d83236fad1405ff369f16ad12b684a30177fe81c47c1f824f9fea6b74d64cc4a

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 04:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gP20jUla_stage2.exe
Size 7.9MB
Sample260905-esed6swfph
SHA256 d83236fad1405ff369f16ad12b684a30177fe81c47c1f824f9fea6b74d64cc4a
MD5 df2081cc9a49dab5a28c3852f1f731c6
SHA1 7f7709566fda41a7c0447bb63e7ebf3c57365d36
SHA512 d5cffcdd92a6ef8ea26f344628164fefdaf8485084473b93e4cc30a409f3b6b2b96d62df030b8948a3c499690daeecedf46951c9d2f2850cd074ceb4e574bb58
SSDEEP 196608:TVadqokJQitHZG9lcSLIqbPCG/WZm/WVnqOfEZYwJCXnxxE05pTx:TVadqouPycSLItG/WZm/W9pcYEmV5pTx
TLSH
T16586338EB7D5D82AC95328B14B400883B4F68ED256746294DB05C5DBC2EB3CF0B5EE79
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4700	gP20jUla_stage2.exe
2936	gP20jUla_stage2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gP20jUla_stage2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gP20jUla_stage2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gP20jUla_stage2.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	gP20jUla_stage2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	gP20jUla_stage2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2936	gP20jUla_stage2.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4700	gP20jUla_stage2.exe
4700	gP20jUla_stage2.exe
4700	gP20jUla_stage2.exe
4700	gP20jUla_stage2.exe
4700	gP20jUla_stage2.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
4700	gP20jUla_stage2.exe
4700	gP20jUla_stage2.exe
4700	gP20jUla_stage2.exe
4700	gP20jUla_stage2.exe
4700	gP20jUla_stage2.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 2936	3308	gP20jUla_stage2.exe	89
PID 3308 wrote to memory of 4700	3308	gP20jUla_stage2.exe	90

C:\Users\Admin\AppData\Local\Temp\gP20jUla_stage2.exe
"C:\Users\Admin\AppData\Local\Temp\gP20jUla_stage2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Users\Admin\AppData\Local\Temp\gP20jUla_stage2.exe
  "C:\Users\Admin\AppData\Local\Temp\gP20jUla_stage2.exe" --local-service
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2936
- C:\Users\Admin\AppData\Local\Temp\gP20jUla_stage2.exe
  "C:\Users\Admin\AppData\Local\Temp\gP20jUla_stage2.exe" --local-control
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gcapi.dll

Path C:\Users\Admin\AppData\Local\Temp\gcapi.dll
Size 385KB
SHA256 73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf
MD5 1ce7d5a1566c8c449d0f6772a8c27900
SHA1 60854185f6338e1bfc7497fd41aa44c5c00d8f85
SHA512 7e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753
SSDEEP 6144:Tv/ioKdMF+LZD/ZRj1vwWrrUFMNoz4pFGxjEB1NYAOrabN2GZvFcD7:Td+LZrNwWrrwMNoz4vG1OYZabtK7
TLSH
T1F784AE11F48180B1E4BE057439B9BE6649BCAD11072896EBD7E80C2F5E746D1B733BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad.trace

Path C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
Size 9KB
SHA256 8cab9a2d1cebee463b02be816cd037ade07160d812bffc0dc7ecc7b57a68e797
MD5 f2a0c82a34cdaf648e0dcedb8a56bb72
SHA1 078133e6c79b978ef6c0309fa3fa6e858bb40017
SHA512 dc066e21fe0668d0d064ebaa2fb5c8b47afb8fb0f02e84c28ea51c278cf74a0807bd93883e500ec2a27d71e39b3902bea39db8b10a87f6d2b906cdb420e5c4d9
SSDEEP 96:qO2L3rFUJ9TFxvguvM93bWfFteXmjNYoy9e:qO2L3qzZxHvM9rHc
TLSH
T1E4129A92B826642334A1C54F99A20A1E868436646F77CB1DF39C9E093B1573F7F1372E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad.trace

