Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    01/02/2025, 14:33

General

  • Target

    AnyDesk.exe

  • Size

    5.3MB

  • MD5

    0a269c555e15783351e02629502bf141

  • SHA1

    8fefa361e9b5bce4af0090093f51bcd02892b25d

  • SHA256

    fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca

  • SHA512

    b1784109f01d004f2f618e91695fc4ab9e64989cdedc39941cb1a4e7fed9032e096190269f3baefa590cc98552af5824d0f447a03213e4ae07cf55214758725a

  • SSDEEP

    98304:Uc9HTcGO0ImBimas54Ub5ixTStxZi/l9K0+zLVasSe4JnzMpm+Gq:UcpYGO0IOqs57bUwxG9CVaskJIYE

Score
4/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
    "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4436
    • C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
      "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3916
    • C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
      "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2352
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5304
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1352
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1932 -parentBuildID 20240401114208 -prefsHandle 1860 -prefMapHandle 1852 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {88dc8b44-9d5e-49cd-bf6e-bebca67f3e7e} 1352 "\\.\pipe\gecko-crash-server-pipe.1352" gpu
        3⤵
          PID:1076
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2332 -parentBuildID 20240401114208 -prefsHandle 2328 -prefMapHandle 2324 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cea21a5f-a5e8-4080-aa36-c50c22df13dc} 1352 "\\.\pipe\gecko-crash-server-pipe.1352" socket
          3⤵
            PID:1888
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3308 -childID 1 -isForBrowser -prefsHandle 3260 -prefMapHandle 3160 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 1364 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6435fbff-8806-4c06-8b25-c56542754866} 1352 "\\.\pipe\gecko-crash-server-pipe.1352" tab
            3⤵
              PID:5888
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3712 -childID 2 -isForBrowser -prefsHandle 3704 -prefMapHandle 3700 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1364 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {94ae9100-80d5-4128-b4c9-54cb194144f1} 1352 "\\.\pipe\gecko-crash-server-pipe.1352" tab
              3⤵
                PID:3720
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4628 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4580 -prefMapHandle 4604 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c37167a3-2048-442c-b092-7de0f7ef060b} 1352 "\\.\pipe\gecko-crash-server-pipe.1352" utility
                3⤵
                • Checks processor information in registry
                PID:5312
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5356 -childID 3 -isForBrowser -prefsHandle 5348 -prefMapHandle 5216 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1364 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc94e199-1f25-4ed4-a352-9ed1ea837dbc} 1352 "\\.\pipe\gecko-crash-server-pipe.1352" tab
                3⤵
                  PID:6072
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5516 -childID 4 -isForBrowser -prefsHandle 5460 -prefMapHandle 5456 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1364 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {efd1fcd7-2bbc-4d2b-b955-77cba0f1b77e} 1352 "\\.\pipe\gecko-crash-server-pipe.1352" tab
                  3⤵
                    PID:1544
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5688 -childID 5 -isForBrowser -prefsHandle 5764 -prefMapHandle 5760 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1364 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {536fcb5d-aa1c-4072-9557-d065cdc850dc} 1352 "\\.\pipe\gecko-crash-server-pipe.1352" tab
                    3⤵
                      PID:1728
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3924 -childID 6 -isForBrowser -prefsHandle 3444 -prefMapHandle 3600 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1364 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9fa2f30-ac04-4ec9-9e41-0b09e672f345} 1352 "\\.\pipe\gecko-crash-server-pipe.1352" tab
                      3⤵
                        PID:3604

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                    Filesize

                    15KB

                    MD5

                    96c542dec016d9ec1ecc4dddfcbaac66

                    SHA1

                    6199f7648bb744efa58acf7b96fee85d938389e4

                    SHA256

                    7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                    SHA512

                    cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                  • C:\Users\Admin\AppData\Local\Temp\gcapi.dll

