fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca

Analysis

max time kernel
93s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2024 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AnyDesk.exe
Size

5.3MB
MD5

0a269c555e15783351e02629502bf141
SHA1

8fefa361e9b5bce4af0090093f51bcd02892b25d
SHA256

fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca
SHA512

b1784109f01d004f2f618e91695fc4ab9e64989cdedc39941cb1a4e7fed9032e096190269f3baefa590cc98552af5824d0f447a03213e4ae07cf55214758725a
SSDEEP

98304:Uc9HTcGO0ImBimas54Ub5ixTStxZi/l9K0+zLVasSe4JnzMpm+Gq:UcpYGO0IOqs57bUwxG9CVaskJIYE

Score

8^/10

discovery

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CA38CF219C8E9782A8CBBD76643D24E4F2D74B03\Blob = 030000000100000014000000ca38cf219c8e9782a8cbbd76643d24e4f2d74b03040000000100000010000000e4e34304f4315a15a0bc0e413363721e0f000000010000002000000092cfeddb8485b879cf9232fde30df21fd200fa56712c8c92908b447e1a1d33af140000000100000014000000573133394358b8d9f870ed67cd50374f92d3ff71190000000100000010000000c87364a1df5cfaa973f544a5206e81945c000000010000000400000000100000180000000100000010000000a344f71a7a52a76ee49b74b1d8816b154b0000000100000044000000380045004300390042003100440030004100420042004400370046003900380042003400300031004400340032003500380032003800380032003800430045005f00000020000000010000007a070000308207763082055ea0030201020210030e330a8ed28347bda3bb478e410d7c300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3234303231323030303030305a170d3235303231323233353935395a307e310b3009060355040613024445311b301906035504080c12426164656e2d57c3bc727474656d626572673112301006035504071309537475747467617274311e301c060355040a1315416e794465736b20536f66747761726520476d6248311e301c06035504031315416e794465736b20536f66747761726520476d624830820222300d06092a864886f70d01010105000382020f003082020a0282020100972d1d652b2ae50cac2c1e499b38c5c561134e6348ecab72337b67dfd1f7bad70054193e2252007751d9ce92967b0454f8a1957870034b465b41f478e60ff6c92c7fd735506ef2b7a81c18acc3729f8ce22cd1caa429bdbe5d5f0ac942344a3ef4bd5fb1048c47ccd25c2c4e315caa2686d3c1c469cd3793f5be068c00b91d7c673741cdaf4a05c1a782e8cc5eee6c09dd927eb31f1eca0c6cab4350196024ab28f5a59f2cbde92850042aaa6798deb5989495ba9224d22b3afe20aa721a379265049ed9d9bc86884dc7c16611e2f784c456d199760ce5d8debd916e68ffcd77c15d71dd1bd4f0ab4aeeafd2e4850c35e6e7109c58dd068e50d5ad9e3d9439e95e007aa2a06222ae6bbebf54f30953f6479fea4d566e4b73ca023ee32cae31f3d59fbeb1f99e218809971def0d1dfd019620c7b251445b6a450137c8831fec87497c7e54533845eb7705a46950a314c78212b079a36dd6353e3b1c1a93b664c2e69f3a1c339dbaaec468c32ac73a48e43daa2d5b66930cfd6ec9ebea031bd3ec04f561ff760bc7d3f713fe9b3e9ec38718750fc452df6ab65548bce5def71ff17c7ed1889165cd03602599f3851b247003f09c896300f23cca788100ce263f66a4ef827e8a718cca76e0d6fcf93e95ce359efc329217f88938b29213a5789bfaa9b471c24b5bc9aab23b68796c185dbbb840b7a074944a6960b134c7b25ed6f50203010001a3820203308201ff301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414573133394358b8d9f870ed67cd50374f92d3ff71303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f435053300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c30819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63727430090603551d1304023000300d06092a864886f70d01010b050003820201009bc3d91cb63175cffbc813b2b5814e77c9940d5e0c2d10fdac84edc784495ddfcb2e4f2719af9843101e70abe1eb54300a715573ccd0433b0dd8ee13efd79eece380f233e18a82ef7b50c2e4f7cf2167e8122a01a8474bd1d3e93c20193f3a45db0afedf99b51460c0e0e8b62b82d56b57e22b9bba3a07696a2799a3fee38dee6a5308d0d429a7c64d59031e0a0e37d91febb3f2fdfa34c9b931d0ba00aa1c9438db280424c8958ef86297c18093c66fb8ac5a2922a97447eb566195def497706a8650fcd7ca6b58ae2cef3315ad47766b35045f419963564448bf06b90094a691de78716c87d58a366bc8e239066e99a81639c03f99c96c68e54aee17af02052b8e8d399499bc03646b44c675f98cba4e86a1130ddbff1d9a78221d5217c95a9fa3587c43d9fda62693aabd448814380e0c7e8a1a32d0a0d3334d33b86eeac1de3828a8b513f8279984e9aeec85544c0d5a3e9c57dfd5641a0598af756de93089c007744baf14b15bb28265ba9aa8088c3753a9c099daa36d8ce4a304e803e8728c5411dcbd182b7ba9caf83499cf3e0ac836a789f8fb26a543e438ac16b3ed277ceb0df5df6e0d0ec8634d8a4b3bbf30a96da5113c10623122820c6b316fcf6fda942642003cc09e658ce6548d55a719e85f6d76b5152c9df8efdd83f090a7ae5acbe7430ae395dcae7b8dd8e859fb7a48c5556a046bd89e2a9c68c9fe2dba	DrvInst.