Path C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
Size 11KB
SHA256 6e63ff92b11d6d7cdc51e874442adccc0bc204a8f595dbb8f82821cc1b2edc1e
MD5 0cdd75b6ab55b375fe250b3b1f152822
SHA1 f9a9d1c51e135dc852fb6256f3dcf1a96595437b
SHA512 07dfb124d1dcb1c9033eaf17d0cce566ea8645d0d30a1d033f74d005d9c5e82e0e35d226862df531be851e7af09b2177c6aa56472129c3e9aa4f37f456edc0ac
SSDEEP 96:qO2L3rFUJ9TFxvguvM93bWfFteXmjNYoy9JiU00vrrK:qO2L3qzZxHvM9rHN00vrrK
TLSH
T18A32ABD27C2664233861C48F99A2061A86843B646F66C71DB3AD9E093F1173F7F6372D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf
Size 1KB
SHA256 0ba9b4fccb650857d384e1ff1fe037e40e695cbac5ea4c76f1d1efe8c264133d
MD5 29822c6feb897eb622266668f1c8a4a3
SHA1 5399287fa51b26582908785a43a6198734b78d01
SHA512 72db59231712b50e8233a499aa7a3ebda55ec9aa83d09957a15fadb5a10178a80b01b773e738b2d2d7641d0299f305953bf5b68032ffc4abe3428895a55b6529
TLSH
T19831C7860AFC9825E97786E82F573775CC7097E56B6100F37A6011851BA8A30AD8D88A
MD5 SHA1 SHA512 TLSH

Submit Download

service.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf
Size 2KB
SHA256 e75016b76540ad423bf779706e008201eef1bff7c12f7e8e409c4a3cda0eb1e7
MD5 12de06b4db81906e11dc202cba533fbf
SHA1 58acf842107d871704c9ddeffd67e19440a74e64
SHA512 2d372136ef321781325ed464bbead97f63199ed8a583402f19c2856bf2f9acf128af287bdc08a606cb227b0ea3bf848eeb7b0b041ce8f8cd18439cf83cf73def
TLSH
T1B7512B861DFC9413F87386E81F777374C83267E4671140B279B315842BB5564EEED809
MD5 SHA1 SHA512 TLSH

Submit Download

service.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf
Size 3KB
SHA256 3339264b6d2308313b0c00c9fa32a11f7898e28d58d770cc59f1ee7b8ef8ddbf
MD5 fa93140ff6d08fe2e4737b869378efdd
SHA1 935762a7d398c05f2b1d3b5365d6b29d8ddf6c5c
SHA512 73fa6189a415d61bfe5bb87f2e7c5e5264a26546216e3f46b296b8a02624ff292f084c3636bdfaf75fc43d589993ee5467cdbfc00a55c6583aeea6bc27eccfd1
TLSH
T1CD615CE11DB88C52FC7B87E86FAB7330C8353774D785007228A112882BB1564FA9CC46
MD5 SHA1 SHA512 TLSH

Submit Download

system.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
Size 142B
SHA256 77ebdc74416647a83a99023793cf73b5e249869fd3eca267c356a0793e24d97a
MD5 30d30d84fa4d1f9de1265d81e0468007
SHA1 d11fec8cc6f9b183b8e2fd1dcc13609d0aa81e00
SHA512 852b79550e687bb096a02dde613a673436146a59a13907d795422548698e8474036616819d058eb2afe05534f82217288cd0300cd625ca2fb0518169a205a776
TLSH
T1A6C00263115DB9B9F013D547C8B636AE23D249200F2B038EAE410907B2D0A75CADE2B8
MD5 SHA1 SHA512 TLSH

Submit Download

system.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
Size 572B
SHA256 502a987f04b1449b9a99595f9b32eee17945c51a942121b81fab87f9e8405b40
MD5 2d39f5ebbafa663d6d65ff00e427bbe6
SHA1 d312c5780f6747831e998295479d47e7ed3861d1
SHA512 affa7fcda0bd45599f6c63035cc44d1e37f8f3b51656ed6847eb7e2e5465cc2d218a59127d190381d650d79dcd41cb5763042e232567fe244ac28a7393c02dde
TLSH
T125F059A7CC0C2031E883E793E47429E84BB624C0255F33CD95086502B2833B288CE3FA
MD5 SHA1 SHA512 TLSH

Submit Download

system.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
Size 598B
SHA256 2f0bc289e7be9d1f9f1274c239ccdcbda7ab473700054d133f30eb0ee2ecb50d
MD5 b258023da8a407f16f6a81e6f1b95fa0
SHA1 e81e5d30827389cc35111438443a83dd639f4163
SHA512 cf3c5dadd46235375633009f3ad6cdeb7a42373c391b06be03d8b2c58418b7fabb3f17066f4c8862d093d56217d2cee22b542c219003af7db5f551d4d416b1b0
TLSH
T124F024A7CD0C2031E883A7D3B47429E84BF635D0255B33CD95086902B2C36A298CE3FA
MD5 SHA1 SHA512 TLSH