                    Filesize

                    64KB

                    MD5

                    ecb9969b560eabbf7894b287d110eb4c

                    SHA1

                    783ded8c10cc919402a665c0702d6120405cee5d

                    SHA256

                    eb8ba080d7b2b98d9c451fbf3a43634491b1fbb563dbbfbc878cbfd728558ea6

                    SHA512

                    d86faac12f13fcb9570dff01df0ba910946a33eff1c1b1e48fb4b17b0fb61dded6abf018574ac8f3e36b9cf11ec025b2f56bb04dd00084df243e6d9d32770942

                  • C:\Users\Admin\AppData\Local\Temp\gcapi.dll

                    Filesize

                    385KB

                    MD5

                    1ce7d5a1566c8c449d0f6772a8c27900

                    SHA1

                    60854185f6338e1bfc7497fd41aa44c5c00d8f85

                    SHA256

                    73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf

                    SHA512

                    7e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                    Filesize

                    479KB

                    MD5

                    09372174e83dbbf696ee732fd2e875bb

                    SHA1

                    ba360186ba650a769f9303f48b7200fb5eaccee1

                    SHA256

                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                    SHA512

                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                    Filesize

                    13.8MB

                    MD5

                    0a8747a2ac9ac08ae9508f36c6d75692

                    SHA1

                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                    SHA256

                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                    SHA512

                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

                    Filesize

                    4KB

                    MD5

                    60937572d45cc2caf604914f7d7a99bb

                    SHA1

                    20132a079278f7b99b551fcd13c9eb36aaf09ee4

                    SHA256

                    b0373137c93f82910ba9b31ec19c2c62d8234aa2ea19b08ea21f31708ea77056

                    SHA512

                    71aefd79ce5bc9c19a2117f11265266ad2761f4343f81f79464f9ae316514f6d9921c3710fc3b57e8302224b068522f624945442240d7202fe596fc5c5fd5cb8

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

                    Filesize

                    9KB

                    MD5

                    f68dc6e8fe08e395c7d0c11e7bb32083

                    SHA1

                    f1920fcbac2ad015ad34abc9aad11bb3acd6d454

                    SHA256

                    d4cb1be3dd16d91550a043f90cc3ee03c96c4222c8a71dc849c3d6e526900081

                    SHA512

                    1b9092c82527ee9eca2a05cef5c21152dfa1d327ce89c36766ec67cb3a204c45b5d87fa4ae027e4a9386d79d69c313105635ab0e41f0f275baf531e08f2a5a1c

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

                    Filesize

                    2KB

                    MD5

                    46b20f4a0ecfd557c9eb9da01f8f1d13

                    SHA1

                    e7fbeea8935f23daa08362a80a975bf58e18d3f2

                    SHA256

                    704d501fc0cf447782b9fb0923f8f9b24786085ec6959af6d0ef5995dc1b8dcc

                    SHA512

                    0086e1e2e93eb403e4d3573a084b2e82dc0acf5aab5d202c4ac86368e9fb5dede3b9c61f1297d52db9734569490ea9d5ad4d451b19092ae7897fe4fe2fd854d5

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

                    Filesize

                    2KB

                    MD5

                    3dd602750f3202128436086231ab7906

                    SHA1

                    901222e7dbf90ac3ebf44a104017988c59849f15

                    SHA256

                    3debef5dd2c1f2bb55edf35c2792b32fd9e885755687eb45f5a51ffe86fd0f0c

                    SHA512

                    68d32a5ffcd3293775fdac17d0ff083031c03add8e61a43eaec6ef5bf36021b04bf8c39a43e3662529fb47df3ca335f75568d5ff277340fc07cf37601dbb1826

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

                    Filesize

                    766B

                    MD5

                    b746d2081b918279f98e086cfcef3228

                    SHA1

                    d44dcebbe7b50085acbf262bd5ec6cbefb920448

                    SHA256

                    09cb70ad54a4054b6ce4bfb73d5bb8ccfc35c7ecfd0d77ce015aeaa8182719d7

                    SHA512

                    d844aa62afada8469cac151158b653997dfd2061f02b981e780b3fd51a980e1d3016b577a758a553a0cf008fd10397501bdc9aa1fd7057f747fa3bc487e16910

