Technical Information
- [<HKLM>\Software\Classes\.anydesk\shell\open\command] '' = '"%ProgramFiles(x86)%\AnyDesk\AnyDesk.exe" --play "%1"'
- [<HKLM>\Software\Classes\AnyDesk\shell\open\command] '' = '"%ProgramFiles(x86)%\AnyDesk\AnyDesk.exe" "%1"'
- [<HKLM>\System\CurrentControlSet\Services\AnyDesk] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\AnyDesk] 'ImagePath' = '"%ProgramFiles(x86)%\AnyDesk\AnyDesk.exe" --service'
- 'AnyDesk' "%ProgramFiles(x86)%\AnyDesk\AnyDesk.exe" --service
- <Current directory>\bancos.xlsx
- %TEMP%\_mei24402\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei24402\cryptography\hazmat\bindings\_constant_time.cp37-win_amd64.pyd
- %TEMP%\_mei24402\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei24402\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei24402\_socket.pyd
- %TEMP%\_mei24402\cryptography\hazmat\bindings\_openssl.cp37-win_amd64.pyd
- %TEMP%\_mei24402\cryptography-2.8-py3.7.egg-info\record
- %TEMP%\_mei24402\cryptography-2.8-py3.7.egg-info\metadata
- %TEMP%\_mei24402\cryptography-2.8-py3.7.egg-info\license.psf
- %TEMP%\_mei24402\cryptography-2.8-py3.7.egg-info\license.bsd
- %TEMP%\_mei24402\cryptography-2.8-py3.7.egg-info\license.apache
- %TEMP%\_mei24402\cryptography-2.8-py3.7.egg-info\license
- %TEMP%\_mei24402\cryptography-2.8-py3.7.egg-info\installer
- %TEMP%\_mei24402\cryptography-2.8-py3.7.egg-info\authors.rst
- %TEMP%\_mei24402\certifi\cacert.pem
- %TEMP%\_mei24402\base_library.zip
- %TEMP%\_mei24402\unicodedata.pyd
- %TEMP%\_mei24402\ucrtbase.dll
- %TEMP%\_mei24402\select.pyd
- %TEMP%\_mei24402\python37.dll
- %TEMP%\_mei24402\pyexpat.pyd
- %TEMP%\_mei24402\p3.exe.manifest
- %TEMP%\_mei24402\libssl-1_1.dll
- %TEMP%\_mei24402\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-profile-l1-1-0.dll
- %ALLUSERSPROFILE%\anydesk\ad_svc.trace
- %TEMP%\_mei24402\_decimal.pyd
- %TEMP%\_mei24402\_cffi_backend.cp37-win_amd64.pyd
- %TEMP%\_mei24402\_bz2.pyd
- %TEMP%\_mei24402\vcruntime140.dll
- %TEMP%\5659.tmp\archivo.txt
- %APPDATA%\anydesk\user.conf
- %ALLUSERSPROFILE%\anydesk\service.conf
- %ALLUSERSPROFILE%\anydesk\system.conf
- %TEMP%\_mei24402\_lzma.pyd
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\anydesk.lnk
- %ProgramFiles(x86)%\anydesk\anydesk.exe
- %APPDATA%\anydesk\ad.trace
- %TEMP%\5659.tmp\p3.exe
- %TEMP%\5659.tmp\anydesk.exe
- %TEMP%\5659.tmp\565a.tmp\566b.bat
- <Current directory>\bancos_.exe
- %TEMP%\_mei24402\cryptography-2.8-py3.7.egg-info\wheel
- %TEMP%\_mei24402\libcrypto-1_1.dll
- %TEMP%\_mei24402\_queue.pyd
- %TEMP%\_mei24402\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei24402\_hashlib.pyd
- %TEMP%\_mei24402\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei24402\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei24402\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei24402\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei24402\_ssl.pyd
- %TEMP%\_mei24402\cryptography-2.8-py3.7.egg-info\top_level.txt
- %TEMP%\5659.tmp\archivo.txt
- %TEMP%\_mei24402\cryptography-2.8-py3.7.egg-info\wheel
- %TEMP%\_mei24402\cryptography-2.8-py3.7.egg-info\top_level.txt