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	AnyDesk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	AnyDesk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	AnyDesk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	AnyDesk.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	AnyDesk.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b347ecc1-04f1-214a-8ff7-77d797e4419e}\SETFA5A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b347ecc1-04f1-214a-8ff7-77d797e4419e}\SETFA6A.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{b347ecc1-04f1-214a-8ff7-77d797e4419e}\SETFA6A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b347ecc1-04f1-214a-8ff7-77d797e4419e}\AnyDeskPrintDriver-manifest.ini	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{b347ecc1-04f1-214a-8ff7-77d797e4419e}\SETFA6B.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{b347ecc1-04f1-214a-8ff7-77d797e4419e}\SETFA6C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b347ecc1-04f1-214a-8ff7-77d797e4419e}\anydeskprintdriver.inf	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	AnyDesk.exe
File created	C:\Windows\System32\DriverStore\Temp\{b347ecc1-04f1-214a-8ff7-77d797e4419e}\SETFA5A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b347ecc1-04f1-214a-8ff7-77d797e4419e}\AnyDeskPrintDriver.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_c69295146af7a90e\AnyDeskPrintDriver-manifest.ini	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	AnyDesk.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b347ecc1-04f1-214a-8ff7-77d797e4419e}\SETFA6D.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	AnyDesk.exe
File created	C:\Windows\System32\DriverStore\Temp\{b347ecc1-04f1-214a-8ff7-77d797e4419e}\SETFA6D.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b347ecc1-04f1-214a-8ff7-77d797e4419e}\SETFA59.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b347ecc1-04f1-214a-8ff7-77d797e4419e}\SETFA6B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_c69295146af7a90e\AnyDeskPrintDriverRenderFilter-PipelineConfig.xml	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_c69295146af7a90e\anydeskprintdriver.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b347ecc1-04f1-214a-8ff7-77d797e4419e}	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	AnyDesk.exe
File created	C:\Windows\System32\DriverStore\Temp\{b347ecc1-04f1-214a-8ff7-77d797e4419e}\SETFA59.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b347ecc1-04f1-214a-8ff7-77d797e4419e}\AnyDeskPrintDriver.gpd	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	AnyDesk.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_c69295146af7a90e\AnyDeskPrintDriverRenderFilter.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_c69295146af7a90e\AnyDeskPrintDriver.cat	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	AnyDesk.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b347ecc1-04f1-214a-8ff7-77d797e4419e}\AnyDeskPrintDriverRenderFilter.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b347ecc1-04f1-214a-8ff7-77d797e4419e}\AnyDeskPrintDriverRenderFilter-PipelineConfig.xml	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b347ecc1-04f1-214a-8ff7-77d797e4419e}\SETFA6C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_c69295146af7a90e\AnyDeskPrintDriver.gpd	DrvInst.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\AnyDesk\AnyDesk.exe	AnyDesk.exe
File created	C:\Program Files (x86)\AnyDesk\gcapi.dll	AnyDesk.exe
File opened for modification	C:\Program Files (x86)\AnyDesk\gcapi.dll	AnyDesk.exe
File created	C:\Program Files (x86)\AnyDesk\AnyDesk.exe	AnyDesk.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe

Executes dropped EXE 3 IoCs

pid	Process
3172	AnyDesk.exe
2240	AnyDesk.exe
3416	AnyDesk.exe

Loads dropped DLL 4 IoCs

pid	Process
4528	AnyDesk.exe
2952	AnyDesk.exe
2240	AnyDesk.exe
3172	AnyDesk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe

Checks SCSI registry key(s) 3 TTPs 26 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AnyDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AnyDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AnyDesk.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe

Modifies registry class 25 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open\command	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open\command\ = "\"C:\\Program Files (x86)\\AnyDesk\\AnyDesk.exe\" \"%1\""	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\DefaultIcon	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\DefaultIcon\ = "\"C:\\Program Files (x86)\\AnyDesk\\AnyDesk.exe\",0"	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk-Assist\shell\open\command\ = "\"C:\\Program Files (x86)\\AnyDesk\\AnyDesk.exe\" \"%1\""	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk-Assist	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk-Assist\shell\open	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\URL Protocol	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk-Assist\ = "URL:AnyDesk Assist Protocol"	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\ = "URL:AnyDesk Protocol"	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\DefaultIcon	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\DefaultIcon\ = "AnyDesk.exe,0"	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open\command	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk-Assist\URL Protocol	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk-Assist\DefaultIcon	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk-Assist\DefaultIcon\ = "AnyDesk.exe,0"	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk-Assist\shell	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open\command\ = "\"C:\\Program Files (x86)\\AnyDesk\\AnyDesk.exe\" --play \"%1\""	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk-Assist\shell\open\command	AnyDesk.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4528	AnyDesk.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2952	AnyDesk.exe
2952	AnyDesk.exe
2952	AnyDesk.exe
2952	AnyDesk.exe
2884	AnyDesk.exe
2884	AnyDesk.exe
2884	AnyDesk.exe
2884	AnyDesk.exe
2884	AnyDesk.exe
2884	AnyDesk.exe
2884	AnyDesk.exe
2884	AnyDesk.exe
2884	AnyDesk.exe
2884	AnyDesk.exe
2884	AnyDesk.exe
2884	AnyDesk.exe
2884	AnyDesk.exe
2884	AnyDesk.exe
2884	AnyDesk.exe
2884	AnyDesk.exe
2884	AnyDesk.exe
2884	AnyDesk.exe
2884	AnyDesk.exe
2884	AnyDesk.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2952	AnyDesk.exe
Token: 33	2728	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2728	AUDIODG.EXE
Token: SeAuditPrivilege	704	svchost.exe
Token: SeSecurityPrivilege	704	svchost.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
4528	AnyDesk.exe
4528	AnyDesk.exe
4528	AnyDesk.exe
4528	AnyDesk.exe
4528	AnyDesk.exe
4528	AnyDesk.exe
4528	AnyDesk.exe
4528	AnyDesk.exe
4528	AnyDesk.exe
4528	AnyDesk.exe
4528	AnyDesk.exe
4528	AnyDesk.exe
2240	AnyDesk.exe
2240	AnyDesk.exe
2240	AnyDesk.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
4528	AnyDesk.exe
4528	AnyDesk.exe
4528	AnyDesk.exe
4528	AnyDesk.exe
4528	AnyDesk.exe
4528	AnyDesk.exe
4528	AnyDesk.exe
4528	AnyDesk.exe
4528	AnyDesk.exe
4528	AnyDesk.exe
4528	AnyDesk.exe
4528	AnyDesk.exe
2240	AnyDesk.exe
2240	AnyDesk.exe
2240	AnyDesk.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4892	AnyDesk.exe
4892	AnyDesk.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 2952	4912	AnyDesk.exe	83
PID 4912 wrote to memory of 2952	4912	AnyDesk.exe	83
PID 4912 wrote to memory of 2952	4912	AnyDesk.exe	83
PID 4912 wrote to memory of 4528	4912	AnyDesk.exe	84
PID 4912 wrote to memory of 4528	4912	AnyDesk.exe	84
PID 4912 wrote to memory of 4528	4912	AnyDesk.exe	84
PID 4912 wrote to memory of 2884	4912	AnyDesk.exe	104
PID 4912 wrote to memory of 2884	4912	AnyDesk.exe	104
PID 4912 wrote to memory of 2884	4912	AnyDesk.exe	104
PID 2884 wrote to memory of 4724	2884	AnyDesk.exe	110
PID 2884 wrote to memory of 4724	2884	AnyDesk.exe	110
PID 2884 wrote to memory of 4724	2884	AnyDesk.exe	110
PID 2884 wrote to memory of 3332	2884	AnyDesk.exe	112
PID 2884 wrote to memory of 3332	2884	AnyDesk.exe	112
PID 2884 wrote to memory of 3332	2884	AnyDesk.exe	112
PID 704 wrote to memory of 2104	704	svchost.exe	115
PID 704 wrote to memory of 2104	704	svchost.exe	115
PID 2104 wrote to memory of 4996	2104	DrvInst.exe	117
PID 2104 wrote to memory of 4996	2104	DrvInst.exe	117

C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- - C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
    "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend
    3⤵
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4892
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4528
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --install "C:\Program Files (x86)\AnyDesk" --start-with-win --create-shortcuts --create-taskbar-icon --create-desktop-icon --install-driver:mirror --install-driver:printer --update-main --svc-conf "C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf" --sys-conf "C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf"
  2⤵
  - Checks computer location settings
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\expand.exe
    expand -F:* "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver\v4.cab" "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4724
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" printui.dll, PrintUIEntry /if /b "AnyDesk Printer" /f "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver\AnyDeskPrintDriver.inf" /r "AD_Port" /m "AnyDesk v4 Printer Driver"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3332

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x244 0x340
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Program Files (x86)\AnyDesk\AnyDesk.exe
"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --service
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3172

C:\Program Files (x86)\AnyDesk\AnyDesk.exe
"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --control
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2240

