076fedfda9

SHA1
06113ff181bce610a8466bdfcb4e46a2b2fd0c63

SHA256
4ee18bd27968182cff17ff5f3f886f5f7831b39703efb8c61f4cf0e5201a110c

SHA512
19e6daa220d5463a1681bacf9841528a607ff98dc9f5cca1b037984df8d5e1a923ce93a0df345aa193fbad00e9148819acf0a2fed2dcd68b1056576d38715196

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7dd31756bc6068b16ddc50f607726bf8

SHA1
437df4dbadcfac78c265a9db8bd2193109254024

SHA256
fa6309e04f987959aeda5b0791c6b7f9cbf28c42d374d23635b599d2d37a1c00

SHA512
b9d80a54cccf94f86c989b8bf665c90b54f685def9ec186db19f2c8507585238493760a0c1c9ad59bf0f9f30e8abf8db6644a6a4649cefe50c3b7e87e964a33c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
54ed818ca4e830c98edc28e3648a96ca

SHA1
0f35de9053f6c9715a5709c26092dd93128b6cb7

SHA256
048b153183af398ca723bb8fdb419136b0bd646842065b8d4bf177b5f9619ba8

SHA512
b8b4579d441ea41f0277e50747d53cda5746d75f72dcdcc15c15fb518536109c3c09d96cf5259f3314602aa222fbacf95887569016ce48ed23501bae800cae61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fda6e1e9de7399cc8c5c1d7ad899e163

SHA1
ce7748cb8cb235681ef29de9d0d5ebb1b673a9f0

SHA256
f2565bae4c23189e6666ef7c7c86a4126f6bba13d208db42ad6c73d6088730f8

SHA512
d3e3e552a7adad6e19d7a45e7f76431236c0ded19a2e980d3b1aeb54b9208b8521f8be3412849a96eacfac85a376af5318b8f4ea5338a2cb30d68d5fe02e7053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7168b9528e689ba9cb7ed8eeaf11c1ad

SHA1
cdfe1ef57b6cdb18f38618ddced586b3fd794378

SHA256
c9b8646121aafcbd0cdc321bc2fb9c568e219a25657a3e438a4633c9dd210a6a

SHA512
9cb2c4a8317a9b4f57d79111a10e01bf99e6d7686a4254fdcdfd6219df57a4d766aa81f2672c7efe7fb39fd5622ffb5b9ee5df104fdf51dd2b1396e26c8641fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e746a05cf32e364f91ddd245c88c7c6b

SHA1
c1f760e4b38c52c040d0a9e70a45336c25b12400

SHA256
43cdcb4eeac4ed2ced13edfad450b98b12cf04329d6843168cca204d84a1acbf

SHA512
ed9898f15fdeb610c9df69fa98c665ec12045e16e2a367402ab5c9c8c214ad5868a2e8e6cfd874739ff8d98d4553a271ab25ff6c82c0582780ed8f51655f580a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
011cabc0b4fdd6507d1fc3f13269c6a5

SHA1
b961c2ddc6fae43921de8ca49f731d1fc9dee5ac

SHA256
013d81bfc5ece4b9c39757ad4f32f39e0ac975bc6723ebf4b2f1a725eb58fcec

SHA512
ad51204c07c23d1849971e5b7828327592ceb24efe33f8cc5d4e702597634fdb927a64a7917f0545f8b90ac92253cb9fb1b69990105306f41b9e0843ce1e041a

Download Submit
C:\Users\Admin\AppData\Local\Temp\gcapi.dll

Filesize
64KB

MD5
ecb9969b560eabbf7894b287d110eb4c

SHA1
783ded8c10cc919402a665c0702d6120405cee5d

SHA256
eb8ba080d7b2b98d9c451fbf3a43634491b1fbb563dbbfbc878cbfd728558ea6

SHA512
d86faac12f13fcb9570dff01df0ba910946a33eff1c1b1e48fb4b17b0fb61dded6abf018574ac8f3e36b9cf11ec025b2f56bb04dd00084df243e6d9d32770942