Submit Download

system.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
Size 621B
SHA256 bac154abeec3f0ddf14d95829f07772d3e34c727610ba92fa96028da921cdb65
MD5 76078a86a7cb6f225778c66341d04f28
SHA1 5df1abb715c243bbde580ece5803e357568a5ad6
SHA512 452d78f1e7080b98670d622707d5dfdaac52bfb673d906ac5cf7563d47ad73cab0cf52a3301c26c9e80e27c0a61ab8b21b3fdf6f19b3eb5063869c105a3210ac
TLSH
T183F0FCA7C91C2031A883A793B47439EC4BE66590255F33CD9504650271C366299CE3F5
MD5 SHA1 SHA512 TLSH

Submit Download

system.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
Size 675B
SHA256 4f9881f1c8336e0c65dcf7dfdffcdf8ea90bc42831d15c7b283cd8f446a1feed
MD5 fa7c0a226cf0bee20b9cc0a81b045f03
SHA1 359e63910c67ecad910d166fa0c6b6cc8cefcdb1
SHA512 dab14d4997771cf90bcb677f578d372af87dbc654c3feb92000d85a69d1899e346eec46f4af304be15263d75dbec5140de41464fe1b0fce18dca4a01ed667ef0
TLSH
T1D00128A7C90C2032A883A797B87839ED5BE675D0255F33CD9504B506728376689CE2F9
MD5 SHA1 SHA512 TLSH

Submit Download

system.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
Size 744B
SHA256 064c19ee56622552710d908a5b0e23f21bf2c410e9602bc54142972681fd5a6d
MD5 ab8057e98965bef637ddfbea7fb99659
SHA1 35a80e0d5e05e23743a4e5b346b44d2cd74c5338
SHA512 0b7bfd553a005250dd7633bc02ded31e6d03b57524f179a726884b0714aacbdf05993e97430a0a77f9a0d13d67cd50d4f9b597dd0d4a5989aae1a85f234fd188
TLSH
T164012BA7C90C2031ECC397D7A87939EC5BE635D0155F33CC9544B505728366699CE2FA
MD5 SHA1 SHA512 TLSH

Submit Download

system.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
Size 312B
SHA256 217ca81cecef817670c9ba5ca2172abf66d5585ceb87ae23ef4ff7713ec8a077
MD5 fcfc2739c1beb0deb53b70705d69b61e
SHA1 00b3752ac8b469515bbf292c11138c7c6c84fdd1
SHA512 2429ecd699337b6fbb550530f4a9ff39a0baf43a0f628d1f013b782471a761643d2524888a719cffa29bf47d1813ff3607c867a19bcf5d12f92338e5aaab9dd4
TLSH
T167E01703855CA132D083F683E4B822EC13F209503A5B034DCA00040BB3C06F588CF3F5
MD5 SHA1 SHA512 TLSH

Submit Download

system.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
Size 391B
SHA256 a6e992696877332ff7c2f9944b794097349882bdfc25a55bfe7e8bc318fbd750
MD5 d60d0dab236dc32b9a153a3d97f0e4ee
SHA1 47be1c2195efe2c51afd69e380ee7f6532ffd341
SHA512 1dcc5c0ca8ca830e56075f2ae8bf3c1ce654985f2460ae962d58d57ccc26fb6a1b02b06e7d9730d439e7daab6f49ade8b233782bd4aae8eb9493f1ae05448a32
TLSH
T10BE04F53D94C6032E083F683E4B425FC17F219502A9B138D9A001807B3C16B588CF3F5
MD5 SHA1 SHA512 TLSH

Submit Download

system.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
Size 424B
SHA256 e054e32b6caff77eca9f04a96bc11262455ab572f50d04fdad9c768d106d26f1
MD5 e454204ad608a956d4019b908edc5a7e
SHA1 4a71336fe6971be01445b597abfe9ec7845731d4
SHA512 6c78957c6e82fcae4626b298545ab087f60bc55afc36cdc5ef84bbc387e56077dc7cb93ccaa246e5880efd630ec6763a43a45cf6ef36e46c84c76e863fef6c58
TLSH
T14AE04853D94C6032E483F793E47429FD1BF119902A9B139D9A442807B7C26B699CF3F5
MD5 SHA1 SHA512 TLSH

Submit Download

system.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
Size 468B
SHA256 b1954bddd3a40a65e9c7050427d3b4f52930afd1bcae2a2a5e17bef11374b678
MD5 97510963e607495dc92b03c6b809222f
SHA1 bf0141efbcad41484dae7be3bc357460626eb761
SHA512 ba8537896c648215d1afe5f653cebe65e8bfa5b1d2535dce1a6fecdc0527accbc1a3bceccc6a1872cd0670945533d16569892d78f31736909bb4741920c815d6
TLSH
T1E6F0E553D90C2032E483E783E87429EC5BF128502A9B238D86042506B2826B688CF3F6
MD5 SHA1 SHA512 TLSH