C:\Program Files (x86)\AnyDesk\AnyDesk.exe
"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --new-install
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:704
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{50ce8990-ecb4-534d-870d-ad341fa91672}\anydeskprintdriver.inf" "9" "49a18f3d7" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "c:\users\admin\appdata\roaming\anydesk\printer_driver"
  2⤵
  - Manipulates Digital Signatures
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{aa73605c-5e4b-1742-9086-f03f722d33d1} Global\{86a6b18a-1f7c-2348-bf27-c5f69541a04a} C:\Windows\System32\DriverStore\Temp\{b347ecc1-04f1-214a-8ff7-77d797e4419e}\anydeskprintdriver.inf C:\Windows\System32\DriverStore\Temp\{b347ecc1-04f1-214a-8ff7-77d797e4419e}\AnyDeskPrintDriver.cat
    3⤵
    PID:4996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\AnyDesk\AnyDesk.exe

Filesize
5.3MB

MD5
0a269c555e15783351e02629502bf141

SHA1
8fefa361e9b5bce4af0090093f51bcd02892b25d

SHA256
fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca

SHA512
b1784109f01d004f2f618e91695fc4ab9e64989cdedc39941cb1a4e7fed9032e096190269f3baefa590cc98552af5824d0f447a03213e4ae07cf55214758725a

Download Submit
C:\ProgramData\AnyDesk\service.conf

Filesize
2KB

MD5
521741c1d3bad878a6909b9fffe0bcd1

SHA1
f7b94fb687bf0ae24c3f78c934fccbfe573baba6

SHA256
dcbfe3ae76cbfbe6fcf5b7422cc51a0a9be9c73a70c7e941f10e3b312f4b76b3

SHA512
97af2d73bc97a60b3ae74dab820c73219c9f6e4827f0bbd5f5a8c375cd017cf229d39ad3950db299f97cf3b661b5b0c5695e57ee1c06087eec534f9d0c450355

Download Submit
C:\ProgramData\AnyDesk\system.conf

Filesize
951B

MD5
732672a23f2f589dcb58b93122d2cc00

SHA1
67e3a50d6a70238a22ae7b536331e67ed7083a2f

SHA256
0d20e43dad572ef8710fc915b59def5dda4601d069d9487ad2a8fe1794ba8540

SHA512
61aac57c36b4826a52d602cee2f40d3de8c9dedc6eb78ce74eeed92a3b72b29e1801698f408eff28d2eec20f93603db6105445d331db1968678131d9d90e80ea

Download Submit
C:\ProgramData\AnyDesk\system.conf

Filesize
951B

MD5
0bfdd957fd919a9530a07f927cc752d7

SHA1
6ad04ae9d43291f37dec3c7fbafebaf3b3197307

SHA256
04d85e183cb14baaea05dacb1689e12d6fbff68b943217862e4fb01c087f52e0

SHA512
89e6ae2fea8a2abf1f21b7f029a0c92239423612e7b85d465227bb332a34a07c9dee452fd25c36200b2cb2b5801221b72bce23b1ac0fedf702210d733daf8897

Download Submit
C:\ProgramData\AnyDesk\system.conf

Filesize
951B

MD5
2e3d4c90d0492576dcf2eb046db0b3da

SHA1
a57e5c5c37c6f7737390f302962190eccf4df671

SHA256
bb2d7f01c90930da0cc713c95b92c77669b207a949a7ca6690b2ecad669663ef

SHA512
88443976cc6c2e06d00dce27c9f3c0545274a0fd2f19446ac980d0897fff800b8ea1ea870ff5e137df5e73040fd57052e4b802d68987d4066b520bb36aba24f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\gcapi.dll

Filesize
385KB

MD5
1ce7d5a1566c8c449d0f6772a8c27900

SHA1
60854185f6338e1bfc7497fd41aa44c5c00d8f85

SHA256
73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf

SHA512
7e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753

Download Submit
C:\Users\Admin\AppData\Local\Temp\{50ce8990-ecb4-534d-870d-ad341fa91672}\SETF97E.tmp

Filesize
299KB

MD5
a4e4b05588899d7dc1d70c651cfce2d2

SHA1
c280c7f97e02eb582f09805451e5b17c34d0e119

SHA256
76a784f5561994bf302f0d65576efc676866429497a16a611ea38f8fc8939396

SHA512
428bd7da6d77af8413227ae3382f707436dbd494e9ead7a3d002a175ba64ceab71f76fcd94581c3f2532809fa69af1eb29a56e48a61d37fe42dfddbe4fef0278

Download Submit
C:\Users\Admin\AppData\Local\Temp\{50ce8990-ecb4-534d-870d-ad341fa91672}\SETF97F.tmp

Filesize
567B

MD5
8accaa9aa32148aa2bcd72ff14880618

SHA1
a1226a1c5c92e41ba22b382debc0f9a754b92c05

SHA256
aa0b5f757b3d83d19c973fddc4e82722b530d9aedec51f6a540a91126e4cc0dd

SHA512
026e07faf75a5be8c96ae59a93302a487a18b193b5d915aba5822cc27d2fd1f70fafb9239b34df8280b060f85bcf3316d1d4d5f1b21c8557b187affaf490a3bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\{50ce8990-ecb4-534d-870d-ad341fa91672}\SETF990.tmp

