fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca

Analysis

max time kernel
1050s
max time network
1053s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-01-2025 19:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AnyDesk.exe
Size

5.3MB
MD5

0a269c555e15783351e02629502bf141
SHA1

8fefa361e9b5bce4af0090093f51bcd02892b25d
SHA256

fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca
SHA512

b1784109f01d004f2f618e91695fc4ab9e64989cdedc39941cb1a4e7fed9032e096190269f3baefa590cc98552af5824d0f447a03213e4ae07cf55214758725a
SSDEEP

98304:Uc9HTcGO0ImBimas54Ub5ixTStxZi/l9K0+zLVasSe4JnzMpm+Gq:UcpYGO0IOqs57bUwxG9CVaskJIYE

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
167	3940	powershell.exe
169	3940	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	AnyDesk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	AnyDesk.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	AnyDesk.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5020 set thread context of 4836	5020	main.exe	175

Executes dropped EXE 1 IoCs

pid	Process
5020	main.exe

Loads dropped DLL 2 IoCs

pid	Process
464	AnyDesk.exe
4816	AnyDesk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	main.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AnyDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
464	AnyDesk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4816	AnyDesk.exe
4816	AnyDesk.exe
4816	AnyDesk.exe
4816	AnyDesk.exe
3940	powershell.exe
3940	powershell.exe
3940	powershell.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3404	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4816	AnyDesk.exe
Token: 33	3480	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3480	AUDIODG.EXE
Token: SeDebugPrivilege	3940	powershell.exe
Token: SeDebugPrivilege	3404	taskmgr.exe
Token: SeSystemProfilePrivilege	3404	taskmgr.exe
Token: SeCreateGlobalPrivilege	3404	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
464	AnyDesk.exe
464	AnyDesk.exe
464	AnyDesk.exe
464	AnyDesk.exe
464	AnyDesk.exe
464	AnyDesk.exe
464	AnyDesk.exe
464	AnyDesk.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
464	AnyDesk.exe
464	AnyDesk.exe
464	AnyDesk.exe
464	AnyDesk.exe
464	AnyDesk.exe
464	AnyDesk.exe
464	AnyDesk.exe
464	AnyDesk.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe
3404	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1328	AnyDesk.exe
4820	AnyDesk.exe
4820	AnyDesk.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 4816	1328	AnyDesk.exe	84
PID 1328 wrote to memory of 4816	1328	AnyDesk.exe	84
PID 1328 wrote to memory of 4816	1328	AnyDesk.exe	84
PID 1328 wrote to memory of 464	1328	AnyDesk.exe	85
PID 1328 wrote to memory of 464	1328	AnyDesk.exe	85
PID 1328 wrote to memory of 464	1328	AnyDesk.exe	85
PID 3940 wrote to memory of 5020	3940	powershell.exe	152
PID 3940 wrote to memory of 5020	3940	powershell.exe	152
PID 3940 wrote to memory of 5020	3940	powershell.exe	152
PID 5020 wrote to memory of 4836	5020	main.exe	175
PID 5020 wrote to memory of 4836	5020	main.exe	175
PID 5020 wrote to memory of 4836	5020	main.exe	175
PID 5020 wrote to memory of 4836	5020	main.exe	175
PID 5020 wrote to memory of 4836	5020	main.exe	175
PID 5020 wrote to memory of 4836	5020	main.exe	175
PID 5020 wrote to memory of 4836	5020	main.exe	175
PID 5020 wrote to memory of 4836	5020	main.exe	175
PID 5020 wrote to memory of 4836	5020	main.exe	175
PID 5020 wrote to memory of 4836	5020	main.exe	175
PID 5020 wrote to memory of 4836	5020	main.exe	175

C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4816
- - C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
    "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend
    3⤵
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4820
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:464

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x49c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3480

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -Embedding
1⤵
PID:4864

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Users\Admin\AppData\Local\main.exe
  "C:\Users\Admin\AppData\Local\main.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4836

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3404

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:3780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_utmd20xu.0lz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\gcapi.dll