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

                    Filesize

                    823B

                    MD5

                    ef441a97e93147087ce56a9e68f7a055

                    SHA1

                    73e0c45715634c343c6265b9f393a873d609b11f

                    SHA256

                    39353fa29c280a766bc372bc46525d9129086e58689326455f70bfb8c2981d8a

                    SHA512

                    64286ce0a49f7ff49267632807fb267a6fba791431f48111e801924962744abd861c49b2e8193c8ba329e2fd286a0e5f2cc264056fb1777c49f96082b269d72e

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

                    Filesize

                    832B

                    MD5

                    4204a4571c8e216ec0716a523c579547

                    SHA1

                    d064e34f13704329dd55288b711eda403781183a

                    SHA256

                    f9cf4ff23570edf9accb994a4edabb7c02f364edefb349e6a0c11057a9ee168c

                    SHA512

                    556c81c2d388048a7c31f029d74681fdddfff4ff6ac1dbabdec44b9b7a2ed689469354560fd68b04522a62eab55e6b2f8e7ce3c8fb0f4ce7a2c8df742350aae7

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

                    Filesize

                    312B

                    MD5

                    0c04ad1083dc5c7c45e3ee2cd344ae38

                    SHA1

                    f1cf190f8ca93000e56d49732e9e827e2554c46f

                    SHA256

                    6452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0

                    SHA512

                    6c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

                    Filesize

                    468B

                    MD5

                    f61bb4a642c28a615260ecb9ffb099c3

                    SHA1

                    b40a7bc45c1e0f1e0c963e79f3f7b4b67f27924e

                    SHA256

                    892528cb2e66a78709ca680f576cc301c42df619a036a22dd806ef2c4a5501aa

                    SHA512

                    5a02be58e7c08e0799298312c341d055bf571e03e25060db99d8c75b2ffbfcf35ff2fba0a9dee5f69187a83fa6d0ce4b74981bf4140ee8d8f71a8836e1bad32e

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

                    Filesize

                    468B

                    MD5

                    88ef84b856db8173a4626718a0763949

                    SHA1

                    8bcbca018b978be807fad44f228c1c3b577fd7d4

                    SHA256

                    542a8aab672e32a6fc9d0482f720a0283d50e21e960d96eb464fcb481e33c3ac

                    SHA512

                    e730444f29771bec063a3614c77f8ff9c6e5649b1fd533e295695ca55e561a8445ef9fca39b8d5c592784455825b1a4f2d6159b4fe5f7f0d6d7e37a130bc8b7e

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                    Filesize

                    2KB

                    MD5

                    0384c1eba490d934ce00cebb36999ca4

                    SHA1

                    0f75a0b84e61dba0980c9bdabbde78c017dd7e5a

                    SHA256

                    eae8682689138bf303e07bdc2b56feea41dd76e8925bfb730ef3110b89116af6

                    SHA512

                    d1ef4218700e9dfce64034363c2ab2a6df268d03ce6b7010d565a2b85eeb20010df1fdc6d5b920034a29426b47bf7615f52f67ec7d7bcfdb814dfcd5a6a40a78

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                    Filesize

                    2KB

                    MD5

                    060656e29a0b84ba41741c0ef33d4ec0

                    SHA1

                    84ac5a3cc723fdd04d08ef21311c823b4141a9ba

                    SHA256

                    a25e3ccccca62c8a14b9cd01baad627fb3b5d56927fcf53f18957983713b68f9

                    SHA512

                    6f40e1055c8e5444c4a8517a7f8d7a16a3b32516c79392dbe89e012a08f0a22dd70d51a8508a0d3b0fd9c0cb3c1e0730eb43f8fcd7339eb70ef12f64d5b0e300

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                    Filesize