Submit Download

system.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
Size 555B
SHA256 bd470b3110a021c1865455bb675398fc030fbc244a731356e4c95b323852a7f9
MD5 126c12bc74b4b2aa8fa83d87fd26e5a6
SHA1 ec5227979923c11bd3bdf0c175ec29d3456ab55c
SHA512 3981541cfb2bebd279ae021e7137e84ca638c65796472eb3c67cba4bdb49ac3ed075fa3a224ef45ba493a9f8a11683edada942312b2df3140af5096aa20c4f29
TLSH
T10DF059A7C80C2031E883E793E47429E84BB62480255F23CC85086502B2833B288CE3F6
MD5 SHA1 SHA512 TLSH

Submit Download

system.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
Size 468B
SHA256 72455f97fd8f687c5a0ec96524ca2aa4ca388cf531475073879c3a05f9a651aa
MD5 3333a44e459c60ec8c6ab2a94f630175
SHA1 d3aa3cb93c21f43bd8338bbf32322effaaafc615
SHA512 0e7f15cfe54ac7094bf2a9f0b2af9a4acd74fc93ea587daf5ea78dc72006fa92d1f06a2fcf5d4db118f5b8714956187a4926dd1116fbafc19272c4f72569bb26
TLSH
T15BF0E553D90C2032E483E783E87429EC5BF128502A9B238DC6441506B2826B288CF3F6
MD5 SHA1 SHA512 TLSH

Submit Download

system.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
Size 532B
SHA256 03429261cb187366f0799f79d324718162d0d9ba10f30e79dfdf993175ac44bd
MD5 92203350d4df7be6030cc9b33e79444b
SHA1 e1b2f30abb5d2fa3dab176ed380c3b52319576d0
SHA512 5b3b956008ace64b67e271493706930ee1f3f2a7509b4190fef2f6545d3c81cf28eee858938eea189edadb107a31902585d4f073760eb2f8a49e3504e92ac537
TLSH
T1C6F0E2A7C94C2031E883E793A47429E89BA22994255B23CD85082506B2836A288CE3F6
MD5 SHA1 SHA512 TLSH

Submit Download

system.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
Size 367B
SHA256 17b915dfa0836ec7200ce0eedcf8f33ced28c9059002ccf5e129767ae1c6dd15
MD5 2cca65eda181bac0adcf1240288c933d
SHA1 5158f4c49472ca7c7b50c11e8771caefde01a45b
SHA512 4b2f9ed2a447e8ea6af2d126bfcfab828163901277ff91205f38fc6a50edb201d3a6f67b3cc1ab198cfad6b19a84cc931447aab287acf1496920095b0ba305a2
TLSH
T1E3E04653D94C6032E083F683E4B425EC17F209502A9B138D9A00080BB2C16B188CE3F5
MD5 SHA1 SHA512 TLSH

Submit Download

system.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
Size 857B
SHA256 ca9bba9c99d7057c7d0e347317dc8d0e72784058845cdb5ced0a5b590ccc583d
MD5 f540e46d670272605ad8175c4a92d412
SHA1 57954c31ebaf8277a4a44e0a7a2aacf5b3196f67
SHA512 057c2664a915ad11c03482fdf2e148e19943f5edf82e0aab5cc643a9def11f865720c8fc6c4b2f79b0b33d5e0d3bce4622f3f226363f7e1a80c123075f1d80e5
TLSH
T15B1149A7CA0C2032ECC397D7A97929E85BE635D0151F33CD5104B50672836AA99CE2F6
MD5 SHA1 SHA512 TLSH

Submit Download

system.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
Size 765B
SHA256 53967782103e21da779d2af99964c47ce61177a1e0af0c2979901be4c1a471f4
MD5 be6a38599d740fba604cd160d9cb2a87
SHA1 7d57661a370a59bb0ae10edb1dd7cbdba0ef290a
SHA512 5b562e698d227e25550791ed27b0b2c054d8bd5d1f039ee1a0c2ef019b3c668b871e469e4da92a52f16d746c83803d4d0c21219d15f7047105d0d24349e1705b
TLSH
T1010147A6C90C2031ACC297D7A83839A85BA635D0151F33CC9104B50572836AA99CE2FA
MD5 SHA1 SHA512 TLSH