Filesize
385KB

MD5
1ce7d5a1566c8c449d0f6772a8c27900

SHA1
60854185f6338e1bfc7497fd41aa44c5c00d8f85

SHA256
73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf

SHA512
7e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753

Download Submit
C:\Users\Admin\AppData\Local\main.exe

Filesize
4.9MB

MD5
5c14a296de00ac77eb98ebd7830d09fc

SHA1
f8ab35d128e469e6938401f8953ec7f7034221fd

SHA256
6f69c27f4055784be554a73cda0ab8e5475a60e4f3588267cb45150aa03f66d7

SHA512
3c3d97702a18553883a36407ec9be5b37db441964e46bac14034980e9661f7081a4c2abb974c12faa0bb5d3b9f0952d52c6c5d877dd7fc8644772958dab9c640

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
5KB

MD5
8b074eb4890711278e2882c534e23d02

SHA1
f094f97494a0d9d4372dde03886faa8150ec0a09

SHA256
f77592dd0a750ae5149d1fda358b523cff964742671444f67706a532326a5bd4

SHA512
09c57007bdd102e16f1d09379ae3fa596cdea1bf5b30057dcbe88987c5cdd63e1fa39266af90acfa82ada53bf48b5519b00da7473354370ecb67c35413c5e864

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
10KB

MD5
f3b20054d95d57b756a86b2e4461fc18

SHA1
ea879f87cfa36a08ad1dd0f60efc0a27e76d93ef

SHA256
ae4af8969b42cf60078d71180448765c9e38a8610919e2b056c45047fc688218

SHA512
619fd766fc9881183c2b001839695214a66bd8a6d1c4538c40df5d89d8d54fcee278b4b74033a3e44181b8db033483916971848b5dd8de5cc972b5abe0e761a6

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
59KB

MD5
de3937f06a69b3d45828bcb252e8b447

SHA1
6ca2d044193c680d7cccd368a1235b171be7e331

SHA256
97cd794404061878d104635b225fd5ee7c51d60caebdd27e3f14950050826081

SHA512
f2dae6b671bf5bfdb1578b38b7699eccaed6af944f234e0c8557bc1ff35594189c18c222278eaf8298d5c889ee164a436fee0f9c4859263a53b99b37953dbd79

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
9d9288a95cc45dd5904b11ce8e04e834

SHA1
cb424d8bcc06d6fe06255cc589cdfa89febcc1c3

SHA256
30557fcaa2acf42b4f5a1344eb662d4c40960719e00b64fe89d71328083cc7ee

SHA512
97f14501325578f63e122e625954cf9e13080744cf0f6c6a0a58597fae01e35b5435a9a6f6560a2c0aa9e69481d3ac923e6eac07b13b8b3ed851b5c0392b44a5

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
4672371be71873b3f1dbe29e30357cc9

SHA1
5550d12b0dd4a584755f666b0ea1c82f9809a393

SHA256
8712ee1579dfe5c863685c2ff13145503a6941cb28245caf3e8142944ee3f23a

SHA512
f6442cb639af68d246ef6991c3f2125773f1643dbfabe0ac9362c9eed89eb3b21fde0c6dca22bac352a58ecdfc5ea717d042b8f1bff387d21d3f184e308ea0c2

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
745B

MD5
2d081fdc221d283c94370435addc3a7b

SHA1
e9098dc3b628f14408bbfc68e9c46d69a6a7612b

SHA256
845a30c94ce10b3e9ac9a7952c8cf74569576012139273c1a33222d31b9f9d78

SHA512
5f0cf013fbcbfe0dc612090ac748115a36f3331dabb6faee116d7d9f34ba0e5d9686bf9025180baa77ecdb2ba49d0fe435fc483cb9734ac9b0e9765d56c4218a

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
766B

MD5
423ee4bbd661ef2dcecfd13da84c5987

SHA1
f9253a1c26d369684f9d99a3c28c6a881b52fbb7

SHA256
4a8a1f19dacbd87604d8e5e8cfb9cc6cdb580d4c27d3d6a54c0f14192bcc2a71

SHA512
12f9c48e66bc3e756947330ef63bdb7db9600d09f83f30489731b40209f75e64357bc0cb8b4c00657d216d94acbe4c4644b58cd15b901d33b461d8de37091b74