                    2KB

                    MD5

                    53f86941e0aa8be02bbca2bf2f9827ec

                    SHA1

                    a55f0899bcd50127cf81e949a53026bab713347b

                    SHA256

                    8749c434608acd3efeb1395f21ef9c909551d27f3d848fdf6117e9508267263f

                    SHA512

                    403bdc01bdc721f207093156c1847004e8b95a009c4d3ae3199a8a0930078bafc891d048cfe33d8274229675e9cb27e5bd3225ea1b08642132dfe17257cab009

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                    Filesize

                    2KB

                    MD5

                    50d153ec679f1dddf353966f3bb4ad1d

                    SHA1

                    17f6ca0d8a7f052a94626e459b26882b790b44cc

                    SHA256

                    f1f5408daf7e91908c9260486919ac40ea34f009959c84ad9b1d57fa55316ac0

                    SHA512

                    b8b543aeb76bb35fc1211e0d127fa90b2c2ee08857077c64c8631850137a0c0315ecbd19dd0afbe836ec9cdb8629db2520de1b3804f0fd7ad7db9ef5cbf7ae4b

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                    Filesize

                    1KB

                    MD5

                    69c7d98186b3ef6f186795186db69c04

                    SHA1

                    c717f99f33a7fb802b235c2a0801254920157fca

                    SHA256

                    a20bf6cb398114b3fae814e2ad9b224b0246138d067daedde59c96f3d1377fca

                    SHA512

                    753d0e3725ff07ec74ff529bda3ca35a45c8f1dc7030c1d892ab6e8681528c21ead3370652e014dfdef3602e9aab01b139654205c598ae19fb467c699ee89015

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                    Filesize

                    1KB

                    MD5

                    8adda46643bfbc8ab8fd276d340b32cd

                    SHA1

                    c5cb962791cabf90a1e79e629e71c505fcd2f197

                    SHA256

                    a5762a234b759b1987a51bde175e51ddf6eee0a7b8f0a9051148c8ff62b4b4e7

                    SHA512

                    2f45c2f71e719ea376b640354c7b7fe5dba1b177d668cbf1661d47c37208cf905040e4de0ec73a7fb4d9097dc046d89dc90f0f0e0665a432d3a9cbea44966368

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                    Filesize

                    1KB

                    MD5

                    2742a4b4071c475ddff71ff4dddfcc48

                    SHA1

                    62975d92f0a6bbdb2be6f8bcce0400907a0437f8

                    SHA256

                    cb13d8d47519e940aec7f54a061401637a528713944168f63a8ab2f05f074be1

                    SHA512

                    1bbc097a19d60ab599d7765109a853f99dd1626aad1024df493e77034e43891d1993668cdf4ff04328ee11d5b13581bb3b89f10bee9c7f2891226e35e0a0db50

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                    Filesize

                    2KB

                    MD5

                    e97e9d1f6abb6e46b55c5c3e595700b5

                    SHA1

                    7589f07abf6c919d4c078d63fedff2d03ec6b1de

                    SHA256

                    59ef88bfa6d6ee46e3280f6315366ae58cfc219968a5a5dfef46748d15c5203f

                    SHA512

                    42120d044d6917f6096f4a2d495f1baff599715a7a4e8b01f94d906090f2de700356576abf735d702af640112ede92c96597f2ded7d83aa16e26cce61e094238

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                    Filesize

                    2KB

                    MD5

                    bc003cd155d83ba36b1e8920cafe436f

                    SHA1

                    c7e027c3e5236eda0a821858c5ee976ccde6384a

                    SHA256

                    b0523296ae85fd85b9ec9780c8302e11708c41485c174db383a04931bd6fc001

                    SHA512

                    ed31891abd7ffbc271e444fcb5d8d929a3135d0c66d1299085b154fd7f56c1bdf13416310651072f48aa1b8184a6c0838895ecda8a0dae6f222862ed97ec6301

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                    Filesize

                    2KB

                    MD5

                    42ac04078b307129400beca2221ff2ff

                    SHA1

                    52a5a1ec541bcf68b3099a0249a7a901bb8e54da

                    SHA256

                    21a88a6da68e8d705dd12bc66f3b31c19d3ae9b3e610b95ac72459fa9454034c

                    SHA512

                    7238cf237aee8ef92c76537d002fab5fec6bc2805baa59b930cf49509889e732804815088b62718624e4bcac534b2fd05fd54ec52919d8f026ecdea6ee5291c2

