Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    581s
  • max time network
    582s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/01/2025, 08:51

Errors

Reason
Machine shutdown

General

  • Target

    AnyDesk (1).exe

  • Size

    5.3MB

  • MD5

    0a269c555e15783351e02629502bf141

  • SHA1

    8fefa361e9b5bce4af0090093f51bcd02892b25d

  • SHA256

    fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca

  • SHA512

    b1784109f01d004f2f618e91695fc4ab9e64989cdedc39941cb1a4e7fed9032e096190269f3baefa590cc98552af5824d0f447a03213e4ae07cf55214758725a

  • SSDEEP

    98304:Uc9HTcGO0ImBimas54Ub5ixTStxZi/l9K0+zLVasSe4JnzMpm+Gq:UcpYGO0IOqs57bUwxG9CVaskJIYE

Score
8/10

Malware Config

Signatures

  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 44 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 7 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 56 IoCs
  • Modifies registry class 25 IoCs
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe
    "C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe
      "C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe" --local-service
      2⤵
      • Checks computer location settings
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:848
    • C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe
      "C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe" --local-control
      2⤵
      • Checks computer location settings
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3456
    • C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe
      "C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe" --install "C:\Program Files (x86)\AnyDesk" --start-with-win --create-shortcuts --create-taskbar-icon --create-desktop-icon --install-driver:mirror --install-driver:printer --update-main --svc-conf "C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf" --sys-conf "C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf"
      2⤵
      • Checks computer location settings
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1156
      • C:\Windows\SysWOW64\expand.exe
        expand -F:* "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver\v4.cab" "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver"
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:1792
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" printui.dll, PrintUIEntry /if /b "AnyDesk Printer" /f "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver\AnyDeskPrintDriver.inf" /r "AD_Port" /m "AnyDesk v4 Printer Driver"
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:2112
  • C:\Program Files (x86)\AnyDesk\AnyDesk.exe
    "C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --service
    1⤵
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2740
    • C:\Program Files (x86)\AnyDesk\AnyDesk.exe
      "C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --backend
      2⤵
      • Drops file in System32 directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2020
    • C:\Program Files (x86)\AnyDesk\AnyDesk.exe
      "C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --backend
      2⤵
      • Drops file in System32 directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1244
  • C:\Program Files (x86)\AnyDesk\AnyDesk.exe
    "C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --control
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1708
  • C:\Program Files (x86)\AnyDesk\AnyDesk.exe
    "C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --new-install
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4468
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3856
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{c134c17a-89e8-6b45-a927-e528834d0caf}\anydeskprintdriver.inf" "9" "49a18f3d7" "0000000000000148" "WinSta0\Default" "0000000000000160" "208" "c:\users\admin\appdata\roaming\anydesk\printer_driver"
      2⤵
      • Manipulates Digital Signatures
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:4000
      • C:\Windows\system32\rundll32.exe
        rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{9da09eef-6e96-6242-81e6-829142af1ac7} Global\{39e43149-28df-b74f-bef2-7182e0c7303d} C:\Windows\System32\DriverStore\Temp\{702c6d55-ed69-444b-8917-bb803b4f2315}\anydeskprintdriver.inf C:\Windows\System32\DriverStore\Temp\{702c6d55-ed69-444b-8917-bb803b4f2315}\AnyDeskPrintDriver.cat
        3⤵
          PID:3116
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x2d4 0x494
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:428
    • C:\Program Files\VideoLAN\VLC\vlc.exe
      "C:\Program Files\VideoLAN\VLC\vlc.exe"
      1⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1980
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultef3eb244hab2ah4860ha739h2cb0386987c2
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:3904
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff85dc346f8,0x7ff85dc34708,0x7ff85dc34718
        2⤵
          PID:1588
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,16789767142551869129,12729087487687095481,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
          2⤵
            PID:3812
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,16789767142551869129,12729087487687095481,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3332
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,16789767142551869129,12729087487687095481,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
            2⤵
              PID:4216
          • C:\Windows\System32\CompPkgSrv.exe
            C:\Windows\System32\CompPkgSrv.exe -Embedding
            1⤵
              PID:3144
            • C:\Windows\System32\CompPkgSrv.exe
              C:\Windows\System32\CompPkgSrv.exe -Embedding
              1⤵
                PID:1952
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
                1⤵
                  PID:4780
                • C:\Windows\system32\LogonUI.exe
                  "LogonUI.exe" /flags:0x4 /state0:0xa3960855 /state1:0x41c64e6d
                  1⤵
                  • Modifies data under HKEY_USERS
                  • Suspicious use of SetWindowsHookEx
                  PID:460

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Program Files (x86)\AnyDesk\AnyDesk.exe

                  Filesize

                  5.3MB

                  MD5

                  0a269c555e15783351e02629502bf141

                  SHA1

                  8fefa361e9b5bce4af0090093f51bcd02892b25d

                  SHA256

                  fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca

                  SHA512

                  b1784109f01d004f2f618e91695fc4ab9e64989cdedc39941cb1a4e7fed9032e096190269f3baefa590cc98552af5824d0f447a03213e4ae07cf55214758725a