Filesize
252B

MD5
5cda10b02df931ebbad3d0fc9d9509b7

SHA1
f04b7885bfac4bee938d047f6703c58d4087facd

SHA256
ca33091bbdfd87bb3acca1a3eec96d3948a0830d9bc7bef3c40e15055e4c9a03

SHA512
99cfc18278eb4726b44caac07f1cec7f877791290cecd003417f1ab06716c5d4c004f2dea767676895db0e96dfa2023661d44684bfe990d5a97fc03e60dfc6bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\{50ce8990-ecb4-534d-870d-ad341fa91672}\SETF9A1.tmp

Filesize
11KB

MD5
ddf4ac6ecd52467516b31e0939b8a030

SHA1
bd452adc22223981b67dc4d665e3a0e8cf470c09

SHA256
019677297ae01db991a5c122ae582424e51d41ef7bb81fdf26269afaaaf5ae22

SHA512
a63b7dc23f8a8ae697aadc564e947fa5a8d3429f319ea72f5b0cbb77c51bd4f7d15450218360d6a742e2f2e3187745eff71f237079bc01fa1fa5cb6fb3c7402b

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
7KB

MD5
4f5663cd61630f344af392d8a1ee4b94

SHA1
b96462ba3e4f92ed08f0e9ac9c3b8455054c5b68

SHA256
14bba11e5a60121ac2a930e73a1cc329b95367ed0f6b967d5dd666acbe0c23ab

SHA512
3be47e27db695fa5dd9d5a2a3ac1b152072f2052c78d1dd6f89c5985cf43004d832586d497985da9444844c67bae86205374bf327913fea9301a71516ea40b2d

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
8KB

MD5
d8c1ceaa45ada796a072bef9873bd256

SHA1
3964b7a39c2eea2c23dddd92fab71019ecc6f544

SHA256
fd37cbf3aeceec05c67370590031b3bc0c68e37918571ecd48ed2ec0d9f8de0c

SHA512
c4e7de4272d0abf1094a19b7a74532d1ee238a630c2f2e1acac149c22497b82f2d4a0df97328a4a9872ef4503e53ab95688439c8211fc4b55f0656804b07d92f

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
39KB

MD5
bad6bf73da02557c4772bbc48c5d5deb

SHA1
6202f742d59b82ec3db04802138c647ae2be8b7c

SHA256
9d954b60865b77a8b1583c647c04fc953817022ba114a496740fc74cb45893f5

SHA512
1f97b874a00bd9a4a7bdaeadd1e5fc3d17ce8eb2ea9594e23f9622d489491c585de3af2fd0089385b00938dce5c889021687f1783f58cd141243c45de5f8ea1e

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
67KB

MD5
66b2694f3a0aa1f2b32a82559e3cbe22

SHA1
0d6674aede01698473ed7066f239bf607c0108a6

SHA256
92c2dd21d0a4c728f66b3c274c15ff7e6e61631521fef06f2e6d4477e1c8db7f

SHA512
643f266fc14c8f66dc37e2555bfb0f0bcdf12cc3034abfb89647c8bb4e71c2a7d5a7b055f25ddb8ae3c9e47a42dd2c8186efd0690e383fa4c0ac6545c20825d4

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
88KB

MD5
40f429a711b9c0ebdb63691de7b7e735

SHA1
485ecdddd6474e8a966f31fabf17ee845552daa6

SHA256
12110d3dc3c44698628c2041de2b96e3a022010c60cc8be0389867f69315b500

SHA512
c972811f39ff4ba4e8e2325d6faefc15f4fc239a24bb374ac5cc8216314f2e93826213b6efb7ae6b7252e9fa8510153106da5c003be1f7cee4828b5097563cb1

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
4acf8bbb5e7cc754812f9ac353f917d3

SHA1
d53a7ff0bcd3da2bbd5223d3b5c39c5a7822475e

SHA256
106b5f2266f6a1e6490cab3f7241a86f93da1f14a1a982f22f86a14c45dd95a5

SHA512
392d732ad44cc42431442df12b73be1ae73453ae5763e1749daf49ca6294ffdb8ebaa91425d47bcc02f17ae7a879ac1ff016731d14ea3fa45a27144bdd3383fe

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
f2a21d4fa9682481f6d234f866c868aa

SHA1
22c027791dc98d9c6f0407d6d5bd3122e2498c6b

SHA256
fa290e414cd09739d6e167777a6e8a988573b42aa2847142e7dda973ec3d2375

SHA512
cfb94730b7e5fe18cdbd3b9f1ef023cd7d8fd9ebf4dc51ad52dc513c1e4f626b345516bfdce12cf2723625ce1dd9a361a4cb177db7b7c76d592dd33407440a60