- %TEMP%\_mei24402\cryptography-2.8-py3.7.egg-info\record
- %TEMP%\_mei24402\cryptography-2.8-py3.7.egg-info\metadata
- %TEMP%\_mei24402\cryptography-2.8-py3.7.egg-info\license.psf
- %TEMP%\_mei24402\cryptography-2.8-py3.7.egg-info\license.bsd
- %TEMP%\_mei24402\libssl-1_1.dll
- %TEMP%\_mei24402\libcrypto-1_1.dll
- %TEMP%\_mei24402\cryptography-2.8-py3.7.egg-info\installer
- %TEMP%\_mei24402\cryptography-2.8-py3.7.egg-info\authors.rst
- %TEMP%\_mei24402\cryptography\hazmat\bindings\_openssl.cp37-win_amd64.pyd
- %TEMP%\_mei24402\cryptography\hazmat\bindings\_constant_time.cp37-win_amd64.pyd
- %TEMP%\_mei24402\certifi\cacert.pem
- %TEMP%\_mei24402\base_library.zip
- %TEMP%\_mei24402\cryptography-2.8-py3.7.egg-info\license.apache
- %TEMP%\_mei24402\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei24402\p3.exe.manifest
- %TEMP%\5659.tmp\p3.exe
- %TEMP%\5659.tmp\anydesk.exe
- %TEMP%\_mei24402\_ssl.pyd
- %TEMP%\_mei24402\_socket.pyd
- %TEMP%\_mei24402\_queue.pyd
- %TEMP%\_mei24402\_lzma.pyd
- %TEMP%\_mei24402\_hashlib.pyd
- %TEMP%\_mei24402\_decimal.pyd
- %TEMP%\_mei24402\_cffi_backend.cp37-win_amd64.pyd
- %TEMP%\_mei24402\_bz2.pyd
- %TEMP%\_mei24402\vcruntime140.dll
- %TEMP%\_mei24402\unicodedata.pyd
- %TEMP%\_mei24402\ucrtbase.dll
- %TEMP%\_mei24402\select.pyd
- %TEMP%\_mei24402\python37.dll
- %TEMP%\_mei24402\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei24402\cryptography-2.8-py3.7.egg-info\license
- %TEMP%\_mei24402\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei24402\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei24402\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\5659.tmp\565a.tmp\566b.bat
- %TEMP%\_mei24402\pyexpat.pyd
- %TEMP%\_mei24402\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei24402\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei24402\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei24402\api-ms-win-core-rtlsupport-l1-1-0.dll
- <Current directory>\bancos_.exe
- 'bo#####.net.anydesk.com':443
- 're#######70c42.net.anydesk.com':80
- 're#######2512e.net.anydesk.com':80
- 'ap#.#pify.org':443
- 'fi###.#00webhost.com':21
- 'fi###.#00webhost.com':50062
- DNS ASK bo#####.net.anydesk.com
- DNS ASK re#######70c42.net.anydesk.com
- DNS ASK re#######2512e.net.anydesk.com
- DNS ASK ap#.#pify.org
- DNS ASK fi###.#00webhost.com
- '23#.#55.102.18':50001
- '23#.#55.102.18':50002
- '23#.#55.102.18':50003
- ClassName: 'EDIT' WindowName: ''
- '<Current directory>\bancos_.exe'
- '%TEMP%\5659.tmp\anydesk.exe' --install "%ProgramFiles(x86)%\AnyDesk" --start-with-win --silent
- '%ProgramFiles(x86)%\anydesk\anydesk.exe' --service
- '%ProgramFiles(x86)%\anydesk\anydesk.exe' --control
- '%TEMP%\5659.tmp\anydesk.exe' --set-password
- '%TEMP%\5659.tmp\anydesk.exe' --get-id
- '%TEMP%\5659.tmp\p3.exe'
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\5659.tmp\565A.tmp\566B.bat <Current directory>\Bancos_.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\5659.tmp\565A.tmp\566B.bat <Current directory>\Bancos_.exe"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo asdf+1234 "
- '%WINDIR%\syswow64\cmd.exe' /c del "Bancos_.exe"