Submit Download

system.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
Size 831B
SHA256 955763f917ff6ff8753263e5d4c8b2a7ac428fb4f3a66b0f813b94066bda93ad
MD5 e70a56f0629a941b9264731e84f1cbc9
SHA1 5dca6b417da9a4ff04d0993eee7040da88a95ef5
SHA512 ade16181b3dfcf4707a454e9111a90859b5e0ddf62280b7acfccdf36fb82c4eaeb499ecea8c6e50f2d86355b0d93d6b1857697aef0c86b2789732faff8a712a8
TLSH
T14A0149A7C90C2032ECC397D7A87929E85BE631D0151F33CD5104B50672836AA99CD2F6
MD5 SHA1 SHA512 TLSH

Submit Download

system.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
Size 468B
SHA256 a44952ac4e90304aefaae6425d369ddf8482c2259d7d7843ee18176b33471774
MD5 e96ab0d2ff1081df187d791611b83c91
SHA1 035a130123ca839161c8d94016c210f43d00d794
SHA512 90add0d8a2e538c90cd425240646a59814d924735d4bb6c5e3d2f81f4ff9703738e72dcfaf4aa3bb4a5471c049855c6c35f6b0878ff5caf49b63b3242ee58478
TLSH
T1B3F0E553D90C2032E483E783E87429EC5BF128502A9B238D86041506B2826B288CF3F6
MD5 SHA1 SHA512 TLSH

Submit Download

system.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
Size 641B
SHA256 edf7656a328bd1163514b4c20dceceb139c3cb4f515096fcf95806694114cecb
MD5 23e62c0135d95c08542b3c8bd6c9c21b
SHA1 c8b6d3a28b127b419558c909b82c50b875a94517
SHA512 a482bf66645dc40724243f29ec8ea4e9780adc61b7f2e511edf759f48a59f0af188bcdf50f80235d3292139d7e75f5ca8c7a8ace7b978321f02af3825667be44
TLSH
T1C6F04CA7C90C2031A883A793B83439EC4BE62590255F33CD9504B50271C336689CE3F5
MD5 SHA1 SHA512 TLSH

Submit Download

system.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
Size 822B
SHA256 0363d3554a817ea5e5920e92681c507e115c576027ff970560a1a42c70097f73
MD5 c99deee6bb6f13ca51375de4f8b0c3fc
SHA1 e4e57067c2c2e46cabdd10a8b4c2e341ecaf2723
SHA512 3f6f577bf81dfaf72d18187cfe771af14211c4a7aec0c5e1b1765e3e600e94e486945f5c4e637a815b9d83b91561f62da76cecbc4acb623f0d73284215ba4bc7
TLSH
T1A5016DA7C90C2032ACC397D3AC7539EC5BE531D0151F33CD5104B50672836AA95CD2F6
MD5 SHA1 SHA512 TLSH

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 41B
SHA256 8a395011a6a877d3bdd53cc8688ef146160dab9d42140eb4a70716ad4293a440
MD5 a787c308bd30d6d844e711d7579be552
SHA1 473520be4ea56333d11a7a3ff339ddcadfe77791
SHA512 da4fcf3a3653ed02ee776cfa786f0e75b264131240a6a3e538c412e98c9af52c8f1e1179d68ed0dd44b13b261dc941319d182a16a4e4b03c087585b9a8286973
MD5 SHA1 SHA512

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 549B
SHA256 33e8e5db5ff3d6ba053d28a717bde8da1a2d1b634c570281334cddfd2b71e1cc
MD5 56ce96cc36d3f605bf5b108c7776b979
SHA1 04c3c03dc4620a7e947f52e85b1c6f87b09e3b54
SHA512 bed2582a9815c7c9ca953b3d88a7c565f3a00e9c9fafa218aefc47ea598d04453e5780ae1efb2bd66406fa107ce7ebdb197b6a1990cd2393ef58725ac9f6f957
TLSH
T195F020B0741424CE2BB622EAE82D496C78EE3553920B6CB6430C28D72623F427D8C81D
MD5 SHA1 SHA512 TLSH

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 55B
SHA256 9f0978233c9f9c61b342eca430d51ef45f974bd4ad9b709fe9294a6d7c53bbbc
MD5 1d92e82fa84a662ef192f1dc0c67391f
SHA1 586d757cd6c82dfda686ab548cd1b7019dc19c56
SHA512 50dc0aa0d81b1df2076a2193fe3c410c949297ef71cc169cd934ba63f88c24162dc78e822aed110307d62565ce74116959b9c6e61f22c13daae3cfdf57211a36
TLSH
T167900265252405364A300210681784F096B99802A59AB4118A45248A5C04DC4DDCD29E
MD5 SHA1 SHA512 TLSH