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
766B

MD5
32dc9bab497c89fef66c7f4ee7d95552

SHA1
f0fccf4bfa52c4db36e0d53c1f98a2b71497e149

SHA256
fb6e9b23039f9afa95a0ab31095f80d09bc43ca8b11eb0ea875db056e4138215

SHA512
14947ab3d2896adfcf6cc37ea8ebf1b5cb8d13b3b6b6afdaed450db7a03624bc7b49a363a5c01d0bd61d1cf837eb425c2152ec0604e22874d21cde65a292f41b

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
832B

MD5
53af8466c0f0b3b0bd2f9bce3fbf3302

SHA1
f3903b2b047f63cd8d1cd76bc906bfbc44821f59

SHA256
d4daaa0c5992c398bfe0209220a34dae7919b4ba50c3428c474d110380aeeae1

SHA512
9aa51f15c7f369b1fed52f63d7e3bb48ff6d203d40c6b0ac5aaee19a623bb5dde632e3c0404f0e364c40300d40fb66875b62cf5bd06b097d3c7f03a2e5c91ea7

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
312B

MD5
0c04ad1083dc5c7c45e3ee2cd344ae38

SHA1
f1cf190f8ca93000e56d49732e9e827e2554c46f

SHA256
6452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0

SHA512
6c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
468B

MD5
b6b63de38208c9b5225abd103a9347dc

SHA1
4fd2502cf293fe4e3d63550c2b1f3f14231ebcf9

SHA256
7e28218ffc2eb8e584dc538b69a104c82760bcfcfd799de0a6758a08671d368b

SHA512
3bcbd80b1c64d9cba3450be15cd61b1e5ba4738100a85bd5cff03b2d8f8de25b901a2b5826e9354875017bce52b4a2fbb4159f19c3294cf1ff0f9ab198475520

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
832B

MD5
39ae21a8a84fa075fa212fbe8f5f44a3

SHA1
4411a28103c297bdcbc5778e07a6fc228b252035

SHA256
3d63ed44ddac33711ecd512e60bf1dc99d4f920994d8e3c6b268a4fb326cdd47

SHA512
9da10602c303b52852c0dcbcc6eb9283a376521c803c38dd55d96514826dcc6f2254e501f3bb041246da96c24aca7802940ad2612dbed165dee43911fbb63a32

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
468B

MD5
21263e80cc827cc96517e1730ada4ada

SHA1
1aef7bc6f45342652e2d27e5cf8a282918ac05e2

SHA256
d661c37d80caacaefa4abeb02e1e0b5322fd6e024c36f7ccffc7433c095595f1

SHA512
fcf19ee04f39060772b41657491ff4535f1cd9eed75d3a209789eaf91416525076d21b840cf8d80c4054e076232321aae8c83d159816475b86d444952c44172e

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
2KB

MD5
d282f391f15de59c87b02926bc96e872

SHA1
b7a2ebdde3a4b1cf59b47d1efb701777c95b07f0

SHA256
64de95ca87a3c7b93b80449915da9fd7fa0063dc89c55cca2729ee2b1b87f451

SHA512
719dd852fe0fd23a99d40cd909998a285aa64b80fd37221be13d773befe877637dc50524747dbec1c06e4f7d91e8c339370cee8486624525fb6ac51eeb6e47cf

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
5KB

MD5
79c6401507b80fbe90b123148ccee16c

SHA1
18d82e584325de37bdb84e23bd1ccbd75e2d5155

SHA256
4962cb2f67bea3404ec4e32e6bce815af285c70a49c1b05c6ab5b3b0d7950dd7

SHA512
d232ca5d8f53a09a592589d91955bc4b7b2ed1141cbfbe0d46c0f451b114309dc59c15ecbaa36b5e84774a2818cfcfd1e7858913ee8ef960d72583966f6cc9d7

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
9a2213d8b23db22774e05b1dbb062dcf

SHA1
6b510036fd5b782db03988203dddee3865b59d77

SHA256
33115c3193bd35effcabc0728c1cb8725641f2d4bedf3575f609b18380e688da

SHA512
094557f10ba4895baab9b9b436e8b1703aaf71f7184207d1f3610b0db1406835106a73ec3a00705f5936d366de6a478a7f6a8152dcc2ea9b968f60f19171e599

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
5d73c32afecf2bac13d3ace9f026739d

SHA1
34d6887367da70b4f1f2d1780c949c8a99f02463

SHA256
0d00f370943c5d41c586f0d16ca16395e0863e7123b9cf378a2e4c8edbb18983

SHA512
bfe1c665c8b91d0db14a689c35195a7fb7735abcbd169ce611225f6e46eba11bb931b81ef3a7f80801440f6573d05af5a8977d8615239a80ca94302b5cc3cb4e

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
dc89bdd6767709e6b84aa4d0adcf3734

SHA1
5d00828dbe76c1f79dbbb21c23efa86efcc153ad

SHA256
2877c63ed6e13427080523816d7051bad5d0e508c0b7c4a397961c1f7668354d

SHA512
197d627f3e9c725736a0069a7fdb7735164d5942ef745502ed2d77672ae4ab90d8bb864b4ab7818c2d549d8478f5555f1e1c4deb35fe814255e595b5e9e59c42