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                    Filesize

                    2KB

                    MD5

                    f9edf0295c06e85008f9f8bb9b6f1c75

                    SHA1

                    c9bb9274785211e3877fad28de65b2640a7135f1

                    SHA256

                    953aae29c74e87d23b1d326b39f4ab6a020c19034504386472d752c0f3b92f64

                    SHA512

                    9fc5a85779657a112b27ab6fbcf60f80a692676e7d13d226bca5635d22f1d09f39f71636c165a3cd54207cc924a2ad82c4d101011bf32aed021d2d28e5e3ddcc

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                    Filesize

                    2KB

                    MD5

                    c98339dd47ee9a3584b118ca2a8fcc09

                    SHA1

                    cdd92cdaf8a3c489cc7384dcc3b4c8651d3f7e47

                    SHA256

                    2faffa81c9c0d9d7a23066a20c1f52a09c950c1a98e002c5dbe06ee066d92ac8

                    SHA512

                    2eb05bb0d7c03c32755f319a335d12579020cdfda55fcd2a214197647f38fdbdd54a6a3ba715522f2ff6a6d88e1d1fd6c762a08baec259793e225d925da0e118

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                    Filesize

                    6KB

                    MD5

                    25235e68f5d5a303434dd3774949416a

                    SHA1

                    d66b8a8bb4e76e06e7243c527413df46775aa5b7

                    SHA256

                    7ef7c21a833e76c223988cc5d3150b43e367205e8be4182b2d321707a80e1a9d

                    SHA512

                    76a7ce35b13d5fcf0fe6ead26497b2d7a105c953dbdac671faee9cb0d8d05101b3ec045f6894173c4ef5bfd23f62d65f728fbeaa373104e4e5b96a401297e3d8

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                    Filesize

                    5KB

                    MD5

                    6949d704514cc8e7e01daa9baeeac014

                    SHA1

                    0de23da935f4fb1bff35e70b1ad9d0b8c97e0d66

                    SHA256

                    19d01642b0b75e48da76c99a2bc174aa6592c7e49cd75f24938291b204a11367

                    SHA512

                    b5cdb736e470d9443eee7f89e0a41eb6691193e1e7d4320d1042e2183ef7b48115f5740ee11f474300e4370e48bcc7a3d3b8268ec5bdff8259aa7a68fa6f1048

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                    Filesize

                    5KB

                    MD5

                    d1c96c9c2fa7bbfcd3b09fab3cd8ddc2

                    SHA1

                    ca0df0ef1a3a99a874865ca664d4ceb64055f668

                    SHA256

                    cab93c11562f0a0199c1a1a3312d857272ac58a6087abb6858c85e301577d6cc

                    SHA512

                    10e603e8f4f9e0f7fedc79e087ac49131bfc60acc2b4b0241e6034b369977ce2e6cf221cdb8a47bcd5e64bad0f408612dffa2b4ca25e551c18694c9fccdfb181

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                    Filesize

                    6KB

                    MD5

                    0e1611c637bea1c805f1c7653bf88721

                    SHA1

                    058acf8b91c1b6ffaad2cef1a366b1e77d14d5d9

                    SHA256

                    612e97b04635b53adb12a73cdb9e912dc11e8581c9193ce75c8cb5b6fb6cb438

                    SHA512

                    8d8b1b8442215e99601684ee3e4516206c78e79f783a8510ecb794dfbc74ab5f0e661a7b0faa4a2cd28dcf3bb543ffba1e8229e3a1617da5ff86fb4ccdc71f1c

                  • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                    Filesize