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 1KB
SHA256 915c315d62ea596c0f458af1e3f6f9c5c0a4d1522ee8368a44f75decd70863e7
MD5 a78da22c344882b64b79d16299b7b7bc
SHA1 472dfe1e842c08b2a5bcc7f3d58fae62c1a68ac7
SHA512 d989f45726e47eb4e69e1ba8e9f3fbf32fcd5c84783b1cfd86e964039680b2f6251534427931501d205419b7f4f799a686209282d6fc9cf1a0ebe358ba76ba7c
TLSH
T1E81175B0B85418CD27F623EBDC1D959C34CA3503970E6C9FC31C14DA2527B9279AC859
MD5 SHA1 SHA512 TLSH

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 1KB
SHA256 ca36461210651359feed3cab0b470e8d2eabf63fb7f762c27ac288f223102205
MD5 036c7d63e649b65ac24614ed2b384176
SHA1 ced188f1a282b93aad9943f0aaf96a284d3b967f
SHA512 fd2a2f9c3b84baa61334fee9b04408e54d65e97d2496f506e43d9b433a47f780aaa1700ea5a7ff727a0f1d7618b3a023401f5dc892a8a47cfb99946748cd4f03
TLSH
T1EA2163B0E44418CD67F623FABC2C95DC79EE340397AAAC4A821C15D62A177412EA880D
MD5 SHA1 SHA512 TLSH

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 1KB
SHA256 a86b696498bcbeab0a739c52ed67e124b63fc4f7b6244f281022882e4729fa2f
MD5 864347ecfe911c6b31aef84fd7375ca5
SHA1 03bd7d4bf7cf812be586e31ebedee38bb8ee8928
SHA512 6ca9af57ce7e71a2ca9e490cf1d9550e51c5760a9e3f89fb84f34ad9591110b6947bc3cd942a81426bd4e6c6e2601d5fd2a6a4c185f9e4925513b1a73bce369b
TLSH
T1F81186B0B85418CD27F623EAAC2D95AC35CA3503970A6C8FC22C14EA25177812AAC80D
MD5 SHA1 SHA512 TLSH

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 5KB
SHA256 7351e4f4a8aebe44714f658f66c7b662e237e8c99536029279ba73620d65fa7d
MD5 13ccc32030d17b4c24cc84a50044bab4
SHA1 03907eaed9e88890a1320c7dfb653aba84135249
SHA512 420a201f94e521599188e5a95e500d0b35f6202606a8bff354a4f9b9291228fdeb6b4cfe1ed6da3472be874055990cb84cf7ab9a76e983d4338fd7e1d22ea036
SSDEEP 96:KnkYpxWSIVYgMcEJ7fkf/ouU88Irb/2ZFML969geMft3Iteo1pq/zPnXFe:BYpsfVYvciIfA7IP2ZFMh6nMflItCrfE
TLSH
T1A0C14BBC3A8439975EED1367D1A6BC8C137D6E31959390CE837059CB02236BAFE5548C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 1KB
SHA256 a5daa602bd0fbf955f1562505e9f7e0ba61eccf519f150fe91eacd434c69f0e1
MD5 14740dc25e31304a98e90127e780567e
SHA1 32caad80efae0519a3904badd581281391f1f8cd
SHA512 cfdd7f06e8180ce19fc8772f2584efa157de0f09113dc6fb61d5e5561f8957f11d3caf945a06039d8511b950e194688eaea752c238a6719aa35d2fe4c347c105
TLSH
T1351163B0B85418CD27F623EBAC2D95AC35DA3503975A6C9BC22C14EA26177816EAC80D
MD5 SHA1 SHA512 TLSH

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 1KB
SHA256 aa1e61f8703515daaee186608f9f49cad740ede92c4dcef850b12a2a098bde5f
MD5 5d03637cc52e71058236aa2aabd7aed3
SHA1 7f34eead215001cc5d48696f59420c30f2c740ec
SHA512 dd8051c15629e425f3d8df9ed544cebc66513e215ad8445cfb3da1e312fc999d0303d5f5da4d661cc89ca932c3d8e000f797981a5f3875534a3eddb81ca891fc
TLSH
T13E2196B0F44418CD27F623FBBC2C959C35DE3403975A6C4BC21C14D62A177412EAC80D
MD5 SHA1 SHA512 TLSH

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 1KB
SHA256 fde38d1e5406279093c5327c63530f6dc98a85ebbed3f277d3cf3dbe1e6138ca
MD5 a80b267c80028e42749f2e127038d2e1
SHA1 609841f3fad97dd0dfdc1582767e98f52d970d14
SHA512 2877d8923b9444fba9954a6fb0e88bc8f7822097db44c5d12652bf1873a848268133f438673f4dadb9b9d2e1b078af70b4ee47f0e06049addc289aa68c851a15
TLSH
T1202174B0F44418CD67F623FBBC2891DC39EA3503979AAC8A821825D62A177456EA880D
MD5 SHA1 SHA512 TLSH