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
8KB

MD5
713563aa8fa55955fa185d3cfb24c218

SHA1
5f1033655927a5bc2173a86d6ca3c76775ac337a

SHA256
f28a617327dba872c1e17c3bb42e53e7ac56e03b82bdf2b9da66da023dd43c43

SHA512
e836e51563bc72d677e49ba0995df8e6d6e4f74948fbd638bd1c4d639262f4298af05d7898ac3ecfbc2a3b2cc317d581827aef8d4194a917ade137b0b2b366f6

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
9KB

MD5
2ea509d9a8aca11758a16f3745ca2565

SHA1
80322a626b8aff11604cbb36fd2de594b57abba1

SHA256
f2772bf283f111c501d1e65eb5355f71c088e399ef38dbee0da80c75daf58671

SHA512
9c50b47485a8335c23757cff4d0c140445be11c5af7d89bf0c34d314feef1d5b9327ac498b93817740f59e44fa82fef78bec16a9e84b6ab6272eeca6bc0ca6a1

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
42KB

MD5
f9e3e9820edcdf9c5b420977837362ac

SHA1
9d3fa92b7b3a40eb09385eaa98b466d5cd9f5263

SHA256
d1cf35354628109353d1ccb14ab21858e1b72f837215258ded3c3d10526d587f

SHA512
b6e26417e6066ef885ae479936a69a19092d38e9ba3e1c8c30d1d71ece6c90862774ecb0ba7fa880b2eec9a17199070d29f6789c75fffd8d79e01bde1077b402

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
b6f10fe0da63686437ae173a1d3f0532

SHA1
7798dba5d5b6cd00ce53daa09dba7963e66c4a9c

SHA256
dab1ca5cb275bd6287cf233903ac1159a7daa29952dedeb16f7ecfb11bf66b97

SHA512
60fd6fd1595a33dccf348b5335cf7b72e23e9629c23aedfc84399f424537c2dad2780a78760404de06439bfc2b72fd86868b1e2e1fc3e3f3c17191cd9d54212d

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
1e10cf6c81facff789bbb360b319e35d

SHA1
546517bc3eac25eef4549dd5c7f7c3a6aa13e282

SHA256
ad10b3fd7eec579139644721137d4d847a2b549c9a5ac0007454e8edb7ddd706

SHA512
c2dfb6ee3875303ca4f7c5a249fa795bed7e280d79c3805b37650b9f476c6425a87688bb4ec8f3d52453e3358742a4d6cd122692f9f9944745dbd9449183d7c7

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
766B

MD5
d870c7712a0e1ae441a9f1e21b448116

SHA1
c844896e6ab93a40e3412b4b35d07074db5a1af2

SHA256
d9b74eccade8f86695bfafcf17984f776920f84aaff01abb0e23d09883dc3c85

SHA512
287121d01b4c5f365c1106ec67200945d145891f595f88fed90b763e137d9c7d56abf98cf457ef99f4fddf03dbf5e6f447715e74115157277b7a2bbbb0bae984

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
823B

MD5
7a5f13a4424fdd48d6d5551e1b93e883

SHA1
73d4ff07961adb608b49d44e0d7bc420a7646150

SHA256
2a3b26aec133829b8699db65beb9dc460ac76b5c356caad600fcb7cd6d215ce2

SHA512
17650cbf3a6f58132d04e39542c5be01b38a02403487227397cde9f1f71ddbabb1f2972865fff61af1652b1f0875fa487678e1d70dc5ba2a5df6f97c9274dd58

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
832B

MD5
537e29e3db987e28329a3190ba377ba9

SHA1
ed77bfe93a9985630db66246062297c2fc0f5caa

SHA256
09edd21b4d0d38bbc57dc288df0a9b1f61d1f9e0a821ed4d0425f1938e37ecae

SHA512
8ca0fa5032a945528db39dbf485f233bf42990d31f0524c96ec11a32e02a6843f8375d6d63d037d49e3493f50a5280ab62d70a3856179e50b5c685ac1c2f1f05