                    1KB

                    MD5

                    80b8a933eee9c7553d6dafddc58c83ad

                    SHA1

                    8b6882dcb5e87839c5a84fdf2d58faccc975195d

                    SHA256

                    ec3a84c60a753fb5239beabf46aa91d87681359f2d93c6fce7b6d15a0b2ff816

                    SHA512

                    316730dcf5d0ff37615970325ba6daf4331c39e559d610a3f328b474a139683858ead68490f1ebc6ea46cef5be19117a82561e5ef9f6771d59b3b603ad131c9b

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\AlternateServices.bin

                    Filesize

                    10KB

                    MD5

                    43228da2a70d6ac80dc495dbbcc63eab

                    SHA1

                    b8a2a0016c30700eba83a06144295eb90c4aa211

                    SHA256

                    f3e20017a8f4f33513fbe51f03db737817d2b4f3aa33ef1108b7ff78267bc7f0

                    SHA512

                    636a8f74d025af3f860e228b64519b609d18290b3a0cfc702e9faf2f9b447341f3b4696221ebfa3749d75f3d14414076275fe32e1e636943f87434ee431ee8bc

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\AlternateServices.bin

                    Filesize

                    12KB

                    MD5

                    d2026fb68c412e1bfe71d96d9f57327f

                    SHA1

                    daff4d47030b5a1e4e635425f2a35ed05b40c5ee

                    SHA256

                    86e7813486a3e3d16467913bf5ca9f0339bb5d1e1ad18c8e5cebffbf6c39f1c8

                    SHA512

                    1e6a77018f4db6bbf2ea4e48292013cbaa60b0764c24fa0002fec6aaf353e2374f4c1daed54c3432e1b1320caecd8f38c7d13578df59f9fcfb791202bd3b691e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    5KB

                    MD5

                    bd89ea675370c16c5a4200caf614fdcd

                    SHA1

                    4baf5b9e84b9de5b628c65361ef17d91d849fd71

                    SHA256

                    b5562f8761bd7178297d11de791d56e59b6e8b5e458788009c34e2fa70f0e447

                    SHA512

                    a979863645afa18c75b1efc33df8370d50e5bf0dbdc30f50a1e7d99e04d39eecfc20ff1f92abcc481067cbe8520d873550b9bf65777ab1863e2139913b2d4314

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\datareporting\glean\pending_pings\03b24acc-d14c-4cc2-88b4-f567147f35e1

                    Filesize

                    25KB

                    MD5

                    67fa1983f87ca99dc73918ee3ede1637

                    SHA1

                    920ddbba307bdecab4fd2acdb7c2f41d96be441b

                    SHA256

                    26717c2aeabeb69cb548e1e588787e3cc6e8e8ebf68046a1d35a5c53e2fbf3a7

                    SHA512

                    d80f70350ec3ecafdb0570987300fd473f7a5226b75461a26f80d40213d11c794a77ce1a60cd48b57ec6640c6e25c691bbcaf08b7196b627fd2f076683fbdd6f

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\datareporting\glean\pending_pings\b0a659bf-9efa-4459-83a1-59f935fb66ea

                    Filesize

                    671B

                    MD5

                    9460b2e60929a544778e1204be6be053

                    SHA1

                    24fdab6c9c95012b44b374d6e398dc431e970038

                    SHA256

                    ff88d09ad56ea21f82b7456e9514a76e77ba9b6e9511fe6ef91dfa78cf3c586f

                    SHA512

                    672b5273cd60ab59bd91ef9cf1df474ba886bd269547c65cf646cb984224d824c070f7892c12fe8d954a513701cc8ac452b64fc505e8791b4a5ecf08e078aab7

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\datareporting\glean\pending_pings\e991c163-ebc2-4151-a19a-88612c6b67f4

                    Filesize

                    982B

                    MD5

                    788964c3ef4d22f7a09625952b340e51

                    SHA1

                    c97363fad67f7095ded905610b9b8d50a194bbf3

                    SHA256

                    cd4fa6e6ae80f6128b87005babf7162f34b0d2f659e2fb3f0dca6659ec06785e

                    SHA512

                    ea0372bf134c18c729151a25952a136f9f099663c53fe5eb5d392ba134d5a6651334f03eae6cbaae69b0d5a106e01191ec5f910b50092926a725f9ccd3d5025b