                • C:\ProgramData\AnyDesk\service.conf

                  Filesize

                  2KB

                  MD5

                  450e1c96a3db5450370622771bd2b949

                  SHA1

                  805f242226c25eb963fdc2612f02d7b284e9f21a

                  SHA256

                  ab97c0d091f3c090b2b0e0a35bcaac083dd1cce029be2339c249430a001870fe

                  SHA512

                  5ccbd3faa3392448b376f0ea3804029c92f23febbe6cbcbd82aeea494004208ea11a6f318bc4168021b3fca25b3dba9338e2d2203391ac3fb8ab2e577a1c0703

                • C:\ProgramData\AnyDesk\system.conf

                  Filesize

                  950B

                  MD5

                  349ca69b63a9d26d55973d8f8c21f416

                  SHA1

                  e1b7ba78f78e65a97e69264a6fc238f855090443

                  SHA256

                  a62b3aff18a2c178af34bc8f56fc9a0eaca22fb6b06c58d893ef76e4858a311e

                  SHA512

                  3f05b3fd2c64575e7e6c3efc303fc0f3db1e7883b4274c1bec5b6b3f24c8076697699748f66d695e88450eac7f026c4c2fc72a6a26f862ff5954c08705604e27

                • C:\ProgramData\AnyDesk\system.conf

                  Filesize

                  950B

                  MD5

                  3a8065229e273170801a416168c68d23

                  SHA1

                  f5d2954e06ba4416f9885f7308f9be74313341df

                  SHA256

                  0b17244f7f2efb02a851c1d338b13adb33111ad4149621c39a744c8cf6e7a7d9

                  SHA512

                  33f3b3de79d3baba8056a6a2e396ef99f1257d4078fbcaa48a15caf237ced7edcfe0bc0a77fa90329500217cda6e47e9763bf64ca6aec5bca48726642374ebc7

                • C:\ProgramData\AnyDesk\system.conf

                  Filesize

                  950B

                  MD5

                  3e0e37594a28bffcb8d46e5924e6960d

                  SHA1

                  d23eae218f29c0cea40880f3403a77392a47812b

                  SHA256

                  0e16c1af5ea9dd909891f00dc95de6ef2cb80499f2dd5e727a9f30a7bcd23176

                  SHA512

                  2318ebad8ebae2e4b0be720e5cbb6ccf5dc2112570d567d920f32a6fe92920b00df5792d25a6757526abee74745ef74bb0a38f4426631fddf1453e2e8ccb00c8

                • C:\ProgramData\AnyDesk\system.conf

                  Filesize

                  942B

                  MD5

                  84310e135bb84beae3e4668ce15a8896

                  SHA1

                  0f9ad4a8a42a1eea9e95306de34e64bbeb476469

                  SHA256

                  8938ce8d77a7d274b4bf6032bd3397847798f07e06df5401276fd9e9faa82bda

                  SHA512

                  87a1cfea6a5add51ee570f49ae0f47012c64bf9c214e01233f0f4ffd4cbfef67c06017a29db48fe564fd097deddfe800f526163359656094cf6b6a34581d5ab7

                • C:\ProgramData\AnyDesk\system.conf

                  Filesize

                  942B

                  MD5

                  5a3536932ab508e34dfceb520a62fbbd

                  SHA1

                  70c242e908f8bd23c1f89b11c79f1f2a8c180c49

                  SHA256

                  6726a70587f864dbcad3941f76209d3f20ee6704e1d46dd14494448a1d6aa798

                  SHA512

                  487c464fa4982f1d6c1115d5b5a964cd340fb62776cd682348a6099a04edcd9201deecd71c8d21bdbe288bab32fac31551ec6e50adbe68b760ba3829815e5a39

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                  Filesize

                  152B

                  MD5

                  f426165d1e5f7df1b7a3758c306cd4ae

                  SHA1

                  59ef728fbbb5c4197600f61daec48556fec651c1

                  SHA256

                  b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

                  SHA512

                  8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\30d7a268-dd58-4f3a-b350-3f37300806f1.tmp

                  Filesize

                  5KB

                  MD5

                  d14b037db048eff52280bdad2efdb3d2

                  SHA1

                  ff6434dc00afc8fc5e8a12cbc4ffbacbf1bd1a7b

                  SHA256

                  6ea3d6b3bf7f7ce2be21c2827d94e1e97d6a56ce0c5b7e7cafc669096283221d

                  SHA512

                  7d323cae845bc513d93bafc914c00f4e1e7b02bcf61a4ff5df92f5a17af3d35ddf5654780434ae9d6b82b8f9573a7a14d407108590bd3809151c99b84a71c150

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                  Filesize

                  8KB

                  MD5

                  df90040e0b5ddc2fff9f399383ee0e71

                  SHA1

                  2bfeb6d76a9a032db16327d20e8c89d440c8d8a8

                  SHA256

                  99d762c160e80cc65960a1141ed069a53304ad5be7c19687656597052cb272f6

                  SHA512

                  2cda64500638cdc17ce793307d03ffd2902a9465bd4e4880a80d13550bd6efc8eff4551b8444c01a70ad1b0865d9db7278c912658a2f460486b60de1d2161239