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
5KB

MD5
592f1a7af4e0781525f1342d9b6e616b

SHA1
3cbad794cc0c6af19e9254463000fd2501011559

SHA256
f0600eaabe9baa18dd4bbc63967f00b2bc6e50f9ae74c37fd2d6aadef6387e74

SHA512
650ba9b8914f036352fa42f4ce0336d3e9db873e4094b9e562455e2f85714bb0f6866f9156ab8115131ce96b08f40520f1938971698504367bcb62c98b99664e

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
96e79395a03ee75c684aac9ae9c5c984

SHA1
eed8e1f67c476c1303a1a460fe51cf98dc08457d

SHA256
fc8218b816cb42f2c001bf08261e32b2a27f37678a9b0660bf9152fb4500f2b1

SHA512
dbaaa0dd11713dc91143ba34313e4e9acb1ae16757b83ff26b715f49394828c61cdc903c527993f79a43e606fa390ad2174902b8289a05ebec58d018a4ef1547

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
58445d8ccceeba55a938d4e1e805d802

SHA1
1749fe2381ae04ce32f1827c0f1623015766d711

SHA256
61da3b1bc5d909e3e87f5f9b6afccce905acedceec706fc2e36ec6b9622307c6

SHA512
a08388fdc01bf72171911a062e7bfc8ecfabda18e7347e8d9cdd3f5fa0a85a59bc7f8297cc64cbf1683c64432bdd2c373f12356f4d142b664ad995c1798e01bd

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
bbb79649cb9faba992b316880b1f7543

SHA1
2d2dd41016b4ca4b0a51934032fee1f1eaefe8ff

SHA256
a424da33a2f36d64c84f8925f610afa2d1557c59725e3f331ea12ca6bd8c8804

SHA512
517e6fbe5f4ee8dc629b6a7880c2058bfe443914118efe9fb5626c7212bd261cc77fb324c1fc4079f1e0a41ba569bb5e5d0ffe909f510a5509a785b004f3e862

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
e09a78c7a312b6177c42838573ebc640

SHA1
7e4aac7ce41108ee6c4fa865a9af0e38d24bc28c

SHA256
48d4987189d4d4e1f9011f08c011992dd4bbc3327b422183347b7ab81fa8e515

SHA512
166a89a570ec969611036eceeeafbd897d18c0b92383316badc87c58f62725a149a0cfe950f8249a2682b60c6c69b88a5f863d98b8ea9fb0178bb8b0149d042c

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
78aaa81bcba560633655d2bb5f6da187

SHA1
7976aefaa45bf5df0d10b96ecaa53a430813700e

SHA256
2d787d6c5035ed4d5d49f706d7605a2dc3ec4910db4aaef8689eb1f6d3af088f

SHA512
1324fb3194e2975c4b387a64ba48cf6b7180ad845ce8dde091454dee48792190d8604541e059c10c03b8cf0b0e038f378069c784286d10757f0f7b4a142f39ff

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
b5034af4367e8dfe05d697f892e4abd9

SHA1
0298fc8fd9e0f266bee06fa28e7d938bf80c5325

SHA256
3c41a7e083716348379dd00d527d191dac04643241cd5b63c33902c438624255

SHA512
49235f47bdfce056d95993070d78eea320879f4f8068370138851b69e6029d226100ee75ded0780c3e0242fbec8e40a34d3210f1008e03418d369b3b96854ebe

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
c7ecf4edc34b5615a5c13c16b9089e54

SHA1
1b58fe77e25d5fc95f36149d505240d04cb2e97e

SHA256
a1e7bad7fe548877c659f2a575d6eb57dc32d68bc7d2fd1bf36ac721ea022fea

SHA512
c056417a8f511afe48af7e057f25c031eff00dd32b443f613f0b072527234d782e5c97ab20ea083efde25284691ff431f806ec4a494634840455277d0481f25a

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
6afef504bc0beac366644390c2ed64d2

SHA1
75e16b43b1b8651f50f63c01bc1e22736221c829

SHA256
80d57050ee928ff6a98f83d9dba563d4b08c2b0311b78c3f32c4e3c3d6e95bcd

SHA512
876064d588dc4f14a6052de2ed2b30624417e6f9b6c559f62d0f4c28d6a9e3436f1c42475edb54a0851d4cb9a36e22960b09242037c6a0481488eeda3ebc4dee

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
d2e6f55325a962dc50fc623426672e02

SHA1
0bbff8845f9df9c645cf700c126518be5631daa7

SHA256
aefe7eda615b5b448a1b0e5a91f076c5c1d5ac959198529698a7e811df8b172d

SHA512
c277189d96388a889ecd32759f0fab1d60492a97f408d5ac7e9b97f8571ddb96ce9495580242572c4c11266629749032ac6e10a1011b2c22dbc55b49d98d21f2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
3KB