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                    Filesize

                    1.1MB

                    MD5

                    842039753bf41fa5e11b3a1383061a87

                    SHA1

                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                    SHA256

                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                    SHA512

                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                    Filesize

                    116B

                    MD5

                    2a461e9eb87fd1955cea740a3444ee7a

                    SHA1

                    b10755914c713f5a4677494dbe8a686ed458c3c5

                    SHA256

                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                    SHA512

                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                    Filesize

                    372B

                    MD5

                    bf957ad58b55f64219ab3f793e374316

                    SHA1

                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                    SHA256

                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                    SHA512

                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                    Filesize

                    17.8MB

                    MD5

                    daf7ef3acccab478aaa7d6dc1c60f865

                    SHA1

                    f8246162b97ce4a945feced27b6ea114366ff2ad

                    SHA256

                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                    SHA512

                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\prefs-1.js

                    Filesize

                    10KB

                    MD5

                    a208fade1de1408cf259d6e986169ca9

                    SHA1

                    f5ba90ad68fb351ca179d851d87c79eb01ee7ec4

                    SHA256

                    1c99a028998cb89e5531dae2b6f1b6c9bb731e76affe4435895dcfd317c910b7

                    SHA512

                    3d97152e8834a416688348ca524e77089c4771efc0b317c76b091011bf7cffecf6f1b6c1fa797fd81b50e569c7b5fc4f66641b7b8e91bacafd0db8ae08ca4875

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\prefs-1.js

                    Filesize

                    9KB

                    MD5

                    e3611cece08efd25080cae24a8739488

                    SHA1

                    5ca9c96b582fb21215a9cb4ca903243cbe204c2a

                    SHA256

                    20278a5504d2b262aca3e666ddc2b60f268633c0026474eb8b4073a3409d6c5b

                    SHA512

                    1f84a2e5f6531e18aabdeca496212c59851ee82589eda05badab8f98aa6dda4168d2c9dc0956d6ae3680526195c27504c2ecdc254399372c4407e50a174c8590

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\prefs-1.js

                    Filesize

                    10KB

                    MD5

                    4be04fefb8671f88828ab11903e78f9b

                    SHA1

                    b27301f5fd9694977f373f92954cd5de7c0c9e6e

                    SHA256

                    afe129e0280356e41599c548392a428dd52cefe2f60e03f8d648df02ff693b99

                    SHA512

                    385ea542b9b5d3d062389a7b04bd109ec1683a89571173a14685257e6462cc212e6441ce645a0289717abbbf095eadd64340d9eb8995c706317d4ec7a8d52404

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\prefs.js

                    Filesize

                    11KB

                    MD5

                    8b3f3fb062782b90af8bd6930139ecbd

                    SHA1

                    ab22302d97b079f4f4f2ecf8c61b99506703fc2e

                    SHA256

                    488ee7f0c5a1ea639b57145c0c2021f2fb1c100ad52cbaa0945c76d31f36db37

                    SHA512

                    f86e3a77868623d15588a70bc0c24bbf57fbce75c51f6f20fc7e13071ce3006922faefde7958f48ec10a44f1cb1dc08e998908c5187aba5fecbf7736f49c7641

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

                    Filesize

                    1KB

                    MD5

                    81cc50693db449207ae905c52aca4621

                    SHA1

                    4da66cfe6c09b5c73ec0bb780235cd6ff00bf449

                    SHA256

                    8b5002d62fd41e4b67bd878a437e3bef22375013defe874a59d78a2d4a60935d

                    SHA512

                    546a20d3ca4cbf3e710490607bab3fb6f7789fe8a79728fb943b5b59a829c6ef1bd98e54c004ec25d9ef608836a71a4b2fb4771e0001a64698f6b828c76e2a6f