                • C:\Users\Admin\AppData\Local\Temp\gcapi.dll

                  Filesize

                  256KB

                  MD5

                  1e2c202611b304429423667726774cb7

                  SHA1

                  9b9ebfb38333a7f53d8e8d9c27da65d0bdeb597f

                  SHA256

                  f6be90507dfddc76d377a493cab51377af79462bbca379f2a251e1ecdebca627

                  SHA512

                  6a8ed9aed23d58ee3058b4a164d329fc4a546fded672a8aa875f53bebfeb3c5c96e649fd137657e736e00587102177a39ce4c3e871108cfc1177de57a51a2858

                • C:\Users\Admin\AppData\Local\Temp\{c134c17a-89e8-6b45-a927-e528834d0caf}\SET586C.tmp

                  Filesize

                  299KB

                  MD5

                  a4e4b05588899d7dc1d70c651cfce2d2

                  SHA1

                  c280c7f97e02eb582f09805451e5b17c34d0e119

                  SHA256

                  76a784f5561994bf302f0d65576efc676866429497a16a611ea38f8fc8939396

                  SHA512

                  428bd7da6d77af8413227ae3382f707436dbd494e9ead7a3d002a175ba64ceab71f76fcd94581c3f2532809fa69af1eb29a56e48a61d37fe42dfddbe4fef0278

                • C:\Users\Admin\AppData\Local\Temp\{c134c17a-89e8-6b45-a927-e528834d0caf}\SET587D.tmp

                  Filesize

                  252B

                  MD5

                  5cda10b02df931ebbad3d0fc9d9509b7

                  SHA1

                  f04b7885bfac4bee938d047f6703c58d4087facd

                  SHA256

                  ca33091bbdfd87bb3acca1a3eec96d3948a0830d9bc7bef3c40e15055e4c9a03

                  SHA512

                  99cfc18278eb4726b44caac07f1cec7f877791290cecd003417f1ab06716c5d4c004f2dea767676895db0e96dfa2023661d44684bfe990d5a97fc03e60dfc6bb

                • C:\Users\Admin\AppData\Local\Temp\{c134c17a-89e8-6b45-a927-e528834d0caf}\SET587F.tmp

                  Filesize

                  11KB

                  MD5

                  ddf4ac6ecd52467516b31e0939b8a030

                  SHA1

                  bd452adc22223981b67dc4d665e3a0e8cf470c09

                  SHA256

                  019677297ae01db991a5c122ae582424e51d41ef7bb81fdf26269afaaaf5ae22

                  SHA512

                  a63b7dc23f8a8ae697aadc564e947fa5a8d3429f319ea72f5b0cbb77c51bd4f7d15450218360d6a742e2f2e3187745eff71f237079bc01fa1fa5cb6fb3c7402b

                • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

                  Filesize

                  9KB

                  MD5

                  abd2735b1a81ebe2c5d1b97dfcc56edc

                  SHA1

                  14a594054851b1ebe09ba6f39043121c9c82f608

                  SHA256

                  36890491b77f4dadbb46805c7d309baff2f8a4189bdf65eace5992d6c4fd69e2

                  SHA512

                  0c1ee52d7f6cb4875f05c72b3e4282d96939adb3cdb776abe8220b98f772ab7b2307875f367015dea06e12617968233e1cc7003144b8db66d20d333182159a98

                • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

                  Filesize

                  7KB

                  MD5

                  b0517392d28638f7688d767368db3c2a

                  SHA1

                  4967e9918fd43e6c05e72bc810b4c777c92c9a4b

                  SHA256

                  c204d40325b20f02372708f38fa84296186f6e34887b20c28706caf2fee8f857

                  SHA512

                  6af2ca32f849fb76567719bf52cfac83a94be1cadd43b4eb3af9ad40b7b75d27bd1bb629756ad9634212714f2b5ac5c844d6d781b74bec73262a6181904e4979

                • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

                  Filesize

                  32KB

                  MD5

                  12cc96d5010e04056d4f01614794303d

                  SHA1

                  070a9cc5555745e512f825abce887f4cca163f40

                  SHA256

                  9441f0e64df0801765110225597e180da3be0aa6a44337f6a5cd115c43f235bb

                  SHA512

                  3234c154cc8aa4e799415dc79523ee52f49429ef62a8dc73e4de1ee9c0785224cf39f49922873c8827410f0c2d8ee28f2409b9a399a46c7cc5742017eccca41f

                • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

                  Filesize

                  47KB

                  MD5

                  49265cbb46b0a2681e001889701cff5e

                  SHA1

                  bcd812f3ea0ce6a47efb475a16540059b8277e34

                  SHA256

                  34c534d21a25830bd7e376881c4687e0063b517369981663b64e66126d58a984

                  SHA512

                  09db52c57b862e331fe539b4c6f38ed8f1db282f42dcac525abceca79bc3e5c3dfcf51a24cddac9a8a48f188ee53f744a9e56eea4dac9bb400634d13f4ed9161

                • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

                  Filesize

                  53KB

                  MD5

                  7f17b7ca0b454708a8d0c9c9dd3a61ee

                  SHA1

                  648fb37dd6fbd22f84e7a0239851b447a93b1cb0

                  SHA256

                  15f4fc228336fa05612d0f4a676833d150634271e8ccc3e5b3264f8e4aad590c

                  SHA512

                  fe86bb8cba7602e1b2fa338cdb94f546481f90a272eaa380326f11aa21120ae2f4080b220986004e0c83122165aa8e38b0685bef5e4b7a9127a1db2c0eb80c7e

                • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

                  Filesize

                  91KB

                  MD5

                  b4298318e987ce4683d2b66635172d23

                  SHA1

                  95b6bb7bfcf1de48927aa51911e0dff041806afe

                  SHA256

                  b97e353f76d72a2a5398c9a43a6782b17a5bfb5386e2239511b4afc9de0bebd7

                  SHA512

                  2e2d3825889e6397eb9187a95e9448bbd4559a06ae9addf5be81db01da927d9d08745accc78b3e45300ceee31265daa24393cfc467bdcf340d4f8d023ac7f079

                • C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

                  Filesize

                  2KB

                  MD5

                  503b327c6942d113de548e6e9709e5bb

                  SHA1

                  5132abafeff99a9e17a6256b98ad5a718a9b9cc8

                  SHA256

                  5905eb19f8599f209b36cf3d7524e2c48a184a9e95e39c037079fbc3a4658a7a

                  SHA512

                  ab62d1ebd3adb08e6d658e4f63c4caa54f91259b826121d14bf1c2905c84e330852db7649c0070ba3eb1293d9832a5ced294c1317b63922f160af156a543490b

                • C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

                  Filesize

                  2KB

                  MD5

                  4d2b907e40791286048d4f2e97db5643

                  SHA1

                  e7d4443133d3f246ce389b924be8b1597cf89a57

                  SHA256

                  2806100b9753997e3dfbf887688f12f2e556d689129e906aa7e0cb1aba172315

                  SHA512

                  9caac61429dc47c30fd8719aa723534dd1d153e933a8781f3b2ba1d2d4ffcfe9adc58895eee059e060249285818b1ac2146f2fa9a28ea1da601c3a84ed53ccc3

                • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

                  Filesize

                  766B

                  MD5

                  89799c7a41868c838fba91d9b1c251c1

                  SHA1

                  4f00429ca110a2a24b71dc8673cde967841f8065

                  SHA256

                  4f96c1bd4acfbfdea454c65a790f3fc1f1b73ba0468510e67a60d4b6308beea4

                  SHA512

                  50442b976db86b01eebcaf29dd172898df48b653556237cd16958ec2a839bc9e57db5d729295b83fa1588069eb9c014470d5af7c0e34417ebf4a675ed1498643

                • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

                  Filesize

                  823B

                  MD5

                  18d0a2c3a20e7a16bf4216fcce72d16b

                  SHA1

                  a534fe9f281a378514fa162f6686618760e233ca

                  SHA256

                  ab0c5349d134738f9a15cf7e1b16ca7b245e536fff9bb19164e282f7a4797edb

                  SHA512

                  d92867d88e1b1b6d6eb97301fc164579522adfb30cf936b7bfe1fa548c09268b6620a82831c8c02b5f63873a97affd44a5667625a1c81f88188376d450346370

                • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

                  Filesize

                  831B

                  MD5

                  266b1a301274f3d78e5705bd8f98662d

                  SHA1

                  f5dc66601fe4fa48f84d0bc6a3da120fb9c3a74c

                  SHA256

                  b5c46e3c6d4321924404e7e9e23c0b4c65646cca41c6efcc103a357730b15a6e

                  SHA512

                  4eee78231f9263007aadba1de03d3a2565e6e055134622605f5494965a91a8088ba926fddf2532334eee2807e423ae5fed92edfc94369076465d62ef7dec5568

                • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

                  Filesize

                  312B

                  MD5

                  0c04ad1083dc5c7c45e3ee2cd344ae38

                  SHA1

                  f1cf190f8ca93000e56d49732e9e827e2554c46f

                  SHA256

                  6452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0

                  SHA512

                  6c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492

                • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

                  Filesize

                  831B

                  MD5

                  2584652c9b9752e8b57c048b4f594b6a

                  SHA1

                  47b4256806b0858045fb9f82c9b08cb7cf879cf9

                  SHA256

                  e0615798e573505b64067a4550a01eace5167d3775a45e98410f65507af03a8a

                  SHA512

                  a6aab3d5666774cd5c52438eaaa778d7c3eb52f0dcddbd73c91465b3b36b0a363c8988f8b774a8db4f93474921ec748bbdbf5bf556fd8f0c8e52f68c507f4df3

                • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

                  Filesize

                  468B

                  MD5

                  ec37bf45454c5a3b99d1d4722eb13575

                  SHA1

                  7dfeea15a4534ab735b00b5c3feee2973466033c

                  SHA256

                  7604c3bb6f52e9c6a659c2dd9de88615b1197404ac891c836930531ec8f7eb6c

                  SHA512

                  f904e9493eea69ba6c5e6b069a8264a7111d59f253ab1b0999afbec74f8a198ad5fae623cd1749db069b3cf30b6c081faa418b72307d64005500135c941274ca

                • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

                  Filesize

                  468B

                  MD5

                  53c222bcbca9d36c0f75831a51f8837b

                  SHA1

                  6f3d449e21768207f9d933caf66497d046cd6b78

                  SHA256

                  0f623bd9bd357f810c2b99088dde21e7b4d03be9955faf6431d3c09970af23bf

                  SHA512

                  3f01985fdb5459f159986200ffd1decd9334582960cf3184c01126825c1c46344626163284612ad6ca117d0b9db8637b3d9fbf76a5f5f5856fab4671cd129eca

                • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                  Filesize

                  2KB

                  MD5

                  c0d2853b807e857ae7b1e57fabb66ca1

                  SHA1

                  5b0af7127509c05caee49336b1efc15d59fd28a0

                  SHA256

                  5fee5819e2a1814e494b107663fb9da57311963e88123837676d17e2c28a58c9

                  SHA512

                  a7a1d3ccc6734a0b7dd50c9f7e2671c58c8173727808890482f38361cded1b231dc56153dc44756b4559e867bb1bbf92813c60a5f0edba50aa997905da9d0405

                • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                  Filesize

                  2KB

                  MD5

                  c47ee1e76e25cab05d6a09977e1d20f4

                  SHA1

                  daac96aeee5cf0a91d107e09e5c85c22b4b17238

                  SHA256

                  7a411bd8c67b7469980b175504f4674e086e68f7134d25a71bf02b0bfa756bb4

                  SHA512

                  f46fd56bac08b0bb5c0165805835fc22a73a1b9743821eb73082de63710cbe7d66b759f831e7bba3b2833b63e61dbe27cb4dc51fbda1b873af1599c1a504953f

                • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                  Filesize

                  6KB

                  MD5

                  cd5bb5ae5d4e5ea6241edcb3d4c78f31

                  SHA1

                  3307c9f763d034f85def5a20b8f9514193c1d972

                  SHA256

                  ca34d80b2303f79034e05ba6c0351cb4448087361dbfd8b618409f076ad60155

                  SHA512

                  ef509332bc09d1e278dad369da30c588a2eeef4c7b0e4e4667997c6a727e9f25f9bbb85650868c10ad365f5bd491a865d2f6fe1822e79afa7f05639581cb5a0d

                • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                  Filesize

                  5KB

                  MD5

                  0b2725dd2b7036455d39308ba2bf2040

                  SHA1

                  6f5b694bb19c815e35f3d8dfb127d8089fc8fc45

                  SHA256

                  fa45298cdec81aa059212e5235cc05faa5bf898ed6d51661e7f73df50fbd73f2

                  SHA512

                  d4e2494f2e8d52f23e3f95c67e315f9e8942aa28628b5feeac4ff8508fba33355e1c7be1fb16de73c7471f2d206cc8b22e410e06f389f33a4be79d1dd03f30f6

                • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                  Filesize

                  5KB

                  MD5

                  74c602a0a2eee0874577254d90652198

                  SHA1

                  171f2d62f69eb2959a2c854e15c1c0b44a6e625b

                  SHA256

                  71866a3dc49e61b647c0b9e63b1e91b06188a10a4e40b3f42f648adfa224168b

                  SHA512

                  8ca1c21edec4093ccae68b6b3fadaf47a9002476d45d3054bbe3f643bab032e49973e4f68ad922b564ca7666c9dc6210ce61d9b8ddaaa7c6b0d71adc4704bef9

                • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                  Filesize

                  5KB

                  MD5

                  5678d8898682aac9f1283178fb56dbea

                  SHA1

                  1359fb65660e0343288189f260e398ef32e18c74

                  SHA256

                  0ba8fb45825246caa2e42a1ecc6b666793beb1dd1e84d7fa139d3670a7ff7770

                  SHA512

                  95ebb218598f13a8ecd73ee756e5fe86a953dd3862c08fb8460cce3953f2b7656eed5e78fb77ebf4e06b92d1588e90f57c00df09822be9d48666883198817696

                • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                  Filesize

                  6KB

                  MD5

                  ad237a5eb46fed908a8b295d30ceba70

                  SHA1

                  89aa7375d1eee2e74d9e62ce95cee0ac02f3cbcd

                  SHA256

                  b90fba02ce1db3a24d8c46a465c1719299d2f709281676e488d5e2928e1b4e1f

                  SHA512

                  1a0dda18562d15715cf4428646cb50a3abdb29603bcd1b04065b00bd2a48571230f37159768fca2faa4537760523c00791525e391d4ba30dd45517c7dbcdc799

                • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                  Filesize

                  1KB

                  MD5

                  ab7e5baedd02d3ce83835c5269bb2be6

                  SHA1

                  08a61c8d2f137ce638be2aa47d2c0b3f4f03c9fb

                  SHA256

                  aecbbdbfcb87ce73cc78d10f1b44f1947e5aabf234dc9aae86db7ed4aeedc0bc

                  SHA512

                  881978a1401352d40d5d519eb1df6701122da0ef48752f6e3f6f22df2601af5514b41260ef7da9fa05406f490b4d47178bb138c5f1332fe00dbccb2978b7ec45

                • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                  Filesize

                  6KB

                  MD5

                  98b204d71e270a62795927754965e5d5

                  SHA1

                  fa405740248af4c95ab95c44b5ea52b39e310c2f

                  SHA256

                  ef220f3d5762ccb3e5fb9753cb1ed038e0863a5d96111e9c19d68a03978ba745

                  SHA512

                  4cc884ffd3f1d241d877a0d86b29aabebb9dddd8240c116d6097bc899ccba856b35496ed93a6d6552373ff5a64357ccffac5981d90266a0db85861ee928baf97

                • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                  Filesize

                  6KB

                  MD5

                  145802e951878de13ab5bcc741118beb

                  SHA1

                  f602d8be049e66d306f7a974c45792dd2981dea5

                  SHA256

                  75243b1c3b20ab7f41b6cea9cebf222f5a578945278ed332071dc558d1278c50

                  SHA512

                  10b221b1af6668755a5d5ba25bb6f7c40cc5c96f404c3af9d3023b217c607efcf62714f164d4829c0d7f22bb7d2c0680a2a81a762b6701b12df68adf2eafd4c7

                • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                  Filesize

                  6KB

                  MD5

                  6bbb5c3b0b16cf8dcbe19cbeab71b4c8

                  SHA1

                  2768d122087fe889feb13b07b2e38e45eb442aa8

                  SHA256

                  fd0f9bb25263099e40f4ee6281975911bec93c465ad2cef00d92adcaa15949aa

                  SHA512

                  d496c66cba2bd3fa97029d82a564c95f58a361e5f2eb2e93107f748c8dd2212c55d6bbd354e5adca22e4f0280e44f4139ebe4cce31feeae18f62df23a729da71

                • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                  Filesize

                  5KB

                  MD5

                  6cc89040a5a090cceb654f4fff6f1af2

                  SHA1

                  49bdf1eeddf8bacd3751ce4134136539b2bc175d

                  SHA256

                  5d142d239db583a63f990161b84a75891a0eccd903a5fc2377cfe0722abff380

                  SHA512

                  b54e7fbe199107c2b85d6233340b95311af42af71e4678bb3c42bb5ff8d4ab4cf2847f13446efb00007d964f93952053e0c2e49ef124dbf47d2db395a04cf6c2

                • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                  Filesize

                  5KB

                  MD5

                  27d28c61b008a03265a56aa627552110

                  SHA1

                  09ba0b00b5e606cd0c21ddaf866b8c0b857c0eea

                  SHA256

                  7b410d42f5955b9e44349222081bc26cc9b96e9f9ac945a553210bb72307a90a

                  SHA512

                  232be4d881a1fc306809cbd76bef01767fda4c0ed4c0ddee1ff7f2c3c3b7593dd4a9e1a49a27f92a584ac0c4c7ae69ed8988df30d5b14f2e2b6de39a0e170a50

                • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                  Filesize

                  1KB

                  MD5

                  dd083f8b915113f331e37ca480bca0a7

                  SHA1

                  3bb67f3294a1337bae7b1e9dc251ea8f51f7566d

                  SHA256

                  214eeb75be97afd32134e95f46e48c6cab41db1e75da566c843204c4e3e735fa

                  SHA512

                  62dbc4f7d130be0af5619e0c39aabafcde3d485654086528bd3c73699a7f4a00cfb03f8fa031adb14687163773971abc75a67e4ff2ac72e748b741688f9eaa5d

                • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                  Filesize

                  5KB

                  MD5

                  a3902d02869365ee0ca025251cd59bd1

                  SHA1

                  ba398c3d94d65ef1842dc4d510a1c102c916bb81

                  SHA256

                  99a2fa40d72043243258e41cf120dcc918413c74abdae805b1640f4354dc7d45

                  SHA512

                  406b5eff4bc44dbefdb0cac5c8a0d3b283768c49a229ae9cfcf73cc5f1e5b0cfee2d74e85b4610b4e7e792d724e0cd89e3929b08776ab4fc541c00c738e6b453

                • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                  Filesize

                  6KB

                  MD5

                  24bb930adee78156ee761870849bc43e

                  SHA1

                  d4505858df7e0d9cf79c34b89774feca503aa1fc

                  SHA256

                  5db8517b2586f55565ad851eeb58f04fe116d3d180909ba8f81121a055664b62

                  SHA512

                  5f9e1e40db300381840da58b88eacb97c2afa03d942972265951b0621174f0ac3fe5220cef14701adac55e25b82093ffc74c747b2e5d076c65d20e45b39d7e9c

                • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                  Filesize

                  6KB

                  MD5

                  92d360eb8777bca10e27e7d42302aaf3

                  SHA1

                  cc145b7b4b6ad3caefedf2608161c81eac1f4013

                  SHA256

                  879dcfbcf479514f45087d46910c5fed45a0bf011ac2f7858144e73cd987bff3

                  SHA512

                  333a097cad167672b8ddc92374ff96cff5f44779046a1feca14ff567fdbbcbe9b379a40ae4854cf26cc7d8b23f8988d0d8ce21a3462f26269e20b772b0cb65f4

                • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                  Filesize

                  1KB

                  MD5

                  150ee0f9156c6f5bd173e5da254064fa

                  SHA1

                  f9f3446db8789466c6b0de0441b033b5dd21813b

                  SHA256

                  e4f33f4232a6af615241bd6865e1e84735c0a1b81f4565a8f3e7cb5530f45694

                  SHA512

                  bd4c5f8e6efea6813e6322a0997c1b9e0a79c4b58808639206c175614304cbf7c181d44dd5c6294339c46933178b30cb989933802cdeacf66f34d306a612c004

                • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                  Filesize

                  1KB

                  MD5

                  66b68682d91e92641318f12bf2df7b1c

                  SHA1

                  e410683f1bb5568217923c5b157b7deaf8148c49

                  SHA256

                  822322560d5ca756535683921f1fea589f8557d089f08d4d88c142b30c316f9e

                  SHA512

                  1fd83641d3830ea49f43199e0f5a6af132275f3841a63f05a4c2a6870143946ce5e0e3d6394403ca3a3180e05bcfa8a546e002c72940b1bba422ea2e5f105b08

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

                  Filesize

                  5KB

                  MD5

                  e9b6c014432c89eafb4cfda70f8bb2c1

                  SHA1

                  101a61985bb766abc9c31934a68d2a3e1859d28a

                  SHA256

                  b4caf5d58a25b4c945df2c84ace029c5554292a1178d1a0a85fd258902dde359

                  SHA512

                  8f13cd246dae4a6b6ead65624f9479ccf4ae3953b4f8c1048307264bbe1a63e0947dbe9753c4b2d5be69795747946428e658689000f57735a8d005b900c2ce3e

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

                  Filesize

                  5KB

                  MD5

                  b7db75cbb9e0ae0ca9821f37349f725f

                  SHA1

                  db54618fa06221e2ecae8b9060c8564980c73e56

                  SHA256

                  6ee95511429a47180383e01a9bd1a36a2c27769a2cfd094cbbe660dd1fe2cbf5

                  SHA512

                  0ab8479c9d71bc6ecaf8148e976532aab6c0c29568ca81f55ca5eb3f7a74387fb7cecb05087fa62f1b9df341f8aa8323decb5715d9a494889697097f76628b2a

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

                  Filesize

                  3KB

                  MD5

                  9ae1b5eccc36f6a62fd2bc8bf098606e

                  SHA1

                  947a4af0c3096e2390c3686092f52deb01ca21c4

                  SHA256

                  fd8424c3020d1385ee1891942934d560bbd7d6b400c2297e534ad40cbf97bc02

                  SHA512

                  15425803e378f3086e602aa329b7629c44004a26386d5b945e2059e518b26143c8ff62857125e9c1d8b13d291af5aef953b67c932e779a1fe49321d47d08ba95

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

                  Filesize

                  3KB

                  MD5

                  0d781bd5933d553581e0d0195f352636

                  SHA1

                  b72e8bafbf02813b2f4d6c0ad8ba011ba39bf996

                  SHA256

                  6f425365606305ec9b949b52d09fffeaab1111a03584cb4578dbbff2b775d792

                  SHA512

                  0d69adea44887fbb80f64a6ff1a918a18ff6d60716219ec2c177c7ddc18394e08f81c0b509fb65f96b84ad0795090cbba541dbb2a8fd95d9984f3f35fe1ad581

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

                  Filesize

                  3KB

                  MD5

                  8d22fb11679517785846c895d874441b

                  SHA1

                  20e6b3440c6739afb02785ff48ca34fcc05d0555

                  SHA256

                  31d26175b4502a0f9024c1dda4848269496ebabdd72a6312641401a58eae350d

                  SHA512

                  a676d9ac1f5ea3aa042544d3048644733fb509ae9576814f232f222ee2833c77f5a5d71628667e397030fa90ce227857df51c982f740fc73e836b12fcb1e4aea

                • \??\c:\users\admin\appdata\roaming\anydesk\PRINTE~1\AnyDeskPrintDriverRenderFilter-PipelineConfig.xml

                  Filesize

                  567B

                  MD5

                  8accaa9aa32148aa2bcd72ff14880618

                  SHA1

                  a1226a1c5c92e41ba22b382debc0f9a754b92c05

                  SHA256

                  aa0b5f757b3d83d19c973fddc4e82722b530d9aedec51f6a540a91126e4cc0dd

                  SHA512

                  026e07faf75a5be8c96ae59a93302a487a18b193b5d915aba5822cc27d2fd1f70fafb9239b34df8280b060f85bcf3316d1d4d5f1b21c8557b187affaf490a3bd

                • \??\c:\users\admin\appdata\roaming\anydesk\printer_driver\AnyDeskPrintDriver.cat

                  Filesize

                  22KB

                  MD5

                  24479253cf8300bc751fcf1b599b11ff

                  SHA1

                  070e03f6a607c07468332189a2af82b1258f611f

                  SHA256

                  b7ed09e5141965dd3f058e87513a778d6b76905a98299a44a96303f89f76f877

                  SHA512

                  7eab3f61b4dcfcc4e80efb90078b5c306eb5240711ee07379626e77e50009a77aab79feff43a2b85e7bf7f2fc2f62205fc2ce095e99582170aa89134efd7b92c