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
775B

MD5
d73fe5c7202a287cbf6a5225be8c181d

SHA1
342819ebae3f0adb3ecb5fd884332a287905c915

SHA256
715d56519efefc3a1ce2ec605b93d2868df0660f74b5eddb1debe65fc7d608fc

SHA512
70cab1ef5866bf935d9cb3b420953ee60c9d54d039c9618cd3a09e45cc3cd2f69c66bce0f705ef46ac2005182b53f4ccfba6d84fca092e205401b56bb524abe3

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
832B

MD5
dba22b9c941417211a3fa9a1e582e8af

SHA1
7a867b55a2308754721205f79c8cef6daf04d0ad

SHA256
30a60a868f7bbab4c28b1f3fd04a4cd4b126bc665fecced78f82afdc95a7051e

SHA512
acceaf72a9ae916c3796a11926c537f712cc3b85e450c662b8f62b7c0162f97abe7e020bf3e610ffa5bc9754ba4e680b374ce96d9ec2470ddd6cca373cbcf7b2

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
312B

MD5
0c04ad1083dc5c7c45e3ee2cd344ae38

SHA1
f1cf190f8ca93000e56d49732e9e827e2554c46f

SHA256
6452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0

SHA512
6c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
468B

MD5
42fed9a70dbc881d891e800f188eecb2

SHA1
1c03a4d8964386c3def1c67dc11c098a26d422c7

SHA256
54b906a0f07cb24e8b44a82c0c9451771616ea739bd2bb0ecd5bb6495b6d4946

SHA512
8c370f7033aa13e2da71d373b62484888fefc4685060598d9ed02d6cab891a8a220d1fef1b090da94a283cf64e372a22d397db8f453185d70de3b4c5934a2f4e

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
468B

MD5
131d3cbae532a57396f147cc875526dd

SHA1
4e4641bd5d627460e7201e38378d9618de328f4c

SHA256
6be0e039fc52bc6c1813b3083f226129f3c89f6e2642ea5d361877453443b8b9

SHA512
f062503d8cb330ff5a71085ef0c5e2f51702542fdad76730693b1b54125c53812d268d0dfe5351e9b637beab209854754c1ca6138609a1fba981a828b93987ca

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
2KB

MD5
9d8710a2a7e9226f60d6b5be4351af3f

SHA1
20686d9a4ac1ab120e3aa4d4aa2197fd7bc67ca9

SHA256
54ec3dd7f3948c4e5f815fcbf4b27bc2c462e425c8946112000df114f0430782

SHA512
52d738abf1917e4b0a495ba50650fcb65c50c0b8895cb27f915f580f2c2218d913f0aa918d7a3f0f8e3f28d850f8f72e3f42219f1f48659be835bca7ffb70fe3

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
2KB

MD5
71c2c3536d38075e6677599082b65787

SHA1
30a86f6ed2366e354eef4ba1bb5ee794329c3dba

SHA256
11afab01683fb99f4a42c18b678e01b841ec0912980a252e4c0aea8a9352682a

SHA512
afddf81a770e5ce01513dbc4175639430e1ec14d8ad3f0ae6c886167d42284eaaa983f31cfd49bb72630f2809b88495f61eee92b26985f28826829551caca5a2

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
2KB

MD5
0476e1ef01a14af7d5b34eaa9e8cfff6

SHA1
d4b007da2d2d7ba2cc10d245c4e607f336f814ee

SHA256
1b4e5edc47e22d0853289878754e1126abb7edbd931d2f47adee7727f1118493

SHA512
7872bfc0f0452094cdbb7f879cbb87b4202a760c6794349add8e7164a8ff136d6019ae645a76014dda628e2e0be9726d3374e6b8fe47eb77407e43472fdea5ec

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
5KB

MD5
b173fe704d1d3aeb9e3d5fa1426a43f9

SHA1
8cc6f85ba7bd6a6d20808f2d143210a3b52407ab

SHA256
fab35574300505501c5cf9eec92fea527029f2b08c3e028c9e75faf2fa514c53

SHA512
9eccc5669ae3fe6a6f3af43235e1ffdeca9e36d0a033aceda2566c6d0d6a5df50031b1e503d82fc45bfb9f23f009a2f977d1cbecabbd240ea4d4b2f324cd4d11

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
8c8365a09e7c0294962b354d53481fb6