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

                    Filesize

                    3KB

                    MD5

                    9c2659fb711ac2880e067e57229a4b47

                    SHA1

                    25f670c895cb89dccdad32259bd45c9534b93d1c

                    SHA256

                    321a2ecdf665a91adddcf4c076b3144a15b69d3a50cc57ce654cb593e9d1d039

                    SHA512

                    b3dde05728fb3ccd94e2bd42eda41d03f00e5cf85532027c7e4840c921a86383111c5012d311ff69553cab1e81b53d1417444cd1f326fb6d2f0c1be80fce563f

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    376KB

                    MD5

                    9fc8f756e7109adfcefee2f252c8300b

                    SHA1

                    88f20402cb6802b94589612c110a2993862e7483

                    SHA256

                    567b38083f0484e12bb49e9c083f8d2f325ff1636ad6c387f002b0508a8b7100

                    SHA512

                    c2ac8a2bc4e3d2cb35ad22336e3dfb04f136d4491e532a78cbbdb6f9e0331c88031f4be1e8e307c2cfddd7aaca7ea59adde777d39bd8ab4915a5abb8c0bb3092

                  • memory/2352-519-0x00000000001F0000-0x0000000001832000-memory.dmp

                    Filesize

                    22.3MB

                  • memory/2352-801-0x00000000001F0000-0x0000000001832000-memory.dmp

                    Filesize

                    22.3MB

                  • memory/2352-16-0x00000000001F0000-0x0000000001832000-memory.dmp

                    Filesize

                    22.3MB

                  • memory/2352-177-0x00000000001F0000-0x0000000001832000-memory.dmp

                    Filesize

                    22.3MB

                  • memory/3916-14-0x00000000001F0000-0x0000000001832000-memory.dmp

                    Filesize

                    22.3MB

                  • memory/3916-176-0x00000000001F0000-0x0000000001832000-memory.dmp

                    Filesize

                    22.3MB

                  • memory/3916-800-0x00000000001F0000-0x0000000001832000-memory.dmp

                    Filesize

                    22.3MB

                  • memory/3916-518-0x00000000001F0000-0x0000000001832000-memory.dmp

                    Filesize

                    22.3MB

                  • memory/3916-43-0x0000000005470000-0x000000000548B000-memory.dmp

                    Filesize

                    108KB

                  • memory/3916-39-0x0000000005470000-0x000000000548B000-memory.dmp

                    Filesize

                    108KB

                  • memory/3916-42-0x0000000005470000-0x000000000548B000-memory.dmp

                    Filesize

                    108KB

                  • memory/3916-25-0x00000000001F0000-0x0000000001832000-memory.dmp

                    Filesize

                    22.3MB

                  • memory/4436-18-0x00000000001F0000-0x0000000001832000-memory.dmp

                    Filesize

                    22.3MB

                  • memory/4436-173-0x00000000001F4000-0x00000000012F6000-memory.dmp

                    Filesize

                    17.0MB

                  • memory/4436-174-0x00000000001F0000-0x0000000001832000-memory.dmp

                    Filesize

                    22.3MB

                  • memory/4436-7-0x00000000001F0000-0x0000000001832000-memory.dmp

                    Filesize

                    22.3MB

                  • memory/4436-93-0x00000000001F0000-0x0000000001832000-memory.dmp

                    Filesize

                    22.3MB

                  • memory/4436-799-0x00000000001F0000-0x0000000001832000-memory.dmp

                    Filesize

                    22.3MB

                  • memory/4436-94-0x00000000001F0000-0x0000000001832000-memory.dmp

                    Filesize

                    22.3MB

                  • memory/4436-515-0x00000000001F0000-0x0000000001832000-memory.dmp

                    Filesize

                    22.3MB

                  • memory/4436-0-0x00000000001F0000-0x0000000001832000-memory.dmp

                    Filesize

                    22.3MB

                  • memory/4436-481-0x00000000001F0000-0x0000000001832000-memory.dmp

                    Filesize

                    22.3MB

                  • memory/4436-2-0x00000000001F4000-0x00000000012F6000-memory.dmp

                    Filesize

                    17.0MB