                • \??\c:\users\admin\appdata\roaming\anydesk\printer_driver\anydeskprintdriver.inf

                  Filesize

                  1KB

                  MD5

                  4fd72ea7caab0a5701ae754ff971977c

                  SHA1

                  6a432aa100f0214cfb0578140882e0a8a6ca473f

                  SHA256

                  9ebbdb3a72bc8f74f71559ce9b069f46e362ffb506cef791f1e40bf624856cfd

                  SHA512

                  7003d768d51b46c979924e02ebfabdc56b465865751914ae42fa1fcc5e3f25560fc2ed851c5c19a8768f64b9df5949b8c45cde65bee4321227eac1307467a4b7

                • \??\c:\users\admin\appdata\roaming\anydesk\printer_driver\v4.cab

                  Filesize

                  140KB

                  MD5

                  493064af94247b271eecca1b9ae654dd

                  SHA1

                  95f32d864f6f6913aa435cb53f88016093c53648

                  SHA256

                  510b7fb3af6c02f71a20c10fe8be8c2d42054f93cd1bd01a58aee31760655a1a

                  SHA512

                  5b3f0643426ef4544e35315affacc1af4da45d9c9d99b61b6ce0a387ecaf6a752f0e7e145698f3f2320fd9a1b53bf99b0661f2d3d852d858d3481cbd790cf496

                • memory/848-232-0x0000000000410000-0x0000000001A52000-memory.dmp

                  Filesize

                  22.3MB

                • memory/848-42-0x00000000055D0000-0x00000000055EB000-memory.dmp

                  Filesize

                  108KB

                • memory/848-38-0x00000000055D0000-0x00000000055EB000-memory.dmp

                  Filesize

                  108KB

                • memory/848-41-0x00000000055D0000-0x00000000055EB000-memory.dmp

                  Filesize

                  108KB

                • memory/848-272-0x0000000000410000-0x0000000001A52000-memory.dmp

                  Filesize

                  22.3MB

                • memory/848-12-0x0000000000410000-0x0000000001A52000-memory.dmp

                  Filesize

                  22.3MB

                • memory/1156-247-0x0000000000410000-0x0000000001A52000-memory.dmp

                  Filesize

                  22.3MB

                • memory/1156-419-0x0000000000410000-0x0000000001A52000-memory.dmp

                  Filesize

                  22.3MB

                • memory/1656-505-0x0000000000410000-0x0000000001A52000-memory.dmp

                  Filesize

                  22.3MB

                • memory/1656-0-0x0000000000414000-0x0000000001516000-memory.dmp

                  Filesize

                  17.0MB

                • memory/1656-1-0x0000000000410000-0x0000000001A52000-memory.dmp

                  Filesize

                  22.3MB

                • memory/1656-7-0x0000000000410000-0x0000000001A52000-memory.dmp

                  Filesize

                  22.3MB

                • memory/1656-231-0x0000000000414000-0x0000000001516000-memory.dmp

                  Filesize

                  17.0MB

                • memory/1656-506-0x0000000000414000-0x0000000001516000-memory.dmp

                  Filesize

                  17.0MB

                • memory/1656-230-0x0000000000410000-0x0000000001A52000-memory.dmp

                  Filesize

                  22.3MB

                • memory/1656-241-0x0000000000410000-0x0000000001A52000-memory.dmp

                  Filesize

                  22.3MB

                • memory/1708-557-0x0000000000040000-0x0000000001682000-memory.dmp

                  Filesize

                  22.3MB

                • memory/1708-380-0x0000000000040000-0x0000000001682000-memory.dmp

                  Filesize

                  22.3MB

                • memory/2740-297-0x0000000004520000-0x000000000453B000-memory.dmp

                  Filesize

                  108KB

                • memory/2740-556-0x0000000000040000-0x0000000001682000-memory.dmp

                  Filesize

                  22.3MB

                • memory/2740-279-0x0000000000040000-0x0000000001682000-memory.dmp

                  Filesize

                  22.3MB

                • memory/2740-294-0x0000000004520000-0x000000000453B000-memory.dmp

                  Filesize

                  108KB

                • memory/2740-298-0x0000000004520000-0x000000000453B000-memory.dmp

                  Filesize

                  108KB

                • memory/3456-278-0x0000000000410000-0x0000000001A52000-memory.dmp

                  Filesize

                  22.3MB

                • memory/3456-234-0x0000000000410000-0x0000000001A52000-memory.dmp

                  Filesize

                  22.3MB

                • memory/3456-18-0x0000000000410000-0x0000000001A52000-memory.dmp

                  Filesize

                  22.3MB

                • memory/3456-10-0x0000000000410000-0x0000000001A52000-memory.dmp

                  Filesize

                  22.3MB

                • memory/4468-558-0x0000000000040000-0x0000000001682000-memory.dmp

                  Filesize

                  22.3MB

                • memory/4468-591-0x0000000000040000-0x0000000001682000-memory.dmp

                  Filesize

                  22.3MB

                • memory/4468-434-0x0000000000040000-0x0000000001682000-memory.dmp

                  Filesize

                  22.3MB