SHA1
440204016c14a7c0c5f54c3afd65ad2eb791a83b

SHA256
bd23c52dde176b55439776d90acf217e97eb288d3486910fcfd10a86095c6d89

SHA512
e36a8902e51a5bca67a8a3d044e707c03f36063caea346ec4909d10e501a2691b3211603e45a2626324e182a2ba38c02060d96d4d23a6fe0b4c19139b1674c47

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
5KB

MD5
27a49f65178e3a7ec37fd9b57b983a81

SHA1
ee516f8ebbf11e2e200ca516aaf4d84badb5cbbb

SHA256
c3ea77d2622aefe8efa4333ba619a59227feedda11f39249fdfce5195638d7ec

SHA512
b70b9337a5fae864b2175d847306abd14dcc64ee258bf0f0ed71e8750b558107461f8d17d91a5903e73d875ae500ca9c71a6bc76b683836ded3d3b31e3e123bb

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
e9670a42f02376d5c06e3e73105021a2

SHA1
b255ecc619bb17a3413e9473c88a1617c7de2c15

SHA256
6bdd6798f2e6103909661516a6aedab79314df4d2a42a40853ebad9b5e0d18c8

SHA512
0958c97ca4b59bcbff1a56ce5119007d759b2330638edd3705e0ea981a9f398dd071ef5d0001f2742127cab010b22a60a6ebaf65c3d2aaec9158799b73ec1f79

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
72f335bf3863392d50e97033b1a390dd

SHA1
5bde42669e001d050180e3b56e2ed049d95ab2e4

SHA256
6c0ccf90b0d1313ceaf7614a80effdf2072e370bcfe0cf029cce4b2a1a82e78b

SHA512
32f60273a54dad217c1a8e26f203d12b99899fc4943d29bc1babe1062008aefdb4ee6703986bb8db009832746a7f0f64c9b3625d0dd4c221af36c338cc06c7e5

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
08335909f2af5b71c66d6791473cacd5

SHA1
73d475e4bc5c18cb8f1d069a9f4d4975bc412ac3

SHA256
3b45509642ff0829fd77ee03691eb5278465b433e7b762d21bfb18db0dc79e42

SHA512
8dc6bffa7efafc027646d561767fe0c07720959e7b9720cc5f096be1558bb9586a5f5a2c54d94d63f930126bbc92eabf2e8b2321abc7f779002b064a7c995b39

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
4aa05bfce5868d2111af805633d735c2

SHA1
f1ba2cd1fdedf4c9ea5c951e52cbcfc2e5be2c1d

SHA256
22a62d0c8859d8ee006c239c976a54d00d0d8a41f720a53244f4523cf2382153

SHA512
b97d08890f84392a908bb186e0b36cb7c8ff2aa3d7915e3526ee64c2663aaf40a816d9669ff161b46eacc091c087492cde4e84774cc5aa36334c23abc70921df

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
9d2642cdcd54d17a1251af6df907483e

SHA1
6a192d9ac3093cb9b02d067a9f4d2dc3df012961

SHA256
b1feb99ce0b1a0ff7f744789e27ee9c92c44dec0e41a1d9b74366914b03db05d

SHA512
bd82189629c54ccf3d7855be8889ecb646710c7204c0484c2c3555371380b2a75a8481f1e7810535b39f9c4796779b4d6c792345d0984e1a64e1f9e39c88460a

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
5KB

MD5
7e0bfdabcdb8d2ca0b7d1e9e8b266a35

SHA1
1d0d341841ac7fe4e7ea596766e5eddce7fb47a6

SHA256
be23ae98d54f0993eda9a4a4d31719a4c5b659fb43257981f7875d34b301a9f3

SHA512
49b24223f085d2ba2a7f325529cf7379ed1188217ff57fc7cce2b8693491184611ee1dcb56f63afb7ac26bb1760f9c9aa3ba0ffab14cd3a264947b298da3ba3e

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
177c0e4350ae0074771077f0d42475f9

SHA1
b0d092d444f0d2241d6e63e7fa8970fa736bda6d

SHA256
764aa13996821faa53dff50b6c14f04e827f5b3b6ed5b5e68fe6fd5f148e4ea2

SHA512
a1c8a9d26da29ecf39b2a03eb3d7f7f1ba0249d514e64d76db690a503f8380f80491f54aad84c3349eb783044be1c7532489225a6de11ab6f8045174fa0cd3c3

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
857fa2a72ed37a1f5234ead8f7684528

SHA1
84084c034054e81afd5c261efa353f873ad3f358

SHA256
a85e6c71687b49bed364631e0dcba0268233a4e8ed890b5d18f94e906c261c61

SHA512
619b64182c681e006b4c7285c193bbc33055232a3d9fc699b7e708d1933b757c2f33dba47c9d430baed188b3c588f379ef77e929d6ebada0118f47f12f46531f

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
be76b543f4a3e5e71a177f9efce847d8

SHA1
5de0243c728b65b4e57d1ac6504a72acf704966c

SHA256
be2619b08b8051b0aa6907945edf3551cb9caf56f3570a3b04e068986fd9160e

SHA512
40579f5642c213199559cfbd46e9862547ebd0a9035272e15a2cc14671390c0a14c7f79325449626362d8f4eb2da9e75bb68d3d7ea4b206344753aeca4112dff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
3KB

MD5
ec19b8a97e03db8ae42ca67349402d65

SHA1
6ece7cb1a082132cbdacfc49625d0f6b74128c99

SHA256
5c36b29227a71369377bf2b19ce6997ab2728560fb54a75902a1962453772cad

SHA512
767927c18920de2ff6d8eb6ea689fb95c230044e44044cefea245fba5d22f33bdad55a7afa02b7aac5363c87ee17c58ea63c894a02753616c8f578d97f5367a4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
3KB

MD5
0a860294630477c322fb5a244622047a

SHA1
d85ade1fa880abc80400a5be24e242b53d72d4c0

SHA256
4828a819d700f391bac88db7b746cf55d24178e98fbf52cf65e00abbfee91142

SHA512
ccbf9266ac0da92b780c2aa379674623fc1ff8ba267305ba03b8d2eb40d0e2faae15264ebb32176095d500436a2891c6fcf906502983c21be8e30b7fd172b6d3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
5KB

MD5
4b480c9f5da389d488768cb80a63af49

SHA1
32f9c4728b74d60b9d2e46853f8915b1b196d5c6

SHA256
da235ff4cc96331eafe9fe3f1591fb0cdf979e1227947ab13fa2af01abb7add1

SHA512
48fbdaf1a6f82522ee9775ee78d57891a707e25859f98562c4e9a2b804b689aa96ed12205524d05d8b099f8ede8de2560c2783825b7f418894dce4752b0b2478

Download Submit
memory/464-10-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download
memory/464-349-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download
memory/464-233-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download
memory/464-356-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download
memory/1328-237-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download
memory/1328-230-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download
memory/1328-2-0x00000000002A4000-0x00000000013A6000-memory.dmp

Filesize
17.0MB

Download
memory/1328-275-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download
memory/1328-7-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download
memory/1328-0-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download
memory/1328-288-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download
memory/1328-231-0x00000000002A4000-0x00000000013A6000-memory.dmp

Filesize
17.0MB

Download
memory/1328-291-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download
memory/1328-353-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download
memory/3940-371-0x000002927BFE0000-0x000002927C002000-memory.dmp

Filesize
136KB

Download
memory/3940-389-0x000002927DA60000-0x000002927E206000-memory.dmp

Filesize
7.6MB

Download
memory/3940-382-0x000002927D230000-0x000002927D2A6000-memory.dmp

Filesize
472KB

Download
memory/3940-381-0x000002927D160000-0x000002927D1A4000-memory.dmp

Filesize
272KB

Download
memory/4816-355-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download
memory/4816-38-0x0000000005460000-0x000000000547B000-memory.dmp

Filesize
108KB

Download
memory/4816-22-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download
memory/4816-42-0x0000000005460000-0x000000000547B000-memory.dmp

Filesize
108KB

Download
memory/4816-292-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download
memory/4816-232-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download
memory/4816-289-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download
memory/4816-16-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download
memory/4816-248-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download
memory/4816-359-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download
memory/4816-348-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download
memory/4816-276-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download
memory/4816-41-0x0000000005460000-0x000000000547B000-memory.dmp

Filesize
108KB

Download
memory/4820-361-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download
memory/4820-358-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download
memory/4820-354-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download
memory/4820-294-0x00000000002A0000-0x00000000018E2000-memory.dmp

Filesize
22.3MB

Download