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 1KB
SHA256 afda938ee82fb8537a42b7af30c8ea68b6b5eea4fe247fbe3dcc9ae16d67c740
MD5 5feeca9115d9940be1aea088de56c742
SHA1 45eb24a7a139755825b8d927d152cd90a555e5f8
SHA512 87556c3b70e254327cba37b3bc2a79d2fd4281605e6b4f3e60f6a4d3e12d6ae7c806c2d8043caae655d8dfbfa960df3b52b4df762da4b3e479ce23b9329ba086
TLSH
T11C21C8B8A9C424CD5AD513A76F22B0CC7EA57000CA9378CB822424D904073809EB414D
MD5 SHA1 SHA512 TLSH

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 1KB
SHA256 e08f9ab1163a479361878cab4794694e473fb44a71e3ed0b16496ebfb715424a
MD5 f8e240fbe5acc1a77db3076ccbeb00b8
SHA1 493a2e34649a6490dc647c7389280b4124c42e1d
SHA512 425d2ff0ce54c3a23f34a16549fd6f6e5b58f17265ed1367ebb58bafdeb58b4bcb34fd7b2f5350fcb2a470704bd91fc5ae012dec7914fb83668601b9f391fdc1
TLSH
T14D21A5BCEEC832DB5AC8137BFA31B8487AF96510C6D334D643342596021B696EE9105D
MD5 SHA1 SHA512 TLSH

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 1KB
SHA256 7cc7a194354b51c278b246b774fe114b164ca10e69196a21c0d8ffaa9c2796db
MD5 3a4d81b630a9d70833a5d02c787e12b7
SHA1 bee735b829dacb5e29f435e6bb08de24962327ec
SHA512 05affd8daa886f8a637b3799d37601df56764181d9683dc7e8224e28e6b1f42f5ca4eab8d269867260b2f23244617921bf5e4583e14dad007f5bc3577608ceab
TLSH
T1D321B7F4F9D804CEAAE513A77F32B0DC7AA970018F96788B821424DE150B3505EB410E
MD5 SHA1 SHA512 TLSH

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 1KB
SHA256 98de1f4518136e0e68491a7001f808c67b2b7a2d52589940a0ca244c30e084c7
MD5 3c6043783fbc0df2805d6bfc89ebafc3
SHA1 fb0b2ae77f4142f8e0250c0539cb825736f284f9
SHA512 e8c2d33fac51d71961b5717b66e919d06b4d3d8c64db260cc4a29fe6b6bdae6bc6d746ba44b8ac8ab47ee725a54dc43f5d81d2ce10852198cf838b34c935251b
TLSH
T10721B7F4B9D814CEAAE513A76F32B0DC7EA570018F96788B822424DD05077505EB414E
MD5 SHA1 SHA512 TLSH

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 1KB
SHA256 e396f2cc8a0a9324837272ca0e6598324ced91498ce597de9869e0165326a023
MD5 abb9b135ae8b1da179759f073827aea7
SHA1 3f07dff8a8355557b343711d08bd408b3f2a8c8a
SHA512 e79cac9b48f80d0d6dbce1f025dcfd70ae62a35242a3fc9007ebf3b655bbb5b6ebbf90cfb9399e9b49f6eef8d369b4e4b772953777b42c340dc5239c6fe8fbdb
TLSH
T1892186BCEDD432DB1BC91377EA3278483BB95550C6D338D643342596421B687EEA118D
MD5 SHA1 SHA512 TLSH

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 1KB
SHA256 18a195dc1f1cea6a7a5d983f51df20221dce3178c1ef9bfecc1fb75aa667e97d
MD5 25e6377d6651a8d76206256a8e2ab134
SHA1 41af4810a0b83d9551769a6f019879cf8343e73a
SHA512 21a459f6dbfa686f6b273846bad2ba8b141fbf9c67196eabac6f0940364dfbdc362f95cd3c929d9cf63f843e4623f36c5cba7c26272975a138baff4a3b0d3c7c
TLSH
T19A21AAF0F5D804CE66E513A77F33B0DC7AEA70018B96748B811424DE151B7505EB411E
MD5 SHA1 SHA512 TLSH

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 1KB
SHA256 f7a1d6d78c08a4351fdd669cc9b1e4b7d98fbb914ae101abf79685c2e7d80747
MD5 36ae8bdae1b8bab465bebda9f568aa34
SHA1 4628d3da55117e5b2a8d7b159b401b866b2f49ce
SHA512 483fac290a83be6ff2980930977e3dcea78904ebd323c1a23a216d83cde5349ddd35e50618881da6d5c01b5b34a86447eb32d4646c1856a83ac8130c2a4f50a0
TLSH
T1FD21C5BCBEC832CF5AC8136BFA31A4487EFE6010C7C334D742342596021B656BE9004E
MD5 SHA1 SHA512 TLSH