MD5
03b6a6e1f9fb2de6ce6f70493105b22b

SHA1
e96f1b1fef6d4e1aab47972f5c09e9872dc2d85f

SHA256
1003d01ff3de4ae3c2e57664551e77198831a2d409a0fb4c9fe1b1fcf8db7436

SHA512
3253e1dc86241cadf54d810da45dc733a618ef095d46e8b77815d07e17925984bb669d0b887db75032754045fbed8e87b35e643786cc934156ea80c9564e923d

Download Submit
\??\c:\users\admin\appdata\roaming\anydesk\printer_driver\AnyDeskPrintDriver.cat

Filesize
22KB

MD5
24479253cf8300bc751fcf1b599b11ff

SHA1
070e03f6a607c07468332189a2af82b1258f611f

SHA256
b7ed09e5141965dd3f058e87513a778d6b76905a98299a44a96303f89f76f877

SHA512
7eab3f61b4dcfcc4e80efb90078b5c306eb5240711ee07379626e77e50009a77aab79feff43a2b85e7bf7f2fc2f62205fc2ce095e99582170aa89134efd7b92c

Download Submit
\??\c:\users\admin\appdata\roaming\anydesk\printer_driver\anydeskprintdriver.inf

Filesize
1KB

MD5
4fd72ea7caab0a5701ae754ff971977c

SHA1
6a432aa100f0214cfb0578140882e0a8a6ca473f

SHA256
9ebbdb3a72bc8f74f71559ce9b069f46e362ffb506cef791f1e40bf624856cfd

SHA512
7003d768d51b46c979924e02ebfabdc56b465865751914ae42fa1fcc5e3f25560fc2ed851c5c19a8768f64b9df5949b8c45cde65bee4321227eac1307467a4b7

Download Submit
\??\c:\users\admin\appdata\roaming\anydesk\printer_driver\v4.cab

Filesize
140KB

MD5
493064af94247b271eecca1b9ae654dd

SHA1
95f32d864f6f6913aa435cb53f88016093c53648

SHA256
510b7fb3af6c02f71a20c10fe8be8c2d42054f93cd1bd01a58aee31760655a1a

SHA512
5b3f0643426ef4544e35315affacc1af4da45d9c9d99b61b6ce0a387ecaf6a752f0e7e145698f3f2320fd9a1b53bf99b0661f2d3d852d858d3481cbd790cf496

Download Submit
memory/2240-480-0x0000000000860000-0x0000000001EA2000-memory.dmp

Filesize
22.3MB

Download
memory/2240-616-0x0000000000860000-0x0000000001EA2000-memory.dmp

Filesize
22.3MB

Download
memory/2884-348-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/2884-486-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/2952-42-0x0000000005230000-0x000000000524B000-memory.dmp

Filesize
108KB

Download
memory/2952-340-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/2952-43-0x0000000005230000-0x000000000524B000-memory.dmp

Filesize
108KB

Download
memory/2952-299-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/2952-39-0x0000000005230000-0x000000000524B000-memory.dmp

Filesize
108KB

Download
memory/2952-214-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/2952-19-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/2952-15-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/2952-356-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/2952-225-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/3172-400-0x0000000004E40000-0x0000000004E5B000-memory.dmp

Filesize
108KB

Download
memory/3172-382-0x0000000000860000-0x0000000001EA2000-memory.dmp

Filesize
22.3MB

Download
memory/3172-399-0x0000000004E40000-0x0000000004E5B000-memory.dmp

Filesize
108KB

Download
memory/3172-615-0x0000000000860000-0x0000000001EA2000-memory.dmp

Filesize
22.3MB

Download
memory/3172-396-0x0000000004E40000-0x0000000004E5B000-memory.dmp

Filesize
108KB

Download
memory/3416-564-0x0000000000860000-0x0000000001EA2000-memory.dmp

Filesize
22.3MB

Download
memory/3416-623-0x0000000000860000-0x0000000001EA2000-memory.dmp

Filesize
22.3MB

Download
memory/3416-617-0x0000000000860000-0x0000000001EA2000-memory.dmp

Filesize
22.3MB

Download
memory/4528-341-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/4528-215-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/4528-300-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/4528-360-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/4528-17-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/4892-338-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/4892-298-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/4892-222-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/4912-133-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/4912-216-0x0000000000074000-0x0000000001176000-memory.dmp

Filesize
17.0MB

Download
memory/4912-213-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/4912-339-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/4912-91-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/4912-217-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/4912-297-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/4912-14-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/4912-7-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/4912-0-0x0000000000074000-0x0000000001176000-memory.dmp

Filesize
17.0MB

Download
memory/4912-1-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download
memory/4912-351-0x0000000000074000-0x0000000001176000-memory.dmp

Filesize
17.0MB

Download
memory/4912-355-0x0000000000070000-0x00000000016B2000-memory.dmp

Filesize
22.3MB

Download