fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca

Analysis

max time kernel
316s
max time network
317s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
26-12-2024 16:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AnyDesk.exe
Size

5.3MB
MD5

0a269c555e15783351e02629502bf141
SHA1

8fefa361e9b5bce4af0090093f51bcd02892b25d
SHA256

fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca
SHA512

b1784109f01d004f2f618e91695fc4ab9e64989cdedc39941cb1a4e7fed9032e096190269f3baefa590cc98552af5824d0f447a03213e4ae07cf55214758725a
SSDEEP

98304:Uc9HTcGO0ImBimas54Ub5ixTStxZi/l9K0+zLVasSe4JnzMpm+Gq:UcpYGO0IOqs57bUwxG9CVaskJIYE

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	AnyDesk.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe

Loads dropped DLL 2 IoCs

pid	Process
3928	AnyDesk.exe
3540	AnyDesk.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AnyDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AnyDesk.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies data under HKEY_USERS 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\Colors\ColorHistory0 = "14120960"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\Colors\ColorHistory4 = "6160618"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290404096"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "200"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 9aebff0061ccff000093fc000078d700005fba00003f9500001a6a0088179800	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\Colors\ColorHistory1 = "12826368"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\Colors\ColorHistory3 = "2298344"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\Colors\ColorHistory2 = "4737612"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Change default settings for CDs, DVDs, and devices so that you can automatically play music, view pictures, install software, and play games."	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "3"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1280x720x96(1).right = "1050"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1280x720x96(1).top = "46"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3001#immutable1 = "Sync files between your computer and network folders"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupView = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-2#immutable1 = "Conserve energy or maximize performance by choosing how your computer manages power."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-102#immutable1 = "Keyboard"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\IconSize = "48"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-10#immutable1 = "Choose which programs you want Windows to use for activities like web browsing, editing photos, sending e-mail, and playing music."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-2#immutable1 = "Change user account settings and passwords for people who share this computer."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Uninstall or change programs on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000cc0000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:PID = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000010000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874369"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\2\NodeSlot = "8"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\MinPos1280x720x96(1).y = "4294967295"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-1#immutable1 = "AutoPlay"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-45#immutable1 = "Make your computer easier to use."	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-300#immutable1 = "Sound"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByDirection = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874369"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1280x720x96(1).left = "250"	explorer.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3928	AnyDesk.exe
4768	explorer.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3540	AnyDesk.exe
3540	AnyDesk.exe
3540	AnyDesk.exe
3540	AnyDesk.exe
3284	msedge.exe
3284	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1200	UserAccountBroker.exe
540	AnyDesk.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
3112	Process not Found
3240	Process not Found
3516	Process not Found
4696	Process not Found
2212	Process not Found
468	Process not Found
2116	Process not Found
1496	Process not Found
1028	Process not Found
1408	Process not Found
1372	Process not Found
1420	Process not Found
3420	Process not Found
2184	Process not Found
3584	Process not Found
4028	Process not Found
4828	Process not Found
3476	Process not Found
3976	Process not Found
2596	Process not Found
4300	Process not Found
3376	Process not Found
3460	Process not Found
3056	Process not Found
4540	Process not Found
5044	Process not Found
4872	Process not Found
3260	Process not Found
3224	Process not Found
1416	Process not Found
1892	Process not Found
3292	Process not Found
1888	Process not Found
2736	Process not Found
3440	Process not Found
1064	Process not Found
4724	Process not Found
388	Process not Found
2188	Process not Found
1440	Process not Found
876	Process not Found
4084	Process not Found
5012	Process not Found
4924	Process not Found
1200	Process not Found
1156	Process not Found
2824	Process not Found
3248	Process not Found
4824	Process not Found
5032	Process not Found
1868	Process not Found
4720	Process not Found
4484	Process not Found
4752	Process not Found
1692	Process not Found
844	Process not Found
3204	Process not Found
2608	Process not Found
2772	Process not Found
4736	Process not Found
2080	Process not Found
4172	Process not Found
1072	Process not Found
4508	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3540	AnyDesk.exe
Token: 33	1048	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1048	AUDIODG.EXE
Token: SeShutdownPrivilege	4768	explorer.exe
Token: SeCreatePagefilePrivilege	4768	explorer.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
3928	AnyDesk.exe
3928	AnyDesk.exe
3928	AnyDesk.exe
3928	AnyDesk.exe
3928	AnyDesk.exe
3928	AnyDesk.exe
3928	AnyDesk.exe
3928	AnyDesk.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
4768	explorer.exe
4768	explorer.exe
4768	explorer.exe
4768	explorer.exe
4768	explorer.exe
4768	explorer.exe
4768	explorer.exe
4768	explorer.exe
4768	explorer.exe
4768	explorer.exe
4768	explorer.exe
4768	explorer.exe
4768	explorer.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
3928	AnyDesk.exe
3928	AnyDesk.exe
3928	AnyDesk.exe
3928	AnyDesk.exe
3928	AnyDesk.exe
3928	AnyDesk.exe
3928	AnyDesk.exe
3928	AnyDesk.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
540	AnyDesk.exe
540	AnyDesk.exe
3972	MiniSearchHost.exe
1200	UserAccountBroker.exe
1600	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 3540	952	AnyDesk.exe	77
PID 952 wrote to memory of 3540	952	AnyDesk.exe	77
PID 952 wrote to memory of 3540	952	AnyDesk.exe	77
PID 952 wrote to memory of 3928	952	AnyDesk.exe	78
PID 952 wrote to memory of 3928	952	AnyDesk.exe	78
PID 952 wrote to memory of 3928	952	AnyDesk.exe	78
PID 2864 wrote to memory of 5048	2864	msedge.exe	99
PID 2864 wrote to memory of 5048	2864	msedge.exe	99
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3280	2864	msedge.exe	100
PID 2864 wrote to memory of 3284	2864	msedge.exe	101
PID 2864 wrote to memory of 3284	2864	msedge.exe	101
PID 2864 wrote to memory of 3124	2864	msedge.exe	102
PID 2864 wrote to memory of 3124	2864	msedge.exe	102
PID 2864 wrote to memory of 3124	2864	msedge.exe	102
PID 2864 wrote to memory of 3124	2864	msedge.exe	102
PID 2864 wrote to memory of 3124	2864	msedge.exe	102
PID 2864 wrote to memory of 3124	2864	msedge.exe	102
PID 2864 wrote to memory of 3124	2864	msedge.exe	102
PID 2864 wrote to memory of 3124	2864	msedge.exe	102
PID 2864 wrote to memory of 3124	2864	msedge.exe	102
PID 2864 wrote to memory of 3124	2864	msedge.exe	102
PID 2864 wrote to memory of 3124	2864	msedge.exe	102
PID 2864 wrote to memory of 3124	2864	msedge.exe	102
PID 2864 wrote to memory of 3124	2864	msedge.exe	102
PID 2864 wrote to memory of 3124	2864	msedge.exe	102

C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:952
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3540
- - C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
    "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend
    3⤵
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:540
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3928

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004D8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1048

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3956

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:1044

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:1768

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?LinkId=335789
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffabbed3cb8,0x7ffabbed3cc8,0x7ffabbed3cd8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,6432335981836669582,14820303321192850257,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,6432335981836669582,14820303321192850257,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,6432335981836669582,14820303321192850257,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6432335981836669582,14820303321192850257,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6432335981836669582,14820303321192850257,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3248

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5004

C:\Windows\System32\control.exe
"C:\Windows\System32\control.exe"
1⤵
PID:4968

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4768
- C:\Windows\system32\UserAccountControlSettings.exe
  "C:\Windows\system32\UserAccountControlSettings.exe"
  2⤵
  PID:2380

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:4684

C:\Windows\system32\UserAccountControlSettings.exe
"C:\Windows\system32\UserAccountControlSettings.exe" /applySettings
1⤵
PID:3256

C:\Windows\System32\UserAccountBroker.exe
C:\Windows\System32\UserAccountBroker.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1200

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:2444

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3a36855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9314124f4f0ad9f845a0d7906fd8dfd8

SHA1
0d4f67fb1a11453551514f230941bdd7ef95693c

SHA256
cbd58fa358e4b1851c3da2d279023c29eba66fb4d438c6e87e7ce5169ffb910e

SHA512
87b9060ca4942974bd8f95b8998df7b2702a3f4aba88c53b2e3423a532a75407070368f813a5bbc0251864b4eae47e015274a839999514386d23c8a526d05d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1544690d41d950f9c1358068301cfb5

SHA1
ae3ff81363fcbe33c419e49cabef61fb6837bffa

SHA256
53d69c9cc3c8aaf2c8b58ea6a2aa47c49c9ec11167dd9414cd9f4192f9978724

SHA512
1e4f1fe2877f4f947d33490e65898752488e48de34d61e197e4448127d6b1926888de80b62349d5a88b96140eed0a5b952ef4dd7ca318689f76e12630c9029da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
51c8993e7e0fefdf5647e2b5c65d67f5

SHA1
69fb8b5a9bdfad64ac615839cb0b6ada091d2dfe

SHA256
852e1ec00bbbd69b765fd428dcc3e7e0443a9d7f56cfb4119812a84587161fd0

SHA512
335d44f2f94bcfad996301c619402e0132a728912a83b3ca0f163a6df9ea9410a90db9ec209334ae1feb6892f84e2112b2dd262584eaa3ef7ccf7278eae139cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b6c052690a2226a3dd1818948d2ad23b

SHA1
66535c300b77354224aa6e70e9224d6d7ff6acd8

SHA256
cf918bdeda43b0111250d1f3be55ed2bb91a2c46b63a75fbc1e1589612994210

SHA512
f022e68c99aa14c7804eb29f99a2058adc6bfa9027275ad877132dbfae89e69e466ad563cb20cd0a0d771ba3ed95447eedaeefe2aea820b59a59d805473e9000

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0edddc522c4cd9ecb083f0c7b9b8c00c

SHA1
26a2e1d108c79781c56529976811697ce870ec61

SHA256
ca48a6392d1d7a6936b10f5249e0bc1031b1e69da50498d45d68f3c444820186

SHA512
ff56bcbefed8488069af288683e147c461b494117d41a732a4d6d9af7807e1dbb9285857e299f2fbf648d11fa3352695fee10eacbaf4d9360d095267a694c5f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2024-12-26.1659.1768.1.odl

Filesize
1KB

MD5
19c2391fd430b67f37571b5a71e2f958

SHA1
fc845c8cd2624c3f6e8ac73453a23c7ee6fc9c53

SHA256
b8016ff853110b68ef72cce3e0cd4ba3729e5935adf4bc583b6d68762ca49948

SHA512
9bf28c3b554edd2ab471a7a0c813a66a708c6135417cbf6c351f14687d3be4f089bda290b2444ac9bc60514d373efb7cf2b40ed296b68c210f09fcce6a9c1e79

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\70fcc44b-20c0-411c-8ada-04273b086876.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
77a8b2c86dd26c214bc11c989789b62d

SHA1
8b0f2d9d0ded2d7f9bff8aed6aefd6b3fdd1a499

SHA256
e288c02cbba393c9703519e660bf8709331f11978c6d994ea2a1346eef462cb8

SHA512
c287e3ae580343c43a5354347ca5444f54840fba127a2b1edc897b1dfea286fa37b5808f6e89f535c4022db8b3f29448aa4cc2f41ab0f308eec525a99fac4e5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\gcapi.dll

Filesize
385KB

MD5
1ce7d5a1566c8c449d0f6772a8c27900

SHA1
60854185f6338e1bfc7497fd41aa44c5c00d8f85

SHA256
73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf

SHA512
7e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
7KB

MD5
11e56b01620145f8b511c52e0f8e1b3c

SHA1
31a819a93e61ab0c7d93f7d73f9ab0b0275f727e

SHA256
d9a79d9382ac68bee9eeb8e8e10385b4cff60c8b444d318b78bb72034b00a410

SHA512
8cdeacfe9108434f9478e968a3b29fa0376a89c072b0a8444e1a8e83fd1ea70ddb10ace37c86a415f6f710d79d7c2830d755b385c6177751b39acafc7c91f97d

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
9KB

MD5
48411ec46726a8ca7267397feaa37dec

SHA1
8d7d31843b9699e2bd48e5100569b240aff912b8

SHA256
da22cf348169c83e46079753a0526c1f113210a3a032ba8de49d93a96f3847bd

SHA512
9b83051d21d5b5c62695fd5a834121ea16bbcfe95814349d28f3e47d06bd2ca8c2573873bbda107468d1d05ae9c30d4630fb156c1a413e9f33a17bf5047b1872

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
43KB

MD5
49e15b6fcecbd9aeb3683b12d1d218a4

SHA1
9e15f5d778208be4921bc1cfb31ae411ca7e7c12

SHA256
38d66e7f60b59529205354e748512f154014d2baf84a39d8b08967dd0a011e70

SHA512
07bf2887922ff8e27b9468a7fd2ac381fed5ac45a671af8db057316c78ef49a87322cbad66a24ec4eea899677ea866075e983b83de97dd403fb02962c00818b1

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
826b36542c9c4e3e2c6e6ca50bea44df

SHA1
efb3e05de99a2364387badec0f29f43d740370a4

SHA256
13314dbadd1c2d251b781246787606db85a8a90e9ff84c97a01151685e06013c

SHA512
1e3f31ef0305deaa75d99644fe29f7b30a0e2f40b8a84845375d109e200d6cf6d9e15d9636db745fe4096fee757841fe7b083a13d58805c5d93dc00c0780b745

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
57edc3e3977a87b6f9838678589643b1

SHA1
c85f52cdff4f95b90e71f66adc2f386ba4eca7e2

SHA256
ddf585557cba08db612a27d965a5db8f5660c04778d581e90a651cc876d0ee51

SHA512
42a40d6e736e15df8b4d9bdff0bbf8b5a36a9d101562a7a46f43624bead2948d5aef4e40753352c9663dc3ba61cd205ad7683847ad45aee25251e9ccd29bce88

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
745B

MD5
5d5d312c71a2d25f45122d76a238332c

SHA1
9e3a7abd010d16c47091e1c0970ae1dbbf334ed0

SHA256
75ee98d3d824ab018d0ad3580eee1abc14491599293aa847f91b7a60b72ff0cb

SHA512
ea3b35ce2e1fcad3264a7185d73a94acb9989c39d9fc1699f59fb0232c385360782f386603af38c9df694e2a8afd2d55250d0b35417af002180e4c82d61cbdb4

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
766B

MD5
489d3e695b2eab44c0931e2d547a6d97

SHA1
4c8e3683c22cfbdc3310ef87ae430251ccb6ec41

SHA256
a4f81cfd075975923a50c830059f40ca7fc447771ad32d04fe000e33d6b81e4a

SHA512
46e9abed48012811b3a74767c83a41751b5f8b640940595e6f4b6e575dd176d21b78976ce8962c467ac24c654e32ea9ac48a2d5e59c756a1f067c5f7c8727177

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
775B

MD5
cf115789635a9dade856e8def2d1bdb5

SHA1
f5155219c36ad30ae5bde7aff32174600d6264b9

SHA256
5163904423c3f5963c260eed77e4b7c86fda5045169dc698eb79b5ad50fc66d8

SHA512
0631a3f87f87ac10e3a3def5a694aa84a2e306121329042d0966063dafbcb8ae8c889b8435040b4c2fc0f672e6c55f4034e4254bc22431476165c03222fd776a

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
832B

MD5
6e543d8b9d565f9329993278b59b4928

SHA1
c908edf53517bd2cb1ffef006a60d0695dd85938

SHA256
9da11da6466ca49bf4d5683eaba2af53b2f5d1c04c04958cbfa04cf9f090ef2a

SHA512
fa7fe186f6fb19c6449ab9fb939f7dbc51a05dc5cd7c512bfc3e267736fde59ff6ba16063c3759a23a8b3ec0ae0bcef86152ea4429caa56a2ed0df230d435e15

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
312B

MD5
0c04ad1083dc5c7c45e3ee2cd344ae38

SHA1
f1cf190f8ca93000e56d49732e9e827e2554c46f

SHA256
6452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0

SHA512
6c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
468B

MD5
9bf2b5774bc285b5b569185d00d70ef9

SHA1
16616a27fe82cfb27d55d5f6d063d61f535800ad

SHA256
6d2cc91ff9eb1bc074b17886959d87bde4aab4a9bb7c9ca606df73fb7e8e4b3b

SHA512
f3547b1746d3db1f2f2d1eacdbb390632ef7fbc80d8f356ae9d5a422d22281f962e309d1e047f103b13485d4a652aeff6b755b1b98c7b842e1a8cc40d5cf07fe

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
468B

MD5
b03621df9703183973f5b8f76fbfc942

SHA1
a7abf19402cf20c7e490bd702cd429debea75415

SHA256
4c4cc12ca0a54c2a61cf8534eba7dab912402b4105ea6e61ace29b78101d72e8

SHA512
e9ef760d791ce5aaa662f2b856f269bf8ce16ee61d80d285148e3a6054def8d660e6ddc0dc03e313568d936c0417041240f1bdc851cde2c3a82004a0c281f35f

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
2KB

MD5
8dfb9c326ce030506d6ed160621ed33d

SHA1
587788796d082edd7665ef02067807d26082aec8

SHA256
e0bf9777d75932e4034366fa6d1b993f0963152cae283bf6bdc1398afb2d5b58

SHA512
7ef111c5250a0e9c28116849691e640affa724255961f58f985c96f75459dd523bfaf76fa3641819903d1e2f923aab6ba07c19b60f0d476fc50e203bdc93a16f

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
2KB

MD5
38dee84ab9931960f4ff40c1ef9fece0

SHA1
37473ec52f5bfff3115fc50e868f79fe61393f3c

SHA256
0c3f91d350cc897157a0660cb378be780ab1538a32ade2143778ff75d73164ee

SHA512
97f163d2dbf03f883f98e0901b290778f5144ce68b0f9c99f787540b61424d164f8911f04b5491a88f5fbdab265419cc32c1c7885cad4bb7f7db22af6ecc4453

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
2KB

MD5
e4b6d5db2a6f88cacd1acac445a23791

SHA1
289d94e7d79973e1c74b97e84a207f38ce42f77b

SHA256
93e1b2954faa4096daabd67848035b749266a2deaa70054264cd4400e13077d9

SHA512
4fbcc98c5a567333c2edaa8f7f7e6c89c2c7367dbd8e7d2963d2c21adffa1a0234ba51b09150d300690e4141e7d11df758d940a4eaf57e2c0489089402dcd2af

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
540ce6b7197323c943c3c1c3d6dfdafb

SHA1
f9019850f9d309f1cfc96dbb06b0fa7e7ee49c30

SHA256
7816d17491f2562005318b7bfd99a2babe38f9bfbc1ece2fb82f6b03f75e620a

SHA512
f74265bcb848c187d9b5239ef1a1931c3f48421e2cefe8d9ee977bf0c3555dc09f7716428e44c3de82bb5e4a7dc00d77191626bef8215265f59f062491a2875e

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
5KB

MD5
c3ccf40daa4e7e73b89b74851ffa6cf6

SHA1
5b5f1ed6f9d9a60fb51268aa151a1739a1c4b3fc

SHA256
73fa65a31aa05ab601622bdc05ba2973344a910a546285aeba588450339d0bd6

SHA512
dd9eb94be5c01c4d1110a9e7bcea28f6ae67c328a13b153a9d9ffc90d5ece2c6bcdd642a2f51d170853ade9f6048ac1530f8ae8f7808d9968824b1012057304a

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
5KB

MD5
8b52921bac73292f4f3351629b3b9e18

SHA1
6526b652548cb7676e6f96d15c083702e30bb27f

SHA256
a807dfc11736fb09e49e21a620bc94fdca1cba0831b72f40220c8374443a50a4

SHA512
c81c5d611bebf1bc4393877603ce8fd84a176a8a2cd18342c0f9c5280f8456944ef280146bd124c04097a5ab2f51c81423127b7fdacb379a42311d5a098b8474

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
fb36d5882c14ab2bf98f0a832e1d0b51

SHA1
8b30b1640733e7a97b325a170ab3d081db66dceb

SHA256
1357765ea57338229a3cef516023ca10e91abcfe5b953a4f4f48cc6444531778

SHA512
68052ac23feedabb4dd96084fccd7a41aaa5d37d99224f78aee88a61fcef97098e2fdd03cf94b62ece8cf1c5b6b04b8746a9b5d13a162ca935b26851cd49f990

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
a01280c02c4017ab4c8f48c5e74b580a

SHA1
4c65bf8041891cb341459566dd8330a796488c53

SHA256
1048b2d439c0298997598e4d752273c9eb64d91b055fd9e7f763c4756776d285

SHA512
59e70058ce6f906ed5dacd6d4fdbe2ab8feeb00fc38ae459979c9ec1ce0d22d83d2fd2e2a39d9f62ed141fc598d44e762523a4ef9ab7ac57c0d3bf9b9410abdc

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
339c4fcf0287f0c52b28af686bf92f31

SHA1
2646900b93d396632eac94ce44f4e5b6d284c9c6

SHA256
bb35f534f6fc60de6dc1eb1428870ed9dd77bb746273b54e7348c4c0db21f1c5

SHA512
7559f2955e76e4559d0f7946db2821576bf2111f62379f895249c77359c0326e0e80e520f2692812a0a40fc9360687f37a4058d0de1628644289640ef864c159

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
12b827e9a6c1464be7326e984d938742

SHA1
45eb94088db0090b845f4078e99debf404a3c9c0

SHA256
bb420fde06fe7a8156f0486aae3e49128748b2161f15be1c117240c3b5e56e17

SHA512
53424067c3c8d02d0ae8247601d49f824d9019f8c1d224ccf359d886eea4e4e6fa6c4387a35dc61fbae827bd4bbcbe6f32e6c580747c09bc85c83d7052c4dc44

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
5KB

MD5
f31797d9a4b7d5db3f0e90bfc29292fe

SHA1
e8a7ad5b7dba9393bd62c7427d65afc024217e08

SHA256
73241358c83678b0ff63954998dfca4440fe62a70f473a6c920ac16dca729878

SHA512
f45f9d69b74c1d88a126c40c510d0a8cb73e4f5c7f0bcac0be338621d41e45911f726e43649d8f06525ff56e493caf89f63ca4d2524e2eb97bc98a51134c4fc4

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
329b9b01242dcebbc4df1db51a76d200

SHA1
b6b03f681522f8a7cd931cb95af4c928570c01bf

SHA256
6ac67fadf734ed635801c2fbff93d23a130d22882b47eae9f5bfd6f6f8fcc677

SHA512
216f7d9c1d98f97ef30a429461fed0254b8cd2b0975a55db91cf166f17b321ebb7105d8470888e15f40f3a8a23af6f5163adef1843b4b031ca915c1b922502ca

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
b0804b60b7a6eaa442ed07bf96aba16e

SHA1
3e4b112052fa6ed72461ced2e5507cff47fa4670

SHA256
0751668d42bfb01520c6b33e14fafc9f4053560f4d0ed156707a16a45ba77238

SHA512
a0da59c945f58a2b121a8ce6701912195d4ff8a5260a2197a544b5bc5153ce7ca223994722ce11dbe4d8af2ded7e77d62636f94c52ded5db5966c586de6acf31

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
92b9151a974f4d8c8fc85c05220bdb4d

SHA1
d1fe5e7aaa443456fbe6cb0c92695d3934a0762e

SHA256
dc37e5df2a35903814f10659c4000a8a9af4ad812916fd719faf1e5199029adb

SHA512
68d4ae064aaa6ffd13f602e7d56a3c2ca916cb9925f185ed19cd4afde226e5526e17ce50fc33d8f15495d24f54ce10635574da3d9c73805fa0c78f27c457fe57

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
fa703c6ad463788b8aa12b1965a357ed

SHA1
324f9d0e3bf1f15c9abacd43d6b3f65ae5ed045b

SHA256
229031ded0e1967f9b38a0eb973a218ac32acc061f2fdc52bf02417bc6ef936e

SHA512
6ffe0116823e67e2408ae568fc7cf81a36b5c4636edf26664299cf8be13c16cab18d88c21053ce9fde40cb5c662594e136b4de9ba54ca9a1167480dea21b609f

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
4c6f9a067f59bd6d32962e5e7e9f12ea

SHA1
972eb957f094f276123708b1d1874a2776529c2d

SHA256
7be766741afff0698baa7e23e0fb3d489e686abe9109b3b162be2a45b685b15f

SHA512
d66bffac752b8bc95c5918afecd1c8b3a880a7d0433a2bb4b2440be8f88ba66662ac02d45f2b1b494fdc623a87fe1cdfa0ce5efef2a47a3f155d4cf5f67e31ce

Download Submit
memory/540-329-0x0000000000010000-0x0000000001652000-memory.dmp

Filesize
22.3MB

Download
memory/540-229-0x0000000000010000-0x0000000001652000-memory.dmp

Filesize
22.3MB

Download
memory/540-450-0x0000000000010000-0x0000000001652000-memory.dmp

Filesize
22.3MB

Download
memory/540-363-0x0000000000010000-0x0000000001652000-memory.dmp

Filesize
22.3MB

Download
memory/540-305-0x0000000000010000-0x0000000001652000-memory.dmp

Filesize
22.3MB

Download
memory/540-292-0x0000000000010000-0x0000000001652000-memory.dmp

Filesize
22.3MB

Download
memory/952-0-0x0000000000014000-0x0000000001116000-memory.dmp

Filesize
17.0MB

Download
memory/952-7-0x0000000000010000-0x0000000001652000-memory.dmp

Filesize
22.3MB

Download
memory/952-1-0x0000000000010000-0x0000000001652000-memory.dmp

Filesize
22.3MB

Download
memory/952-286-0x0000000000010000-0x0000000001652000-memory.dmp

Filesize
22.3MB

Download
memory/952-221-0x0000000000010000-0x0000000001652000-memory.dmp

Filesize
22.3MB

Download
memory/952-224-0x0000000000014000-0x0000000001116000-memory.dmp

Filesize
17.0MB

Download
memory/3540-294-0x0000000000010000-0x0000000001652000-memory.dmp

Filesize
22.3MB

Download
memory/3540-42-0x0000000005190000-0x00000000051AB000-memory.dmp

Filesize
108KB

Download
memory/3540-38-0x0000000005190000-0x00000000051AB000-memory.dmp

Filesize
108KB

Download
memory/3540-41-0x0000000005190000-0x00000000051AB000-memory.dmp

Filesize
108KB

Download
memory/3540-11-0x0000000000010000-0x0000000001652000-memory.dmp

Filesize
22.3MB

Download
memory/3540-287-0x0000000000010000-0x0000000001652000-memory.dmp

Filesize
22.3MB

Download
memory/3540-222-0x0000000000010000-0x0000000001652000-memory.dmp

Filesize
22.3MB

Download
memory/3928-295-0x0000000000010000-0x0000000001652000-memory.dmp

Filesize
22.3MB

Download
memory/3928-10-0x0000000000010000-0x0000000001652000-memory.dmp

Filesize
22.3MB

Download
memory/3928-223-0x0000000000010000-0x0000000001652000-memory.dmp

Filesize
22.3MB

Download
memory/3928-14-0x0000000000010000-0x0000000001652000-memory.dmp

Filesize
22.3MB

Download
memory/3928-288-0x0000000000010000-0x0000000001652000-memory.dmp

Filesize
22.3MB

Download
memory/3928-441-0x0000000000010000-0x0000000001652000-memory.dmp

Filesize
22.3MB

Download