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
312B

MD5
0c04ad1083dc5c7c45e3ee2cd344ae38

SHA1
f1cf190f8ca93000e56d49732e9e827e2554c46f

SHA256
6452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0

SHA512
6c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
468B

MD5
09be18708025645eeb3766a80088d957

SHA1
e005b2dbbf8d5147c9870d6eaae79431c27df64f

SHA256
b8c6dda0508ef1b64b013b022df393186ba7d0b408d6d2611d1d3eca03133d28

SHA512
900dc7480a19dc410a401bb19485860e6a7b92e9d4a4e4a50f4f8ed302f1a1c07464eac35d5ef875097ffc9948f5bb6d55e064d6213bc3ed2b265c36816e25cf

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
468B

MD5
49783e8c94d84e2c6aa42e727d0e999b

SHA1
7b9f94d4ab620a55741b461e0396dd225af40570

SHA256
69e6d4ef56ffcf0b0fba21b8547dfa4a2e22990d31e6ba80a993f8f5d51b64a6

SHA512
bd1c600f25e452ba45d65e1816f30b7f11d83d2dade9864867f71e944e7bd3e4c4aef0e30f7e37a3fe0625da09f7edbe784839f8462ad2759dc22fde90681093

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
5KB

MD5
09520007e4f4986a0c1a82fc607c880c

SHA1
05d495699a05301193d66799db283289c94086b5

SHA256
437a3788e1a68b02a4d1d1a8474478a5a1de793d8ecfc17c543742c1c7b219cd

SHA512
2a97dd2f1f002a709bae72d3179ef8fe5f62f50d3bc4c322340dc5e45f810dfc557a53c8edec02ac4ac97486b7507d4040f2243c63fb197d4f589e1637245705

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
d9218ba1082740c65b1d121d9b7a3447

SHA1
100cfce025925e39068d7e6bcbef011a1c32abf4

SHA256
383555b2b380ccd4f0067112d9e252933dc9dafa9a3d4c395459fc9fd4b27494

SHA512
cc82ff034935d38ba06b21a2d07a181df4a49c12de7cfc21c788f78a2c00c8050f8b478a80a3e8c525a9a035963b9acc5b968022b0c705152fd8fcd73e1c05fd

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
5a30c3213f1a3f24390572dd80345378

SHA1
2e643bd4c7ca94e6ceb60bc480db6d6f54967dd4

SHA256
5ffb74ea52a70567a63167d07a3048d519104d1956c6d7e6d94ca9775c8f60bb

SHA512
97d75092701b9c1ebe106019d5331d82fe92369931970310ce45474936196e935e5f3b78ebfa44312f2c021307b9b89d4768e82a40c9754fab4495820fd15753

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
2dd81747d51c086b04e588d874b1ac2a

SHA1
1ca638289310ae58cd1d34e9daec9a65508cce31

SHA256
53d51e1b96060a3afe652bfbaa81f27c7776bd622be18edba88ebd4c33baf661

SHA512
00dc9d7f7d030e2f5156e5972f6ea24c1ba697d6f640d8cdb10ed9079ea4670b38cdf5cd16db60c1c61bffbc613c223220bd63f2894ecee7334881c1ddcb925f

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
fd3c63ed419c4df63bd015636ca21d01

SHA1
aefa80f98cf7883a5690d49f1115d5164c98a4ab

SHA256
32375c3a6f562a484c3e3b092080d4ce95ddf10ba0d9848f54c8759f17daefea

SHA512
740b06d35498bf127a8f12295750b9c7065dfcbf8656585a8eaad9c52a859c2333afbd33607e69cafec226c49746b6626624d25aad88fb199a9b9c739039ad9d

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
5KB

MD5
831a1de78976ae42541e2630f9f7a7a1

SHA1
6a34dbac267454d3251ade10767b6bb23e8d3a23

SHA256
059254b90bd006c51f16f7c8c86420ea58246f63d6458ec1d24f8dc22ab6b602

SHA512
111fbd258860c021f0ac331d0ebb16d9ccbf38ad33bf556b9f0b2d4b88b295a9d53709d368fe7676a62c9f785dd085636c7e701f14033bfc10a90c59434747f3

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
5ab298d8b0a584f6e3a91510d4800f5a

SHA1
ac3786af538237c1ee1c04b4f69f208af2b838f2

SHA256
964a9a3fc23194313e8e541b68458d6ebac2ff5a84c9ec31156fcc8d0e5b1f57

SHA512
64e06bce1efc3225486bbaa0b466bce4373c73cda1223fc68da4f8dcc7fc58f38e1e9e53f504888321d0ed1fa1f30c834c79109f619c96322762c47efeab5ce0

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
28906fc709b5b879f8cfe3e903d543d1

SHA1
69e19b1b13caef88f9c423ac426035bd567120f2

SHA256
6e5555ecf5e1fc42e2ba14c7f209be3d6ea1d267deb6e95dbc3d1c1aca322b02

SHA512
bf86db395c36caaf7d24ea077dee15e865d7781aadcb163970b7dcab0aa7329faf91982deeec4f13a4e1032a5da3f1c50833e2a91ebc2959cf1f5e1595283465

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
ba004af5668563c30d116028eac78fc7

SHA1
0d6784b4c15da0d920a53e66bc8f974b269cdac3

SHA256
0ce5700c9b790d39bddb96a38daf54075cfbb87198f9d7c8363c18851d9c8c3b

SHA512
83044dc3fa831f904817a9cdc93698a5307b594b64d4c4d525df71ae24e348c47f9f5f2455c29662f4d8a708dbe81fa489759de7f5a341dfe7e81e756de4d7a5

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
20c2d385e786961725f7eeaf93fd3281

SHA1
3c2b42f17fd4218a0a5414102b7a07d502baf113

SHA256
5b2a8756bacd1c6747db5dd78b35d80f6ebfecb464fd775f9232114990d5411b

SHA512
58c7e313cb5f2a07db6c79f96101c152a86e838833d8b95e4e6418d001c6bf43ad65c7ef2b2daa00406c962e4ec7b58699fd5f94354def330d515dac1c8d8419

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 27683.crdownload

Filesize
2.1MB

MD5
aadb7f07999510a53480c9e36468f633

SHA1
7585c61b7f2557f85fcaf82d1fb1080fa947bce0

SHA256
6e63becaf5c5e17a9d3afb6e2104eee3dbe473c8930ae8783eba0fedadb4a152

SHA512
c10ce85ffa05d31257b2807762a35b7b18797384a8c7ebf41cb3d4357be0c5333a389cf76f38f49eabe1af13ff3a984958102854225c66b50dd7a0d514ee05e6

Download Submit
C:\Windows\SysWOW64\COMDLG32.OCX

Filesize
137KB

MD5
b73809a916e6d7c1ae56f182a2e8f7e2

SHA1
34e4213d8bf0e150d3f50ae0bd3f5b328e1105f5

SHA256
64c6ee999562961d11af130254ad3ffd24bb725d3c18e7877f9fd362f4936195

SHA512
26c28cb6c7e1b47425403ab8850a765ac420dd6474327ce8469376219c830ab46218383d15a73c9ea3a23fc6b5f392ee6e2a1632a1bf644b1bd1a05a4729e333

Download Submit
C:\Windows\SysWOW64\MSCHRT20.OCX

Filesize
987KB

MD5
38ce0c8fcd78d00fd717ce3a91214cbc

SHA1
953b182806a8ddcde48b033537e3432a56d1cf39

SHA256
de49eb9f935416cc57a1b590cca686e4a14e7b3cbbde10b8ff7fb88642a215ce

SHA512
bd7c0319953c5280d1e0f961cd6324c70c4949c0db0aa1cd77c27a8a1abfd6e592164a8888e3a06b5b127614d9b9caf1dfcae95b9e50216547a8e8ffb1f00006

Download Submit
C:\Windows\SysWOW64\MSCOMCTL.OCX

Filesize
1.0MB

MD5
766f501b61c22723536af696a74133d4

SHA1
b82b79c981da0750566cdbcccd8c7c6183e75d1b

SHA256
793fca37e1848495affb9bfbad543609d19e6549181e735ceb6f97b8e58faa26

SHA512
84a10cb82f1e52fbc74d074cf9d8bf761425d69fe893851d490cbf466ae647fa0cd3849ea81356a3ff1c91b67c0834ff59a6f67eddc3267c68f88667ef42fb83

Download Submit
C:\Windows\SysWOW64\TABCTL32.OCX

Filesize
218KB

MD5
dc925b6d77ba9ecb532e2f6750be943b

SHA1
f71215e701401f0dd6fe143e3a630b2e168a4fac

SHA256
d10a197fd53e65dc910ca4aed86cb674c613ff14ce6436d1a445bb27a7a499e0

SHA512
ee9c40e695a29de7e7b8a9fe1ca01ebba9a8bdc199d46d98c71a4e3ecfec566f2fc31300a5e9867e8c791b15ac3ebec076f0710e0f6eec6c3fdea3bde37ab171

Download Submit
memory/1048-181-0x0000000000C74000-0x0000000001D76000-memory.dmp

Filesize
17.0MB

Download
memory/1048-180-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/1048-277-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/1048-7-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/1048-7-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/1048-181-0x0000000000C74000-0x0000000001D76000-memory.dmp

Filesize
17.0MB

Download
memory/1048-245-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/1048-0-0x0000000000C74000-0x0000000001D76000-memory.dmp

Filesize
17.0MB

Download
memory/1048-181-0x0000000000C74000-0x0000000001D76000-memory.dmp

Filesize
17.0MB

Download
memory/1048-1-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/1048-277-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/1048-277-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/1048-245-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/1048-180-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/1048-245-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/1048-0-0x0000000000C74000-0x0000000001D76000-memory.dmp

Filesize
17.0MB

Download
memory/1048-1-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/1048-1-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/1048-7-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/1048-0-0x0000000000C74000-0x0000000001D76000-memory.dmp

Filesize
17.0MB

Download
memory/1048-1-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/1048-7-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/1048-277-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/1048-181-0x0000000000C74000-0x0000000001D76000-memory.dmp

Filesize
17.0MB

Download
memory/1048-245-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/1048-180-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/1048-0-0x0000000000C74000-0x0000000001D76000-memory.dmp

Filesize
17.0MB

Download
memory/1048-180-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/3672-196-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/3672-246-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/3672-246-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/3672-196-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/3672-196-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/3672-246-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/3672-246-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/3672-196-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4736-182-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4736-39-0x0000000005210000-0x000000000522B000-memory.dmp

Filesize
108KB

Download
memory/4736-10-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4736-14-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4736-182-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4736-10-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4736-243-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4736-14-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4736-42-0x0000000005210000-0x000000000522B000-memory.dmp

Filesize
108KB

Download
memory/4736-39-0x0000000005210000-0x000000000522B000-memory.dmp

Filesize
108KB

Download
memory/4736-43-0x0000000005210000-0x000000000522B000-memory.dmp

Filesize
108KB

Download
memory/4736-43-0x0000000005210000-0x000000000522B000-memory.dmp

Filesize
108KB

Download
memory/4736-39-0x0000000005210000-0x000000000522B000-memory.dmp

Filesize
108KB

Download
memory/4736-182-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4736-42-0x0000000005210000-0x000000000522B000-memory.dmp

Filesize
108KB

Download
memory/4736-42-0x0000000005210000-0x000000000522B000-memory.dmp

Filesize
108KB

Download
memory/4736-182-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4736-243-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4736-14-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4736-39-0x0000000005210000-0x000000000522B000-memory.dmp

Filesize
108KB

Download
memory/4736-10-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4736-243-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4736-43-0x0000000005210000-0x000000000522B000-memory.dmp

Filesize
108KB

Download
memory/4736-43-0x0000000005210000-0x000000000522B000-memory.dmp

Filesize
108KB

Download
memory/4736-10-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4736-243-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4736-14-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4736-42-0x0000000005210000-0x000000000522B000-memory.dmp

Filesize
108KB

Download
memory/4796-12-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4796-183-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4796-244-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4796-12-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4796-244-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4796-183-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4796-183-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4796-244-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4796-12-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4796-183-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4796-12-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download
memory/4796-244-0x0000000000C70000-0x00000000022B2000-memory.dmp

Filesize
22.3MB

Download