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 5KB
SHA256 b348181be1f80beb4bb760b46aa8cd204f63afcb7be735b70223b802ec8fd360
MD5 08a4eef499db349785d59a8b3025365e
SHA1 4b09b9d6216e0d46dae737dbe48a42c23e83cf18
SHA512 ac41c751885f7ea3e22a8f6b8a042b27f4c5c2c67a2c4ab679f9e632cc268bfb9be16d56dbacf17edf642eb658dc9b8561a9d3629cb20edc7d381a191f32ac8e
SSDEEP 96:qnkYpxWSIVYgMcEJ7fkf/ouU88Irb/2ZFML969geMft3Iteo1pq/zPnXFlu:hYpsfVYvciIfA7IP2ZFMh6nMflItCrfy
TLSH
T1EAC14CBC3A8439975EED1367D1A6BC8C137D6E31959390CE837059CB02236BAFE5108C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 1KB
SHA256 a62522796ea3d4be5852792b40bdf8feec2977b55b0f507ebbdcd8360a59100e
MD5 6eca0bed032f34ec57a1b94a3326fb26
SHA1 84a013ee6cb2cc1d6a7b1b07d57dfbe1a7a3cb4e
SHA512 5d1dc28df8cd2abfaa420448c0f638e312588a957ebb4694e5ce3f29be75fbad81f19c96231ea95a632c0c80ca848c3b79ea9a90d55efb54c128edbcb8d20d80
TLSH
T13F2186BCE9C432DB1BC91377EA3178483BB95550C6D338C643342596021B686EE9118D
MD5 SHA1 SHA512 TLSH

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 1KB
SHA256 f8867d4cbf49e1faab74bda4a74ad603e02fbb75f0e3a5a9f3096c84404f60e5
MD5 1efccf2cddc0d1df51241b8e9fb99961
SHA1 a6f078f4a3c2a000ca3fb5baa985f9a61fd55c5c
SHA512 54365a6927c12df0142523b3f89b904c882240d3175c6fe730e766081e715cf966fe6ddf936cb193c1a29476edb88952899008f9953bc28a144cb8a71cbb7eba
TLSH
T1E621A5B8A9C424CE6AD523A7AF22A4CC7EA57500CA9378CB823424D915073819EB418D
MD5 SHA1 SHA512 TLSH

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 1KB
SHA256 4933fa033a8cd1d97ad6fe53b50a24252193d3f91ea6dfb6453cde7e3816c74f
MD5 c4b63a7d058efee4527e810cda3e4f51
SHA1 c3f5f51e9600a9819628e155aea6cc195e5f8be0
SHA512 13d7562f2014849d95641b4316d5380214bd556c2179a653ee57e1aa996863d7a79ac3ccf42cc6bdd641eabb8565c5311da8cb82479152f30cb655f8c028181b
TLSH
T13E21B6BCEAC832DB1AC81377EA3178483BB95510C6D334C643342586021B686EE9104D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2936-416-0x00000000001E0000-0x00000000026F3000-memory.dmp

Download

memory/2936-157-0x0000000007840000-0x000000000785B000-memory.dmp

Download

memory/2936-154-0x0000000007840000-0x000000000785B000-memory.dmp

Download

memory/2936-156-0x0000000007840000-0x000000000785B000-memory.dmp

Download

memory/2936-95-0x00000000001E0000-0x00000000026F3000-memory.dmp

Download

memory/2936-44-0x00000000001E0000-0x00000000026F3000-memory.dmp

Download

memory/3308-22-0x00000000001E0000-0x00000000026F3000-memory.dmp

Download

memory/3308-94-0x00000000001E0000-0x00000000026F3000-memory.dmp

Download

memory/3308-152-0x00000000001E4000-0x0000000001F08000-memory.dmp

Download

memory/3308-0-0x00000000001E0000-0x00000000026F3000-memory.dmp

Download

memory/3308-415-0x00000000001E0000-0x00000000026F3000-memory.dmp

Download

memory/3308-2-0x00000000001E4000-0x0000000001F08000-memory.dmp

Download

memory/4700-46-0x00000000001E0000-0x00000000026F3000-memory.dmp

Download

memory/4700-96-0x00000000001E0000-0x00000000026F3000-memory.dmp

Download

memory/4700-417-0x00000000001E0000-0x00000000026F3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads